Tüm alıştırma soruları

2237 soru

Soru 621Soru

A systems engineer is implementing high availability and link redundancy for a critical database host connected to two independent physical switches. The network architecture must support simultaneous active-active frame forwarding across both links for throughput aggregation while preventing Layer 2 loops, without utilizing vendor-proprietary physical stacking cables. Which TWO of the following configurations or technologies must be deployed together to achieve this redundancy design?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Multi-Chassis Link Aggregation (MLAG / MC-LAG) enabled across the physical switches; Link Aggregation Control Protocol (LACP / IEEE 802.3ad) in active mode on the host network interfaces

Cevap

Multi-Chassis Link Aggregation (MLAG / MC-LAG) enabled across the physical switches AND Link Aggregation Control Protocol (LACP / IEEE 802.3ad) in active mode on the host network interfaces
To achieve active-active bandwidth aggregation and link-level failover across two separate switches without physical stacking, Multi-Chassis Link Aggregation (MLAG) must be configured on the switch pair so they appear as a single logical switch. Concurrently, the host must use Link Aggregation Control Protocol (LACP) in active mode to dynamically negotiate the multi-chassis aggregated link.

Adım Adım Çözüm

1
Identify the requirement for active-active link redundancy across two distinct physical switches without switch stacking.
Recognize that standard LACP cannot bridge across independent switches without Multi-Chassis Link Aggregation (MLAG).
Standard LACP requires all aggregated links to terminate on a single logical switch control plane; MLAG presents two separate switches as one logical entity.
2
Select the host-side link aggregation protocol.
Choose LACP (802.3ad) active mode for the host bonding configuration.
LACP dynamically negotiates link aggregation with the MLAG-enabled switches to form a resilient multi-homed link.

Anahtar Kavram

Multi-Chassis Link Aggregation and Dynamic NIC Teaming for High Availability
Soru 622Soru

Match each network logging mechanism or Syslog severity level on the left with its corresponding description or operational characteristic on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Syslog Severity 0 (Emergency)
Syslog Severity 4 (Warning)
NetFlow / IPFIX
SNMP Trap

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Syslog Severity 0 matches system panic/unusable condition; Syslog Severity 4 matches non-disruptive abnormal warning condition; NetFlow / IPFIX matches export of traffic flow statistics; SNMP Trap matches unsolicited event notifications from agent to collector.
Each logging mechanism and severity rating accurately corresponds to its defining operational definition within enterprise network management.

Adım Adım Çözüm

1
Differentiate Syslog severity levels based on numerical values.
Severity 0 corresponds to Emergency (highest severity), while Severity 4 corresponds to Warning.
Syslog RFC standards rank severities from 0 (Emergency) to 7 (Debug).
2
Distinguish between session telemetry and asynchronous alert protocols.
NetFlow aggregates IP session metadata for flow analysis, whereas SNMP Traps transmit asynchronous event notifications.
Flow telemetry measures volume and communication paths, while SNMP traps notify administrators of real-time status changes.

Anahtar Kavram

Syslog Severity Levels and Network Logging Telemetry Protocols
Soru 623Soru

Match each centralized authentication protocol or access control framework component to its corresponding transport layer behavior, encryption boundary, or operational function.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

RADIUS Protocol
TACACS+ Protocol
802.1X Supplicant
EAP-TLS Framework

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

RADIUS Protocol pairs with UDP 1812/1813 password-only encryption; TACACS+ Protocol pairs with TCP port 49 full payload encryption; 802.1X Supplicant pairs with client-side software credential agent; EAP-TLS Framework pairs with mutual certificate-based authentication.
Each security protocol and architectural term is matched accurately according to its transport protocol layer, payload encryption scope, endpoint role, or cryptographic verification mechanism.

Adım Adım Çözüm

1
Analyze transport protocols and security boundaries for AAA frameworks.
RADIUS uses UDP ports 1812/1813 and encrypts only the user password field. TACACS+ uses TCP port 49 and encrypts the entire packet payload.
Differentiating transport types (UDP vs TCP) and encryption scope is crucial for evaluating network authentication architecture security.
2
Identify roles within 802.1X network access control.
The Supplicant represents the client end-node software requesting access, whereas the switch or wireless access point functions as the Authenticator.
Establishing explicit boundaries between endpoint client software, access devices, and AAA backends defines the 802.1X topology.
3
Evaluate Extensible Authentication Protocol (EAP) variants.
EAP-TLS requires client-side and server-side PKI digital certificates to validate both parties.
EAP-TLS is distinct from password-based or outer-tunnel EAP methods due to its mandatory mutual certificate requirement.

Anahtar Kavram

Centralized AAA Framework mechanisms, protocol transport differences, and 802.1X/EAP architecture components
Soru 624Soru

A network administrator needs to configure a wireless access point for a company office. Policy mandates that every employee must authenticate using their own unique corporate credentials managed by a centralized RADIUS server, rather than sharing a static password. Which wireless security mode should be configured on the access point?

