Examkin

Network Troubleshooting

486 questions

All types486Multiple choice248Multiple select111Matching61Ordering66
Question 381Question →

Match each physical or protocol network troubleshooting scenario to the most appropriate diagnostic tool or analyzer function.

Click a left item, then click its matching right item

Items

Multimeter
Tone Generator and Probe
Optical Power Meter
Wireshark Display Filter

Matches

Show answer & explanation

Answer

Multimeter matches with verifying DC voltage on PoE injector; Tone Generator and Probe matches with tracing unlabelled UTP drop; Optical Power Meter matches with measuring optical power loss across fiber run; Wireshark Display Filter matches with filtering captured traffic for TCP SYN packets.
Each diagnostic requirement corresponds directly to its specialized tool: multimeters test electrical voltage (PoE), tone generators and probes locate physical copper pathways, optical power meters evaluate fiber optic light levels, and packet analyzer display filters evaluate network protocol traffic.

Step-by-Step Solution

1
Analyze electrical power measurement requirement
Confirming DC voltage supplied to an access point requires testing electrical potential across conductor pairs.
A multimeter is the standard tool for measuring AC/DC voltage and resistance.
2
Analyze cable tracing requirement
Locating an unlabelled copper run through walls and patch panels requires generating an audible signal.
A tone generator applies an analog/digital signal to the wire, and an inductive probe picks up the acoustic tone.
3
Analyze fiber optical signal loss requirement
Evaluating attenuation and light power levels on fiber optic cables after connector repair requires measuring decibels (dBm).
An optical power meter (often paired with a light source) quantifies light signal power loss.
4
Analyze protocol packet inspection requirement
Parsing frame-level packet captures to inspect specific TCP header flags requires software analysis rules.
A packet analyzer display filter selectively isolates packets matching criteria such as tcp.flags.syn.

Key Concept

Selecting appropriate physical layer testing hardware and software packet analyzers based on diagnostic objectives.
Question 382Question →

A network administrator is troubleshooting persistent link degradation and high CRC error counts on a 75-meter Category 6 UTP run connecting an industrial factory floor workstation to an IDF switch. A basic continuity wire mapper indicates that all eight conductors are mapped correctly according to TIA/EIA 568B pinouts at both ends. Which of the following diagnostic steps or corrective actions should the technician take to isolate and resolve the physical layer failure? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Use a cable certifier or TDR to measure near-end crosstalk (NEXT) and detect potential split pairs caused by improper cable termination.; Inspect the cable pathway to verify sufficient physical clearance from heavy electrical machinery and high-voltage lighting to minimize electromagnetic interference (EMI).

Answer

The technician should use a cable certifier or TDR to test for crosstalk and split pairs, and inspect the physical pathway to ensure proper separation from sources of electromagnetic interference (EMI).
The correct troubleshooting actions involve using advanced copper cable certification equipment (TDR / cable certifier) to measure NEXT and identify split pairs, alongside inspecting the physical cabling path for sources of environmental EMI. Simple continuity tests do not detect crosstalk or EMI, which are common causes of CRC errors on copper UTP links in industrial environments.

Step-by-Step Solution

1
Analyze why a basic continuity wire mapper passed despite high CRC error rates.
Basic wire mappers only verify DC continuity and pin mapping; they cannot measure high-frequency electrical characteristics like crosstalk, return loss, or environmental noise.
Split pairs maintain 1-to-1 pin alignment but break pair twisting geometry, resulting in severe crosstalk under active Ethernet signaling.
2
Select advanced physical testing tools suitable for twisted-pair copper cabling.
A cable certifier/TDR assesses signal quality parameters (NEXT, FEXT, return loss) and identifies split pairs or excessive untwisting at termination blocks.
Certifiers validate whether copper runs comply with TIA/EIA performance standards.
3
Evaluate environmental physical factors affecting UTP cabling in an industrial setting.
Unshielded cabling routed near high-voltage lines or industrial motors absorbs EMI, causing frame corruption and CRC errors.
Physical separation or shielded cabling (STP/FTP) is required to protect copper signals from external noise sources.

Key Concept

Distinguishing basic continuity mapping from advanced cable certification (NEXT/split pair testing) and environmental interference isolation in UTP cabling environments.
Estimated Time:1m 30s
Question 383Question →

A network technician is troubleshooting a client workstation that is generating an APIPA address (169.254.x.x169.254.x.x) on a newly created VLAN. Which sequence of diagnostic steps represents the correct order to isolate and resolve this DHCP relay issue?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with verifying client configuration (`ipconfig /all`), followed by verifying local switch port link and VLAN assignment, then validating the Layer 3 helper address relay setting on the gateway, and finally inspecting the central DHCP server scope status.
Methodological network troubleshooting follows a structured approach starting from the affected endpoint. First, the technician verifies local client IP configurations (`ipconfig /all`) to confirm the APIPA condition. Second, local Layer 1/2 connectivity and VLAN port assignments are checked. Third, because the workstation is on a remote VLAN, the Layer 3 gateway interface must be inspected for a correct `ip helper-address` to relay DHCP broadcasts across subnets. Finally, the central DHCP server scope status and lease pool are checked.

