Examkin

Tüm alıştırma soruları

2237 soru

Tüm türler2,237Çoktan seçmeli1,150Çoklu seçim488Sayısal30Eşleştirme350Sıralama201Kısa cevap18
Soru 2101Soru →

A network technician connects a new workstation to Port 4 on a Layer 2 switch. Port 4 is configured as an access port in VLAN 30. The workstation immediately sends a broadcast ARP request to discover its default gateway. The switch currently has active access ports in VLAN 10 and VLAN 30, as well as an 802.1Q trunk port carrying both VLANs (with VLAN 1 as the native VLAN). Which of the following actions will the switch take upon receiving this frame?

Cevabı ve açıklamayı göster

Cevap: Forward the frame to all active access ports in VLAN 30 and encapsulate it with an 802.1Q tag for VLAN 30 across the trunk port.

Cevap

The switch forwards the broadcast frame out all active access ports assigned to VLAN 30 and tags the frame with an 802.1Q header for VLAN 30 before transmitting it across the trunk port.
VLANs partition a physical switch into distinct Layer 2 broadcast domains. When an untagged broadcast frame enters an access port assigned to VLAN 30, the switch floods the frame to all local active interfaces belonging to VLAN 30. Furthermore, when forwarding the frame across an 802.1Q trunk link where VLAN 30 is non-native, the switch inserts an 802.1Q tag header containing the VLAN 30 ID so the adjacent switch maintains proper VLAN isolation.

Adım Adım Çözüm

1
Identify the ingress port's VLAN assignment and frame type.
The frame enters Port 4 (assigned to VLAN 30) as an untagged Layer 2 broadcast frame destined for ffff.ffff.ffff.
Traffic entering an access port is implicitly associated with that port's configured access VLAN.
2
Determine the Layer 2 forwarding domain boundaries.
The broadcast domain is restricted exclusively to interfaces belonging to VLAN 30.
VLANs logically segment a physical switch into isolated Layer 2 broadcast domains.
3
Apply 802.1Q trunking rules for outgoing interfaces.
The frame is flooded to all active local access ports in VLAN 30 and sent out the trunk port with an added 4-byte 802.1Q header specifying VLAN 30.
802.1Q trunk links carry traffic for multiple VLANs by appending VLAN identification tags to non-native VLAN frames.

Anahtar Kavram

VLAN Broadcast Isolation and 802.1Q Trunk Tagging
Soru 2102Soru →

A network engineer is documenting network protocol stack operations for a technical audit. Match each OSI model layer listed on the left to its corresponding primary functional responsibility on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Session Layer (Layer 5)
Presentation Layer (Layer 6)
Transport Layer (Layer 4)
Data Link Layer (Layer 2)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Session Layer (Layer 5) matches establishing and synchronizing application dialog control checkpoints; Presentation Layer (Layer 6) matches data formatting, character encoding, and encryption; Transport Layer (Layer 4) matches end-to-end segmentation, flow control, and port addressing; Data Link Layer (Layer 2) matches node-to-node framing and physical MAC addressing.
Each OSI model layer serves a distinct role in data processing: Layer 5 manages session connections and checkpoints; Layer 6 standardizes syntax, encoding, and encryption; Layer 4 facilitates transport segmentation and port communication; and Layer 2 constructs data frames for physical hop-to-hop media traversal.

Adım Adım Çözüm

1
Identify the primary responsibility of the Session Layer (Layer 5).
Layer 5 establishes, maintains, and terminates communication sessions, managing synchronization checkpoints between end-user applications.
Dialog management and session recovery are core functions defined at Layer 5.
2
Identify the primary responsibility of the Presentation Layer (Layer 6).
Layer 6 acts as a data translator, handling syntax formatting, MIME/character conversion, and cryptographic operations such as encryption and compression.
It ensures that data sent from the application layer of one system can be read by the application layer of another system.
3
Identify the primary responsibility of the Transport Layer (Layer 4).
Layer 4 handles service-to-service host communications, segmenting data streams, providing port addressing, and controlling data flow (via TCP/UDP).
Transport protocols govern reliable or unreliable host-to-host data delivery mechanism.
4
Identify the primary responsibility of the Data Link Layer (Layer 2).
Layer 2 organizes raw bits into structured frames and applies physical hardware MAC addressing for single-hop delivery across local networks.
Physical medium transmission management and frame error checking (FCS) operate at Layer 2.

