Network Troubleshooting

486 questions

All types486 Multiple choice248 Multiple select111 Matching61 Ordering66

A network technician receives reports that client workstations on a corporate subnet are unable to resolve external internet hostnames, although internal hostname resolution functions normally. Place the diagnostic and remediation steps in the correct logical sequence from initial client-side isolation to final resolution verification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with verifying network connectivity to the internal DNS server, testing recursive lookup failure on the local resolver, testing direct outbound lookup to a public DNS server, remediating server forwarder and firewall settings, and finally flushing the local client cache to verify resolution.

Effective troubleshooting follows a logical progression from local connectivity verification to service isolation, root-cause remediation, and end-state validation. Verifying network layer reachability first ensures the client can reach its assigned resolver. Testing queries against the internal DNS server isolates recursion failures. Testing queries directly against an external public resolver determines if outbound transport on port

53

is blocked. Fixing the forwarders/firewall addresses the root cause, and flushing the client cache verifies successful end-to-end resolution.

Step-by-Step Solution

Verify basic connectivity to the local DNS server.

Confirms the network interface and routing path to the primary resolver are operational.

Lower-layer connectivity issues must be ruled out before testing application-layer DNS functionality.

Test external DNS query against the local internal DNS server using `nslookup`.

Identifies that the internal server responds to internal names but fails or times out on external domain requests.

Isolates the failure to external recursion or upstream forwarding features on the DNS server.

Test direct external query to a public DNS server (such as

8.8.8.8

) using `nslookup`.

Determines whether perimeter firewalls permit outbound UDP/TCP port

53

traffic from the network.

Distinguishes between a network/firewall transport issue and an internal DNS server forwarder misconfiguration.

Correct DNS forwarder settings on the internal DNS server and ensure firewall ACLs permit egress DNS traffic.

Restores upstream name resolution processing on the internal DNS server.

Fixes the underlying infrastructure root cause permitting recursive queries to succeed.

Execute `ipconfig /flushdns` on the client workstation and test web browsing.

Removes old negative or stale cached entries and confirms successful domain resolution.

Ensures client applications receive freshly resolved IP addresses following service restoration.

Key Concept

Systematic DNS Troubleshooting Methodology for External Resolution and Upstream Forwarder Failures

Estimated Time:1m 30s

Question 162Question →

A network technician suspects that recent Active Directory logon failures across a branch office are caused by Network Time Protocol (NTP) traffic being blocked by a newly deployed perimeter firewall. To test this theory, the technician creates a temporary logging rule on the firewall and attempts a manual time synchronization from a branch domain controller, observing that outgoing UDP port 123 packets are actively being dropped. Having confirmed that NTP packet blockage is the root cause of the synchronization failure, which of the following actions should the technician perform NEXT according to the CompTIA troubleshooting methodology?

Document the firewall drop logs and root cause analysis in the ticketing system.

Develop a plan of action to modify the firewall security policy and implement the fix.

Perform system-wide authentication testing to verify that domain controller logon delays are eliminated.

Question affected branch office users to determine if non-domain devices are experiencing time skew.

Show answer & explanation

Answer: Develop a plan of action to modify the firewall security policy and implement the fix.

Answer

Develop a plan of action to modify the firewall security policy and implement the fix.

According to the official CompTIA Troubleshooting Methodology, the steps are strictly ordered as: 1) Identify the problem, 2) Establish a theory of probable cause, 3) Test the theory to determine cause, 4) Establish a plan of action to resolve the problem and implement the solution, 5) Verify full system functionality and implement preventive measures, and 6) Document findings, actions, and outcomes. Because the technician has successfully tested and confirmed the theory (Step 3), the immediate next step is to establish a plan of action and implement the solution (Step 4).

Step-by-Step Solution

Identify current methodology stage

The technician completed testing the theory by confirming firewall drops on UDP port 123.

Testing the theory (Step 3) confirms the root cause of the problem.

Determine the next sequential step in the CompTIA 6-step model

Step 4 is 'Establish a plan of action to resolve the problem and implement the solution'.

After confirming the cause, the technician must plan the remediation steps (including change management approval if necessary) and execute the implementation.

Key Concept

CompTIA Troubleshooting Methodology Order

Estimated Time:1m 15s

Question 163Question →

A client workstation on VLAN 10 ( $10.10.10.0/24$ ) fails to receive an IPv4 address lease from a centralized DHCP server located on VLAN 20 ( $10.10.20.5$ ). Which TWO of the following configurations or conditions on the intervening Layer 3 router would directly prevent the client from obtaining a DHCP lease? (Select TWO.)

Select all that apply

The router interface attached to VLAN 10 lacks an IP helper address (DHCP relay agent) configured to forward broadcast request packets to

10.10.20.5

An inbound Access Control List (ACL) applied to the VLAN 10 router interface is blocking UDP traffic targeted at destination ports 67 and 68.

The DHCP server's scope for VLAN 10 has auto-assigned an APIPA address of

169.254.1.50

to the client due to default gateway unreachable errors.

The router's default gateway address for VLAN 20 resides on a different subnet than the DHCP server's IP address.

Show answer & explanation

Answer: The router interface attached to VLAN 10 lacks an IP helper address (DHCP relay agent) configured to forward broadcast request packets to $10.10.20.5$ .; An inbound Access Control List (ACL) applied to the VLAN 10 router interface is blocking UDP traffic targeted at destination ports 67 and 68.

Answer

The client fails to obtain an IP lease because the router interface on VLAN 10 is missing a DHCP relay (IP helper address) to forward broadcast traffic across subnets, and/or an Access Control List on the router is blocking UDP ports 67 and 68 used by DHCP.

DHCP Discover packets are sent as broadcasts (

255.255.255.255

). Routers do not forward broadcasts between subnets unless a DHCP relay agent (IP helper address) is explicitly configured on the receiving interface. Additionally, DHCP relies on UDP ports 67 and 68, so blocking these ports with an ACL on the router interface prevents relay processing.

Step-by-Step Solution

Analyze how DHCP broadcast packets behave at Layer 3 boundaries.