Cevabı ve açıklamayı göster

Cevap: WPA3-Enterprise

Cevap

WPA3-Enterprise
WPA3-Enterprise specifies the use of IEEE 802.1X authentication, allowing clients to authenticate individually against a backend RADIUS server using personalized credentials.

Adım Adım Çözüm

1
Identify the authentication requirement described in the scenario
The requirement calls for individual user credentials authenticated against a centralized RADIUS server via 802.1X.
Enterprise wireless modes integrate with 802.1X/RADIUS to support central user account management.
2
Distinguish between Personal (PSK/SAE) and Enterprise (802.1X) wireless security modes
Personal modes use a shared passphrase, whereas Enterprise modes utilize 802.1X authentication servers.
Choosing an Enterprise wireless mode satisfies the requirement for central RADIUS authentication.

Anahtar Kavram

WPA3 Enterprise vs. Personal Authentication Modes
Soru 625Soru

A network technician is setting up a new network segment using the IP block 10.0.4.0/2410.0.4.0/24. Following standard configuration guidelines, the default gateway will be assigned the last usable host IP address in the subnet. What is the last usable IPv4 host address in the 10.0.4.0/2410.0.4.0/24 network?

Cevabı ve açıklamayı göster

Cevap: 10.0.4.254

Cevap

The last usable IPv4 host address in the 10.0.4.0/2410.0.4.0/24 network is 10.0.4.25410.0.4.254.
For a /24/24 IPv4 subnet, the address space covers 256 total IP addresses (10.0.4.010.0.4.0 to 10.0.4.25510.0.4.255). The first address (10.0.4.010.0.4.0) serves as the network ID and the last address (10.0.4.25510.0.4.255) serves as the broadcast address. Thus, the assignable host range is 10.0.4.110.0.4.1 through 10.0.4.25410.0.4.254, making 10.0.4.25410.0.4.254 the last usable host address.

Adım Adım Çözüm

1
Identify the network address and broadcast address for 10.0.4.0/2410.0.4.0/24.
Network address is 10.0.4.010.0.4.0 and broadcast address is 10.0.4.25510.0.4.255.
A /24/24 prefix provides 256 total IP addresses in the final octet (range 0–255).
2
Determine the range of usable host IP addresses.
The usable host address range spans from 10.0.4.110.0.4.1 to 10.0.4.25410.0.4.254.
The network address (10.0.4.010.0.4.0) and the broadcast address (10.0.4.25510.0.4.255) cannot be assigned to hosts.
3
Select the last assignable host address.
10.0.4.25410.0.4.254
It is the highest usable IP address immediately preceding the broadcast address.

Anahtar Kavram

IPv4 Usable Host Range and Subnet Boundary Calculation
Soru 626Soru

A client workstation connected to VLAN 45 (10.45.0.0/2410.45.0.0/24) issues a Layer 2 broadcast `DHCPDISCOVER` packet (255.255.255.255255.255.255.255) to obtain an IP configuration. The default gateway interface for VLAN 45 on the Layer 3 switch is configured with the IP address 10.45.0.110.45.0.1 and an IP helper address pointing to a centralized DHCP server at 10.200.10.2510.200.10.25. Which set of header and payload modifications will the Layer 3 switch perform on this packet before forwarding it across the routed core to the DHCP server?

Cevabı ve açıklamayı göster

Cevap: It sets the Gateway IP Address (`giaddr`) field in the DHCP payload to 10.45.0.110.45.0.1, sets the source IP address to 10.45.0.110.45.0.1, sets the destination IP address to 10.200.10.2510.200.10.25, and forwards the unicast packet using UDP destination port 67.

Cevap

The Layer 3 switch populates the Gateway IP Address (`giaddr`) field in the DHCP payload with 10.45.0.110.45.0.1, rewrites the source IP address as 10.45.0.110.45.0.1, sets the destination IP to 10.200.10.2510.200.10.25, and forwards the unicast packet using UDP port 67.
The correct answer accurately describes the dual modification executed by a DHCP relay agent (IP helper): it writes the receiving Layer 3 interface's IP address (10.45.0.110.45.0.1) into the DHCP payload's `giaddr` (gateway IP address) field, and encapsulates the request into a standard unicast IP packet (Source: 10.45.0.110.45.0.1, Destination: 10.200.10.2510.200.10.25, UDP Port 67) so it can be routed across network subnets.

