Network Troubleshooting

486 questions

Question 121Question

A network engineer is troubleshooting wireless performance issues in a multi-story office building. Wireless site survey logs indicate that client devices in crowded conference rooms remain stickily connected to distant access points (APs) with a weak RSSI of -83 dBm, causing slow throughput and dropped VoIP calls. Simultaneously, the 2.4 GHz spectrum is severely saturated with high client density. Which of the following actions should the engineer take to resolve these wireless connectivity and coverage issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure band steering on the wireless LAN controller to push dual-band client devices onto the 5 GHz spectrum.; Adjust the minimum RSSI disassociation threshold on access points to disconnect clients when signal strength drops below a playable level.

Answer

The correct actions are to enable band steering on the wireless controller to steer clients away from the saturated 2.4 GHz spectrum onto 5 GHz, and to adjust minimum RSSI thresholds on access points to resolve sticky client issues by forcing weak clients to disassociate and roam.
Enabling band steering optimizes traffic by directing dual-band clients away from the congested 2.4 GHz frequency and onto 5 GHz channels. Configuring minimum RSSI thresholds fixes sticky client roaming by actively disassociating client devices when their signal drops below a specific dBm level, prompting them to scan and connect to an AP with better RSSI.

Step-by-Step Solution

1
Analyze the reported symptoms: client stickiness at low RSSI (-83 dBm) and 2.4 GHz spectrum saturation.
Identified two distinct issues: sticky roaming behavior and band congestion.
Resolving wireless issues requires addressing both physical cell boundaries/roaming triggers and spectrum utilization.
2
Evaluate solutions for sticky clients.
Configuring minimum RSSI disassociation thresholds forces clients to drop weak connections and re-associate with nearer access points.
Client devices default to holding onto connections until signal is completely lost unless enforced by AP disassociation thresholds.
3
Evaluate solutions for 2.4 GHz spectrum saturation.
Enabling band steering offloads 5 GHz-capable devices from the 2.4 GHz band.
5 GHz offers higher throughput and more non-overlapping channels, mitigating high-density contention.

Key Concept

Wireless roaming optimization (minimum RSSI) and band management (band steering)
Question 122Question

A network administrator is investigating an issue where a workstation configured with IPv4 address 192.168.20.45/24192.168.20.45/24 cannot connect to an internal HTTPS server at 10.50.10.100:44310.50.10.100:443. The network path spans multiple VLANs across a Layer 3 switch, a core router, and perimeter firewalls. Following a systematic network troubleshooting methodology, place the diagnostic steps in the correct logical sequence to systematically isolate whether the root cause lies within the host setup, default gateway reachability, routing table entries, or ACL filtering.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct troubleshooting sequence starts by verifying host IP configuration parameters, testing reachability to the local default gateway, tracing the path toward the target server to locate where packets drop, inspecting the routing table at that hop, and finally auditing interface ACLs for filtering rules blocking TCP port 443.
Structured network troubleshooting progresses logically from local host configuration (Layer 1–3) to local gateway connectivity, followed by path discovery (traceroute), transit routing table lookup, and lastly Layer 4 security filtering (ACLs). This bottom-up and path-isolation approach avoids misdiagnosing infrastructure security filters when basic host parameters or gateway routes are misconfigured.

Step-by-Step Solution

1
Verify local IP configuration parameters on the source workstation
Ensures the workstation has a valid IP address, correct subnet mask, and assigned gateway address
Troubleshooting should start closest to the host to eliminate local misconfigurations before investigating network infrastructure.
2
Test connectivity to the default gateway interface
Confirms Layer 2 switch connectivity and Layer 3 local gateway responsiveness
If the workstation cannot reach its gateway, remote routing and ACLs cannot be reached or evaluated.
3
Perform a traceroute to the destination IP address
Identifies the exact transit router hop where packet forwarding ceases
Tracing the path isolates the scope of the problem to a specific router or Layer 3 segment.
4
Examine the IP routing table on the failing router hop
Validates whether an active, valid route exists for the destination subnet
A router without a matching route or valid default route will drop incoming traffic or send an ICMP unreachable message.
5
Inspect interface Access Control Lists (ACLs) along the path
Reveals whether explicit deny rules or the default implicit deny block destination port 443
If routing is operational, packet drops on specific ports (e.g., HTTPS 443) are typically caused by ACL rule ordering or misconfigured filter statements.

Key Concept

CompTIA Layered Network Troubleshooting Methodology for Gateway, Routing, and Access Control List Failures
Estimated Time:2m 0s
Question 123Question

During a routine wireless performance audit of a corporate facility, an administrator observes severe packet loss and elevated frame retransmissions among clients connected to 2.4 GHz access points. Signal strength measurements indicate strong coverage (-55 dBm) across all work areas. Inspection of the wireless controller configuration reveals that adjacent access points are operating on channels 1, 2, 4, and 5. Which of the following represents the primary root cause of this connectivity issue?

Show answer & explanation

Answer: Adjacent-channel interference resulting from overlapping channel selection in the 2.4 GHz spectrum.