Anahtar Kavram

OSI Model Seven Layer Functional Breakdown
Tahmini Süre:1m 30s
Soru 2103Soru →

A network administrator is designing a WAN architecture to connect 12 remote branch offices directly back to a central headquarters location. The business requirements mandate centralized security inspection at headquarters, minimal WAN link provisioning costs, and simple routing administration. Direct inter-branch communication is not required. Which topology best satisfies these requirements?

Cevabı ve açıklamayı göster

Cevap: Hub-and-spoke topology

Cevap

Hub-and-spoke topology is the optimal topology because it connects each remote site back to a central site, minimizing line costs and centralizing policy control.
The hub-and-spoke topology connects every remote site directly to a central hub (headquarters). Because branch offices only need to communicate with headquarters and not directly with each other, this minimizes WAN link costs (requiring only one link per site) and centralizes administration and security inspection.

Adım Adım Çözüm

1
Analyze requirement 1: Centralized traffic control and routing at headquarters.
Requires a centralized point through which all branch traffic flows.
Security monitoring and inspection policies must be enforced at a single hub.
2
Analyze requirement 2: Minimal connection costs without direct inter-branch traffic needs.
Eliminates the need for n(n−1)/2n(n-1)/2 full mesh or partial mesh links between branch offices.
Only nn point-to-point links (where nn is the number of branch offices) are needed to connect each branch to the central hub.
3
Match topology characteristics to requirements.
Hub-and-spoke provides centralized routing with minimum required WAN connections.
It fulfills all scenario constraints (cost, central management, scale) efficiently.

Anahtar Kavram

Hub-and-Spoke WAN Topology
Soru 2104Soru →

A network security administrator is configuring centralized event collection and device monitoring across enterprise infrastructure. Match each network logging, monitoring, or auditing mechanism on the left with its defining operational characteristic or security control capability on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Syslog Severity Level 2
SNMPv3 authNoPriv Mode
NetFlow / IPFIX Telemetry
SIEM Correlation Engine

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Syslog Severity Level 2 matches Critical condition alerts; SNMPv3 authNoPriv Mode matches authenticated but unencrypted SNMP traffic; NetFlow / IPFIX Telemetry matches flow metadata export without full payload capture; SIEM Correlation Engine matches centralized time-correlated event log analysis across multiple network systems.
Each concept is matched to its exact operational role in enterprise network operations: Syslog Level 2 identifies critical emergency alerts; SNMPv3 authNoPriv secures log/management requests via authentication hashes without packet encryption; NetFlow/IPFIX provides high-level session flow statistics for audit analysis; and a SIEM engine correlates centralized log streams across disparate infrastructure devices.

Adım Adım Çözüm

1
Analyze standard Syslog severity numerical levels.
Identify that Syslog severity levels range from 0 (Emergency) to 7 (Debug). Severity Level 2 represents Critical conditions requiring immediate attention (e.g., loss of primary network link).
Correctly categorizing Syslog severity levels ensures proper event notification filtering in enterprise log management.
2
Evaluate SNMPv3 security levels (noAuthNoPriv, authNoPriv, authPriv).
Determine that authNoPriv incorporates authentication algorithms (HMAC-SHA or MD5) for integrity and user authentication, but omits payload encryption (DES/AES).
Understanding SNMPv3 security modes prevents misconfigurations where confidential management data is transmitted unencrypted despite enabling authentication.
3
Differentiate traffic flow telemetry from full packet capture.
Recognize that NetFlow/IPFIX records flow metadata (5-tuple: source IP, destination IP, source port, destination port, protocol, plus packet/byte counters) for bandwidth auditing and anomaly detection.
NetFlow provides scalable network visibility without requiring heavy storage infrastructure needed for packet capture files.
4
Define the primary function of a SIEM correlation engine in network auditing.
Connect SIEM functionality with cross-device event aggregation, parsing, and rule-based correlation of time-stamped logs from switches, firewalls, and servers.
SIEM systems correlate isolated log entries to identify multi-stage attacks or broader operational issues across the enterprise network.

Anahtar Kavram

Network Logging, Telemetry, and Auditing Architecture
Soru 2105Soru →

An organization's security policy mandates centralized access control for managing network hardware via CLI. The policy specifically requires that individual commands executed during an administrative session must be authorized separately on a per-user basis, and that all payload data exchanged between the network switches and the AAA server must be fully encrypted. Which security protocol should the administrator implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: TACACS+

Cevap

TACACS+ is the correct choice because it separates AAA functions to support command-level authorization and encrypts the entire packet payload.
TACACS+ separates the AAA architecture into distinct functions, allowing administrators to enforce granular per-command authorization for CLI management. Additionally, TACACS+ encrypts the entire packet body (payload) rather than just the password field, ensuring complete confidentiality over TCP port 49.