Adım Adım Çözüm

1
Analyze incoming broadcast packet parameters
The client issues a `DHCPDISCOVER` frame with Source IP 0.0.0.00.0.0.0, Destination IP 255.255.255.255255.255.255.255, Source MAC = Client MAC, Destination MAC = `FF:FF:FF:FF:FF:FF`, Source Port = UDP 68, Destination Port = UDP 67.
Unconfigured clients must broadcast their initial DHCP discovery requests.
2
Identify DHCP Relay Agent (IP Helper) processing
The Layer 3 interface receiving the broadcast (10.45.0.110.45.0.1) intercepts the frame, inspects the `giaddr` field in the DHCP payload, and writes its own interface IP (10.45.0.110.45.0.1) into `giaddr`.
The centralized DHCP server uses the `giaddr` field to determine which address pool/scope (10.45.0.0/2410.45.0.0/24) to allocate an IP address from.
3
Examine IP and UDP header modifications for unicast transit
The switch constructs a unicast IP packet: Source IP = 10.45.0.110.45.0.1, Destination IP = 10.200.10.2510.200.10.25, Source Port = UDP 67, Destination Port = UDP 67.
Routers cannot route 255.255.255.255255.255.255.255 broadcasts. Converting the request to unicast allows it to traverse standard Layer 3 routed hops to reach the remote server.

Anahtar Kavram

DHCP Relay Agent Payload and Header Modification (`giaddr` Insertion & Broadcast-to-Unicast Conversion)
Soru 627Soru

A core router receives an IP packet destined for host address 192.168.88.77192.168.88.77. The router's routing table contains the following matching entries:

TypeDestination SubnetAdministrative Distance / MetricNext-Hop Interface
Static192.168.88.0/24192.168.88.0/24[1/0][1/0]10.0.0.110.0.0.1
BGP192.168.0.0/16192.168.0.0/16[20/100][20/100]10.0.0.210.0.0.2
OSPF192.168.88.64/26192.168.88.64/26[110/15][110/15]10.0.0.310.0.0.3
RIPv2192.168.88.72/29192.168.88.72/29[120/3][120/3]10.0.0.410.0.0.4

Based on standard Layer 3 forwarding logic, to which next-hop IP address will the router forward the packet?

Cevabı ve açıklamayı göster

Cevap: 10.0.0.410.0.0.4

Cevap

The router forwards the packet to next-hop 10.0.0.410.0.0.4 based on the Longest Prefix Match rule.
When a router performs a forwarding lookup for a destination IP, it evaluates the prefix length of all matching routes in the routing table. The route with the longest matching prefix mask (/29/29, 192.168.88.72/29192.168.88.72/29) is the most specific route to 192.168.88.77192.168.88.77. Longest prefix match takes precedence over administrative distance and metric values during packet forwarding decisions. Therefore, the router forwards traffic to next-hop 10.0.0.410.0.0.4.

Adım Adım Çözüm

1
Determine which subnets contain the target IP address 192.168.88.77192.168.88.77.
The target address matches all four entries: 192.168.88.0/24192.168.88.0/24, 192.168.0.0/16192.168.0.0/16, 192.168.88.64/26192.168.88.64/26 (range .64.64.127.127), and 192.168.88.72/29192.168.88.72/29 (range .72.72.79.79).
All four routing entries encompass the destination IP address.
2
Compare the prefix lengths (subnet mask specificity) of all matching routes.
The prefix lengths are /16/16, /24/24, /26/26, and /29/29. The longest (most specific) prefix match is /29/29.
Routers evaluate the Longest Prefix Match (LPM) first when selecting a path from the routing table.
3
Select the next-hop associated with the longest prefix match.
The route for 192.168.88.72/29192.168.88.72/29 points to next-hop 10.0.0.410.0.0.4.
Administrative distance and metric are only used to compare identical prefix destinations from different sources, not routes with different prefix lengths.

Anahtar Kavram

Longest Prefix Match (LPM) routing table lookup hierarchy
Tahmini Süre:2m 0s
Soru 628Soru

A network administrator is designing an IP addressing scheme for a new branch office location. The department requires static IP assignments for 60 user workstations, 2 IP phone gateways, and 2 redundant default gateway router interfaces. The administrator must assign the smallest possible subnet block from `10.150.0.0/16` that will successfully accommodate all required host devices. Which CIDR prefix and subnet mask should the administrator configure?

Cevabı ve açıklamayı göster

Cevap: /25 (255.255.255.128)

Cevap

/25 (255.255.255.128)
The scenario requires 64 usable IPv4 addresses (60 workstations + 2 phone gateways + 2 router interfaces). Using the formula for usable hosts 2h22^h - 2, a /26 prefix has 6 host bits (262=622^6 - 2 = 62), which falls short by 2 addresses. Therefore, the network administrator must allocate a /25 prefix with 7 host bits (272=1262^7 - 2 = 126), which is the smallest subnet block capable of supporting all 64 host IP addresses.