DHCP Discover messages are sent as Layer 2/3 broadcasts, which routers drop by default.

To cross subnets to reach a server on VLAN 20, the router interface on VLAN 10 must have a relay agent (IP helper address) enabled.

Identify required transport protocol ports for DHCP communications.

DHCP traffic uses UDP port 67 for the server and UDP port 68 for the client.

If an ACL on the router blocks these ports, DHCP messages cannot be relayed or processed.

Key Concept

DHCP Relay and Port Requirements for Cross-Subnet IP Addressing Services

Question 164Question →

A network administrator has just completed diagnostic testing and confirmed that a failing Small Form-factor Pluggable (SFP+) optical transceiver on a core switch is causing excessive CRC errors and link flapping. According to the CompTIA troubleshooting methodology, which TWO of the following actions should the administrator take next as part of the immediate following step?

Select all that apply

Develop a detailed plan of action to replace the faulty optical transceiver while identifying any potential operational impacts.

Perform continuous ping tests and bandwidth benchmarking across the link to confirm interface error counters remain at zero.

Execute the physical replacement of the compromised SFP+ module during an approved maintenance window.

Log the root cause, transceiver serial numbers, and vendor RMA details in the enterprise ticketing system for future reference.

Show answer & explanation

Answer: Develop a detailed plan of action to replace the faulty optical transceiver while identifying any potential operational impacts.; Execute the physical replacement of the compromised SFP+ module during an approved maintenance window.

Answer

The administrator should develop a detailed plan of action identifying potential effects and execute the physical replacement of the transceiver during an approved window.

Once a theory of probable cause is confirmed in Step 3 of the CompTIA troubleshooting methodology, the administrator must move to Step 4: 'Establish a plan of action to resolve the problem and identify potential effects', followed by implementing the fix. Developing a structured plan to minimize outage risks and subsequently replacing the hardware during a maintenance window represent the correct actions within this phase.

Step-by-Step Solution

Identify the current phase of the troubleshooting methodology based on the scenario state.

The scenario states that diagnostic testing is complete and the theory of probable cause has been confirmed (Step 3: Test the theory to determine cause).

Determining the completed phase establishes where the administrator is in the CompTIA 6-step sequence.

Determine the mandatory next phase in the official CompTIA sequence.

The immediate next phase is Step 4: Establish a plan of action to resolve the problem and identify potential effects, then implement the solution or escalate.

CompTIA methodology strictly requires planning and assessing impact prior to implementation, followed by implementing the fix.

Select the correct actions that belong strictly to Step 4.

Developing a plan of action while considering potential effects and replacing the module during a scheduled window belong directly to Step 4.

Actions involving verification belong to Step 5, while final logging and documentation belong to Step 6.

Key Concept

CompTIA Troubleshooting Methodology Sequence (Step 3 to Step 4 transition)

Question 165Question →

A network technician is troubleshooting a suspected physical wiring fault on an unshielded twisted-pair (UTP) Ethernet cable run. Which of the following tools should the technician use to identify pinout errors and locate physical conductor breaks? (Select TWO.)

Select all that apply

Using a wiremap tester to verify pin continuity and detect split pair conditions

Using a Time-Domain Reflectometer (TDR) to locate the precise distance to an open or short circuit

Using a tone generator and probe to measure signal attenuation and crosstalk metrics across individual wires

Using an optical power meter to test insertion loss along the copper cable run

Show answer & explanation

Answer: Using a wiremap tester to verify pin continuity and detect split pair conditions; Using a Time-Domain Reflectometer (TDR) to locate the precise distance to an open or short circuit

Answer

The correct tools are using a wiremap tester to verify pin continuity and detect split pairs, and using a Time-Domain Reflectometer (TDR) to locate the precise distance to an open or short circuit.

A wiremap tester evaluates individual conductor connections to identify open circuits, shorts, reversed pairs, and split pairs across RJ45 terminations. A Time-Domain Reflectometer (TDR) transmits electrical pulses down copper pairs and measures signal reflections to calculate the exact distance to physical damage such as a severed wire or short.

Step-by-Step Solution

Identify tools designed specifically for copper physical layer continuity and fault diagnostics.

Wiremap testers and TDRs evaluate the electrical continuity and physical integrity of copper conductor pairs.

Wiremap testers verify pin assignments and pair alignment, while TDRs send electrical pulses and analyze signal reflections to pinpoint conductor breaks.

Eliminate misapplied or incompatible network testing tools.

Tone probes are limited to physical cable tracing, and optical power meters are strictly designed for fiber optics.

Tone generators do not perform quantitative electrical signal measurement, and optical meters cannot interface with copper conductors.

Key Concept

Selecting Appropriate Tools for Copper Physical Cabling Troubleshooting

Question 166Question →

A network engineer is troubleshooting name resolution failures for a corporate portal on a Linux workstation. The engineer executes an initial query using `dig @10.50.1.10 portal.corp.local` and receives the following output snippet:

text
;; flags: qr rd ra tc; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; MSG SIZE rcvd: 52

To troubleshoot further, the engineer attempts an explicit TCP query using `dig +tcp @10.50.1.10 portal.corp.local`, which results in a connection timeout after 15 seconds. Standard UDP ICMP reachability to `10.50.1.10` is verified. Which of the following is the root cause of this name resolution failure?

An intermediate network security device is blocking TCP port 53, preventing the resolver from completing DNS fallback after receiving a truncated UDP response.

The DNS server lacks a valid A or AAAA record for portal.corp.local, causing the resolver to fail back to TCP to request missing resource records.

The local workstation resolver incorrectly interprets the truncated flag as an authoritative SERVFAIL response and misroutes the TCP query.

The DNS server protocol implementation requires TCP for initial domain queries and uses UDP only as a secondary fallback protocol.

Show answer & explanation

Answer: An intermediate network security device is blocking TCP port 53, preventing the resolver from completing DNS fallback after receiving a truncated UDP response.

Answer

An intermediate network security device is blocking TCP port 53, preventing the resolver from completing DNS fallback after receiving a truncated UDP response.

