Tüm alıştırma soruları

A security analyst is auditing an edge router configured with stateless Access Control Lists (ACLs) to filter traffic between an internal management subnet ($10.200.5.0/24$) and a cloud monitoring cluster ($172.31.40.0/24$). The analyst notes that SNMP monitoring requests sent over UDP port 161 from the cloud cluster to internal endpoints pass successfully, but the response packets generated by the internal endpoints fail to reach the monitoring cluster.

Which TWO of the following statements correctly explain why this issue occurs and identify an appropriate resolution?

During a security audit, a network analyst discovers that a host connected to an access port on VLAN 10 successfully transmitted unauthorized frames directly to a critical server on VLAN 30 without passing through an inter-VLAN routing firewall. The two hosts reside on separate switches connected by an 802.1Q trunk link, where VLAN 10 is designated as the native VLAN. Which of the following statements correctly identify the mechanism behind this security breach and the appropriate remediation step? (Select TWO.)

Match each wireless security standard on the left with its corresponding primary cryptographic cipher and authentication mechanism on the right.

A network administrator needs to display a list of all active network connections and listening ports on a local Windows host to inspect running network services. Which command-line utility should the administrator execute?

A network engineer is troubleshooting a name resolution issue on a corporate client workstation. When the engineer runs `nslookup internal.example.com 10.20.4.15`, the hostname successfully resolves to `10.20.4.100`. However, standard web browsers and ping utilities on the workstation report an error stating that the host cannot be found. Which of the following potential root causes best explain why direct `nslookup` queries succeed while system applications fail to resolve the hostname? (Select TWO.)

A network administrator suspects that an unauthorized device acting as a rogue DHCP server is responding to client requests on a local subnet and handing out invalid default gateway addresses. The administrator connects a laptop running a packet analyzer to a mirrored port on the switch. Which display filter should the administrator apply in the packet analyzer to isolate traffic originating specifically from DHCP servers?

Match each AAA protocol or network authentication framework to its corresponding operational characteristic.

A network technician is systematically troubleshooting a connectivity failure from a client workstation to a remote application server. Place the following command-line utilities in the logical order they should be executed to isolate the issue from local interface settings out to remote route reachability.

A network engineer is diagnosing intermittent performance issues and log warnings on an inter-switch trunk link connecting Switch-Alpha (GigabitEthernet0/1) to Switch-Beta (GigabitEthernet0/1). The console on Switch-Alpha displays `%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet0/1 (10), with Switch-Beta GigabitEthernet0/1 (20)`. Concurrently, interface statistics for GigabitEthernet0/1 on Switch-Alpha show a steadily increasing count of late collisions and Frame Check Sequence (FCS) errors. Which TWO of the following root causes are directly responsible for the observed log messages and interface error counters?

A network administrator is troubleshooting an issue where a user's workstation periodically attempts to connect to an old IP address (10.1.5.50) when reaching `db.internal.corp`, despite the DNS server returning the updated IP address (10.1.5.200) for other hosts. The administrator inspects the client using a local command-line diagnostic tool and views the following output snippet:

text
Record Name . . . . . : db.internal.corp
Record Type . . . . . : 1
Time To Live . . . . : 86400
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 10.1.5.50

Which of the following actions should the administrator take on the client workstation to resolve this issue and ensure it uses the correct IP address? (Select TWO.)

Match each network diagnostic requirement or operational anomaly to the most appropriate diagnostic hardware tool or packet analyzer syntax.

A Linux server configured with the IPv4 address $192.168.120.45/24$ is unable to establish connections with servers on external subnets. Local subnet communication functions normally. The network administrator runs `ip route show` on the server and reviews the following routing table output:

text
default via 192.168.121.1 dev eth0
192.168.120.0/24 dev eth0 proto kernel scope link src 192.168.120.45

Which of the following identifies the root cause of the connectivity failure?

A network administrator needs to enable centralized remote monitoring on core network switches. The corporate security baseline mandates that management traffic must enforce both cryptographic user authentication and encryption (privacy) of transmitted payload data across the management network. Which SNMP configuration should the administrator implement to satisfy these security requirements?

A network administrator needs to establish a remote management connection to a core router located at an unstaffed branch office. The solution must grant low-level command-line interface (CLI) access for emergency troubleshooting even if the router's primary operating system network interfaces or main WAN links experience a complete failure. Which of the following solutions best satisfies these requirements?

During an incident response investigation, a network security analyst discovers that internal users attempting to connect to a partner organization's remote server were redirected to an untrusted external host. Analysis reveals that client workstations issued standard domain name lookup requests, but the enterprise's recursive resolver returned forged IP address records that had been injected into its local cache. Which of the following attack types best describes this security incident?

Users on a remote office subnet ($10.240.12.0/24$) report that they cannot access a cloud database hosted at $172.16.50.100$. Follow the standard CompTIA network troubleshooting methodology to arrange the administrative actions into the correct logical sequence from first step to last step.

An enterprise network architect is assigned the IPv4 block $10.180.64.0/19$. Using Variable Length Subnet Masking (VLSM), the architect sequentially allocates subnets starting from the lowest available IP address to satisfy the following host requirements:

- Subnet A (Data Center): $1,200$ usable hosts
- Subnet B (Corporate HQ): $500$ usable hosts
- Subnet C (Voice Gateway): $250$ usable hosts
- Subnet D (Branch Office): $120$ usable hosts

Each subnet is provisioned using the smallest viable CIDR block. After allocating these four subnets back-to-back without leaving gaps between them, what is the maximum number of usable host IP addresses that can be supported by the single largest contiguous subnet that can be formed within the remaining unallocated space of the $10.180.64.0/19$ prefix?

During a security incident response on subnet $192.168.50.0/24$, a network engineer observes that multiple workstations have lost connectivity to internal corporate servers and are transmitting sensitive traffic to an unapproved external address. Packet captures reveal a rapid influx of DHCP DISCOVER and REQUEST messages originating from thousands of randomly generated MAC addresses, which completely exhausts the legitimate DHCP server's IP address pool. Immediately after the pool is depleted, clients receive IP leases containing an unauthorized default gateway IP address broadcast by an unidentified device on the local Layer 2 broadcast domain. Which of the following attack types represents the primary vector used to hijack client traffic?

An enterprise server receives an Ethernet frame containing an HTTP request destined for its running web service. Which of the following operations occur during the de-encapsulation process as the incoming data moves up the protocol stack at the receiving host? (Select TWO.)

A network administrator is configuring an edge router connected to two upstream service providers. The router learns a default route ($0.00.0/0$) via eBGP from ISP A with an Administrative Distance of 20 and a metric of 10. Simultaneously, the administrator configures a manual static default route pointing toward ISP B using the default Administrative Distance of 1. If both links are active and healthy, which path will the router install into its Routing Information Base (RIB) for default traffic?