Answer

Adjacent-channel interference resulting from overlapping channel selection in the 2.4 GHz spectrum.
In the 2.4 GHz spectrum, 802.11 channels are spaced 5 MHz apart but require a 20 MHz signal width (plus sidebands), requiring 25 MHz of total channel spacing to avoid overlap. The standard non-overlapping channels in 2.4 GHz are 1, 6, and 11. Assigning channels 1, 2, 4, and 5 causes adjacent radios to transmit on overlapping frequencies. This results in severe adjacent-channel interference (ACI), leading to unreadable RF energy, packet collisions, high frame retransmissions, and throughput drops despite strong RSSI readings.

Step-by-Step Solution

1
Analyze the reported signal metrics and physical layer status.
The measured signal strength of -55 dBm indicates excellent RF power and eliminates attenuation or distance issues as the root cause.
Signal levels above -65 dBm are generally considered strong for enterprise Wi-Fi environments.
2
Evaluate the 2.4 GHz channel plan against standard 802.11 specifications.
The 2.4 GHz band uses 22 MHz wide channels spaced 5 MHz apart. The only non-overlapping 20 MHz channel plan in North America consists of channels 1, 6, and 11.
Channels 1, 2, 4, and 5 overlap directly in frequency space.
3
Determine the impact of assigning overlapping channels to adjacent access points.
Transmissions on channel 2 bleed into channels 1 and 4, creating elevated noise and frame collisions, which causes clients to retransmit frames and suffer degraded throughput.
Adjacent-channel interference (ACI) cannot be decoded as valid Wi-Fi preamble by neighboring radios, treating it instead as raw RF noise.

Key Concept

2.4 GHz Channel Overlap and Adjacent-Channel Interference (ACI)
Question 124Question

A network administrator runs the following query on a client workstation to test hostname resolution:

> nslookup webserver.corp.local
Server: dns1.corp.local
Address: 10.0.0.10

*** dns1.corp.local can't find webserver.corp.local: Non-existent domain

The administrator verifies that the target server is powered on, fully functional, and reachable directly by its IP address. Which of the following is the most likely cause of this issue?

Show answer & explanation

Answer: The DNS server is missing a host (A) record for the domain name.

Answer

The DNS server is missing a host (A) record for the domain name.
The 'Non-existent domain' (NXDOMAIN) error returned by nslookup indicates that the client successfully communicated with the DNS server, but the server does not have a matching Host (A) record configured in its DNS zone for the requested hostname.

Step-by-Step Solution

1
Analyze the nslookup command output.
The local DNS server at 10.0.0.10 responded with 'Non-existent domain' (NXDOMAIN).
This confirms network connectivity to the DNS server is working properly.
2
Evaluate the cause of the NXDOMAIN response.
NXDOMAIN means the queried name server has no record matching the requested hostname in its database.
Since the destination server is online and reachable via IP address, the failure is strictly due to the absence of the corresponding Host (A) resource record on the DNS server.

Key Concept

DNS Record Verification and NXDOMAIN Troubleshooting
Question 125Question

A network technician executes `ipconfig` on a workstation that is unable to reach local network resources. The output displays an IPv4 address of 169.254.12.89169.254.12.89 and a subnet mask of 255.255.0.0255.255.0.0. Which of the following is the most likely cause of this issue?

Show answer & explanation

Answer: The workstation was unable to contact a DHCP server and self-assigned an Automatic Private IP Addressing (APIPA) address.

Answer

The workstation was unable to contact a DHCP server and self-assigned an Automatic Private IP Addressing (APIPA) address.
The correct answer states that the workstation failed to reach a DHCP server and self-assigned an APIPA address. When a DHCP client initiates the DORA process and receives no reply from a DHCP server within a designated timeout period, the operating system assigns a link-local IP address in the 169.254.0.1169.254.0.1 to 169.254.255.254169.254.255.254 range so local subnet communication can still occur.

Step-by-Step Solution

1
Analyze the IP address output provided in the scenario.
The IP address is 169.254.12.89169.254.12.89.
Recognizing the address space is crucial for determining how the host received its network configuration.
2
Identify the protocol responsible for the 169.254.0.0/16169.254.0.0/16 address range.
The address falls within the APIPA (Automatic Private IP Addressing) link-local range.
Operating systems automatically assign an APIPA address when a DHCP DISCOVER request receives no DHCP OFFER response.
3
Determine the root cause based on APIPA behavior.
The workstation failed to contact a DHCP server to obtain an IP lease.
APIPA is a fallback mechanism used exclusively when dynamic IP configuration fails.

Key Concept

Automatic Private IP Addressing (APIPA) Diagnosis
Question 126Question

A network technician is systematically troubleshooting a Linux workstation that fails to resolve an internal fully qualified domain name (FQDN). Arrange the following diagnostic steps in the correct order, starting from local client configuration inspection and escalating through to upstream network infrastructure isolation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with inspecting the local hosts file, followed by checking local resolver IP configuration in `/etc/resolv.conf`, clearing local resolver cache, querying the targeted internal DNS server directly via `dig`, and finally querying an external public DNS server to isolate internal vs. external scope.
Systematic network troubleshooting follows a bottom-up / local-to-remote sequence: first checking local static files (`/etc/hosts`), then local network client configuration (`/etc/resolv.conf`), followed by local cache clearing (`resolvectl flush-caches`), then testing targeted internal DNS server responses via direct `dig` queries, and lastly testing external DNS reachability to isolate enterprise boundary issues.