The output from `dig` explicitly shows the `tc` (truncation) header flag. According to DNS standard specifications (RFC 1035), when a server response exceeds the maximum allowed payload size for a UDP datagram, the server sets the `tc` bit. Upon detecting this bit, the client's resolver is designed to re-issue the query using TCP on port 53 to receive the full data stream. Because the explicit `dig +tcp` query timed out while UDP/ICMP reachability was confirmed, an intermediate firewall or security control is blocking TCP port 53, preventing the resolution process from completing.

Step-by-Step Solution

Analyze the initial DNS query output flags.

The `dig` output contains the `tc` (truncated) flag, indicating the server's response was larger than the maximum allowed UDP packet size and was cut off.

When a DNS response payload exceeds the UDP limit, the server sets `tc` to instruct the client to re-query using TCP.

Analyze the explicit TCP query result (`dig +tcp`).

The command timed out after 15 seconds.

A timeout specifically on TCP port 53 (while ICMP/UDP reachability exists) points to intermediate filtering (Access Control List or firewall) blocking TCP traffic on port 53.

Synthesize findings to determine root cause.

Because UDP responses are truncated and TCP port 53 is blocked, the client cannot successfully retrieve the complete DNS resource records.

DNS relies on TCP port 53 for fallback when responses exceed UDP size limits. Blocking TCP port 53 breaks large DNS responses.

Key Concept

DNS Protocol Operations & TCP Fallback Truncation Mechanics

Estimated Time:2m 0s

Question 167Question →

A network administrator is troubleshooting persistent latency spikes and excessive frame retransmissions in an executive conference facility. A site survey reveals that adjacent access points are broadcasting on overlapping 40 MHz channels within the 2.4 GHz spectrum, and legacy 802.11b basic data rates (1 Mbps and 2 Mbps) remain enabled across all radios. Which TWO actions should the administrator take to mitigate these wireless performance issues?

Select all that apply

Reconfigure all 2.4 GHz radios to use 20 MHz channel widths and assign non-overlapping channels (1, 6, or 11).

Increase the RF transmit power on all access points to maximum output to overcome signal attenuation.

Disable basic data rates below 12 Mbps on the wireless controller to eliminate legacy management frame overhead.

Expand the DHCP scope by altering the subnet mask from /24 to /22 to prevent IP address pool exhaustion.

Show answer & explanation

Answer: Reconfigure all 2.4 GHz radios to use 20 MHz channel widths and assign non-overlapping channels (1, 6, or 11).; Disable basic data rates below 12 Mbps on the wireless controller to eliminate legacy management frame overhead.

Answer

Reconfigure all 2.4 GHz radios to use 20 MHz channel widths on non-overlapping channels (1, 6, or 11), and disable basic data rates below 12 Mbps on the wireless controller.

The performance issues are caused by RF channel overlap and airtime congestion. In the 2.4 GHz spectrum, 40 MHz channel bonding consumes almost the entire band, making channel overlap inevitable. Restricting 2.4 GHz radios to 20 MHz channel widths using non-overlapping channels (1, 6, and 11) removes adjacent-channel interference. Additionally, management and control frames must be sent at the lowest enabled basic data rate; disabling legacy rates below 12 Mbps reduces the airtime required for overhead traffic, freeing up RF capacity.

Step-by-Step Solution

Analyze the site survey findings to identify physical layer and airtime efficiency bottlenecks.

Identified two primary issues: 40 MHz channel bonding in 2.4 GHz causing severe channel overlap, and 1-2 Mbps basic data rates causing airtime hogging by management frames.

The 2.4 GHz band only has 83.5 MHz of total spectrum, making 40 MHz channels guarantee overlap; legacy basic rates force control frames (beacons, ACKs) to transmit at slow speeds.

Remediate radio frequency channel overlap in the 2.4 GHz spectrum.

Reduce channel width to 20 MHz and assign channels 1, 6, and 11 across adjacent access points.

20 MHz channel widths allow exactly three non-overlapping channels (1, 6, 11) in North America/standard regulatory domains, eliminating adjacent-channel interference.

Optimize wireless airtime utilization on the controller.

Disable basic rates of 1 Mbps, 2 Mbps, 5.5 Mbps, and 11 Mbps, setting the minimum mandatory rate to 12 Mbps.

Management and multicast frames are sent at the lowest mandatory basic rate. Raising this threshold speeds up frame transmission and reduces channel utilization.

Key Concept

2.4 GHz Channel Planning and Wireless Airtime Efficiency Optimization

Estimated Time:2m 0s

Question 168Question →

A network technician is troubleshooting a newly deployed web server configured with IP address $10.50.12.35/27$ . The server can ping another host on the local subnet at $10.50.12.34$ , but it cannot reach external networks or receive HTTPS requests from internet clients.

Reviewing the device settings reveals:
- Router LAN Interface IP: $10.50.12.33/27$
- Server Default Gateway: $10.50.12.1$
- Router WAN Interface Inbound ACL:
- `permit tcp any host 10.50.12.35 eq 80`
- `deny ip any any`

Which TWO of the following troubleshooting actions are required to restore full intended connectivity for the server?

Select all that apply

Update the server's default gateway address to

10.50.12.33

Add a rule to the router WAN inbound ACL permitting TCP port 443 traffic to

10.50.12.35

Change the server subnet mask to

255.255.255.0

to include

10.50.12.1

within the local subnet.

Reassign the server interface to the native VLAN to bypass Layer 3 routing for external destinations.

Show answer & explanation

Answer: Update the server's default gateway address to $10.50.12.33$ .; Add a rule to the router WAN inbound ACL permitting TCP port 443 traffic to $10.50.12.35$ .

Answer

The server's default gateway address must be changed to

10.50.12.33

, and an inbound ACL rule permitting TCP port 443 to host

10.50.12.35

must be added to the router's WAN interface.

The host resides on the

10.50.12.32/27

subnet. The gateway IP

10.50.12.1

is outside this subnet, preventing remote network access until updated to the router interface address

10.50.12.33

. Additionally, incoming HTTPS traffic uses TCP port 443, which is blocked by the WAN ACL's implicit deny until an explicit permit rule for TCP port 443 is inserted.