Adım Adım Çözüm

1
Analyze authorization requirements
The requirement specifies per-command authorization during administrative CLI sessions.
Protocols that combine authentication and authorization cannot evaluate individual commands independently after session establishment.
2
Analyze encryption requirements
The policy requires the entire network communication payload between switch and AAA server to be encrypted.
Protocols that obscure only passwords leave headers and command details unencrypted in transit.
3
Compare TACACS+ and RADIUS feature profiles
TACACS+ uses TCP port 49, decouples AAA functions (allowing granular command authorization), and encrypts the entire packet body. RADIUS uses UDP ports 1812/1813, combines authentication/authorization, and encrypts only the password field.
Only TACACS+ satisfies both full payload encryption and command-level authorization.

Anahtar Kavram

AAA Protocol Differences (TACACS+ vs RADIUS)
Soru 2106Soru →

An enterprise network security engineer is evaluating the deployment of a passive Network Intrusion Detection System (NIDS) connected via a switch SPAN port versus an inline Network Intrusion Prevention System (NIPS) placed at the perimeter firewall interface. Which of the following statements accurately describe the operational trade-offs and functional behaviors of these two implementations? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The inline NIPS can actively drop malicious traffic in real time before it reaches internal hosts, but it introduces network latency and a potential single point of failure.; The passive NIDS analyzes out-of-band traffic copies, ensuring zero impact on live network throughput and latency while providing threat visibility.

Cevap

The inline NIPS actively drops malicious traffic in real time at the cost of adding latency and introducing a potential single point of failure, whereas the passive NIDS inspects out-of-band traffic copies without affecting network latency or throughput.
Inline NIPS operates in-band, inspecting live traffic to drop malicious packets before they hit internal systems, though this adds processing latency and introduces a potential single point of failure. Conversely, passive NIDS receives duplicated frames from a SPAN port out-of-band, preserving maximum network performance and throughput without introducing latency.

Adım Adım Çözüm

1
Analyze the operational placement of inline NIPS versus passive NIDS.
Inline NIPS is deployed in-band directly in the data path, allowing active packet dropping, whereas passive NIDS uses out-of-band port mirroring (SPAN/TAP).
In-band placement enables active prevention, but introduces processing latency and hardware single point of failure risk.
2
Evaluate the performance impact of out-of-band SPAN port monitoring.
Out-of-band monitoring operates on duplicate packets, preventing interference with original frames and eliminating latency impact.
Because SPAN delivers copies of packets asynchronously, a NIDS cannot prevent the first malicious packet from reaching its target.

Anahtar Kavram

Operational trade-offs between in-band NIPS (active prevention, latency, failure point) and out-of-band NIDS (passive monitoring, zero latency impact, detection only).
Soru 2107Soru →

A network administrator needs to update the firmware on 50 wireless access points deployed across a large corporate campus. To mitigate the risk of widespread network downtime in the event that the new firmware introduces instability, which of the following patch deployment strategies should the administrator implement?

Cevabı ve açıklamayı göster

Cevap: Perform a pilot update on a small group of non-critical access points and evaluate stability before upgrading the remaining devices.

Cevap

Perform a pilot update on a small group of non-critical access points and evaluate stability before upgrading the remaining devices.
Executing a pilot deployment on a small subset of non-critical access points ensures that any unforeseen firmware bugs or incompatibilities are discovered with minimal operational impact. Once the pilot group demonstrates stable performance over an observation period, the patch can safely be rolled out to the rest of the network.

Adım Adım Çözüm

1
Analyze the operational risk of upgrading 50 production access points simultaneously.
Identified that a faulty update pushed globally could result in total wireless network failure across the campus.
Patch management best practices require risk mitigation controls prior to full-scale deployment.
2
Select a deployment method that permits live validation with limited failure impact.
Staged deployment (canary or pilot testing) limits potential downtime to a controlled subset of devices.
Pilot deployments verify real-world performance under monitoring before affecting mission-critical areas.

Anahtar Kavram

Staged Patch Deployment and Pilot Testing
Soru 2108Soru →

A security team is evaluating the operational differences between placing a Network Intrusion Detection System (NIDS) passively via a switch SPAN port versus deploying a Network Intrusion Prevention System (NIPS) inline. Which of the following statements accurately describe these deployment models? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Inline NIPS placement allows the security appliance to actively stop threat vectors by dropping malicious packets in real time.; Passive NIDS monitoring via a SPAN port inspects mirrored network traffic without adding inline latency to production network traffic.