Step-by-Step Solution

1
Check local static mappings in `/etc/hosts`.
Ensures no hardcoded IP address or hostname entry is overriding standard DNS queries on the endpoint.
The OS checks local host files prior to making network resolver requests.
2
Verify client DNS server IP settings in `/etc/resolv.conf`.
Confirms the workstation attempts DNS queries against valid, reachable DNS IP addresses.
If the configured DNS server IP is incorrect or misassigned by DHCP, network queries will fail regardless of server status.
3
Clear cached name resolution entries using `resolvectl flush-caches`.
Purges temporary cached lookup failures or expired record mappings.
Eliminates local cache corruption or stale TTL records as the root cause.
4
Directly query the internal DNS server using `dig @<Internal_DNS_IP> <FQDN>`.
Determines if the internal DNS daemon responds on UDP/TCP port 53 and returns valid resource records.
Isolates the local resolver library from the actual network response of the designated DNS server.
5
Query a public external DNS resolver using `dig @8.8.8.8 <FQDN>`.
Helps distinguish between an isolated internal DNS server issue and broader firewall or outbound network connectivity failures.
Determines if DNS traffic generally egresses the host and isolates internal infrastructure misconfigurations.

Key Concept

Systematic DNS Troubleshooting Sequence
Estimated Time:2m 0s
Question 127Question

A network administrator is troubleshooting an intermittent physical layer failure on a newly provisioned 90-meter Category 6A unshielded twisted-pair (UTP) link connecting a core switch to a server farm switch. A standard continuity test verifies 1-to-1 pin mapping with no opens or shorts. However, when the link auto-negotiates to 10GBASE-T, the switch interfaces report extremely high cyclic redundancy check (CRC) error counts and dropped frames, whereas forcing the link speed down to 1000BASE-T yields stable performance. Which diagnostic tool should the administrator use to pinpoint the exact location and nature of this signal degradation along the cable run?

Show answer & explanation

Answer: A cable certifier capable of measuring frequency-dependent parameters such as Near-End Crosstalk (NEXT) and return loss across the cable length

Answer

A cable certifier capable of measuring frequency-dependent parameters such as Near-End Crosstalk (NEXT) and return loss across the cable length
High-speed transmission standards such as 10GBASE-T over Cat 6A operate at high frequencies (up to 500 MHz). Physical installation flaws such as untwisting wire pairs too far during punch-down or exceeding bend radii cause high-frequency impairments like Near-End Crosstalk (NEXT) and return loss. A cable certifier performs full parametric frequency sweeps and time-domain analysis to pinpoint exact failure points along the cable run.

Step-by-Step Solution

1
Analyze the symptoms presented in the scenario
The cable run passes simple DC continuity tests (no open or short circuits), operates normally at 1Gbps, but suffers severe frame corruption (CRC errors) at 10Gbps over Cat 6A UTP.
10Gbps transmission operates at significantly higher frequencies (up to 500 MHz), making it far more sensitive to high-frequency physical layer impairments like NEXT, FEXT, and return loss.
2
Evaluate the capabilities of basic copper testing tools versus advanced diagnostic tools
Basic continuity wiremap testers only verify physical conductor connection from end to end. They do not evaluate high-frequency electrical characteristics.
A cable run can have perfect 1-to-1 pin alignment while still failing frequency compliance due to excessive conductor untwisting at termination points or tight bend radii.
3
Select the appropriate diagnostic tool for high-frequency cabling certification
A full cable certifier performs frequency-sweep testing up to Category specifications (e.g., 500 MHz for Cat 6A) and provides time-domain crosstalk (TDX) plots to pinpoint where crosstalk or impedance anomalies occur.
Only a cable certifier can validate physical layer compliance against TIA/EIA standards and isolate high-frequency signal integrity failure locations.

Key Concept

Cable certification and frequency-dependent parametric testing for high-speed copper links
Question 128Question

Employees in a newly renovated office suite report that laptops connected to the 5 GHz Wi-Fi network experience severe signal drop-offs and low throughput when moving inside glass-walled conference rooms. However, clients connected to the 2.4 GHz wireless network maintain stable signal strength throughout the entire floor. Diagnostic site survey tools reveal a significant drop in RSSI specifically when receiving 5 GHz signals behind the newly installed tinted glass walls. Which of the following is the primary cause of the performance degradation on the 5 GHz band?

Show answer & explanation

Answer: Greater signal attenuation and absorption of higher-frequency radio waves by dense building materials

Answer

Greater signal attenuation and absorption of higher-frequency radio waves by dense building materials
The correct answer correctly identifies that higher-frequency RF signals, such as 5 GHz, experience greater absorption and attenuation when passing through solid or coated building materials like low-emissivity glass. Because lower frequencies (2.4 GHz) have longer wavelengths, they penetrate physical barriers more effectively, explaining why 2.4 GHz signal strength remains stable while 5 GHz drops significantly.