Adım Adım Çözüm

1
Calculate the total number of host IP addresses required.
60 workstations + 2 IP phone gateways + 2 router interfaces = 64 host IP addresses.
Every active device and router gateway interface on the subnet requires a unique usable IPv4 address.
2
Apply the usable host formula 2h2642^h - 2 \ge 64 to determine the required host bits (hh).
For h=6h = 6, 262=622^6 - 2 = 62 usable hosts (insufficient). For h=7h = 7, 272=1262^7 - 2 = 126 usable hosts (sufficient).
Subnetting calculations require subtracting 2 reserved addresses (the Network ID and Broadcast ID) from total addresses (2h2^h).
3
Determine the prefix length and dotted-decimal subnet mask.
Prefix length is 327=/2532 - 7 = /25, which corresponds to the subnet mask `255.255.255.128`.
Subtracting 7 host bits from 32 total IPv4 bits leaves 25 network bits.

Anahtar Kavram

IPv4 Subnetting and Usable Host Calculation
Soru 629Soru

Match each switchport configuration scenario on the left with its corresponding IEEE 802.1Q frame processing behavior or operational link state on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

An untagged Ethernet frame arrives on a trunk port configured with 'switchport trunk native vlan 99'.
An 802.1Q tagged Ethernet frame with VLAN ID 30 arrives on a port configured with 'switchport trunk allowed vlan 10,20'.
A switchport configured with 'switchport mode dynamic auto' connects to an adjacent switchport configured with 'switchport mode dynamic desirable'.
An 802.1Q tagged frame with VLAN ID 50 arrives on a switchport configured with 'switchport mode access' and 'switchport access vlan 10'.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Untagged ingress on native VLAN 99 maps internally to VLAN 99 without a tag; VLAN ID 30 on a trunk allowing only 10,20 is dropped due to pruning rules; dynamic auto connecting to dynamic desirable successfully negotiates an 802.1Q trunk link via DTP; tagged VLAN 50 traffic arriving on an access port for VLAN 10 is dropped.
The correct pairings accurately reflect standard IEEE 802.1Q frame processing rules and Cisco DTP negotiation matrix rules: native VLAN frames travel untagged; non-allowed VLAN traffic is dropped by trunk interface filtering; dynamic auto and dynamic desirable negotiate a functional trunk; and unexpected tagged traffic on access ports is dropped.

Adım Adım Çözüm

1
Analyze Native VLAN Ingress Tagging Rules
Untagged frames arriving on an 802.1Q trunk port are processed on the native VLAN defined by 'switchport trunk native vlan <id>'.
802.1Q trunking specifies that native VLAN traffic does not carry a 4-byte VLAN tag across the link.
2
Evaluate Trunk Allowed List Filtering
VLAN 30 traffic is dropped upon arrival.
The command 'switchport trunk allowed vlan 10,20' restricts trunk traversal exclusively to VLANs 10 and 20, pruning all unlisted VLAN IDs.
3
Evaluate Dynamic Trunking Protocol (DTP) Negotiation
The link operates as a trunk.
Dynamic desirable actively sends DTP requests to convert the link to a trunk, and dynamic auto responds positively to trunking requests.
4
Assess Access Port Tagged Ingress Behavior
The frame tagged with VLAN ID 50 is dropped on the access port assigned to VLAN 10.
Standard access ports operate within a single broadcast domain and drop ingress frames containing mismatched 802.1Q tags.

Anahtar Kavram

VLAN Configuration and 802.1Q Trunking
Tahmini Süre:3m 0s
Soru 630Soru

During network maintenance, an administrator inspects a newly crimped Category 6 UTP cable that passes basic DC continuity testing but fails Gigabit performance certification due to severe Near-End Crosstalk (NEXT). Visual inspection reveals that the wire pairs were untwisted by approximately 5 centimeters (2 inches) prior to inserting them into the RJ-45 modular plug. Which of the following physical layer corrective actions should the administrator perform to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Re-terminate the cable ends while keeping the untwisted portion of the wire pairs to less than 1.3 centimeters (0.5 inches).

Cevap

Re-terminate the cable ends while keeping the untwisted portion of the wire pairs to less than 1.3 centimeters (0.5 inches).
Near-End Crosstalk (NEXT) occurs when signals on one wire pair interfere with adjacent pairs near the transmitting end. TIA/EIA cabling standards specify that conductor pairs must remain twisted as close to the connector termination point as possible (maximum 0.5 inches / 12.7 mm for Cat 6). Re-terminating the cable with minimal untwisting restores noise cancellation capabilities.