Step-by-Step Solution

Analyze the subnet boundaries for the server's IP configuration.

For

10.50.12.35/27

, the network ID is

10.50.12.32

, the broadcast address is

10.50.12.63

, and usable host IP addresses range from

10.50.12.33

10.50.12.62

Determines whether the gateway address assigned to the server resides on the same local subnet.

Identify the routing error causing external host unreachability.

The configured gateway

10.50.12.1

is on a different subnet (

10.50.12.0/27

), making it unreachable as a Layer 3 next hop. Updating the default gateway to

10.50.12.33

resolves outbound routing.

A host must have a valid default gateway on its local subnet to send packets outside its local segment.

Evaluate the WAN interface inbound ACL for HTTPS traffic.

The ACL permits port 80 (HTTP) but lacks a permit rule for port 443 (HTTPS). Due to the implicit deny rule (`deny ip any any`), incoming HTTPS packets are dropped.

An explicit ACL permit rule for TCP port 443 is necessary to allow inbound HTTPS traffic.

Key Concept

Subnet Default Gateway Alignment & Access Control List Port Filtering

Question 169Question →

A network administrator suspects that a twisted-pair copper cable run inside a wall cavity has a broken conductor, causing a complete link failure. Which of the following tools should the administrator use to locate the exact distance to the break along the cable run?

Time-Domain Reflectometer (TDR)

Tone generator and probe

Optical power meter

Wiremap tester

Show answer & explanation

Answer: Time-Domain Reflectometer (TDR)

Answer

Time-Domain Reflectometer (TDR)

A Time-Domain Reflectometer (TDR) issues electrical signals along copper wire pairs and calculates the precise distance to an open or short circuit based on signal reflections.

Step-by-Step Solution

Identify the primary diagnostic requirement in the scenario.

The goal is to measure the distance along a copper cable to locate a conductor break (open circuit).

Different testing tools serve distinct functions; finding the distance to a fault requires signal reflection measurements.

Evaluate the capabilities of metallic cable testing tools.

A Time-Domain Reflectometer (TDR) sends pulses down the cable and analyzes reflected signals to measure distance to cable anomalies.

Impedance changes from breaks or shorts reflect pulses back to the device, enabling accurate distance calculation.

Key Concept

Using a Time-Domain Reflectometer (TDR) to locate distance to faults in copper cabling

Estimated Time:45s

Question 170Question →

A network technician deploys a 65-meter Category 6A UTP cable run between a core switch and a distribution switch. A basic continuity cable tester indicates proper 1-to-1 pin alignment across all eight conductors (Pin 1 to Pin 1, Pin 2 to Pin 2, etc.). However, when the link is connected to 10GBASE-T ports, the connection frequently drops, exhibits excessive frame errors, and fails to sustain 10Gbps throughput. During physical termination, individual wires from different twisted pairs were incorrectly paired together on adjacent pins (such as pairing pin 3 with pin 4 and pin 5 with pin 6) at both ends of the run. Which physical cabling fault is present in this installation, and which diagnostic tool is required to identify and measure the extent of this failure?

A split pair condition; a cable certifier capable of measuring Near-End Crosstalk (NEXT)

An open pair fault; a tone generator and inductive probe tracking signal propagation

A switch duplex mismatch; a network device CLI analyzing port interface error counters

A Layer 2 PDU encapsulation mismatch; a software packet analyzer capturing data frames

Show answer & explanation

Answer: A split pair condition; a cable certifier capable of measuring Near-End Crosstalk (NEXT)

Answer

A split pair condition is present in the installation, requiring a cable certifier capable of measuring Near-End Crosstalk (NEXT) to detect and quantify the fault.

The correct answer identifies a split pair condition and selects a cable certifier. In twisted-pair Ethernet cabling standards (such as T568A/T568B), specific pins form differential pairs (Pins 1-2, 3-6, 4-5, and 7-8). When an installer connects wires from different pairs to pins intended for a single pair at both ends, DC continuity remains 1-to-1 straight-through, so basic wiremap tools report no errors. However, because the positive and negative signals of a differential pair no longer travel along the same twisted pair of wires, mutual electromagnetic shielding is lost, producing catastrophic Near-End Crosstalk (NEXT) at high signaling rates such as 10GBASE-T. A cable certifier evaluates RF signaling performance, including NEXT, across the frequency spectrum of Category 6A.

Step-by-Step Solution

Analyze the reported symptom and continuity test results

The continuity tester shows straight-through pin-to-pin alignment (1-to-1), ruling out simple opens, shorts, or transposed pins (reversed wiremap).

Standard continuity testers only measure DC electrical continuity and wire alignment, not high-frequency signal integrity.

Evaluate the physical termination details

Wires from separate pairs were placed onto adjacent pin positions (e.g., pin 3 with pin 4, pin 5 with pin 6) at both ends of the cable run.

Twisted pair cabling (such as T568A/T568B) relies on specific pair groupings (pins 1-2, 3-6, 4-5, 7-8) to ensure electromagnetic interference and crosstalk cancel out along the run. Splitting pairs destroys this differential signaling protection.

Identify the cabling anomaly and appropriate testing tool

This fault is defined as a split pair, which causes severe Near-End Crosstalk (NEXT) and attenuation-to-crosstalk ratio (ACR) failure under high frequencies. A cable certifier is required to measure RF parameters like NEXT.

Simple continuity testers or tone probes cannot measure RF parameters or detect split pairs when DC continuity is preserved.

Key Concept

Split Pair Faults and NEXT Measurement

Estimated Time:2m 0s

Question 171Question →

A network technician notices severe network performance degradation on a workstation connected to a switch port. Checking the switch port statistics shows a high count of late collisions and alignment errors, while the workstation's network interface card is manually set to full-duplex. Which of the following is the most likely cause of this issue?

The switch interface is operating in half-duplex mode, causing a duplex mismatch.

The native VLAN configured on the switch port does not match the workstation's default VLAN.