Step-by-Step Solution

1
Analyze the observed symptoms
The issue specifically affects the 5 GHz frequency band behind glass walls, while 2.4 GHz remains stable.
Different RF frequencies exhibit distinct propagation and penetration characteristics.
2
Evaluate RF attenuation properties by frequency
Higher frequencies (5 GHz) suffer greater free-space path loss and higher absorption rates through physical obstacles compared to lower frequencies (2.4 GHz).
Shorter wavelengths at 5 GHz struggle to penetrate dense or metallic materials like treated low-emissivity glass.
3
Select the matching physical layer cause
Absorption and attenuation by the building material explain the RSSI drop exclusively on the 5 GHz band.
Environmental obstacles impact higher frequency signals more severely.

Key Concept

RF Attenuation and Absorption by Frequency
Question 129Question

A network administrator applies the following extended Access Control List (ACL) to the inbound direction of interface GigabitEthernet0/1 on a branch router to allow subnet `192.168.50.0/24` access to a web server at `10.10.20.100`:

text
Router# show access-lists 105
Extended IP access list 105
10 permit tcp 192.168.50.0 0.0.0.255 host 10.10.20.100 eq 443
20 permit tcp 192.168.50.0 0.0.0.255 host 10.10.20.100 eq 80

Immediately after applying this ACL, workstations on the `192.168.50.0/24` subnet report that they can no longer reach external internet sites or perform domain name resolution via the internal DNS server at `10.10.10.5`. Which of the following best explains the root cause of this connectivity failure?

Show answer & explanation

Answer: The implicit deny statement at the end of the ACL is dropping all unpermitted traffic, including DNS requests and traffic destined for external subnets.

Answer

The implicit deny rule at the end of the Access Control List filters out all traffic not explicitly permitted, blocking DNS resolution (UDP 53) and general outbound IP routing.
In network security configurations, Access Control Lists contain an unwritten implicit deny all rule (`deny ip any any`) at the end of the rule list. When only HTTP and HTTPS traffic to a specific destination host are permitted, all other IP traffic—including DNS requests (UDP port 53) and traffic routed to the default gateway for external networks—hits the implicit deny and is discarded.

Step-by-Step Solution

1
Analyze the ACL configuration rules
Rules 10 and 20 explicitly permit TCP traffic on ports 443 and 80 to host 10.10.20.100.
Identify what traffic is explicitly allowed by the configured statements.
2
Evaluate default ACL behavioral mechanics
An unwritten 'deny ip any any' (implicit deny) statement exists at the end of all standard and extended ACLs.
Understand why non-matching traffic is dropped.
3
Correlate symptoms with the ACL rules
DNS requests (UDP port 53) and general internet traffic do not match rules 10 or 20, causing them to hit the implicit deny and be dropped.
Determine why DNS resolution and internet reachability failed following the ACL application.

Key Concept

Access Control List Implicit Deny Behavior
Estimated Time:1m 30s
Question 130Question

A network administrator deployed a new internal database server named `db-primary` with IP address 172.16.45.10172.16.45.10 inside the `internal.corp.net` DNS zone. Users situated on workstations within the `sales.corp.net` domain report that querying short hostname `db-primary` fails, whereas querying the fully qualified domain name (FQDN) succeeds.

The administrator executes the following troubleshooting commands from a user workstation in `sales.corp.net`:

C:\> nslookup db-primary
Server: dc1.sales.corp.net
Address: 172.16.10.5

*** dc1.sales.corp.net can't find db-primary: Non-existent domain

C:\> nslookup db-primary.internal.corp.net
Server: dc1.sales.corp.net
Address: 172.16.10.5

Name: db-primary.internal.corp.net
Address: 172.16.45.10

Which of the following configuration changes will resolve the short hostname resolution failure for all workstations in `sales.corp.net`?

Show answer & explanation

Answer: Append internal.corp.net to the DNS domain search list distributed to workstations via DHCP Option 119.

Answer

Append internal.corp.net to the DNS domain search list distributed to workstations via DHCP Option 119.
When a client queries a single-label short hostname (such as 'db-primary'), the operating system resolver appends domain suffixes from its DNS suffix search list. Because the target host resides in 'internal.corp.net' and the workstations belong to 'sales.corp.net', the client fails to resolve the host unless 'internal.corp.net' is appended to the workstation's search list. Distributing this suffix via DHCP Option 119 resolves the problem for all clients automatically.

Step-by-Step Solution

1
Analyze the CLI output for short name vs FQDN queries.
The query for 'db-primary' returns NXDOMAIN (Non-existent domain) under 'sales.corp.net', while 'db-primary.internal.corp.net' resolves successfully.
The client operating system only appends its primary domain suffix ('sales.corp.net') when attempting to resolve single-label short names.
2
Determine the necessary mechanism to resolve single-label names across multi-domain environments.
Adding 'internal.corp.net' to the client's DNS suffix search list instructs the resolver to append 'internal.corp.net' if the initial local domain lookup fails.
Resolvers iterate through configured search suffixes sequentially when presented with single-label hostnames.
3
Select the centralized administrative fix for network-wide deployment.
Configuring DHCP Option 119 (Domain Search Option) ensures all client workstations dynamically receive the required suffix list.
Centralized DHCP option management updates all workstations without requiring manual static IP or adapter reconfiguration on individual hosts.