Adım Adım Çözüm

1
Identify the cause of Near-End Crosstalk (NEXT).
Excessive untwisting of wire pairs near termination points exposes individual conductors to electromagnetic coupling from adjacent pairs.
Twisted pair cabling relies on precise pair twisting ratios to cancel out differential electromagnetic interference.
2
Evaluate standard physical termination practices for Category 6 cabling.
TIA/EIA standards specify that pair untwisting must not exceed 0.5 inches (12.7 mm) from the point of termination.
Limiting untwisting preserves noise cancellation up to the RJ-45 contact pins.
3
Select the appropriate corrective action.
Cut off the improperly terminated RJ-45 plug and re-terminate with minimal untwisting.
Physical re-termination directly resolves the root cause of the NEXT failure.

Anahtar Kavram

Crosstalk Mitigation and Termination Standards
Tahmini Süre:1m 30s
Soru 631Soru

An enterprise monitors its internal data center network using a passive Network Intrusion Detection System (NIDS) connected to a switch SPAN port. During a security incident, an attacker successfully exploits a vulnerability on a Linux target server by transmitting crafted TCP packets containing overlapping sequence numbers with conflicting data payloads (a TCP stream segmentation evasion attack). Although traffic reached the sensor, the NIDS failed to generate an alert because its stream reassembly engine interpreted the overlapping segments differently than the target server's IP/TCP protocol stack. Which of the following actions best addresses this detection failure while maintaining zero impact on network latency?

Cevabı ve açıklamayı göster

Cevap: Tune the NIDS stream reassembly engine's target-oriented policy to match the reassembly behavior of the target host's operating system.

Cevap

Tune the NIDS stream reassembly engine's target-oriented policy to match the reassembly behavior of the target host's operating system.
When attackers craft overlapping TCP segments, different host operating systems apply distinct rules to decide whether original or newer overlapping bytes take precedence. A passive NIDS uses stream normalization engines with target-oriented policies to align its reassembly logic with the exact operating system of the target destination host. Tuning these policies ensures the NIDS reassembles the payload identically to the target host, detecting evasive attacks out-of-band without introducing inline latency.

Adım Adım Çözüm

1
Analyze the attack mechanism and NIDS failure mode.
Identified that the attacker used TCP stream segmentation evasion (overlapping sequence numbers), which caused the passive NIDS engine to reconstruct a benign payload while the target OS reconstructed the malicious payload.
Different operating systems (e.g., Linux vs. Windows) resolve overlapping TCP sequence numbers using different prioritization rules (e.g., favoring original vs. subsequent segments).
2
Evaluate deployment constraints.
The solution must maintain zero impact on network propagation delay and latency.
Converting to an inline network intrusion prevention system (NIPS) introduces processing delay and single points of failure, violating the requirement.
3
Select the appropriate NIDS configuration fix.
Configure target-oriented session reassembly policies on the out-of-band NIDS.
Target-oriented reassembly allows the passive sensor to apply host-specific TCP reassembly rules per target IP address, neutralizing evasion attacks out-of-band without adding network latency.

Anahtar Kavram

Target-Oriented TCP Stream Reassembly in Out-of-Band NIDS
Soru 632Soru

A network administrator is updating the telemetry and auditing configuration across core switch infrastructure to adhere to security compliance standards. The compliance policy mandates that all remote device management queries must provide cryptographic authentication and payload privacy, and that system log messages must be securely forwarded to a central server using a reliable, encrypted transport protocol. Which TWO of the following configurations should the administrator implement to satisfy these mandates? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable SNMPv3 using the authPriv security level for device polling and monitoring.; Configure Syslog log forwarding using Transport Layer Security (TLS) over TCP port 6514.

Cevap

The administrator must implement SNMPv3 with the authPriv security level to ensure payload encryption and authentication for device management queries, and configure Syslog log forwarding using TLS over TCP port 6514 for secure and reliable log transmission.
Enabling SNMPv3 with the authPriv mode satisfies the mandate for administrative query privacy because authPriv adds payload encryption in addition to authentication. Configuring Syslog forwarding over TCP port 6514 using TLS satisfies the requirement for encrypted, reliable log transfer to the central repository.

Adım Adım Çözüm

1
Evaluate the security requirement for management queries.
Identified that cryptographic authentication and payload privacy require SNMPv3 authPriv.
SNMPv1 and SNMPv2c send community strings in plaintext. In SNMPv3, noAuthNoPriv provides no security, authNoPriv authenticates without encrypting data, and authPriv provides both authentication and privacy (encryption).
2
Evaluate the requirement for log message transport encryption and reliability.
Identified that Syslog over TCP 6514 with TLS provides encrypted, reliable log transport.
Traditional Syslog uses unencrypted UDP port 514, which lacks transport reliability and payload security. RFC 5425 specifies TLS over TCP port 6514 to secure Syslog communications with connection reliability.

Anahtar Kavram

Secure Network Logging and Device Monitoring Protocols
Tahmini Süre:1m 30s
Soru 633Soru

A network engineering team is preparing to deploy a vendor-released maintenance patch to address a critical security vulnerability across multiple enterprise edge routers. To ensure network stability and adhere to standard change management procedures, which of the following operational steps should be completed prior to applying the patch to production hardware? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Perform a verified baseline configuration backup of all target devices prior to initiating the update process.; Test and validate the patch inside an isolated laboratory environment that mirrors the production hardware configuration.