The workstation is assigned to a different VLAN than its default gateway without inter-VLAN routing.

The switch port has Spanning Tree Protocol enabled with an incorrect root bridge priority.

Show answer & explanation

Answer: The switch interface is operating in half-duplex mode, causing a duplex mismatch.

Answer

The switch interface is operating in half-duplex mode, causing a duplex mismatch.

A duplex mismatch occurs when one end of an Ethernet link runs in full-duplex mode and the other operates in half-duplex mode. The half-duplex port senses collisions while the full-duplex port transmits arbitrarily, resulting in late collisions, FCS errors, and poor throughput.

Step-by-Step Solution

Analyze the reported port symptoms and interface error counters.

The presence of late collisions specifically indicates that one side of the link is attempting CSMA/CD collision detection (half-duplex) while the other side transmits simultaneously without checking for carrier sense (full-duplex).

Late collisions occur when a collision is detected after the first 64 bytes of a frame have been transmitted, which is characteristic of a duplex mismatch.

Evaluate the configuration state of both link endpoints.

Since the workstation is hardcoded to full-duplex, the switch port autonegotiation likely failed or was manually set to half-duplex.

Duplex autonegotiation standard specifies that if autonegotiation fails on one end, the port defaults to half-duplex mode.

Key Concept

Duplex Mismatch Identification

Question 172Question →

A network administrator is troubleshooting connectivity failures for dynamic clients in a newly provisioned branch office. Users on VLAN 102 ( $10.102.4.0/22$ ) report that their workstations periodically lose connection to local corporate resources and display IP addresses in the $169.254.x.x$ range. The centralized dual DHCP redundant servers reside on VLAN 10 ( $10.10.1.5$ and $10.10.1.6$ ).

Upon reviewing the Core L3 Switch configuration and DHCP server diagnostics, the administrator notes the following:
text Interface VLAN 102 description Workstation_Subnet ip address 10.102.4.1 255.255.252.0 ip helper-address 10.10.1.5 ! DHCP Server Scope Statistics (10.102.4.0/22): Active Leases: 1022 / 1022 (100% Utilized) Default Lease Time: 8 Days Environment Type: High-density roaming laptop conference area

Which of the following actions should the network administrator perform to resolve the IP address assignment failures and ensure high-availability DHCP relay operations? (Select TWO.)

Select all that apply

Add a second `ip helper-address 10.10.1.6` command under the Interface VLAN 102 configuration on the Core L3 Switch.

Decrease the DHCP lease duration on the server scope and implement shorter lease periods suited for transient device environments.

Configure the client default gateway statically to 169.254.0.1 to permit APIPA addresses to route across Layer 3 interfaces.

Change the subnet mask on Interface VLAN 102 from 255.255.252.0 to 255.255.255.0 to expand the total usable host capacity of the DHCP pool.

Show answer & explanation

Answer: Add a second `ip helper-address 10.10.1.6` command under the Interface VLAN 102 configuration on the Core L3 Switch.; Decrease the DHCP lease duration on the server scope and implement shorter lease periods suited for transient device environments.

Answer

The network administrator must add the second DHCP relay address (`ip helper-address 10.10.1.6`) on the VLAN subinterface for relay redundancy, and reduce the DHCP scope lease duration on the DHCP server to mitigate scope exhaustion caused by transient devices.

The scenario highlights two distinct IP addressing and DHCP troubleshooting issues: scope exhaustion and missing relay redundancy. First, reducing the lease duration allows transient client leases to expire rapidly, recycling addresses back into the pool. Second, configuring the secondary IP helper address (`ip helper-address 10.10.1.6`) on the Layer 3 interface allows the router to forward DHCP unicast requests to both redundant DHCP servers simultaneously.

Step-by-Step Solution

Analyze client IP output and DHCP scope state

Workstations receive

169.254.x.x

(APIPA) because the single configured DHCP server's scope is 100% exhausted (

1022/1022

active leases).

An 8-day lease duration in a transient conference environment retains IP assignments long after devices disconnect, leading to exhaustion.

Evaluate DHCP Relay (IP Helper) configuration for redundancy

The Layer 3 interface only contains `ip helper-address 10.10.1.5`, omitting the secondary server (

10.10.1.6

Without configuring the second helper address, relay requests are never forwarded to the backup server when the primary server scope is exhausted or unavailable.

Select appropriate remediation steps

Adding `ip helper-address 10.10.1.6` ensures dual-relay forwarding, while shortening lease times frees expired leases quickly.

Both steps together resolve immediate capacity bottlenecks and build resilient DHCP relay operations across subnets.

Key Concept

Troubleshooting DHCP Scope Exhaustion and Redundant Relay Agent Placement

Estimated Time:3m 0s

Question 173Question →

A network administrator is troubleshooting an 802.1Q trunk connection between Switch-1 and Switch-2. Switch-1 is configured with a native VLAN of 10 and allows VLANs 10, 20, and 30 across its trunk interface GigabitEthernet0/1. Switch-2 has its GigabitEthernet0/1 trunk interface configured with a native VLAN of 20 and allows only VLANs 10 and 20. Console logs indicate recurring CDP native VLAN mismatch messages, and workstations residing on VLAN 30 attached to Switch-1 are completely unable to communicate with VLAN 30 hosts attached to Switch-2.

Which TWO configuration adjustments must be performed on Switch-2 to resolve the console error logs and restore VLAN 30 trunking communication?

Select all that apply

Configure the native VLAN on Switch-2 interface GigabitEthernet0/1 to VLAN 10.

Add VLAN 30 to the allowed VLAN list on Switch-2 interface GigabitEthernet0/1.

Lower the Spanning Tree Protocol (STP) priority value on Switch-2 for VLAN 30 to force it to become the STP root bridge.

Change the operating duplex mode on Switch-2 interface GigabitEthernet0/1 from full-duplex to half-duplex.

Show answer & explanation

Answer: Configure the native VLAN on Switch-2 interface GigabitEthernet0/1 to VLAN 10.; Add VLAN 30 to the allowed VLAN list on Switch-2 interface GigabitEthernet0/1.