Key Concept

DNS Suffix Search List & Unqualified Hostname Resolution
Question 131Question

A user reports that a recently updated internal web application still directs their browser to an obsolete IP address on their local client machine. In what order should a network technician perform the following steps to systematically troubleshoot and resolve this stale name resolution issue?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of troubleshooting steps begins with inspecting the local DNS resolver cache, followed by flushing the local DNS cache, querying the primary DNS server directly, and finally verifying host connectivity.
Logical troubleshooting dictates examining local system state before making changes. First inspecting the local cache confirms if stale records exist. Flushing the cache then removes obsolete mappings. Querying the primary DNS server ensures the upstream infrastructure yields correct records. Finally, verifying network reachability confirms overall resolution.

Step-by-Step Solution

1
Inspect local DNS resolver cache
Determines whether an obsolete hostname-to-IP mapping is stored in the client cache.
Systematic troubleshooting requires gathering diagnostic evidence of local caching prior to modifying system state.
2
Flush the local DNS resolver cache
Removes stale DNS entries stored in local operating system memory.
Clearing the cache ensures subsequent host lookup attempts request fresh record data from DNS servers.
3
Query the primary DNS server directly
Validates that the upstream DNS server resolves the FQDN to the modern, expected IP address.
Direct queries test DNS server functionality independently from client-side local configuration files or caches.
4
Verify host reachability and service access
Confirms application traffic reaches the destination IP correctly.
Final testing validates that both name resolution and network transport are working as intended.

Key Concept

Client-side DNS resolver cache troubleshooting workflow
Question 132Question

A network administrator receives reports that newly arriving wireless clients on a high-density office VLAN (192.168.32.0/23192.168.32.0/23) are unable to access network resources. Inspecting an affected workstation via `ipconfig /all` reveals the following output:

text
IPv4 Address. . . . . . . . . . . : 169.254.112.45
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . :

Wireless 802.1X authentication logs show that clients authenticate successfully, but DHCP lease requests time out. Further inspection of the centralized DHCP server shows that the scope for 192.168.32.0/23192.168.32.0/23 has 508508 active leases out of 508508 total allocated addresses, with a default lease duration of 88 days.

Which of the following actions is the most appropriate resolution to fix the IP address assignment failure?

Show answer & explanation

Answer: Reduce the DHCP scope lease duration and expand the available address pool for the wireless VLAN.

Answer

Reduce the DHCP scope lease duration and expand the available address pool for the wireless VLAN.
The client terminal output shows an APIPA address (169.254.112.45169.254.112.45), confirming that the client failed to receive a DHCP response. The DHCP server statistics confirm that all 508508 usable addresses in the 192.168.32.0/23192.168.32.0/23 pool are in use. Because the environment is high-density wireless and has an excessively long 88-day lease time, addresses are held long after devices leave the network. Reducing lease duration and increasing the pool capacity addresses the root cause of scope exhaustion.

Step-by-Step Solution

1
Analyze client IP configuration
The presence of an IPv4 address in the 169.254.0.0/16169.254.0.0/16 range (169.254.112.45169.254.112.45) with no default gateway indicates an Automatic Private IP Addressing (APIPA) self-assignment resulting from a failed DHCP request.
When a client fails to receive a response to its DHCPDISCOVER broadcast, the operating system self-assigns an APIPA address to maintain local link connectivity.
2
Evaluate DHCP server logs and scope state
The server logs show 508508 out of 508508 addresses in the 192.168.32.0/23192.168.32.0/23 scope are currently leased.
A /23/23 subnet provides 232232=5102=5082^{32-23} - 2 = 510 - 2 = 508 usable host addresses. Having 508508 active leases indicates total DHCP scope exhaustion.
3
Determine corrective action for high-density wireless environments
Long lease durations (88 days) in transient or high-density wireless environments prevent IP addresses from recycled back into the pool. Reducing the lease duration (e.g., to several hours) and expanding the IP range resolves exhaustion.
Shorter lease times reclaim IP addresses from disconnected transient devices, ensuring available capacity for incoming clients.

Key Concept

DHCP Scope Exhaustion and Lease Duration Tuning
Question 133Question

A network administrator is investigating an issue where corporate users cannot authenticate to the 802.1X wireless network following a server maintenance window. The administrator suspects that an expired RADIUS server SSL certificate is preventing successful EAP-TLS handshakes. To test this theory, the administrator installs a valid test certificate on a staging RADIUS server and successfully authenticates a test client. According to the CompTIA troubleshooting methodology, what is the immediate NEXT step the administrator should perform?

Show answer & explanation

Answer: Establish a plan of action to deploy the renewed certificate in production and implement the solution.

Answer

Establish a plan of action to deploy the renewed certificate in production and implement the solution.
The technician has completed Step 3 of the CompTIA troubleshooting methodology by testing and confirming the theory on a staging environment. The immediate next phase (Step 4) requires establishing a plan of action to resolve the issue in the live environment and implementing that solution.

Step-by-Step Solution

1
Identify current phase in CompTIA troubleshooting methodology
The technician suspected an expired RADIUS certificate (Establish a theory - Step 2) and tested it on a staging server successfully (Test the theory - Step 3).
Confirming that authentications succeed with a valid test certificate validates the root cause theory.
2
Determine the next sequential phase
Following Step 3 (Test the theory to determine cause), the official CompTIA methodology mandates Step 4: Establish a plan of action to resolve the problem and implement the solution.
A formal rollout plan must be created and executed (including change approval if required) before verifying full system functionality.

Key Concept

CompTIA 6-Step Troubleshooting Methodology Sequence
Question 134Question

A network administrator has verified that a recently modified firewall access control list (ACL) blocking TCP port 636 is the root cause of directory authentication failures for hybrid cloud VPN users. The administrator confirmed this theory after testing the ACL modification in a staging environment. According to the CompTIA troubleshooting methodology, which TWO of the following actions should the administrator perform NEXT during the upcoming phase? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Assess potential security and operational impacts before applying the revised access control list to the production firewall.; Apply the modified access control list on the production firewall to restore secure directory authentication services.

Answer

The administrator should evaluate potential security and operational impacts of the firewall change and implement the updated access control list on the production firewall.
Once a theory of probable cause has been confirmed through testing (Step 3), the network administrator must proceed to Step 4: Establish a plan of action to resolve the problem and implement the solution. This phase requires identifying potential side effects or impacts of the proposed change on production systems and subsequently deploying the fix.

Step-by-Step Solution

1
Identify the current phase completed in the CompTIA troubleshooting methodology.
The technician has already established and tested a theory of probable cause (Step 3: Test the theory to determine cause).
Confirming that TCP port 636 was blocked in staging completes the hypothesis testing step.
2
Determine the mandatory next phase according to the 6-step framework.
The immediate next phase is Step 4: Establish a plan of action to resolve the problem and implement the solution.
CompTIA methodology strictly dictates establishing a plan of action (including identifying potential effects) and then implementing the solution before moving to system verification.
3
Select the appropriate actions that align strictly with Step 4.
Evaluating potential impacts of the ACL change and deploying the fix to production fall directly within Step 4.
Impact assessment ensures change safety, while rule deployment executes the planned resolution.

Key Concept

CompTIA 6-Step Troubleshooting Methodology: Transitioning from Theory Testing (Step 3) to Plan of Action & Implementation (Step 4)
Estimated Time:2m 0s
Question 135Question

A network administrator is troubleshooting an intermittent 10GBASE-LR single-mode optical fiber link between two campus buildings. Switch port diagnostics indicate high optical signal attenuation and excessive return loss (back reflection) following a recent patch panel maintenance window. Optical transceivers on both endpoints report normal transmit power levels. Which of the following actions should the network administrator perform to accurately pinpoint the fault location and resolve the physical layer degradation? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Inspect all fiber end-faces with a optical fiber inspection scope and replace any mixed APC (green) and UPC (blue) connector patch cables with matching connector polish types.; Use an Optical Time-Domain Reflectometer (OTDR) to analyze reflection spikes and measure attenuation across splices, bends, and connector transitions along the fiber run.

Answer

The administrator must inspect ferrule end-faces using an optical inspection scope to ensure APC and UPC connector polishes are not mixed, and utilize an Optical Time-Domain Reflectometer (OTDR) to pinpoint physical attenuation and reflectometry anomalies along the single-mode fiber run.
High optical return loss and signal attenuation on a single-mode fiber link are key indicators of connector polish mismatches (e.g., mating green APC connectors with blue UPC connectors) or physical cable damage. Using an optical fiber inspection scope allows technicians to identify physical ferrule contamination or polish mismatch, while an Optical Time-Domain Reflectometer (OTDR) precise measures light loss and distance to reflective events across the fiber span.

Step-by-Step Solution

1
Evaluate the reported physical symptoms on the fiber link.
High attenuation (insertion loss) combined with excessive return loss (back reflection) on single-mode fiber points directly to physical interface mismatch, contaminated end-faces, microbends/macrobends, or damaged physical fiber.
Normal transceiver transmit power rules out active transceivers as the primary failure point, isolating the issue to the passive cabling medium and physical connector interfaces.
2
Select the proper optical diagnostic tool to localize faults across the fiber run.
An Optical Time-Domain Reflectometer (OTDR) measures backscattered light over distance to locate splices, severe bends, or physical breaks.
Copper testing tools (like standard electrical TDRs) cannot send or analyze light signals on fiber optic strands.
3
Verify physical connector polish compliance and end-face cleanliness.
Replacing mismatched APC (8-degree angle ferrule) and UPC (flat spherical ferrule) connectors eliminates air gap reflections and high decibel signal loss.
Mating an APC connector directly with a UPC connector damages ferrule tips and causes significant air gap reflection, yielding high return loss.

Key Concept

Fiber Optic Physical Layer Troubleshooting & Diagnostic Instrument Selection
Question 136Question

A user's workstation is assigned the static IP address 10.0.4.5010.0.4.50 with a subnet mask of 255.255.255.0255.255.255.0. The workstation can successfully ping other local computers on the 10.0.4.0/2410.0.4.0/24 network, but it cannot reach any servers on external subnets or the internet. An administrator reviews the network configuration and notes that the default gateway is set to 10.0.5.110.0.5.1. Which of the following is the root cause of the outbound connectivity issue?

Show answer & explanation

Answer: The default gateway is configured on a different IP subnet than the host.

Answer

The default gateway is configured on a different IP subnet than the host.
For a host to communicate with remote networks, its default gateway must reside on the exact same local IP subnet. Here, the host is on 10.0.4.0/2410.0.4.0/24, but the gateway is set to 10.0.5.110.0.5.1 (which is on 10.0.5.0/2410.0.5.0/24). Consequently, the host cannot deliver traffic to the gateway for routing to external subnets.

Step-by-Step Solution

1
Analyze the host IP address and subnet mask.
The host address is 10.0.4.5010.0.4.50 with subnet mask 255.255.255.0255.255.255.0 (/24), defining a usable local subnet of 10.0.4.110.0.4.1 through 10.0.4.25410.0.4.254.
Devices on a network can directly communicate only with other devices on their local IP subnet.
2
Compare the configured default gateway address to the local subnet.
The default gateway address 10.0.5.110.0.5.1 belongs to the 10.0.5.0/2410.0.5.0/24 subnet.
A host must send traffic destined for external networks to a gateway on its own local subnet. Because 10.0.5.110.0.5.1 is outside 10.0.4.0/2410.0.4.0/24, the host cannot resolve its MAC address locally to deliver outbound packets.

Key Concept

Default Gateway Subnet Matching
Question 137Question

A network administrator is troubleshooting connectivity issues on a corporate wireless guest network spanning the 192.168.100.0/24192.168.100.0/24 subnet. Transient users report that their laptops periodically fail to connect to network resources and receive self-assigned IP addresses in the 169.254.0.0/16169.254.0.0/16 range during peak operating hours. Upon inspecting the central DHCP server status, the administrator observes the following command output snippet:

text
DHCP Scope: Guest_VLAN100
Subnet Prefix: 192.168.100.0/24
Range: 192.168.100.10 - 192.168.100.250
Total Scope Addresses: 241
Active Leases: 241 (100% utilized)
Pending Requests: 14 (Dropped - No available addresses)
Lease Duration: 8 days 00:00:00

Physical attendance logs confirm that no more than 60 guest users are ever present in the facility concurrently. Which of the following is the most likely root cause of this issue?

Show answer & explanation

Answer: The DHCP lease duration is configured too long for a network with high host turnover, leading to scope exhaustion.

Answer

The most likely root cause is that the DHCP lease duration is configured too long for a network with high host turnover, leading to scope exhaustion.
The correct answer identifies that an excessively long DHCP lease time (8 days) on a transient network (guest Wi-Fi) leads to scope exhaustion. Even though concurrent user count is low, new MAC addresses consume IP allocations that are retained long after devices leave the network.

Step-by-Step Solution

1
Analyze the client symptom
Clients receive 169.254.x.x169.254.x.x (APIPA) addresses, indicating a failure to receive a DHCP response during the DORA process.
When a host sends a DHCPDISCOVER and receives no DHCPOFFER, operating systems fall back to Automatic Private IP Addressing.
2
Examine the DHCP server log output
Active leases equal 241241 out of 241241 (100%100\% utilization), and 1414 pending requests are dropped due to no available addresses.
The server scope is completely exhausted, preventing new DHCPOFFER messages from being issued.
3
Correlate scope metrics with environment characteristics
The physical presence is only ~60 concurrent users, but the lease duration is set to 8 days.
Transient devices connect, lease an IP, and leave. Because the lease lasts 8 days, old MAC bindings remain occupied in state memory long after devices depart, accumulating 241 assigned leases over time.

Key Concept

DHCP Scope Exhaustion and Lease Time Optimization
Question 138Question

A network engineer is troubleshooting a client workstation that cannot connect to an internal web portal using its hostname `srv01.corp.internal`. The engineer executes two `nslookup` queries from the client's command prompt:

text
C:\> nslookup srv01.corp.internal
Server: UnKnown
Address: 192.168.1.1
*** UnKnown can't find srv01.corp.internal: Non-existent domain

C:\> nslookup srv01.corp.internal 10.0.0.53
Server: dc01.corp.internal
Address: 10.0.0.53

Name: srv01.corp.internal
Address: 10.0.0.150

Based on the output above, which of the following are the MOST likely root causes of the name resolution issue on the workstation? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The workstation is assigned a default DNS resolver IP address that lacks the internal domain zone information.; The local DHCP server scope is misconfigured to distribute a local gateway or public DNS server address instead of the internal DNS server.

Answer

The workstation is configured with a default DNS server (192.168.1.1, likely a home router or upstream gateway) that does not maintain or forward queries for the internal domain `.corp.internal`. Furthermore, the DHCP server scope distributing network configurations to local clients is misconfigured to pass out 192.168.1.1 rather than the authoritative internal DNS server (10.0.0.53).
The initial query to default DNS server 192.168.1.1 fails because that server does not hold authoritative records for the private zone `corp.internal`. However, explicitly specifying the internal DNS server (10.0.0.53) in the command parameter resolves the hostname successfully. This demonstrates that the internal DNS server is functioning and configured properly with the host A record, but client workstations are using an incorrect default DNS server assigned via DHCP.

Step-by-Step Solution

1
Analyze the default nslookup query output
The workstation automatically queries its configured default server 192.168.1.1, which fails with 'Non-existent domain' (NXDOMAIN).
This confirms that 192.168.1.1 cannot resolve hostnames within the `corp.internal` private namespace.
2
Analyze the explicit nslookup query output targeting 10.0.0.53
When explicitly directed to query server 10.0.0.53, name resolution succeeds immediately and returns IP address 10.0.0.150.
This proves that the internal DNS server is reachable, online, and contains a valid A record for the target host.
3
Deduce the underlying root causes
Identify that the client workstation has an incorrect preferred DNS resolver configured, which is typically distributed dynamically via DHCP scope settings.
Correcting the network adapter's primary DNS setting or updating the DHCP scope options to distribute 10.0.0.53 resolves the issue.

Key Concept

DNS Server Configuration & DHCP Resolver Scopes
Question 139Question

Match each physical layer cabling diagnostic tool to the primary troubleshooting task or measurement it is designed to perform.

Click a left item, then click its matching right item

Items

Tone Generator and Probe Kit
Time-Domain Reflectometer (TDR)
Optical Power Meter (OPM)
Cable Certifier

Matches

Show answer & explanation

Answer

Tone Generator and Probe Kit pairs with locating an unlabeled copper cable trace in a patch panel bundle. Time-Domain Reflectometer (TDR) pairs with determining the exact distance to an open or short circuit on a twisted-pair cable. Optical Power Meter (OPM) pairs with measuring optical signal loss and power levels on a fiber optic link. Cable Certifier pairs with verifying that a newly installed copper cable meets TIA/EIA Category 6A specification standards.
Each physical cabling tool serves a distinct role in network diagnostics: tone generators locate individual cable ends through audio signals, TDRs measure distance to physical copper faults using pulse reflections, Optical Power Meters calculate light attenuation on fiber runs, and Cable Certifiers validate that a cable installation meets official bandwidth performance standards.

Step-by-Step Solution

1
Identify the primary function of tracing cables
Connecting the Tone Generator and Probe Kit to the task of finding unlabeled cable ends via signal induction.
Toner probes are designed specifically for tracing and identifying individual conductors in mixed bundles.
2
Identify physical fault distance measurement tools for copper media
Mapping the Time-Domain Reflectometer (TDR) to locating the precise distance to physical breaks or short circuits.
TDR calculates distance to fault using electrical pulse reflections.
3
Determine the tool used for optical signal loss measurement
Associating the Optical Power Meter (OPM) with measuring light power across fiber optic strands.
OPMs measure light power loss in decibels (dB) on optical links.
4
Identify standard compliance testing tools
Linking the Cable Certifier to verifying full TIA/EIA Category 6A specification standards.
Cable certifiers perform comprehensive high-frequency electrical parameter testing against industry standard standards.

Key Concept

Selecting Appropriate Cabling Diagnostic Tools
Question 140Question

An IT technician is troubleshooting name resolution issues on an administrator workstation. The technician issues an `nslookup` command for `app.finance.local` and receives a successful reply pointing to `192.168.10.50`. However, when attempting to ping `app.finance.local` from the same machine, the system attempts to send traffic to `10.0.0.99` and times out.

text
C:\Users\Admin> nslookup app.finance.local
Server: dns01.corp.internal
Address: 10.0.0.1

Name: app.finance.local
Address: 192.168.10.50

C:\Users\Admin> ping app.finance.local
Pinging app.finance.local [10.0.0.99] with 32 bytes of data:
Request timed out.

Which of the following is the most likely cause of the discrepancy in resolved IP addresses?

Show answer & explanation

Answer: A static entry for app.finance.local mapping to 10.0.0.99 is present in the local hosts file.

Answer

A static entry for app.finance.local mapping to 10.0.0.99 is present in the local hosts file.
The correct answer identifies that a static entry exists in the local hosts file. Standard operating system commands like `ping` utilize the OS name resolution pipeline, which evaluates the local `hosts` file and resolver cache before sending requests to remote DNS servers. The diagnostic tool `nslookup`, however, bypasses local system files and queries the DNS server directly. The discrepancy between `nslookup` (192.168.10.50) and `ping` (10.0.0.99) indicates that a local `hosts` file entry is overriding the DNS server's record for normal application traffic.

Step-by-Step Solution

1
Analyze the behavior of the nslookup utility
nslookup directly contacts the configured DNS server (10.0.0.1) over network sockets, completely bypassing the local operating system resolver library, DNS cache, and hosts file.
This confirms that the DNS server holds the correct record (192.168.10.50).
2
Analyze the behavior of standard OS utilities (e.g., ping)
ping relies on the OS Stub Resolver, which checks local mechanisms (such as the local hosts file and local DNS resolver cache) prior to initiating a network DNS query.
Because ping attempts to reach 10.0.0.99, a local override must exist on the client machine that takes precedence over network DNS responses.
3
Identify the root cause of the address discrepancy
A legacy or manual entry in the system's local hosts file (%SystemRoot%\System32\drivers\etc\hosts) maps app.finance.local to 10.0.0.99, overriding the valid DNS response for standard applications.
Removing or correcting the entry in the local hosts file will restore consistent name resolution.

Key Concept

Operating System Hostname Resolution Order vs. Direct DNS Diagnostics (nslookup vs. OS Resolver)
PreviousPage 7 / 25Next
Network Troubleshooting Practice Questions — CompTIA Network+ — Page 7 | Examkin