Cevap

Prior to deploying software maintenance patches to production network devices, engineers must perform a verified baseline backup of device configurations and thoroughly test the patch in an isolated lab environment that mirrors production.
Safe patch management procedures mandate creating a full, verified baseline configuration backup and validating software patches in an isolated staging/lab environment prior to production deployment. These steps ensure configuration recovery capability and minimize unexpected operational downtime.

Adım Adım Çözüm

1
Identify change management pre-deployment requirements
Recognize that baseline backups and lab/staging environment testing are mandatory risk mitigation controls.
Lab testing detects unforeseen bugs before production deployment, while backups enable rapid recovery if rollback is required.
2
Evaluate post-deployment and execution timing hazards
Reject updating live devices during peak hours or overwriting newly patched devices with incremental restorations.
Updates must occur during approved maintenance windows, and backups should only be restored if a rollback is explicitly required.

Anahtar Kavram

Pre-deployment validation, staging lab testing, baseline configuration backup, and scheduled maintenance windows in patch management workflows.
Soru 634Soru

A network security administrator is deploying a client-based SSL/TLS remote access VPN solution with host posture assessment and Multi-Factor Authentication (MFA). In what chronological order do the following operational steps occur during a successful client connection sequence from initial packet transmission to secure internal network access?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with negotiating the TLS handshake over TCP port 443 to secure the control plane, followed by authenticating user credentials and MFA tokens via RADIUS, performing host posture compliance assessment, and concluding with virtual inner IP assignment and encrypted tunnel establishment.
In a secure remote access SSL/TLS VPN workflow, the sequence follows strict dependency ordering: First, transport security is established via a TLS handshake on TCP port 443. Second, user identity and MFA credentials are validated against an enterprise AAA/RADIUS server. Third, Network Access Control (NAC) posture evaluation checks endpoint compliance (antivirus, patches, host firewall). Fourth, once both user identity and device posture pass validation, the gateway assigns an internal IP address and instantiates the encrypted data tunnel.

Adım Adım Çözüm

1
Establish transport-layer encrypted control channel
TLS session established on TCP port 443 with server certificate validation.
The client must first verify the identity of the VPN gateway and establish cryptographic privacy before sending sensitive login credentials.
2
Authenticate user identity with multi-factor authentication
RADIUS AAA server validates primary credentials and TOTP token.
Verifying user identity ensures that unauthenticated users cannot consume gateway resources or submit health telemetry.
3
Execute endpoint posture and health compliance check
Posture agent verifies OS patches, local firewall state, and AV signatures, transmitting compliance confirmation to the gateway.
Endpoint health checks prevent non-compliant or compromised devices from bridging malware onto the internal corporate network.
4
Allocate virtual inner IP address and establish network tunnel
Gateway assigns internal virtual IP address and binds network-layer encapsulation to the client virtual adapter.
Tunnel interface creation and inner address assignment complete the connection pipeline after all authentication and authorization barriers pass.

Anahtar Kavram

SSL/TLS VPN Connection Sequence, AAA Integration, and Endpoint Posture Assessment
Soru 635Soru

A network technician is configuring a secure wireless network for a regional field office. Management mandates enhancing security beyond WPA2-Personal to protect against offline dictionary attacks and wireless management frame spoofing, but the site lacks the infrastructure required for centralized RADIUS authentication. Which TWO of the following features or protocols must be implemented to fulfill these requirements under WPA3-Personal?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Simultaneous Authentication of Equals (SAE) to replace the legacy pre-shared key handshake and defend against offline dictionary attacks; Mandatory integration of Protected Management Frames (PMF / IEEE 802.11w) to safeguard unicast and multicast management traffic against spoofing

Cevap

Simultaneous Authentication of Equals (SAE) and mandatory Protected Management Frames (PMF / IEEE 802.11w) must be implemented for WPA3-Personal.
WPA3-Personal enhances wireless security by introducing Simultaneous Authentication of Equals (SAE) to eliminate vulnerability to offline dictionary attacks without requiring a RADIUS infrastructure. Additionally, WPA3 makes Protected Management Frames (PMF / IEEE 802.11w) mandatory to protect wireless management traffic from deauthentication spoofing.

Adım Adım Çözüm

1
Analyze site constraints and security requirements
The scenario specifies a WPA3-Personal deployment without RADIUS infrastructure, requiring protection against offline dictionary attacks and management frame spoofing.
Identifying the target security standard and lack of 802.1X enterprise authentication eliminates 802.1X / RADIUS features.
2
Identify the key authentication upgrade in WPA3-Personal
Simultaneous Authentication of Equals (SAE) replaces WPA2 PSK.
SAE utilizes the Dragonfly Key Exchange to ensure forward secrecy and protect against offline dictionary attacks without requiring user-specific certificates.
3
Identify the management frame protection requirement
Protected Management Frames (PMF / IEEE 802.11w) are mandatory in WPA3.
PMF authenticates management frames such as deauthentication and disassociation, mitigating wireless spoofing attacks.

Anahtar Kavram

WPA3-Personal Security Enhancements (SAE and PMF)
Soru 636Soru

During a high-availability audit of a corporate network, a technician evaluates a VRRP pair where Router 1 (10.1.1.2) and Router 2 (10.1.1.3) share Virtual IP (VIP) 10.1.1.1. When Router 1 is powered off for maintenance, workstations on the local subnet immediately lose connectivity to remote networks despite Router 2 assuming the active master role. Troubleshooting reveals that workstations cannot reach their default gateway during the outage. What is the most likely root cause of this failure?

Cevabı ve açıklamayı göster

Cevap: Workstations were configured with the physical IP address of Router 1 (10.1.1.2) as their default gateway instead of the virtual IP address (10.1.1.1).

Cevap

Workstations were configured with the physical IP address of Router 1 (10.1.1.2) as their default gateway instead of the virtual IP address (10.1.1.1).
In First Hop Redundancy Protocols (FHRP) such as VRRP or HSRP, hosts must be configured to point to the shared Virtual IP (VIP) as their default gateway. When hosts are instead configured with the physical IP of a specific router, traffic goes strictly to that physical device. When that router shuts down, hosts lose gateway reachability even though the standby router correctly assumes the master VRRP role.

Adım Adım Çözüm

1
Analyze the high-availability gateway architecture
Identify that Router 1 (10.1.1.2) and Router 2 (10.1.1.3) form a VRRP group with Virtual IP (VIP) 10.1.1.1.
VRRP creates a shared virtual gateway IP address so end devices have a single redundant default gateway destination.
2
Evaluate the symptom during failover
Router 2 becomes master as intended when Router 1 shuts down, but host workstations lose remote network access.
This indicates that VRRP protocol state transitions are functioning correctly, but client traffic is not reaching the new master router.
3
Determine the host configuration misconfiguration
Clients were using the physical IP of Router 1 rather than the VIP.
For gateway redundancy to work, end hosts must direct their default gateway traffic to the VIP (10.1.1.1) so VRRP can dynamically map the active router's MAC address.

Anahtar Kavram

FHRP Virtual Gateway IP Configuration
Tahmini Süre:1m 30s
Soru 637Soru

A network engineer attempts to configure a static route on a enterprise router using the destination IPv6 address 2001:db8:1000:1::0:100::5. Upon executing the command, the router CLI rejects the entry and displays a syntax error. Which of the following best explains why this IPv6 address representation is invalid?

Cevabı ve açıklamayı göster

Cevap: The address uses the double-colon shorthand (::) more than once, creating ambiguity in the total number of zero-padded 16-bit hextets.

Cevap

The address uses the double-colon shorthand (::) more than once, creating ambiguity in the total number of zero-padded 16-bit hextets.
The IPv6 specification mandates that the double-colon shorthand (::) can only be used ONCE in any single address string. Because an IPv6 address must expand to exactly eight 16-bit hextets (128 bits total), having two instances of :: makes it impossible for the system parser to determine how many zero blocks each :: represents.

Adım Adım Çözüm

1
Analyze the full structural components of an IPv6 address.
An IPv6 address consists of 128 bits divided into eight 16-bit blocks (hextets) separated by colons.
Understanding the 8-hextet baseline allows accurate expansion of compressed IPv6 representations.
2
Evaluate the provided IPv6 string 2001:db8:1000:1::0:100::5 for shorthand compression compliance.
The string contains two separate instances of the double-colon (::) operator.
The double-colon represents one or more contiguous hextets of all zeros.
3
Determine the impact of using multiple double-colon operators.
When expanding two double colons, the exact count of zero hextets represented by each double colon cannot be unambiguously calculated.
Because of this mathematical ambiguity, networking software and CLI parsers reject addresses containing more than one double colon as invalid syntax.

Anahtar Kavram

IPv6 Address Compression Rules (RFC 5952)
Tahmini Süre:1m 0s
Soru 638Soru

A network administrator is configuring a new subnet assigned a /26/26 CIDR prefix. What is the maximum number of usable host IP addresses that can be assigned to devices on this subnet?

Cevabı ve açıklamayı göster

Cevap: 62

Cevap

The maximum number of usable host IP addresses on a /26/26 subnet is 62.
A /26/26 subnet prefix leaves 3226=632 - 26 = 6 bits for host assignment. The total address capacity is 26=642^6 = 64 IP addresses. Subtracting the network identifier and broadcast address yields 642=6264 - 2 = 62 usable host addresses.