Answer

To resolve the issues, Switch-2 must have its trunk native VLAN updated to VLAN 10 to match Switch-1, and VLAN 30 must be explicitly added to the trunk port's allowed VLAN list.

The correct adjustments require aligning the native VLAN ID across both ends of the trunk (setting Switch-2 native VLAN to 10) to clear the CDP native VLAN mismatch log, and expanding Switch-2's allowed VLAN trunk list to include VLAN 30 so that tagged frames for VLAN 30 can be received and forwarded.

Step-by-Step Solution

Analyze the native VLAN mismatch error between Switch-1 and Switch-2.

Switch-1 uses VLAN 10 as native, while Switch-2 uses VLAN 20. 802.1Q trunks send native VLAN frames untagged, causing cross-VLAN traffic leakage and log errors.

Both ends of an 802.1Q trunk must agree on the native VLAN ID so untagged frames are properly mapped to the identical broadcast domain on both switches.

Analyze the VLAN 30 connectivity failure across the trunk.

Switch-2 allowed list only includes VLANs 10 and 20. VLAN 30 frames sent by Switch-1 are dropped at Switch-2's trunk ingress.

Trunk interfaces prune traffic for VLANs not explicitly included in their allowed VLAN list.

Determine the required remedial commands on Switch-2.

Reconfigure Switch-2 GigabitEthernet0/1 to use native VLAN 10 and add VLAN 30 to the trunk allowed VLAN list.

These two steps directly clear the console error and allow VLAN 30 tagged traffic to pass.

Key Concept

802.1Q Trunking Parameters & Native VLAN / Allowed VLAN Troubleshooting

Question 174Question →

A network administrator is troubleshooting an issue where client workstations can resolve standard hostnames, but queries returning large DNS Security Extensions (DNSSEC) records fail to resolve. To isolate the issue, the administrator runs the following command from an affected host:

$ dig +tcp @10.0.0.53 sec.enterprise.local +dnssec
;; Communications error to 10.0.0.53#53(10.0.0.53): connection timed out

Standard `dig` queries executed without the `+tcp` flag complete successfully over UDP. Which of the following is the most likely root cause of this resolution failure?

An intermediate firewall or network ACL is blocking inbound or outbound TCP port 53 traffic.

DNS inherently operates only over UDP port 53, making the explicit `+tcp` query flag an invalid protocol request.

The technician misinterpreted the output, confusing a non-authoritative cache miss response with an unreachable server timeout.

TCP-based DNS queries must be redirected to port 5353 because standard DNS servers do not listen for TCP on port 53.

Show answer & explanation

Answer: An intermediate firewall or network ACL is blocking inbound or outbound TCP port 53 traffic.

Answer

An intermediate firewall or network ACL is blocking inbound or outbound TCP port 53 traffic.

DNS relies on UDP port 53 for standard queries, but falls back to TCP port 53 whenever response data exceeds the maximum UDP packet size (common with DNSSEC records) or when requested explicitly via tools like `dig +tcp`. Because UDP queries succeed but TCP queries time out, a network firewall or access control list (ACL) is dropping TCP port 53 traffic.

Step-by-Step Solution

Analyze the baseline behavior vs the failure condition.

Standard UDP DNS queries to 10.0.0.53 succeed, but forced TCP DNS queries time out.

Isolates the problem specifically to the transport protocol (TCP vs UDP) rather than general IP unreachability or invalid DNS record data.

Evaluate protocol requirements for DNS operations.

DNS uses UDP port 53 for standard small lookups, but relies on TCP port 53 when responses exceed payload limits (like DNSSEC) or for explicit TCP queries.

Explains why basic queries work while DNSSEC queries requiring TCP fail.

Correlate CLI output timeout with network access controls.

A 'connection timed out' error on port 53 over TCP indicates packet dropping by a firewall or access control list (ACL).

Pinpoints the root cause as blocked TCP port 53 traffic on an intervening network security device.

Key Concept

DNS Transport Layer Protocols (UDP/TCP Port 53)

Question 175Question →

A network administrator is troubleshooting an issue where a database server at $192.168.50.10/24$ cannot establish a connection to a cloud backup endpoint at $172.24.100.45/24$ . The database server is configured with $192.168.50.1$ as its default gateway.

A traceroute executed from the database server produces the following output:

C:\> traceroute 172.24.100.45
Tracing route to 172.24.100.45 over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms 192.168.50.1
2 2 ms 1 ms 2 ms 10.200.1.1
3 * * * Request timed out.
4 * * * Request timed out.

The administrator connects to router $10.200.1.1$ and reviews its routing table and interface status:

Gateway of last resort is 10.200.2.2 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via 10.200.2.2
C 10.200.1.0/30 is directly connected, GigabitEthernet0/0
C 192.168.50.0/24 is directly connected, GigabitEthernet0/1
S 172.24.0.0/16 [1/0] via 10.200.3.2

GigabitEthernet0/0 is up, line protocol is up (IP 10.200.1.1/30)
GigabitEthernet0/1 is up, line protocol is up (IP 192.168.50.1/24)
GigabitEthernet0/2 is down, line protocol is down (IP 10.200.3.1/30)

Which of the following is the root cause of the connectivity failure?

The router selects the static route

172.24.0.0/16

based on longest prefix match, but its associated outbound interface is down.

The default gateway on the database server resides on a different IP subnet than the host address.

The subnet mask

/16

exceeds the usable host range allowed for classful routing protocols.

An implicit deny Access Control List (ACL) rule on interface GigabitEthernet0/0 drops all default gateway traffic.

Show answer & explanation

Answer: The router selects the static route $172.24.0.0/16$ based on longest prefix match, but its associated outbound interface is down.

Answer

The router selects the static route

172.24.0.0/16

based on longest prefix match, but its associated outbound interface is down.

Routers forward packets based on the Longest Prefix Match rule. Because

172.24.0.0/16

is more specific than the default route

0.0.0.0/0

, traffic destined for

172.24.100.45

matches the static route via

10.200.3.2

. However, interface GigabitEthernet0/2 is down, causing router

10.200.1.1

to drop the traffic rather than forwarding it.