Step-by-Step Solution

1
Confirm client symptoms using `ipconfig /all`.
Establishes that the client is receiving an APIPA address (169.254.x.x169.254.x.x) due to a lack of DHCP response.
Always start troubleshooting at the affected endpoint to verify reported symptoms.
2
Verify local physical link and switch port VLAN configuration.
Ensures the client is physically connected and assigned to the intended VLAN.
A misconfigured VLAN or link issue prevents packets from reaching the local default gateway.
3
Check `ip helper-address` on the Layer 3 gateway interface.
Verifies that broadcast DHCP discover packets are converted to unicast and forwarded to the central DHCP server.
Without an IP helper address, cross-subnet DHCP requests cannot cross the router boundary.
4
Examine the DHCP server scope and pool availability.
Confirms the server is actively listening, authorized, and contains available IP addresses.
Scope exhaustion or server unresponsiveness is diagnosed after local network path and relay functionality are verified.

Key Concept

Methodological troubleshooting of DHCP relay and IP addressing failures across network segments.
Estimated Time:1m 30s
Question 384Question →

A system administrator is troubleshooting a database connection failure from a newly deployed application host (`10.150.12.45/24`) to an enterprise database server (`172.28.100.50`). The application requires TCP port 5432 (PostgreSQL). The administrator executes diagnostic commands on the host and the intermediary router:

Host CLI Output (`ip route` & `ip addr`):
text eth0: inet 10.150.12.45/24 brd 10.150.12.255 scope global eth0 default via 10.150.13.1 dev eth0

Router ACL Output (`show ip access-lists OUTBOUND_DB`):
text Extended IP access list OUTBOUND_DB 10 permit tcp 10.150.12.0 0.0.0.255 host 172.28.100.50 eq 3306 20 deny ip any any

Based on the diagnostic output, which TWO factors are directly preventing the application host from communicating with the database server?

Select all that apply

Show answer & explanation

Answer: The default gateway IP address configured on the host resides in a different IPv4 subnet than the host's primary interface.; The active router Access Control List only permits MySQL traffic (TCP 3306) and relies on an explicit deny rule that blocks PostgreSQL traffic (TCP 5432).

Answer

The connection failure is caused by a default gateway configured on a different IP subnet than the host interface, and an ACL rule that permits TCP 3306 while blocking TCP 5432.
First, the host IP 10.150.12.45/2410.150.12.45/24 resides in the 10.150.12.0/2410.150.12.0/24 network segment, while its configured gateway (10.150.13.110.150.13.1) is in 10.150.13.0/2410.150.13.0/24, preventing local ARP resolution and off-subnet forwarding. Second, the router ACL explicitly permits TCP port 3306 (MySQL) but denies all other traffic via Rule 20, blocking the application's PostgreSQL traffic on TCP port 5432.

Step-by-Step Solution

1
Analyze the host network configuration.
The interface address is 10.150.12.45/2410.150.12.45/24, placing valid host IPs in 10.150.12.110.150.12.1 through 10.150.12.25410.150.12.254. The gateway 10.150.13.110.150.13.1 is outside this subnet, preventing ARP resolution for outbound packets.
A host must have a default gateway within its local IP subnet boundaries.
2
Analyze the router Access Control List rules.
Rule 10 specifically matches TCP port 3306. PostgreSQL traffic on TCP port 5432 is not matched by Rule 10 and is dropped by Rule 20.
ACLs evaluate traffic sequentially against entries; unmatched traffic falls through to subsequent rules or implicit deny rules.

Key Concept

Troubleshooting Gateway Subnet Alignment and ACL Rule Matching
Question 385Question →

A network administrator is investigating severe transmission errors and dropped frames on a newly installed Category 6 UTP cable connecting a core switch to a critical server. The administrator must verify whether the copper cable installation meets official TIA/EIA structural performance standards, including measuring Near-End Crosstalk (NEXT), return loss, and attenuation under high-frequency signal loads. Which diagnostic tool should the administrator use to perform this compliance verification?

Show answer & explanation

Answer: A cable certifier

Answer

A cable certifier is the correct tool because it tests high-frequency parameters such as Near-End Crosstalk (NEXT) and attenuation to verify compliance with TIA/EIA standards.
A cable certifier is specifically built to test physical cabling against official TIA/EIA performance specifications. It measures advanced physical parameters including Near-End Crosstalk (NEXT), Far-End Crosstalk (FEXT), insertion loss, and return loss at operating frequencies, confirming whether a cable run is certified for high-speed Ethernet operation.

Step-by-Step Solution

1
Identify the troubleshooting layer and requirement.
The requirement is at Layer 1 (Physical) to verify Category 6 electrical performance and TIA/EIA certification standards under active load.
Signal degradation issues such as Near-End Crosstalk (NEXT) and return loss require physical layer testing tools capable of sending high-frequency test signals across conductors.
2
Evaluate the capabilities of various physical layer testing tools.
Basic continuity testers check pin mapping only; toner probes locate cables; packet analyzers inspect Layer 2–7 protocol frames. Only a cable certifier measures NEXT, return loss, attenuation, and frequency limits required for formal compliance.
Cable certifiers are specifically engineered to validate that installed cabling meets specified category standards.

Key Concept

Cable Certification and Hardware Diagnostic Tools
Estimated Time:1m 30s
Question 386Question →

A network administrator is troubleshooting connectivity issues on a Linux backup server. The server is assigned the static IP address 172.16.88.200/25172.16.88.200/25. Local diagnostic testing reveals that the server can communicate with hosts on its immediate local network segment, but traffic destined for remote subnets fails completely. The administrator verifies the host routing table output:

text
default via 172.16.88.1 dev eth0
172.16.88.128/25 dev eth0 proto kernel scope link src 172.16.88.200

Which of the following identifies the root cause of the external connectivity failure?

Show answer & explanation

Answer: The assigned default gateway IP address resides on a different IP subnet than the host server.

Answer

The assigned default gateway IP address resides on a different IP subnet than the host server.
The server's IP address 172.16.88.200/25172.16.88.200/25 places it in the 172.16.88.128/25172.16.88.128/25 subnet (range 172.16.88.128172.16.88.128 - 172.16.88.255172.16.88.255). The configured default gateway 172.16.88.1172.16.88.1 resides in the adjacent 172.16.88.0/25172.16.88.0/25 subnet. A default gateway must be on the same local subnet as the host interface for Layer 2 ARP resolution and off-subnet forwarding to function.

Step-by-Step Solution

1
Analyze host IP address and subnet mask.
Host IP 172.16.88.200172.16.88.200 with CIDR /25/25 (255.255.255.128255.255.255.128) resides in subnet 172.16.88.128/25172.16.88.128/25. Usable host range is 172.16.88.129172.16.88.129 to 172.16.88.254172.16.88.254.
Subnet math determines the boundaries of the local broadcast domain.
2
Evaluate the configured default gateway address.
The configured default gateway is 172.16.88.1172.16.88.1, which falls into subnet 172.16.88.0/25172.16.88.0/25 (usable range 172.16.88.1172.16.88.1 to 172.16.88.126172.16.88.126).
Default gateways must reside on the same IP subnet as the local interface.
3
Determine the impact on host routing.
Because 172.16.88.1172.16.88.1 is not on the 172.16.88.128/25172.16.88.128/25 local network segment, ARP resolution for the default gateway fails, preventing remote traffic delivery.
Layer 3 forwarding requires the next-hop router IP to be directly reachable at Layer 2.

Key Concept

Default Gateway Subnet Alignment
Estimated Time:1m 30s
Question 387Question →

A network administrator is investigating a connectivity issue on a newly deployed workstation on the finance floor. The user reports being able to communicate with other devices on the local subnet, but cannot access external services or the internet. The administrator runs `ipconfig /all` on the client machine and observes the following output:

IPv4 Address . . . . . . . . . . . : 10.45.20.11510.45.20.115
Subnet Mask . . . . . . . . . . . . : 255.255.255.0255.255.255.0
Default Gateway . . . . . . . . . . : 10.45.21.110.45.21.1
DHCP Server . . . . . . . . . . . . : 10.45.10.1510.45.10.15

Which of the following identifies the root cause of the workstation's external connectivity failure?

Show answer & explanation

Answer: The configured default gateway address resides on a different IP subnet than the host IP address.

Answer

The configured default gateway address resides on a different IP subnet than the host IP address.
The host IP address (10.45.20.11510.45.20.115) with mask 255.255.255.0255.255.255.0 places the device on the 10.45.20.0/2410.45.20.0/24 network. The default gateway (10.45.21.110.45.21.1) resides on the 10.45.21.0/2410.45.21.0/24 network. A host cannot route packets outside its local segment if its default gateway is on a different subnet, resulting in local-only network connectivity.

Step-by-Step Solution

1
Calculate the workstation's local network address range
Host IP 10.45.20.11510.45.20.115 with Subnet Mask 255.255.255.0255.255.255.0 means the local subnet is 10.45.20.0/2410.45.20.0/24 (usable host IPs: 10.45.20.110.45.20.1 to 10.45.20.25410.45.20.254).
Determines the boundaries of the local broadcast domain.
2
Evaluate the default gateway IP address against the local subnet boundaries
The configured gateway 10.45.21.110.45.21.1 falls outside the 10.45.20.0/2410.45.20.0/24 subnet.
A default gateway must be a Layer 3 interface directly reachable on the local IP subnet segment.
3
Correlate symptoms with the configuration mismatch
Local traffic works because ARP resolves local IPs directly; remote traffic fails because the host cannot reach its default gateway on the local segment.
Explains why intra-subnet connectivity succeeds while inter-subnet/internet traffic fails.

Key Concept

Default Gateway Subnet Alignment
Question 388Question →

Match each command-line network utility invocation to its primary operational purpose during a network diagnostic workflow.

Click a left item, then click its matching right item

Items

ipconfig /flushdns
tracert -d host.example.com
netstat -ano
arp -a

Matches

Show answer & explanation

Answer

The command 'ipconfig /flushdns' pairs with clearing the local DNS resolver cache; 'tracert -d host.example.com' pairs with tracing path hops without resolving hostnames; 'netstat -ano' pairs with displaying active network sessions, numerical ports, and process IDs; and 'arp -a' pairs with displaying the IP-to-MAC address cache table.
Each command-line utility serves a distinct diagnostic role: 'ipconfig /flushdns' clears cached DNS resolver entries; 'tracert -d' measures hop-by-hop reachability while suppressing slow reverse DNS lookups; 'netstat -ano' details active TCP/UDP connections with numerical endpoints and process IDs; and 'arp -a' displays local subnet IP-to-MAC address mappings.

Step-by-Step Solution

1
Analyze DNS client utilities
Identify that 'ipconfig /flushdns' purges the DNS resolver cache.
Flushdns specifically empties cached DNS records on Windows operating systems.
2
Analyze ICMP path diagnostic switches
Match 'tracert -d' to path tracing with disabled reverse DNS lookup.
The '-d' flag instructs traceroute/tracert to avoid resolving IP addresses to domain names, saving diagnostic time.
3
Analyze socket and session monitoring tools
Match 'netstat -ano' to active session listing with numerical ports and owning process IDs.
The flags '-a' (all), '-n' (numerical), and '-o' (owning PID) combine to report local and remote connection state details.
4
Analyze Layer 2 mapping tools
Match 'arp -a' to viewing the host's IP-to-MAC address resolution cache table.
The Address Resolution Protocol table stores Ethernet MAC address mappings for local subnet IP addresses.

Key Concept

Selecting and interpreting command-line utilities and flags for network diagnostics
Question 389Question →

A network technician is migrating a branch office segment to a new IPv4 addressing scheme (10.50.40.0/2410.50.40.0/24). Workstations on VLAN 40 successfully acquire IP addresses from the central DHCP server, but users report they cannot reach servers on other subnets or access the internet. An output inspection of `ipconfig /all` on an affected client displays the following parameters:

- IPv4 Address: 10.50.40.8810.50.40.88
- Subnet Mask: 255.255.255.0255.255.255.0
- Default Gateway: 10.50.4.110.50.4.1
- DHCP Server: 10.20.10.510.20.10.5

Which TWO of the following configuration changes are required to restore full routing capabilities for these workstations?

Select all that apply

Show answer & explanation

Answer: Update DHCP Scope Option 003 on the DHCP server to assign a gateway address residing on the 10.50.40.0/2410.50.40.0/24 subnet.; Ensure the router interface servicing VLAN 40 is configured with an IP address on the 10.50.40.0/2410.50.40.0/24 subnet.

Answer

To resolve the routing issue, the administrator must update DHCP Scope Option 003 on the DHCP server so clients receive a gateway address within 10.50.40.0/2410.50.40.0/24, and ensure the router interface on VLAN 40 is configured with a corresponding IP address in that same subnet.
For a host to communicate outside its local subnet, its default gateway must reside on the exact same IPv4 network segment. Updating DHCP Scope Option 003 ensures that clients receive a default gateway address within 10.50.40.0/2410.50.40.0/24, and verifying that the router interface servicing VLAN 40 has an IP address assigned in 10.50.40.0/2410.50.40.0/24 establishes the required physical Layer 3 forwarding point.

Step-by-Step Solution

1
Analyze client IP configuration settings from the `ipconfig /all` snippet.
Identified that the client IPv4 address (10.50.40.88/2410.50.40.88/24) and the configured default gateway (10.50.4.110.50.4.1) reside on different IP subnets.
A default gateway must reside on the same logical IP subnet as the client host to receive local Layer 2 frames destined for external routing.
2
Determine the necessary DHCP server scope modification.
Option 003 (Default Gateway) must be updated to an IP address within the client's local subnet range (10.50.40.0/2410.50.40.0/24).
Clients automatically pull their network configuration parameters via DHCP; modifying Option 003 ensures all scope lease recipients acquire a valid local gateway address.
3
Verify physical/logical router interface addressing on the local VLAN gateway.
The router interface attached to VLAN 40 must be assigned an IP address within 10.50.40.0/2410.50.40.0/24 matching the updated Option 003 value.
Without a corresponding active Layer 3 interface on the router inside the 10.50.40.0/2410.50.40.0/24 broadcast domain, packets destined outside the subnet cannot be processed.

Key Concept

Default Gateway Subnet Alignment and DHCP Option 003 Configuration
Question 390Question →

A network technician needs to determine which port on a busy 48-port patch panel connects to an unlabeled wall outlet in a newly renovated conference room. Which hardware troubleshooting tool should the technician connect to the outlet to trace the physical cable run back to the correct patch panel port?

Show answer & explanation

Answer: Tone generator and probe kit

Answer

The tone generator and probe kit is the correct tool for placing a signal on a wire pair to audibly trace and identify the corresponding patch panel termination.
The correct tool is a tone generator and probe kit (often called a fox and hound). The tone generator injects a signal onto the copper cabling at the wall outlet, and the inductive probe picks up the generated electromagnetic tone at the patch panel end, allowing rapid identification of the unlabeled port.

Step-by-Step Solution

1
Identify the goal of physical cable tracing across patch panels.
Recognize that locating an unknown wire run requires placing a recognizable signal on one end and detecting it at the remote destination.
Structured cabling runs through walls and conduits, preventing visual inspection.
2
Evaluate hardware diagnostic tools based on their primary function.
A tone generator connects to the outlet RJ45 port and transmits a tone signal along the copper pair, allowing the non-contact inductive probe to detect the tone when brought near the correct patch panel port wire termination.
Inductive probing enables fast identification without having to individually plug into or strip wires across 48 panel ports.

Key Concept

Cable Tracing and Identification Tools
Question 391Question →

Users on a newly provisioned branch office subnet (172.16.40.0/24172.16.40.0/24) report an inability to reach intranet services or external websites. Running `ipconfig /all` on an affected client workstation yields the following output:

IPv4 Address. . . . . . . . . . . : 169.254.14.88
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . :

The central DHCP server is located on the headquarters data center VLAN (192.168.10.0/24192.168.10.0/24). Network operations confirms that the DHCP scope for 172.16.40.0/24172.16.40.0/24 is online and contains 150 available IP addresses. Which of the following is the most likely root cause of this issue?

Show answer & explanation

Answer: The router interface serving as the default gateway for 172.16.40.0/24172.16.40.0/24 lacks a configured DHCP relay agent (IP helper address).

Answer

The router interface acting as the default gateway for the branch subnet is missing a DHCP relay agent (IP helper address) to forward broadcast DHCP requests across subnets.
DHCP requests begin as Layer 2 broadcast packets. Routers drop Layer 2 broadcasts by default. When the DHCP server resides on a different network segment from the clients, the router interface facing the client subnet must be configured with a DHCP relay agent (such as `ip helper-address` in Cisco IOS) to convert broadcast requests into unicast traffic directed to the remote DHCP server. Without this, clients fallback to APIPA (169.254.x.x169.254.x.x).

Step-by-Step Solution

1
Analyze the client workstation IP address output.
The client has an address of 169.254.14.88169.254.14.88 with no Default Gateway or DHCP Server listed.
Addresses in the 169.254.0.0/16169.254.0.0/16 range indicate that APIPA assigned the IP after the client sent DHCP DISCOVER requests without receiving a DHCP OFFER response.
2
Evaluate the network architecture and DHCP server status.
The DHCP server is on a separate subnet (192.168.10.0/24192.168.10.0/24) and has active, unallocated leases available.
Since the server has capacity, the failure is occurring in transport between the client subnet (172.16.40.0/24172.16.40.0/24) and the server subnet.
3
Identify Layer 3 boundary behavior for broadcast traffic.
DHCP DISCOVER messages are Layer 2 broadcasts (255.255.255.255255.255.255.255) and do not cross routers by default.
To forward these broadcast requests as unicast packets to a DHCP server on another subnet, the local router interface must be configured with a DHCP relay agent (`ip helper-address`).

Key Concept

DHCP Relay / IP Helper Agent Configuration
Question 392Question →

A network administrator is troubleshooting an issue where a workstation attached to Switch-A on port FastEthernet 0/5 experiences severe latency and dropped frames during file transfers to a server in the same VLAN on Switch-B. Switch-A logs indicate frequent speed and duplex mismatch alerts, and interface counters show a high count of late collisions on FastEthernet 0/5. Physical cable testing verifies the cabling is intact. The workstation's network interface is manually configured for 100 Mbps Full Duplex, whereas the switch port is set to auto-negotiation. Which of the following is the root cause of the performance degradation and frame loss on this link?

Show answer & explanation

Answer: Auto-negotiation on the switch interface defaulted to Half Duplex after failing duplex detection, resulting in a duplex mismatch with the host.

Answer

Auto-negotiation on the switch interface defaulted to Half Duplex after failing duplex detection, resulting in a duplex mismatch with the host.
When an end device interface is hardcoded to Full Duplex while the switch port auto-negotiates, auto-negotiation cannot establish duplex settings. The switch interface detects the 100 Mbps signal through parallel detection but defaults to Half Duplex in accordance with IEEE standards. The resulting duplex mismatch causes the full-duplex workstation to send frames regardless of line state, leading the half-duplex switch port to register late collisions, buffer congestion, and heavy packet loss.

Step-by-Step Solution

1
Analyze the link negotiation settings configured on both endpoints.
Identified that the workstation host is hardcoded to 100 Mbps Full Duplex while the connected switch port relies on auto-negotiation.
Mismatched link negotiation methods prevent duplex parameter exchange signals from completing.
2
Determine the IEEE auto-negotiation fallback behavior for duplex selection.
The switch port detects the 100 Mbps signal via parallel detection but cannot negotiate duplex mode, defaulting to Half Duplex per standard IEEE rules.
Standard Ethernet auto-negotiation specifies falling back to Half Duplex when duplex detection fails.
3
Correlate the duplex mismatch condition with interface error counters.
The full-duplex host transmits without line sensing while the half-duplex switch port senses collisions mid-frame, recording late collisions and packet drops.
High rates of late collisions during active file transfers are a definitive diagnostic indicator of a duplex mismatch.

Key Concept

Duplex Mismatch and Auto-Negotiation Fallback
Question 393Question →

A network administrator is investigating an issue where a client workstation (10.20.40.1510.20.40.15) fails to connect to an internal web service running on port 80808080 at 10.20.40.25010.20.40.250. The administrator executes two command-line diagnostic utilities from the workstation, producing the following terminal outputs:

Command 1: `ping 10.20.40.250`

Pinging 10.20.40.250 with 32 bytes of data:
Reply from 10.20.40.250: bytes=32 time=2ms TTL=64
Reply from 10.20.40.250: bytes=32 time=1ms TTL=64

Command 2: `tracert -d 10.20.40.250`

Tracing route to 10.20.40.250 over a maximum of 30 hops
1 <1 ms <1 ms <1 ms 10.20.40.250
Trace complete.

Based on these diagnostic results, which TWO of the following conclusions are valid? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The destination host resides on the same local network segment as the client workstation.; Basic Layer 3 IP reachability to the destination host is confirmed via ICMP.

Answer

The destination host resides on the same local network segment as the client workstation, and basic Layer 3 IP reachability to the destination host is confirmed via ICMP.
A single hop in the traceroute output confirms that the client workstation and target server share the same local network segment without crossing a router. Furthermore, receiving ICMP echo replies from ping validates basic Layer 3 IP reachability.

Step-by-Step Solution

1
Analyze the ping command output.
Received successful ICMP Echo replies from 10.20.40.250 with low round-trip times.
Confirms operational Layer 3 IP reachability between the client and server.
2
Analyze the tracert -d command output.
The target IP address is reached in a single hop.
Indicates no intermediate routers were traversed, proving both hosts reside on the same broadcast domain and IP subnet.
3
Evaluate the limitation of ping regarding TCP port testing.
Recognize that ICMP reachability does not guarantee that TCP port 8080 is open or listening.
ICMP functions at the Network layer (Layer 3), whereas TCP port 8080 operates at the Transport layer (Layer 4).

Key Concept

Utilizing Command-Line Network Troubleshooting Utilities
Question 394Question →

A network technician is troubleshooting a newly installed Category 6 UTP cable drop connecting a desktop computer to a wall outlet. The workstation successfully connects at 100 Mbps Fast Ethernet, but fails to establish a 1000BASE-T (Gigabit Ethernet) link. A basic wiremap continuity tester indicates that all eight conductor pins match correctly end-to-end (pins 1 through 8 are straight-through). Which of the following diagnostic findings or testing methods would most likely identify the root cause of this failure? (Select TWO)

Select all that apply

Show answer & explanation

Answer: A split pair condition is present on the termination points, allowing DC continuity to pass while causing severe high-frequency crosstalk.; Using a cable certifier to measure Near-End Crosstalk (NEXT) and attenuation parameters across all four pairs.

Answer

The physical failure is identified by recognizing a split pair condition at the termination points and utilizing a cable certifier to measure Near-End Crosstalk (NEXT) and attenuation.
Gigabit Ethernet (1000BASE-T) relies on all four pairs working with tight differential noise rejection. A split pair retains pin-to-pin continuity (passing simple wiremap devices) but breaks pair pairing, generating excessive Near-End Crosstalk (NEXT). A cable certifier evaluates NEXT, attenuation, and frequency compliance to accurately diagnose this condition.

Step-by-Step Solution

1
Analyze the reported symptoms and test results.
100BASE-TX operates on two pairs (pins 1, 2, 3, and 6), whereas 1000BASE-T requires all four pairs (pins 1-8). Basic continuity testers verify DC pin-to-pin connectivity but cannot test high-frequency signal integrity or pair pairing consistency.
Passing a basic continuity test proves electrical connection, but does not guarantee that wires are paired according to T568A/T568B color standards.
2
Identify the physical impairment cause.
Split pairs maintain 1-to-1 pin connections across both ends (passing basic continuity checks), but separate the twisted pairs. This leads to severe crosstalk at high frequencies, preventing 1 Gbps speed negotiation.
Ethernet twisted pairs rely on balanced differential signaling to reject cross-talk; untwisting or splitting pairs disrupts differential cancellation.
3
Select the appropriate diagnostic tool for confirmation.
A advanced cable certifier tests RF performance indicators such as NEXT, FEXT, return loss, and attenuation.
Advanced parameter measurement is required to pinpoint physical layer faults that simple continuity or tone testing tools miss.

Key Concept

Identifying Split Pairs and Cable Certification Testing
Question 395Question →

Match each network troubleshooting scenario to the most appropriate hardware diagnostic tool or packet analyzer feature.

Click a left item, then click its matching right item

Items

Locating the precise distance to a high-attenuation splice loss or macrobend on a single-mode fiber-optic run
Analyzing frame-level Ethernet header fields to isolate unauthorized DHCP OFFER broadcasts on a subnet
Identifying pinout transposition errors, such as reversed pairs or split pairs, on a newly crimped Cat 6 RJ-45 cable
Validating the physical transmit and receive circuitry of an isolated Ethernet interface port without a switch connection

Matches

Show answer & explanation

Answer

The diagnostic scenarios map to their respective tools based on physical medium and OSI layer: OTDR measures light reflection to pinpoint distance to fiber anomalies, Packet Analyzer decodes frame payloads for protocol inspection, Wiremap Tester evaluates individual pinout continuity on copper cables, and Loopback Plug isolates local port hardware transceiver operation.
Each diagnostic scenario requires matching the target media and Layer of the OSI model: an OTDR uses backscattered light to locate distance to fiber macrobends; a packet analyzer decodes protocol headers to detect rogue DHCP OFFER traffic; a wiremap tester verifies pin-to-pin conductor integrity on UTP terminations; and a loopback plug isolates local NIC hardware by looping transmit signals to receive pins.

Step-by-Step Solution

1
Evaluate the optical fiber fault distance measurement requirement.
Select the Optical Time-Domain Reflectometer (OTDR).
OTDR measures backscattered light over time to calculate exact distances to optical attenuation points, splices, or breaks.
2
Examine the protocol inspection and frame decoding requirement.
Select the Packet Analyzer.
Protocol analysis software captures upper-layer traffic to inspect header flags, DHCP options, and ARP broadcast payloads.
3
Assess the copper cabling conductor pinout check scenario.
Select the Wiremap Tester.
Wiremap testing checks pin-to-pin conductor continuity across RJ-45 terminations to detect wiring layout faults.
4
Determine how to test physical port transceivers without an active network link.
Select the Loopback Plug.
A loopback plug redirects outgoing transmit signals into the local receiver pins to verify host NIC hardware functionality.

Key Concept

Hardware Diagnostic Tools and Packet Analyzer Selection
Question 396Question →

A network engineer is investigating excessive link degradation and packet loss on a 10GBASE-LR single-mode fiber link connecting two campus buildings spaced 1.2 kilometers apart. An optical power meter confirms that received optical power is 16 dB below expected baseline levels, indicating high attenuation along the path. Which diagnostic tool should the engineer use to identify the precise distance to the macrobend or splice fault causing the signal loss?

Show answer & explanation

Answer: Optical Time-Domain Reflectometer (OTDR)

Answer

An Optical Time-Domain Reflectometer (OTDR) should be used because it measures light reflections along an optical fiber cable to locate the precise distance to physical faults, splices, and severe attenuation points.
The Optical Time-Domain Reflectometer (OTDR) is specifically designed for optical fiber media. It injects light pulses down the fiber core and measures the time and intensity of light reflected back (Rayleigh backscattering and Fresnel reflections). This allows the tool to display a trace mapping the precise distance to splices, connectors, macrobends, or physical breaks.

Step-by-Step Solution

1
Analyze the physical medium and problem type
The scenario specifies single-mode optical fiber media exhibiting high attenuation (excessive dB loss).
Selecting the correct tester requires identifying whether the medium is copper or fiber.
2
Determine the diagnostic requirement
The technician needs to locate the exact position (distance) of a physical Layer 1 optical fault.
While an optical power meter measures total loss, pinpointing distance to a break or bend requires reflection analysis.
3
Select the appropriate hardware tester
An Optical Time-Domain Reflectometer (OTDR) transmits light pulses into the fiber and calculates fault distances based on return time and light scattering.
OTDR is the industry-standard tool for graphical signature and distance measurement of fiber optic link anomalies.

Key Concept

Fiber Optic Physical Layer Troubleshooting with OTDR
Question 397Question →

A network technician is troubleshooting an IP surveillance camera connected via an 80-meter Category 6 Ethernet drop. Although basic wiremap testing confirms all eight conductors have pin-to-pin continuity with no opens or shorts, the camera regularly experiences frame drops and fails to negotiate a 1000Base-T link, falling back to 100Mbps. The technician suspects high signal degradation and Near-End Crosstalk (NEXT) caused by excessive untwisting of wire pairs near the patch panel punch-down termination. Which of the following tools should the technician use to perform a full frequency performance analysis and verify whether the cable run complies with Category 6 standards?

Show answer & explanation

Answer: Cable certifier

Answer

The cable certifier is the appropriate tool because it measures complex signal performance metrics such as Near-End Crosstalk (NEXT) and attenuation across category standards.
The option recommending a cable certifier is correct because certifiers perform full-spectrum electrical testing across the frequency range required by TIA/EIA standards (such as Cat 6), measuring parameters like Near-End Crosstalk (NEXT), return loss, and attenuation to verify 1000Base-T capability.

Step-by-Step Solution

1
Analyze the reported symptoms and physical environment.
Basic DC continuity and pin mapping pass, eliminating opens, shorts, and wiremap errors as the cause of failure. However, Gigabit link negotiation fails and high-speed traffic drops frames over an 80-meter Category 6 run.
When pin continuity is intact but high-speed link negotiation fails, high-frequency transmission parameters like crosstalk or attenuation are failing.
2
Identify the specific performance parameter being tested.
The technician suspects Near-End Crosstalk (NEXT) due to un-twisted copper conductors near the patch panel.
NEXT occurs when signals on one wire pair bleed into an adjacent pair due to degraded pair twisting or poor termination practice.
3
Select the diagnostic instrument capable of assessing high-frequency cable standards.
Choose a cable certifier.
Only a cable certifier tests electrical performance against TIA/EIA standard specifications (e.g., Cat 6 up to 250 MHz) to qualify cabling for specific Ethernet standards like 1000Base-T.

Key Concept

Selecting Cabling Troubleshooting Tools for High-Frequency Certification
Estimated Time:1m 15s
Question 398Question →

A network technician configures an 802.1Q trunk link between Switch-1 and Switch-2. Switch-1 is configured with native VLAN 10, whereas Switch-2 is configured with native VLAN 20. Users connected to VLAN 10 on Switch-1 report that they can unexpectedly reach servers on VLAN 20 attached to Switch-2 without going through a router, while console logs generate periodic CDP error messages. Which of the following best explains the root cause of this cross-VLAN communication?

Show answer & explanation

Answer: Untagged frames sent from VLAN 10 on Switch-1 travel across the trunk link and are automatically placed into native VLAN 20 upon arrival at Switch-2.

Answer

Untagged frames sent from VLAN 10 on Switch-1 travel across the trunk link and are automatically placed into native VLAN 20 upon arrival at Switch-2.
Under 802.1Q encapsulation, frames originating from the native VLAN are sent across a trunk link untagged. When neighboring switches have mismatched native VLAN settings (VLAN 10 on one end and VLAN 20 on the other), untagged frames originating on VLAN 10 are ingested by the receiving switch and mapped directly into VLAN 20. This creates a security leak and unexpected Layer 2 connectivity between two distinct VLANs.

Step-by-Step Solution

1
Analyze the 802.1Q trunking behavior regarding native VLANs.
802.1Q trunking transmits frames belonging to the native VLAN without inserting an 802.1Q VLAN tag.
Native VLAN traffic is intentionally untagged to maintain backward compatibility with legacy non-tagging devices.
2
Trace the path of untagged frames from Switch-1 to Switch-2.
Frames from VLAN 10 leave Switch-1 untagged. Switch-2 receives the untagged frames and assigns them to its local native VLAN (VLAN 20).
Switches implicitly assume all incoming untagged frames on an 802.1Q trunk belong to whichever VLAN is configured as native on that specific ingress interface.
3
Identify the diagnostic indicators matching the scenario.
Cross-VLAN traffic leakage without a router combined with CDP native VLAN mismatch log warnings confirms a native VLAN configuration mismatch.
Cisco Discovery Protocol (CDP) and LLDP continuously monitor link parameters and report native VLAN mismatches to prevent security and routing anomalies.

Key Concept

802.1Q Native VLAN Mismatch Dynamics
Question 399Question →

Match each network physical layer diagnostic tool with the troubleshooting scenario it is best suited to resolve.

Click a left item, then click its matching right item

Items

Optical Power Meter (OPM)
Time-Domain Reflectometer (TDR)
Cable Certifier
Tone Generator and Probe

Matches

Show answer & explanation

Answer

Optical Power Meter pairs with measuring optical signal loss across fiber; Time-Domain Reflectometer pairs with locating distance to a copper conductor break; Cable Certifier pairs with verifying Category 6A compliance with TIA/EIA standards; Tone Generator and Probe pairs with tracing an unlabelled drop to a wall port.
Each physical layer tool fulfills a distinct troubleshooting requirement: an Optical Power Meter calculates decibel loss on fiber links; a Time-Domain Reflectometer uses electrical reflections to determine distance to a copper break; a Cable Certifier validates complete TIA/EIA standard parameters like NEXT and attenuation; and a Tone Generator with Probe physically traces unlabelled wire runs.

Step-by-Step Solution

1
Analyze each physical layer troubleshooting tool and identify its underlying diagnostic mechanism.
Identified light loss measurement for fiber, electrical signal reflection analysis for copper distance-to-fault, compliance sweep testing for Category ratings, and signal modulation tracing for wire identification.
Different physical media and failure modes require distinct diagnostic tool capabilities.
2
Map each tool to its primary diagnostic scenario.
Optical Power Meter maps to fiber optical loss; TDR maps to copper open fault distance; Cable Certifier maps to TIA/EIA standards validation; Tone Generator and Probe maps to cable identification.
Proper tool selection depends directly on the media type (copper vs fiber) and whether the goal is tracing, fault location, or standards certification.

Key Concept

Physical Cabling Diagnostic Tool Selection
Question 400Question →

A network technician executes `nslookup -type=TXT _dmarc.example.com` to verify an email authentication policy record. The command returns the following terminal output:

Server: UnKnown
Address: 192.168.1.2

Non-authoritative answer:
_dmarc.example.com text = "v=DMARC1; p=reject;"

Based on this command-line output, which of the following statements correctly interprets the diagnostic result?

Show answer & explanation

Answer: The record data was successfully retrieved from a local caching DNS resolver rather than the authoritative DNS server for example.com.

Answer

The record data was successfully retrieved from a local caching DNS resolver rather than the authoritative DNS server for example.com.
The 'Non-authoritative answer' output header signifies that the server responding to the query (192.168.1.2) obtained the record via recursive resolution or local cache rather than directly holding the authoritative zone files for example.com. The TXT query successfully returned the expected DMARC record.

Step-by-Step Solution

1
Analyze the output header line 'Server: UnKnown / Address: 192.168.1.2'.
Identifies that the local computer queried the internal DNS server at 192.168.1.2, whose reverse DNS PTR lookup is unconfigured.
Understanding local DNS server settings prevents confusing unmapped server hostnames with query failures.
2
Examine the answer section designation 'Non-authoritative answer:'.
Confirms the response originated from a recursive or caching server rather than the authoritative name server hosting the primary zone.
Non-authoritative answers occur when a resolver holds cached records or queries third-party root/TLD servers on behalf of the client.
3
Evaluate the record payload '_dmarc.example.com text = "v=DMARC1; p=reject;"'.
Confirms valid TXT record contents were successfully fetched.
DMARC policies are properly published within TXT resource records.

Key Concept

Interpreting nslookup output headers and non-authoritative DNS lookup results
PreviousPage 20 / 25Next