Cevap

The statement explaining that inline NIPS placement actively drops malicious packets in real time, along with the statement indicating that passive NIDS monitoring via a SPAN port inspects copied traffic without adding latency, are both correct.
Inline NIPS devices sit directly within the communication stream, enabling active packet drops upon detecting malicious traffic. Conversely, passive NIDS deployment receives mirrored traffic via switch SPAN ports, providing threat detection visibility without introducing inline processing latency.

Adım Adım Çözüm

1
Analyze NIPS inline placement features.
Inline placement puts the prevention device directly in the physical or logical flow of network traffic, enabling active mitigation such as packet dropping.
Traffic must pass through an inline device, allowing immediate inline action upon threat detection.
2
Analyze NIDS passive (out-of-band) placement features.
Out-of-band passive monitoring inspects mirrored traffic streams provided by SPAN ports or network TAPs without impacting packet forwarding latency.
Since traffic is mirrored, the NIDS operates in parallel to active network transmission.

Anahtar Kavram

In-band inline prevention versus out-of-band passive detection deployment models.
Soru 2109Soru →

A network administrator must update network device telemetry and event logging configurations across core switches to satisfy a new security audit mandate. The compliance policy requires log transport reliability during network congestion, cryptographic encryption for audit log traffic, and payload-level encryption for SNMP polling queries. Which TWO of the following implementation steps should the administrator execute to satisfy these audit requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Syslog forwarding using TCP port 6514 with Transport Layer Security (TLS) encryption.; Configure SNMPv3 using the authPriv security level for management polling.

Cevap

The administrator must implement Syslog forwarding using TCP port 6514 with TLS encryption and configure SNMPv3 using the authPriv security level.
Configuring Syslog using TCP port 6514 with Transport Layer Security (TLS) satisfies the requirements for connection reliability and log traffic confidentiality. Simultaneously, deploying SNMPv3 using the authPriv security level provides both HMAC-based authentication and CBC-DES/AES payload privacy (encryption), fulfilling the requirement for encrypted polling queries.

Adım Adım Çözüm

1
Analyze transport reliability and log encryption requirements
Standard Syslog utilizes UDP port 514, which lacks transport reliability and encryption. Secure Syslog uses TCP port 6514 with TLS to ensure reliable log packet delivery and payload encryption.
TCP guarantees sequence delivery and retransmission during congestion, while TLS secures the log stream.
2
Analyze SNMP security level requirements
SNMPv3 supports three security levels: noAuthNoPriv (no auth, no encryption), authNoPriv (authentication, no encryption), and authPriv (authentication and privacy/encryption).
Only authPriv satisfies the mandate for payload-level encryption during management polling.

Anahtar Kavram

Secure Logging (Syslog over TLS/TCP) and SNMPv3 Security Models
Soru 2110Soru →

A network technician is deploying a pair of redundant routers to provide seamless default gateway redundancy for a local user subnet. Which TWO of the following steps are required to ensure hosts maintain uninterrupted default gateway access during a router failure?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a First Hop Redundancy Protocol (FHRP) such as HSRP or VRRP to share a Virtual IP (VIP) address between both routers.; Configure the client host machines on the subnet to use the Virtual IP (VIP) address as their default gateway.

Cevap

To ensure host devices maintain default gateway connectivity during a failure, a First Hop Redundancy Protocol (FHRP) must be configured to generate a shared Virtual IP (VIP) address across the redundant routers, and the host devices must be configured to point to that Virtual IP as their default gateway address.
High availability at Layer 3 requires a First Hop Redundancy Protocol (such as HSRP or VRRP) to present a single logical gateway identity represented by a Virtual IP (VIP) address. Client devices configured to use this VIP as their default gateway remain unaware of physical hardware failures because the backup router automatically assumes control of the VIP upon primary router failure.

Adım Adım Çözüm

1
Identify the mechanism used for first-hop router redundancy.
Recognize that protocols like HSRP or VRRP bind multiple physical routers together into a virtual group with a single shared Virtual IP (VIP).
FHRP protocols enable automatic state tracking and failover of gateway responsibilities.
2
Determine proper client host gateway configuration.
Ensure all client hosts point their default gateway IP address to the Virtual IP address rather than any single physical router interface IP.
If hosts point to the VIP, traffic automatically routes through whichever physical router is actively handling the VIP.

Anahtar Kavram

First Hop Redundancy Protocols (FHRP) and Virtual IP (VIP) Default Gateway Assignment
Soru 2111Soru →

A network administrator is implementing Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) for corporate wireless client authentication. Which of the following components are required to successfully establish mutual authentication using EAP-TLS? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A valid digital certificate installed on the RADIUS server; A valid client digital certificate installed on each endpoint device

Cevap

EAP-TLS mutual authentication requires both a valid server digital certificate on the RADIUS server and a valid client digital certificate on each connecting device.
EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) is a highly secure 802.1X authentication method that mandates mutual authentication. The authentication server (RADIUS) must present a valid X.509 certificate to verify its identity to the client, and the wireless endpoint device must also present a valid client certificate to verify its identity to the server.

Adım Adım Çözüm

1
Identify the authentication protocol specified in the scenario
The scenario specifies EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) for 802.1X wireless access.
EAP-TLS is an open standard defined for certificate-based 802.1X authentication.
2
Determine the certificate requirements for EAP-TLS
EAP-TLS uses PKI to establish mutual authentication, requiring certificates on both the server side (RADIUS) and client side (supplicant).
Unlike EAP-PEAP or EAP-TTLS which only require server-side certificates and use passwords for clients, EAP-TLS enforces two-way certificate validation.

Anahtar Kavram

EAP-TLS Mutual Authentication Certificate Requirements
Soru 2112Soru →

An organization plans to update the firmware on its primary network security appliances during an upcoming maintenance window. To ensure system operations can be restored promptly if the new firmware encounters a critical fault, which of the following actions should be completed immediately before starting the installation?

Cevabı ve açıklamayı göster

Cevap: Create and verify a full configuration backup and system state snapshot of the active appliances.

Cevap

Create and verify a full configuration backup and system state snapshot of the active appliances.
In standard network patch management procedures, creating and validating a full configuration backup and system state snapshot prior to applying firmware updates is mandatory. This establishes an authoritative baseline and guarantees that administrators can execute a rollback plan if the patch causes instability.

Adım Adım Çözüm

1
Identify the risk mitigation requirement for software updates.
Recognize that firmware upgrades carry a risk of device instability or rollback necessity.
Standard patch management lifecycles require a verified rollback mechanism prior to change execution.
2
Evaluate the safest pre-deployment task.
Generating a validated configuration backup and state snapshot provides a known-good restore point.
Verification confirms the backup is non-corrupt and usable if a restore is needed.

Anahtar Kavram

Pre-Patch Baseline and Rollback Preparedness
Soru 2113Soru →

Match each enterprise high-availability mechanism on the left with its corresponding operational function on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Dual power supply with independent PDU feeds
Link Aggregation Control Protocol (LACP)
Multipath I/O (MPIO)
Virtual Router Redundancy Protocol (VRRP)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Dual power supplies connect to separate PDUs to prevent electrical outage points. LACP aggregates physical switch links into a logical interface. MPIO creates redundant storage connection paths. VRRP provides default gateway failover via an open-standard virtual IP.
Each mechanism addresses high availability at a distinct layer of enterprise infrastructure: dual power supplies protect hardware power feeds; LACP aggregates Layer 2 ethernet links; MPIO ensures block storage access resilience; VRRP provides open-standard Layer 3 default gateway redundancy.

Adım Adım Çözüm

1
Analyze power redundancy requirements
Dual power supplies fed by independent PDUs safeguard hardware against circuit failure.
Redundant power hardware relies on independent feed paths to prevent a single point of failure.
2
Identify network link aggregation mechanisms
LACP bundles multiple network cables into a single trunk for failover and throughput.
LACP dynamically negotiates link aggregation across interfaces.
3
Evaluate storage interconnect redundancy
MPIO routes host storage I/O traffic over multiple redundant host-to-SAN paths.
MPIO provides path failover and load balancing for storage block devices.
4
Select the appropriate gateway redundancy protocol
VRRP establishes an open-standard virtual IP shared among multiple routers.
VRRP allows automatic failover of default gateways without vendor lock-in.

Anahtar Kavram

High Availability and Redundancy Architecture across Power, Network Links, Storage, and First-Hop Routers
Soru 2114Soru →

An enterprise network administrator is deploying a site-to-site IPsec VPN between a corporate headquarters and a remote branch office. The branch office router is positioned behind a service provider gateway performing Port Address Translation (PAT). Diagnostic logs confirm that Phase 1 (IKE) authentication succeeds over UDP port 500. However, Phase 2 fails to establish a functional data tunnel. Further analysis reveals that the security policy is configured to use IPsec Authentication Header (AH) in tunnel mode. Which of the following root causes best explains why the IPsec VPN tunnel fails to operate across the PAT gateway?

Cevabı ve açıklamayı göster

Cevap: IPsec AH calculates an Integrity Check Value across the entire IP header, causing integrity validation failures at the destination because PAT modifies header fields during translation.

Cevap

IPsec AH calculates an Integrity Check Value across the entire IP header, causing integrity validation failures at the destination because PAT modifies header fields during translation.
The correct answer identifies that IPsec Authentication Header (AH) computes its Integrity Check Value (ICV) over the entire IP packet, including header fields like IP addresses and ports. When a PAT gateway modifies these fields to route packets across public subnets, the receiver recalculates the ICV and detects a discrepancy, dropping the traffic. AH is fundamentally incompatible with NAT/PAT for this reason.

Adım Adım Çözüm

1
Analyze the VPN protocol suite and operational mode specified in the scenario.
Identified that the setup uses IPsec Authentication Header (AH) in tunnel mode across a Port Address Translation (PAT) boundary.
Understanding the cryptographic scope of IPsec AH vs ESP is critical for identifying NAT compatibility issues.
2
Evaluate how Port Address Translation (PAT) modifies IP packets in transit.
PAT modifies the source/destination IP addresses and transport layer port numbers in the outer IP header.
Translating private IP addresses to public IP addresses requires header modification by the NAT/PAT gateway.
3
Determine the cryptographic coverage of IPsec Authentication Header (AH).
AH computes an Integrity Check Value (ICV) over the entire packet, including non-mutable and mutable fields in the outer IP header.
Because PAT alters IP header fields after the sender calculates the ICV, the receiver's ICV calculation fails, causing the packet to be rejected.
4
Identify the correct remediation standard according to Network+ core security objectives.
Migrate from AH to Encapsulating Security Payload (ESP) with NAT-Traversal (NAT-T) enabled over UDP port 4500.
ESP protects the payload payload and leaves mutable outer IP headers unauthenticated, enabling seamless NAT/PAT traversal when encapsulated in UDP packets.

Anahtar Kavram

IPsec AH vs ESP Cryptographic Scope and NAT Traversal Compatibility
Soru 2115Soru →

A network security team is deploying an 802.1X port-based network access control framework across enterprise Ethernet switches. Which of the following statements accurately describe the operational roles and protocol encapsulation methods defined in this framework? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The network switch functions as the authenticator, relaying EAP messages between the endpoint client and the backend AAA server without evaluating user credentials locally.; Extensible Authentication Protocol over LAN (EAPOL) carries authentication frames between the supplicant and switch, while EAP over RADIUS carries frames between the switch and AAA server.

Cevap

The correct statements are that the network switch functions as an authenticator relaying EAP messages without validating credentials locally, and EAPOL is used between the supplicant and switch while EAP over RADIUS is used between the switch and authentication server.
The 802.1X standard separates access control into three roles: the supplicant (client), the authenticator (switch or wireless access point), and the authentication server (RADIUS). The switch does not evaluate credentials; it simply relays EAP packets. The client communicates with the switch using EAPOL frames, while the switch encapsulates those EAP payloads into RADIUS packets sent to the AAA server over UDP ports 1812/1813.

Adım Adım Çözüm

1
Identify the core components of the IEEE 802.1X architecture.
The architecture defines three entities: Supplicant (client), Authenticator (switch/AP), and Authentication Server (RADIUS).
Understanding component roles clarifies which node processes user credentials.
2
Determine the role of the network switch (authenticator).
The switch acts as a pass-through proxy that holds the port in an unauthorized state, forwarding EAP traffic until authentication succeeds on the RADIUS server.
This confirms that the switch does not validate credentials locally.
3
Analyze protocol encapsulation across the two network links.
Link 1 (Client to Switch) uses EAPOL (EAP over LAN / 802.3 framing). Link 2 (Switch to RADIUS Server) encapsulates EAP inside RADIUS UDP packets.
This confirms the correct transport framing across layer 2 local links and layer 3 backend networks.

Anahtar Kavram

802.1X Framework Roles and EAP Protocol Encapsulation
Soru 2116Soru →

An enterprise network analyst observes that unicast frames intended exclusively for a secure file server are suddenly being received by all host interfaces connected to the same switch module. A review of the switch diagnostics reveals that the switch's MAC address table is entirely saturated with thousands of randomized, fake source MAC addresses. As a result, new frame forwarding defaults to broadcasting across all ports within the VLAN. Which of the following attack types has occurred, and what is its operational objective?

Cevabı ve açıklamayı göster

Cevap: MAC flooding, which forces the switch into a fail-open state to allow unauthorized packet sniffing of unicast traffic

Cevap

MAC flooding, which forces the switch into a fail-open state to allow unauthorized packet sniffing of unicast traffic
The correct answer identifies MAC flooding. During a MAC flooding attack, an attacker generates rapid traffic containing thousands of randomized source MAC addresses. This exhausts the storage capacity of the switch's Content Addressable Memory (CAM) table. Once full, the switch cannot learn legitimate MAC addresses and enters a fail-open operational mode, broadcasting incoming unicast frames to every active port in the VLAN. Threat actors use this vector to transform switched networks into shared media to execute packet sniffing.

Adım Adım Çözüm

1
Analyze the observed network symptom
Unicast traffic intended for a single destination host is being broadcast to all ports across the switch segment.
This indicates that the Layer 2 switch can no longer locate destination MAC addresses in its dynamic forwarding database.
2
Examine switch diagnostics and state change
The switch's Content Addressable Memory (CAM) table is exhausted due to thousands of randomized source MAC addresses.
When a switch's CAM table reaches maximum capacity, it falls back to a fail-open mode where unknown unicast traffic is flooded out every port within the VLAN.
3
Correlate symptoms with known attack vectors
This scenario matches a MAC flooding (CAM table overflow) attack designed to facilitate passive packet sniffing.
By converting switch behavior into hub-like broadcasting, an attacker connected to any switch port can capture sensitive frames intended for other hosts.

Anahtar Kavram

MAC Flooding / CAM Table Overflow
Tahmini Süre:2m 0s
Soru 2117Soru →

Match each physical security or environmental control mechanism to its primary function in a network facility.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Mantrap
Clean Agent System
Faraday Cage
Environmental Sensor

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Mantrap pairs with interlocking doors; Clean Agent System pairs with non-conductive gas fire suppression; Faraday Cage pairs with blocking electromagnetic fields; Environmental Sensor pairs with monitoring relative humidity and temperature.
Each control mechanism aligns directly with its primary defensive role: a mantrap prevents unauthorized access via interlocking doors, clean agent systems suppress fires without damaging electrical hardware, Faraday cages block electromagnetic interference, and environmental sensors alert administrators to climate shifts.

Adım Adım Çözüm

1
Identify the physical access control mechanism designed specifically to stop tailgating.
Mantrap corresponds to the interlocking door system.
Mantraps enforce single-person access control by locking one door until the adjacent door is secured.
2
Determine the appropriate fire suppression method for server equipment sensitive to liquid damage.
Clean Agent System corresponds to non-conductive gaseous fire suppression.
Standard water sprinklers cause severe electrical damage, whereas clean gaseous agents extinguish fires safely.
3
Identify the protective shielding designed to block RF signals and EMI.
Faraday Cage corresponds to blocking external electromagnetic fields.
Solid or mesh conductive enclosures isolate sensitive equipment from external wireless signals and interference.
4
Select the component responsible for measuring room climate conditions.
Environmental Sensor corresponds to monitoring ambient humidity and temperature.
Sensors provide continuous alerts for thermal or moisture anomalies in server environments.

Anahtar Kavram

Physical and Environmental Security Controls
Soru 2118Soru →

A network engineer is establishing physical and environmental controls for a newly constructed remote edge data facility. To prevent hardware failure from static accumulation, moisture buildup, and inefficient thermal distribution, which TWO of the following environmental deployment strategies should be implemented? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Maintain relative humidity levels within the room between 40% and 55%.; Arrange equipment chassis into alternating hot-aisle and cold-aisle containment rows.

Cevap

The correct physical and environmental measures are maintaining relative humidity between 40% and 55% and arranging equipment into alternating hot-aisle and cold-aisle containment rows.
Maintaining relative humidity between 40% and 55% prevents both static electricity accumulation (ESD) and water condensation. Additionally, implementing hot-aisle/cold-aisle containment optimizes airflow by separating cold intake air from hot exhaust air, preventing thermal recirculation.

Adım Adım Çözüm

1
Analyze environmental humidity requirements.
Relative humidity must be kept in a moderate range (40%–55%). Too low causes electrostatic discharge (ESD); too high causes condensation.
Protecting network components against both ESD buildup and corrosion requires controlled humidity.
2
Analyze airflow and cooling containment measures.
Organizing server racks in alternating hot-aisle and cold-aisle configurations ensures cool intake air isn't mixed with hot exhaust air.
Separating air streams improves HVAC efficiency and reduces thermal stress on network hardware.