Step-by-Step Solution

Analyze traceroute diagnostic output

The packet successfully reaches hop 1 (

192.168.50.1

) and hop 2 (

10.200.1.1

), but times out at hop 3, indicating the breakdown occurs at router

10.200.1.1

Identify the specific hop where packet forwarding fails.

Evaluate the routing decision logic on router

10.200.1.1

The target address is

172.24.100.45

. The router evaluates candidate routes: default route

0.0.0.0/0

vs static route

172.24.0.0/16

Routers apply Longest Prefix Match (LPM) rules, preferring

/16

over

/0

regardless of default gateway settings.

Correlate the selected route with interface operational state

The route to

172.24.0.0/16

forwards packets via next-hop

10.200.3.2

out interface GigabitEthernet0/2, which has a status of line protocol down.

Traffic matching a static route pointing to an inactive or down interface will be dropped, preventing failover to less specific routes if not dynamically withdrawn.

Key Concept

Longest Prefix Match Routing and Next-Hop/Interface Unreachability

Estimated Time:2m 0s

Question 176Question →

A network engineer is troubleshooting an enterprise 10GBASE-SR multimode fiber backbone run measuring 350 meters that connects two core switches across a campus facility. The optical link fails to bring up the interface. An initial power check indicates high optical attenuation along the path, but both transceivers and patch cables test normally. Which diagnostic tool should the engineer use to locate the precise distance to the physical break or microbend within the fiber optic cable run?

Optical Time-Domain Reflectometer (OTDR)

Optical Power Meter (OPM) and Light Source

Visual Fault Locator (VFL)

Copper Time-Domain Reflectometer (TDR)

Show answer & explanation

Answer: Optical Time-Domain Reflectometer (OTDR)

Answer

An Optical Time-Domain Reflectometer (OTDR) should be used to locate the precise distance to a physical break or bend in a fiber optic cable run.

An Optical Time-Domain Reflectometer (OTDR) injects light pulses into the optical fiber and analyzes backscattered and reflected light signals. By measuring the elapsed time of returned reflections, it accurately plots attenuation along the cable and pinpoints the exact distance to physical discontinuities such as macrobends, dirty splices, or cable breaks.

Step-by-Step Solution

Analyze the physical layer requirements and media type.

The scenario specifies a 350-meter 10GBASE-SR multimode optical fiber link.

Choosing the correct diagnostic tool requires selecting media-compatible equipment (optical fiber vs. twisted-pair copper).

Differentiate between end-to-end loss testing and fault location pinpointing.

End-to-end attenuation is known, but the specific location of the structural fault inside the conduit needs to be mapped.

An Optical Power Meter confirms total signal loss across the link but cannot measure distance to a fault.

Select the tool designed for reflective distance-to-fault analysis over optical fiber.

An OTDR emits optical pulses and analyzes Rayleigh backscattering and Fresnel reflections to output a trace graph showing exact distance markers for events like breaks, bends, and splices.

An OTDR is the definitive tool for locating physical faults along medium-to-long fiber runs.

Key Concept

Fiber Optic Diagnostic Tools and OTDR Operation

Estimated Time:1m 30s

Question 177Question →

A network administrator runs the `ipconfig` command on a user's workstation that is experiencing network connectivity issues. The command output displays an IPv4 address of $169.254.108.42$ with a subnet mask of $255.255.0.0$ . Which of the following best explains the root cause of this configuration?

The workstation failed to contact a DHCP server and automatically assigned itself an Automatic Private IP Addressing (APIPA) address.

The default gateway IP address was misconfigured on the workstation's network adapter.

The DHCP server's scope is configured with an incorrect CIDR subnet mask.

The workstation's network interface card is disabled in the operating system.

Show answer & explanation

Answer: The workstation failed to contact a DHCP server and automatically assigned itself an Automatic Private IP Addressing (APIPA) address.

Answer

The workstation failed to contact a DHCP server and automatically assigned itself an Automatic Private IP Addressing (APIPA) address.

When a network interface configured for dynamic addressing cannot reach a DHCP server, Windows client operating systems automatically assign a link-local IP address in the range of

169.254.0.1

169.254.255.254

using APIPA.

Step-by-Step Solution

Analyze the IP address output from ipconfig

The IPv4 address is 169.254.108.42.

Addresses within the range 169.254.0.0/16 are reserved for Automatic Private IP Addressing (APIPA).

Identify the conditions under which APIPA is used

APIPA is invoked when a DHCP client requests an IP address lease but receives no response from any DHCP server on the local network or via DHCP relay.

This mechanism allows link-local communication when centralized network IP assignment fails.

Key Concept

APIPA Address Symptom Diagnosis

Estimated Time:45s

Question 178Question →

During a network maintenance window, a network administrator configures an extended Access Control List (ACL) on a Layer 3 core switch to restrict access from the Engineering VLAN subnet ( $10.120.4.0/22$ ) to the Data Center subnet ( $10.120.32.0/24$ ). Shortly after implementation, users report that while HTTP web access to an internal application server at $10.120.32.50$ is functional, secure HTTPS sessions to the same server fail to establish.

The administrator inspects the switch configuration using `show ip access-lists ENG_TO_DC` and retrieves the following output:

text
Extended IP access list ENG_TO_DC
10 permit tcp 10.120.4.0 0.0.3.255 host 10.120.32.50 eq 80
20 deny ip 10.120.4.0 0.0.3.255 10.120.32.0 0.0.0.255
30 permit tcp 10.120.4.0 0.0.3.255 host 10.120.32.50 eq 443

Which of the following identifies the root cause of the HTTPS connectivity failure?

Rule 20 explicitly denies all IP traffic directed to the Data Center subnet before Rule 30 evaluating HTTPS traffic can be processed.

The wildcard mask 0.0.3.255 incorrectly matches host addresses outside the 10.120.4.0/22 Engineering subnet.

HTTPS protocol communications utilize UDP port 443, causing Rule 30 to mismatch incoming transport layer packets.