Adım Adım Çözüm

1
Determine host portion bit length
6 bits (3226=632 - 26 = 6)
IPv4 addresses consist of 32 bits total. Subtracting the prefix length yields the number of bits allocated for host addresses.
2
Calculate total address space
64 IP addresses (26=642^6 = 64)
The total number of unique address combinations is 2h2^h, where hh is the number of host bits.
3
Subtract reserved addresses
62 usable host addresses (642=6264 - 2 = 62)
The network address (all host bits 0) and the broadcast address (all host bits 1) cannot be assigned to endpoints.

Anahtar Kavram

Calculating usable host count from IPv4 CIDR prefix length
Soru 639Soru

A network technician is troubleshooting severe packet loss and link flapping on a 60-meter Category 6 UTP cable drop connecting a workstation to a access switch. A basic wiremap tester indicates that all eight conductors maintain correct end-to-end pin continuity with no open or short circuits. However, when testing the link with a Time-Domain Reflectometer (TDR), the device indicates a significant signal reflection and impedance anomaly at exactly 32 meters from the local patch panel. Which of the following physical cable conditions is the TDR identifying that the basic wiremap tester failed to detect?

Cevabı ve açıklamayı göster

Cevap: A physical deformation, such as a sharp bend radius violation or severe cable kink, that alters pair geometry and characteristic impedance without severing pin continuity

Cevap

The TDR identifies a physical deformation, such as a sharp bend or severe kink in the cable run, that alters characteristic impedance without breaking DC continuity.
The correct answer explains that a Time-Domain Reflectometer (TDR) transmits electrical pulses along a conductor and measures reflections caused by changes in characteristic impedance. A physical defect such as a kink or severe bend alters the spacing between twisted pairs, creating an impedance mismatch at that location (32 meters) without severing the conductor. This causes high return loss and link degradation at high data rates while passing basic wiremap DC continuity tests.

Adım Adım Çözüm

1
Analyze the diagnostic capabilities of a basic wiremap tester versus a Time-Domain Reflectometer (TDR).
A wiremap tester only verifies pinout alignment and DC electrical continuity (detecting opens, shorts, and reversed pairs). It cannot measure signal reflections or impedance consistency.
Passing a wiremap test rules out complete conductor breaks or pin transposition errors.
2
Interpret the TDR measurement output of a signal reflection at 32 meters.
TDR sends electrical pulses down the cable; any change in characteristic impedance (such as from a kink, tight cable tie, or physical crush) reflects a portion of the pulse back to the source.
The time delay of the reflection determines the exact distance to the impedance anomaly.
3
Evaluate the underlying physical cause of high packet loss despite full continuity.
Impedance mismatches cause return loss and signal attenuation, which degrade high-speed signals (like 1000BASE-T) while allowing low-frequency DC continuity checks to succeed.
Maintaining physical bend radius guidelines prevents impedance changes along twisted-pair runs.

Anahtar Kavram

Time-Domain Reflectometry (TDR) and Impedance Anomaly Detection
Soru 640Soru

Match each network attack type on the left with its corresponding technical mechanism or operational signature on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

BGP Route Hijacking
TCP Session Hijacking
Wireless Deauthentication
DNS Amplification

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

BGP Route Hijacking matches with advertising false IP prefixes to Autonomous Systems. TCP Session Hijacking matches with predicting connection sequence numbers to inject payloads. Wireless Deauthentication matches with transmitting spoofed 802.11 management frames. DNS Amplification matches with exploiting open recursive name servers using spoofed source IPs.
BGP Route Hijacking relies on rogue Autonomous System prefix announcements to misroute traffic. TCP Session Hijacking exploits TCP sequence counter predictability to commandeer established streams. Wireless Deauthentication sends spoofed 802.11 management packets to sever wireless associations. DNS Amplification leverages open resolvers and UDP source spoofing to magnify attack traffic directed at a target.

Adım Adım Çözüm

1
Analyze each network attack type to determine its primary protocol layer and attack mechanism.
Identified four distinct network attacks operating across routing, transport, wireless, and application layers.
Matching requires evaluating the fundamental operation of each attack vector.
2
Associate each attack with its specific technical implementation and operational signature.
Successfully paired BGP Route Hijacking with prefix advertisement spoofing, TCP Session Hijacking with sequence number prediction, Wireless Deauthentication with 802.11 frame spoofing, and DNS Amplification with open resolver reflection.
Each mechanism relies on unique protocol vulnerabilities and operational behaviors.

Anahtar Kavram

Common Network Attack Types and Vectors
Tahmini Süre:1m 30s
ÖncekiSayfa 32 / 112Sonraki
Tüm alıştırma soruları — CompTIA Network+ | Examkin