Anahtar Kavram

Physical Security Controls and Environmental Measures
Tahmini Süre:1m 30s
Soru 2119Soru →

A network security team is auditing remote access infrastructure and site-to-site connectivity parameters across an enterprise environment. Match each remote access or tunneling mechanism on the left with its corresponding technical encapsulation and operational characteristic on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

IPsec Encapsulating Security Payload (ESP) with NAT-Traversal (NAT-T)
Secure Socket Tunneling Protocol (SSTP)
Generic Routing Encapsulation (GRE) over IPsec Tunnel Mode
WireGuard Protocol

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

IPsec ESP with NAT-T matches encapsulation inside UDP port 4500 to protect integrity checks across PAT devices; SSTP matches encapsulation of PPP frames in SSL/TLS over TCP port 443; GRE over IPsec matches encapsulating multicast routing protocols prior to IPsec encryption; WireGuard matches the modern kernel-space cryptokey routing architecture using UDP port 51820.
Each protocol match correctly aligns the underlying encapsulation mechanism with its target operational requirement: IPsec NAT-T encapsulates ESP in UDP 4500 to survive PAT translation; SSTP packages PPP into SSL/TLS over TCP 443 for firewall traversal; GRE over IPsec enables dynamic routing by wrapping multicast traffic in unicast headers before IPsec encryption; and WireGuard delivers high performance via kernel-space cryptokey routing on UDP 51820.

Adım Adım Çözüm

1
Analyze the technical requirements of IPsec NAT-Traversal.
Recognize that NAT-T embeds IPsec ESP (protocol 50) within UDP port 4500 headers so NAT/PAT gateways can translate addresses without corrupting packets or breaking ICV checks.
Standard IPsec ESP lacks Layer 4 port numbers, causing translation failures on NAPT/PAT routers.
2
Analyze firewall traversal mechanisms for remote clients.
Identify SSTP as using TLS over TCP port 443 carrying PPP payloads to masquerade as standard HTTPS web traffic.
Standard HTTPS port 443 is almost universally permitted outward through firewalls and web proxies.
3
Evaluate multi-protocol routing over VPN tunnels.
Connect GRE over IPsec with dynamic routing (multicast) encapsulation capabilities.
IPsec ESP/AH cannot natively encapsulate multicast packets, whereas GRE creates a virtual point-to-point link supporting multicast protocols like OSPF.
4
Evaluate lightweight modern VPN implementations.
Associate WireGuard with its default UDP port 51820 and cryptokey routing model operating in kernel space.
WireGuard avoids complex IKE negotiation overhead by binding static IP addresses directly to public key cryptography configurations.

Anahtar Kavram

Encapsulation, port mapping, and operational characteristics of enterprise VPN protocols.
Soru 2120Soru →

A financial institution requires a technical solution for transmitting executive financial reports across an internal network. The solution must guarantee that the recipient can verify the document was not altered in transit and prove conclusively which executive authored the document. Which of the following combinations of security principles and mechanisms best addresses these requirements?

Cevabı ve açıklamayı göster

Cevap: Integrity and Non-repudiation provided by asymmetric digital signatures

Cevap

Integrity and Non-repudiation provided by asymmetric digital signatures
Asymmetric digital signatures satisfy both requirements. A cryptographic hash of the document ensures integrity by detecting any tampering in transit. Signing that hash with the sender's private key establishes non-repudiation, as only the holder of the corresponding key pair could have generated the signature.

Adım Adım Çözüm

1
Identify the key security goals from the scenario requirements
Requirement 1 (verifying data was not altered) maps to Integrity. Requirement 2 (indisputably proving author identity) maps to Non-repudiation.
Integrity protects against unauthorized modification, while Non-repudiation prevents an author from denying they created the data.
2
Analyze technical controls that support both principles simultaneously
Asymmetric digital signatures use a cryptographic hash for integrity and the signer's private key for non-repudiation.
A modified file changes the calculated hash value (failing integrity check), and only the private key owner could have produced the signature (enforcing non-repudiation).

Anahtar Kavram

CIA Triad & Core Security Concepts (Integrity and Non-repudiation)
Tahmini Süre:1m 30s
ÖncekiSayfa 106 / 112Sonraki
Tüm alıştırma soruları — CompTIA Network+ | Examkin