The default gateway drops HTTPS packets because return traffic triggers the implicit deny rule at the end of the ACL.

Show answer & explanation

Answer: Rule 20 explicitly denies all IP traffic directed to the Data Center subnet before Rule 30 evaluating HTTPS traffic can be processed.

Answer

Rule 20 explicitly denies all IP traffic directed to the Data Center subnet before Rule 30 evaluating HTTPS traffic can be processed.

Access Control Lists process rules sequentially in numerical order. Rule 20 contains a broad block filtering all IP traffic destined for the 10.120.32.0/24 subnet. When an HTTPS packet arrives, it fails to match Rule 10 (which requires port 80), matches Rule 20, and is immediately dropped. Rule 30 is shadowed and never evaluated.

Step-by-Step Solution

Analyze the sequential processing mechanism of Access Control Lists (ACLs).

ACLs process packets top-down, stopping at the first rule that matches packet headers.

Top-down evaluation means higher-numbered sequence rules are never evaluated if a prior rule matches.

Evaluate incoming HTTPS packets against the rules in sequence.

An HTTPS packet targeting port 443 does not match Rule 10 (port 80), but matches the broad criteria of Rule 20 (deny ip 10.120.4.0 0.0.3.255 10.120.32.0 0.0.0.255).

Since 'ip' encompasses all Layer 3 payloads (including TCP), Rule 20 matches all remaining traffic to the destination subnet.

Determine the impact on Rule 30.

Rule 30 is shadowed and will receive zero packet matches.

Placing a broad deny rule above a specific permit rule creates a logical shadowing defect.

Key Concept

ACL Rule Ordering and Rule Shadowing

Estimated Time:1m 30s

Question 179Question →

A systems engineer is troubleshooting a name resolution failure for an internal application alias, `app.corp.net`. When querying the primary DNS server directly using `nslookup`, the following output is returned:

text
$ nslookup app.corp.net 10.150.1.10
Server: dns01.corp.net
Address: 10.150.1.10

** server can't find app.corp.net: NXDOMAIN

Upon reviewing the primary zone configuration, the administrator confirms that `app.corp.net` exists as a valid CNAME record mapping to `web-prod-01.internal.net`. However, `web-prod-01.internal.net` is hosted in a separate private zone that is not configured on or reachable by `dns01.corp.net`.

Which of the following best explains why the DNS server returns an NXDOMAIN error for the CNAME query?

The DNS server is unable to resolve the canonical host specified in the CNAME record to a valid address record within its available zones.

The CNAME record was improperly defined using an IP address rather than a fully qualified domain name.

The nslookup utility bypassed local DNS server processing and displayed a stale negative entry from the workstation's local resolver cache.

The CNAME alias response exceeded the 512-byte limit for UDP traffic, causing the query to fail due to TCP port 53 blocking.

Show answer & explanation

Answer: The DNS server is unable to resolve the canonical host specified in the CNAME record to a valid address record within its available zones.

Answer

The DNS server is unable to resolve the canonical host specified in the CNAME record to a valid address record within its available zones.

When a DNS client queries a record that is configured as a CNAME (Canonical Name), the DNS server must follow the alias to the target FQDN and resolve its corresponding address (A/AAAA) record. If the target FQDN belongs to a zone that is missing, unreachable, or un-delegated, the server cannot fulfill the query chain and returns an NXDOMAIN error.

Step-by-Step Solution

Analyze the command output and error code.

The command targets DNS server `10.150.1.10` directly and returns `NXDOMAIN` for `app.corp.net`.

`NXDOMAIN` (Non-Existent Domain) indicates that the server queried believes the domain name does not exist in DNS.

Evaluate the DNS record configuration described in the scenario.

`app.corp.net` is a CNAME record pointing to `web-prod-01.internal.net`.

Resolving a CNAME record requires a two-step resolution process: looking up the alias, and then resolving the canonical target hostname to an IP address (A or AAAA record).

Correlate the missing target zone with the resolution failure.

Because `web-prod-01.internal.net` resides in an unlinked private zone, the DNS server fails to complete the canonical name lookup.

If the canonical target name cannot be resolved to an IP address by the server, the final response returned to the client for the CNAME lookup is `NXDOMAIN`.

Key Concept

DNS CNAME Resolution Chaining and NXDOMAIN Failure Modes

Estimated Time:2m 0s

Question 180Question →

A network technician is investigating a client workstation that fails to resolve the internal hostname `app.finance.local`. Place the following diagnostic steps in the correct order, starting from initial client configuration verification through transport layer troubleshooting.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper troubleshooting sequence moves from local client IP configuration verification, to clearing local host resolution mechanisms (HOSTS file and DNS resolver cache), to testing direct DNS server resolution via `nslookup`, and finally checking transport connectivity on port 53.

A methodical name resolution troubleshooting workflow starts by validating client IP/DNS configuration, clearing local client-side caches and static lookup overrides, querying the designated DNS server directly to test record availability, and lastly verifying port 53 reachability if timeouts occur.

Step-by-Step Solution

Verify client TCP/IP configuration

Confirms the workstation possesses a valid IP, subnet mask, default gateway, and correct DNS server IP.

Troubleshooting should start at Layer 3 client settings to ensure the endpoint knows which DNS server to query.

Check and clear local name resolution state

Eliminates bad static overrides in the local `HOSTS` file and flushes stale cache records.

Operating systems query local file maps and DNS resolver caches prior to sending network DNS requests.

Perform direct DNS resolution query

Determines whether the DNS server returns an IP address, an NXDOMAIN error, or a server failure response.

Direct diagnostic tools like `nslookup` bypass local caching to evaluate DNS server operational status and zone records.

Verify transport layer filtering and reachability

Identifies if firewall ACLs or intermediate network devices are dropping UDP or TCP port 53 traffic.

If DNS queries time out completely, network access controls or port-level filtering must be diagnosed.

Key Concept

Systematic DNS and Host Name Resolution Troubleshooting Sequence

PreviousPage 9 / 25Next

Network Troubleshooting

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept