Tüm alıştırma soruları

2237 soru

Soru 721Soru

A network technician is tasked with creating documentation for a newly installed equipment cabinet in a telecommunications room. Which of the following specifications belong specifically in a rack diagram? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The vertical rack unit (U) position of each patch panel and switch; The physical height dimensions (measured in U space) of installed servers and PDUs

Cevap

The correct details to include in a rack diagram are the vertical rack unit (U) position of each patch panel and switch, and the physical height dimensions (in U space) of installed servers and power distribution units (PDUs).
A rack diagram is a physical documentation tool that shows the front and rear visual layouts of network hardware inside an equipment rack. Essential components include exact rack unit (U) position numbering (e.g., U1 through U42) and the physical height (in U space) of each device such as switches, patch panels, UPS units, and PDUs.

Adım Adım Çözüm

1
Identify the main purpose of a rack diagram.
A rack diagram visually maps out the physical placement, spacing, and inventory of devices mounted inside an IT enclosure or cabinet.
Understanding document types ensures correct selection of physical versus logical elements.
2
Evaluate candidate options for physical rack placement details.
Vertical unit positions (U space) and device height dimensions describe physical cabinet layout.
Rack diagrams strictly track vertical space (1U = 1.75 inches) and device slot locations.
3
Distinguish physical rack attributes from logical configuration parameters.
STP priorities, IP address pools, and OSI PDU encapsulations represent logical configuration settings rather than physical rack dimensions.
Logical attributes belong in network topology diagrams and IP address management documentation.

Anahtar Kavram

Rack Diagram Documentation
Soru 722Soru

An organization uses Open Shortest Path First (OSPF) as its primary interior gateway routing protocol to maintain connectivity to a remote branch office. A network administrator needs to implement a backup path using a static route over a secondary leased line. The backup path must remain inactive in the routing table under normal operations and automatically take over only if the OSPF path fails. Which configuration strategy satisfies this requirement?

Cevabı ve açıklamayı göster

Cevap: Configure the static route with an administrative distance higher than 110, such as 120.

Cevap

The static route should be configured with an administrative distance higher than OSPF's default value of 110 (such as 120) to create a floating static route.
Routers select paths based on Administrative Distance (AD) first when multiple sources provide routes to the same target subnet. Since OSPF routes have a default AD of 110 and standard static routes have a default AD of 1, configuring a static route with an AD higher than 110 (such as 120) ensures it remains inactive as a 'floating static route' until the OSPF route is withdrawn.

Adım Adım Çözüm

1
Identify the Administrative Distance (AD) of the primary dynamic routing protocol.
OSPF has a default Administrative Distance of 110110.
Routers use Administrative Distance to evaluate trustworthiness between different route sources before comparing metrics.
2
Determine the default Administrative Distance of a static route.
A standard static route has a default AD of 11, which would normally override OSPF (110110).
To prevent the static route from overriding OSPF during normal operations, its AD must be manually adjusted.
3
Configure a floating static route.
Assign an AD greater than 110110 (e.g., 120120) to the static route.
The router will prefer the OSPF route (AD 110110) and place it in the routing table. If the OSPF route disappears, the static route (AD 120120) becomes the best available path and is inserted into the routing table.

Anahtar Kavram

Floating Static Route and Administrative Distance Hierarchy
Tahmini Süre:1m 0s
Soru 723Soru

A system administrator is preparing to deploy IPv6 across a corporate local area network and is verifying basic IPv6 addressing standards and migration mechanisms. Which of the following statements regarding IPv6 addressing and deployment are correct? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Link-local addresses starting with the fe80::/10 prefix are automatically configured on IPv6-enabled interfaces to support local network segment communication.; Dual-stack deployment enables network devices to run IPv4 and IPv6 protocol suites simultaneously on the same physical network interface.

Cevap

The correct statements are that link-local addresses starting with fe80::/10 are automatically configured on IPv6-enabled interfaces for local segment communication, and dual-stack deployment allows running IPv4 and IPv6 simultaneously on the same interface.
Link-local addresses (fe80::/10) are mandatory auto-configured IPv6 addresses used for link-scoped communication. Additionally, dual-stack protocol operation allows network interfaces to process both IPv4 and IPv6 traffic concurrently during migration.

Adım Adım Çözüm

1
Evaluate link-local addressing characteristics
Link-local addresses use the prefix fe80::/10 and are automatically generated on every IPv6-capable interface for local subnet communication.
IPv6 mandates link-local scoping for neighbor discovery and basic local connectivity.
2
Verify IPv6 zero compression rules
The double colon (::) can only be used once per address to prevent ambiguous address expansion.
Multiple double colons make it impossible to determine the exact number of suppressed zeros in each position.
3
Examine dual-stack coexistence mechanics
Dual-stack allows dual-protocol operation on a single network interface.
It is the primary transition mechanism recommended for incremental IPv6 migration.
4
Identify DNS record types for IPv6
AAAA records are required for IPv6 host resolution, not A records.
A records map hostnames to 32-bit IPv4 addresses, whereas AAAA records map hostnames to 128-bit IPv6 addresses.

Anahtar Kavram

IPv6 Address Scoping, Compression Rules, and Dual-Stack Coexistence
Soru 724Soru

A network analyst is reviewing security baseline configurations across enterprise infrastructure servers. Match each network protocol on the left with its corresponding default transport protocol, port number, and primary operational function on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

LDAPS
SFTP
SNMP
RDP

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

LDAPS pairs with TCP 636 for secure directory services; SFTP pairs with TCP 22 for encrypted file transfers over SSH; SNMP pairs with UDP 161 for device polling; and RDP pairs with TCP 3389 for graphical remote desktop sessions.
Each network protocol correctly corresponds to its standard transport protocol, default port number, and administrative use case: LDAPS uses TCP 636 for secure directory services; SFTP uses TCP 22 for secure SSH file transfers; SNMP uses UDP 161 for device monitoring; and RDP uses TCP 3389 for graphical remote desktop connections.

Adım Adım Çözüm

1
Determine the transport protocol and port for secure LDAP (LDAPS).
LDAPS uses TCP port 636.
Standard unencrypted LDAP uses TCP port 389, whereas TLS-encrypted LDAPS uses TCP port 636.
2
Determine the transport protocol and port for SSH File Transfer Protocol (SFTP).
SFTP uses TCP port 22.
SFTP operates as an extension of SSH and relies on the default SSH port TCP 22.
3
Determine the transport protocol and port for Simple Network Management Protocol (SNMP) polling.
SNMP polling uses UDP port 161.
SNMP request and response messages between NMS managers and network device agents run over connectionless UDP port 161.
4
Determine the transport protocol and port for Remote Desktop Protocol (RDP).
RDP uses TCP port 3389.
Microsoft RDP utilizes TCP port 3389 to deliver interactive GUI remote administration.

Anahtar Kavram

Standard Network Ports and Transport Layer Protocols
Soru 725Soru

A network administrator is configuring firewall security rules between a Layer 3 router acting as a DHCP relay agent and a centralized DHCP server located at 10.10.10.25010.10.10.250. Workstations on a remote host VLAN generate broadcast DHCP lease requests that the router receives, but the relay agent fails to deliver the unicast requests to the DHCP server because firewall policies block the traffic. Which transport protocol and destination port combination must be permitted on the firewall for the relay agent to successfully forward client requests to the DHCP server?

Cevabı ve açıklamayı göster

Cevap: UDP port 67

Cevap

UDP port 67 must be allowed on the firewall to permit communication from the relay agent to the DHCP server.
DHCP servers receive incoming messages from both direct broadcast clients and unicast DHCP relay agents on UDP port 67. Allowing UDP port 67 on the intermediate firewall enables the relay agent to successfully forward the encapsulated request packets to the centralized server.

Adım Adım Çözüm

1
Identify the transport protocol used by DHCP services.
DHCP relies entirely on UDP for connectionless message delivery.
DHCP uses UDP to avoid protocol overhead during initial IP configuration.
2
Determine the destination port used by DHCP servers to receive requests.
The DHCP server listens on UDP port 67 for incoming requests from clients and relay agents.
Port 67 is designated for server-side processing, whereas port 68 is used by clients to receive responses.
3
Apply the firewall policy requirement for DHCP relay forwarding.
The firewall rule must permit UDP traffic targeted to destination port 67 on the DHCP server.
The relay agent converts client broadcasts into unicast UDP packets sent to port 67 of the DHCP server.

Anahtar Kavram

DHCP Relay Transport Protocol and Port Assignment
Soru 726Soru

An ON-site network technician is investigating a physical link failure between a wall outlet in a conference room and a switch located in the building's telecommunications closet. The technician needs to identify the precise wire pinouts, color coding standards, patch panel terminal punch-downs, and wall jack labeling schemes used for that specific horizontal cable run. Which of the following network documentation artifacts should the technician consult?

Cevabı ve açıklamayı göster

Cevap: Wiring schematic

Cevap

The technician should consult a wiring schematic, as it documents detailed physical cabling specifications including pinouts, color coding, wall jack designations, and terminal punch-downs.
A wiring schematic (or wiring diagram) is the specialized documentation artifact that details physical layer conductor pinouts, T568A/T568B color coding standards, wall plate jack IDs, and patch panel termination details for cabling runs.

Adım Adım Çözüm

1
Analyze the operational requirement from the scenario.
The technician specifically requires physical layer conductor details, wire pinouts, color codes, wall jack labels, and patch panel termination mappings.
Different network documentation types serve distinct operational purposes across Layer 1 physical layout, Layer 2/3 logical topology, and equipment rack layout.
2
Evaluate the purpose of a wiring schematic.
Wiring schematics and wiring diagrams focus explicitly on low-level physical wiring details, pin positions, T568A/T568B termination standards, and cable run endpoints.
This artifact directly supplies the pinout and termination information required to trace and repair the horizontal cable run.
3
Differentiate wiring schematics from logical diagrams, rack diagrams, and baselines.
Logical diagrams detail Layer 2/3 IP/VLAN topology, rack diagrams map rack unit space allocation, and baselines measure bandwidth/traffic performance metrics.
None of the alternative document types contain individual conductor color codes or wall outlet pinout specifications.

Anahtar Kavram

Wiring Schematics and Physical Cabling Documentation
Soru 727Soru

A enterprise network engineer is auditing a high-availability server cluster spanning two intermediate distribution frames (IDFs). During a simulated power failure on IDF-1, the secondary dual-homed database server lost network connectivity despite being physically connected to an uninterruptible power supply (UPS) in IDF-2. Upon investigation, the engineer discovers that the server's secondary network interface card (NIC) was patched into an unconfigured access port on a switch powered by a non-redundant PDU circuit, while the primary NIC was documented on VLAN 100 with 802.1Q trunking. To systematically rectify the physical layout, cable path, equipment mounting height, and logical subnet boundaries to prevent recurrence, which combination of documentation artifacts must the engineer update?

Cevabı ve açıklamayı göster

Cevap: Rack elevation diagrams, physical cable schedules, logical network topology diagrams, and port mapping documentation

Cevap

Rack elevation diagrams, physical cable schedules, logical network topology diagrams, and port mapping documentation
Addressing a complex multi-layer failure involving rack power distribution, physical switch patching, and logical VLAN/subnet boundaries requires updating four core documentation artifacts: rack elevation diagrams (for rack unit location and PDU power circuit mapping), physical cable schedules and port mappings (for exact physical patch connections and switch ports), and logical topology diagrams (for VLAN designations, subnets, and trunking pathways).

Adım Adım Çözüm

1
Analyze the physical rack power and mounting requirements.
Identified that rack elevation diagrams are needed to document equipment rack unit positions and PDU power circuit redundancy.
The failure involved a server connected to a non-redundant PDU circuit within the equipment rack.
2
Analyze physical patch cabling and port assignment needs.
Identified that cable schedules and port mapping documentation are required to record switch port destinations and physical cable runs between IDFs.
The secondary NIC was incorrectly patched into an unconfigured access port without proper records.
3
Analyze logical layer-2 and layer-3 network configurations.
Identified that logical network topology diagrams are required to document VLAN configurations, 802.1Q trunking, and IP subnets.
The primary interface relied on VLAN 100 trunking, which was missing on the secondary interface's port.

Anahtar Kavram

Comprehensive Network Documentation Artifacts (Physical vs. Logical Documentation)
Soru 728Soru

A network security administrator is selecting a centralized AAA protocol for managing corporate switches and firewalls. Organization security policies dictate that administrative sessions must use a connection-oriented transport protocol and encrypt the complete packet payload, including the header and body. Which protocol meets all specified requirements?

Cevabı ve açıklamayı göster

Cevap: TACACS+

Cevap

TACACS+ is the correct choice because it encrypts the entire packet payload and utilizes connection-oriented TCP port 49.
TACACS+ encrypts the complete body of every packet exchanged between the client network device and authentication server. In addition, it operates over connection-oriented TCP port 49, providing connection reliability and detailed command-by-command authorization controls.

Adım Adım Çözüm

1
Analyze encryption requirements specified in the scenario
The scenario requires full payload encryption (not just password obfuscation).
RADIUS encrypts only the password field, whereas TACACS+ encrypts the entire body of the packet.
2
Analyze transport protocol requirements specified in the scenario
The scenario mandates a connection-oriented transport protocol.
TCP provides connection-oriented reliability. TACACS+ uses TCP port 49, whereas RADIUS uses UDP ports 1812/1813.
3
Synthesize protocol characteristics to select the correct answer
TACACS+ fulfills both full payload encryption and TCP-based reliable transport.
TACACS+ decouples AAA components, encrypts all communication beyond the header, and runs over TCP.

Anahtar Kavram

RADIUS vs TACACS+ Protocol Feature Matrix
Soru 729Soru

A network administrator receives a critical zero-day vulnerability advisory affecting the operating system of two enterprise core switches configured as a high-availability active/standby pair. Applying the software patch requires a full reboot of the updated switch. To mitigate operational risk, preserve service uptime, and ensure rollback capability during this emergency maintenance, which of the following procedures represents the correct workflow for deploying the patch?

Cevabı ve açıklamayı göster

Cevap: Staging and validating the patch in an isolated lab environment, backing up the current running configurations, securing emergency Change Advisory Board (CAB) approval, applying the patch to the standby switch first, verifying standby health, failing over active traffic to the standby switch, and subsequently patching the former active switch.

Cevap

The correct operational approach is to validate the patch in a lab environment, back up current configurations, obtain emergency change approval, patch the standby switch first, perform a controlled failover, and then patch the remaining switch.
Safe network software maintenance in high-availability environments requires a structured workflow: pre-test in a lab environment, create baseline configuration backups, obtain proper change management authorization, patch the standby device first, verify stability, execute a controlled failover, and patch the remaining device. This guarantees network uptime and provides clear rollback procedures at every step.

Adım Adım Çözüm

1
Pre-deployment staging and backup
Patch compatibility is verified in a non-production lab environment, and current operational configurations are safely backed up to allow rapid restoration if needed.
Prevents deploying untested firmware directly to production infrastructure and establishes a known-good restore baseline.
2
Change control and standby updating
Emergency CAB approval is secured, and the patch is applied to the standby switch while the active switch continues processing production traffic.
Protects production uptime by ensuring active network traffic is unaffected while updating the redundant node.
3
Validation, failover, and active updating
The upgraded standby switch is confirmed healthy, active traffic is manually failed over to it, and the former active switch is updated to achieve version parity.
Validates the stability of the newly patched OS in production with minimal disruption before completing the patch across both nodes.

Anahtar Kavram

High-Availability Patch Management & Controlled Rollout Sequences
Tahmini Süre:2m 0s
Soru 730Soru

A network security administrator is tasked with deploying a solution to protect internal web servers from malicious payload attacks. The deployment requirements specify that the device must inspect passing packet payloads in real time and actively drop malicious packets before they reach the destination hosts. Which of the following system types and deployment modes should the administrator implement?

Cevabı ve açıklamayı göster

Cevap: An inline Network Intrusion Prevention System (NIPS) positioned directly in the network traffic path

Cevap

An inline Network Intrusion Prevention System (NIPS) positioned directly in the network traffic path
An inline Network Intrusion Prevention System (NIPS) sits directly in the flow of traffic. This in-band position allows it to analyze packet payloads and drop malicious packets before they traverse the rest of the network to reach target hosts.

Adım Adım Çözüm

1
Analyze the scenario requirements.
The requirement specifies deep packet payload inspection and real-time active inline dropping of malicious packets before destination delivery.
Understanding the need for active prevention versus passive notification dictates the system selection.
2
Compare Network Intrusion Detection (NIDS) and Network Intrusion Prevention (NIPS) architectures.
NIDS operates out-of-band (passive mode via SPAN/TAP), whereas NIPS operates in-band (inline mode).
Only an in-band NIPS device possesses the network positioning required to inspect and stop malicious traffic in real time.

Anahtar Kavram

NIPS vs NIDS placement architecture (In-band inline prevention vs out-of-band passive detection)
Soru 731Soru

A network administrator is investigating high latency and severe throughput degradation on a critical database server connected to switch port FastEthernet0/12. An inspection of the switch port statistics shows a high count of late collisions, alignment errors, and frame check sequence (FCS) errors on FastEthernet0/12 during heavy traffic periods. The switch interface is set to default auto-negotiation settings, whereas the server's network interface card (NIC) was recently manually forced to 100 Mbps Full Duplex. Which of the following is the most likely root cause of the late collisions recorded on the switch port?

Cevabı ve açıklamayı göster

Cevap: The switch interface defaulted to half-duplex operation after failing auto-negotiation with the forced full-duplex server NIC.

Cevap

The switch interface defaulted to half-duplex operation after failing auto-negotiation with the forced full-duplex server NIC.
When a network device interface is manually configured for full duplex without auto-negotiation enabled, the connected switch port set to auto-negotiation can detect the link speed (100 Mbps) via clock pulses, but fails to negotiate duplex parameters. Standard Ethernet behavior dictates that an auto-negotiating interface must default to half-duplex when duplex negotiation fails. Consequently, the server transmits whenever it has data (full duplex), while the switch expects half-duplex CSMA/CD rules. When the switch transmits while simultaneously receiving data from the server, the switch registers a collision after transmitting the first 64 bytes of the frame, logging a late collision.

Adım Adım Çözüm

1
Analyze the observed interface error counters.
Identified high counts of late collisions, FCS errors, and alignment errors on FastEthernet0/12.
Late collisions occur when a device transmits data after its collision window (first 64 bytes) has passed, which is a key indicator of a duplex mismatch.
2
Evaluate the configuration settings on both link endpoints.
The server NIC is forced to 100 Mbps Full Duplex, while the switch port relies on auto-negotiation.
IEEE 802.3 auto-negotiation requires both ends to participate. If one end is forced, the auto-negotiating end can sense speed (100 Mbps) but cannot determine duplex mode.
3
Apply Ethernet standard fallback rules for duplex negotiation.
The switch port sets its speed to 100 Mbps and defaults its duplex to half-duplex.
The default fallback for auto-negotiation when duplex cannot be negotiated is half-duplex. The server sends frames continuously (full-duplex), while the switch listens for line activity and detects collisions during its own transmissions, logging late collisions.

Anahtar Kavram

Ethernet Auto-Negotiation and Duplex Mismatch Symptoms
Soru 732Soru

A network technician is troubleshooting a newly installed server connected to VLAN 50 (192.168.50.0/24192.168.50.0/24). The server is configured to obtain IP settings dynamically but continually configures an IP address of 169.254.112.45169.254.112.45. The organization's centralized DHCP server is located on VLAN 10 (192.168.10.5192.168.10.5) and correctly services hosts on VLAN 10. Which of the following root causes and remediation steps accurately address this connectivity issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The router interface servicing VLAN 50 lacks a DHCP relay agent configuration, preventing broadcast DHCP requests from reaching the server on VLAN 10.; An IP helper address pointing to 192.168.10.5 must be configured on the VLAN 50 default gateway interface.

Cevap

The server is receiving an APIPA address (169.254.112.45169.254.112.45) because DHCP broadcast traffic from VLAN 50 is not traversing the router to the DHCP server on VLAN 10. To resolve this, a DHCP relay agent (IP helper address pointing to 192.168.10.5192.168.10.5) must be configured on the router interface for VLAN 50.
DHCP clients issue Layer 2 broadcast requests during discovery. Because routers block Layer 2 broadcasts by default, devices on VLAN 50 cannot reach the DHCP server on VLAN 10 unless a DHCP relay agent is enabled. Configuring an IP helper address on the router interface servicing VLAN 50 converts these local broadcasts into targeted unicast traffic sent to 192.168.10.5, allowing the server on VLAN 50 to receive an IP lease.

Adım Adım Çözüm

1
Analyze the IP address symptom (169.254.112.45169.254.112.45).
Recognize that the 169.254.0.0/16169.254.0.0/16 range represents APIPA, indicating the client sent DHCPDISCOVER requests but received no DHCP OFFER response.
When a DHCP client receives no response to its broadcast requests, the operating system self-assigns an APIPA address.
2
Examine the network topology boundaries between VLAN 50 and VLAN 10.
Identify that VLAN 50 (192.168.50.0/24192.168.50.0/24) and VLAN 10 (192.168.10.0/24192.168.10.0/24) are separated by a Layer 3 router.
Routers drop Layer 2 broadcast packets (like DHCPDISCOVER) by default unless explicitly configured to relay them.
3
Determine the required resolution to forward broadcast DHCP traffic across subnets.
Configure `ip helper-address 192.168.10.5` on the default gateway interface for VLAN 50.
The IP helper feature intercepts incoming DHCP broadcasts on the interface and unicasts them to the DHCP server IP specified.

Anahtar Kavram

DHCP Relay Agent (IP Helper) Operations and APIPA Diagnosis
Tahmini Süre:1m 30s
Soru 733Soru

A network engineer is troubleshooting an issue where hosts on VLAN 10 (10.45.8.0/2410.45.8.0/24) can ping their default gateway interface (10.45.8.110.45.8.1), but cannot establish TCP connections to an application cluster on VLAN 50 (10.45.50.0/2410.45.50.0/24). Diagnostic commands reveal that the intermediate Core-Router shows its OSPF adjacency with the Distribution Switch stuck in the EXSTART/EXCHANGE state across their interconnect subnet (10.45.200.0/3010.45.200.0/30). Additionally, large packet pings with the Don't Fragment (DF) bit set fail without receiving any diagnostic response. Which TWO of the following root causes or misconfigurations are most likely responsible for this behavior?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: An Maximum Transmission Unit (MTU) size mismatch exists between the connecting interface of the Core-Router and the Distribution Switch.; An Access Control List (ACL) on the router interface is explicitly dropping ICMP Type 3 Code 4 (Fragmentation Needed) packets.

Cevap

The MTU size mismatch on the interconnecting router interfaces and an ACL filtering ICMP Fragmentation Needed (Type 3, Code 4) packets.
An OSPF neighbor relationship stuck in EXSTART/EXCHANGE is a classic sign of an interface MTU mismatch between adjacent devices, as OSPF includes interface MTU in Database Description (DBD) packets. Furthermore, when large packets with the Don't Fragment (DF) bit set fail without an ICMP response, it indicates an Access Control List (ACL) is dropping ICMP Type 3 Code 4 (Destination Unreachable - Fragmentation Needed) packets, breaking Path MTU Discovery and causing silent packet drops.

Adım Adım Çözüm

1
Analyze OSPF Neighbor State
Neighbor stuck in EXSTART/EXCHANGE state indicates Database Description (DBD) packets are failing to transmit/receive across the neighbor link.
During EXSTART/EXCHANGE, routers exchange DBD packets. If interface MTUs differ, the router with the larger MTU sends DBD packets that the router with the smaller MTU drops, hanging the adjacency.
2
Analyze PMTUD and ICMP Behavior
Large packets with Don't Fragment (DF) set fail silently without ICMP responses.
When a router attempts to forward a packet exceeding interface MTU with the DF bit set, it must drop the packet and send an ICMP Type 3 Code 4 (Fragmentation Needed) back to the sender. Filtering this message in an ACL causes PMTUD black-holing.

Anahtar Kavram

OSPF Adjacency States, Interface MTU Mismatch, and Path MTU Discovery (PMTUD) ICMP Dependencies
Soru 734Soru

A network engineer is troubleshooting an issue where client computers can establish a basic TCP handshake with a remote application server across an IPsec VPN tunnel, but bulk data transfers fail or time out. The engineer suspects that packets exceeding the tunnel's Maximum Transmission Unit (MTU) are being dropped because path MTU discovery is failing.

Which of the following command-line utility commands should the engineer run on a Windows workstation to test reachability while setting the Don't Fragment flag to identify the maximum unfragmented payload size?

Cevabı ve açıklamayı göster

Cevap: ping -f -l 1472 172.16.10.50

Cevap

Running 'ping -f -l 1472 172.16.10.50' sends an ICMP echo request with the Don't Fragment bit enabled (-f) and a specific payload size (-l 1472), allowing the engineer to determine the maximum MTU that can pass without fragmentation.
The option specifying 'ping -f -l 1472 172.16.10.50' is correct because on Windows systems, '-f' instructs the operating system to set the Don't Fragment (DF) bit in the IP header, and '-l' defines the buffer size. This allows administrators to test path MTU limits and detect where packet fragmentation failures occur.

Adım Adım Çözüm

1
Identify the diagnostic objective.
The goal is to determine if network packets exceeding a certain byte size are being dropped due to fragmentation restrictions along the path.
VPN encapsulation adds overhead, reducing the usable MTU size below the standard 1500 bytes.
2
Select the utility and appropriate flags for path MTU testing on Windows.
The 'ping' utility supports the '-f' switch to set the Don't Fragment (DF) flag in the IPv4 header and the '-l' switch to set the ICMP payload size in bytes.
If a router along the path needs to fragment the packet but the DF bit is set, it drops the packet and returns an ICMP 'Fragmentation Needed and DF Set' message (or silently drops it if ICMP is blocked).
3
Calculate payload size relative to MTU.
An ICMP payload of 1472 bytes plus 20 bytes of IP header and 8 bytes of ICMP header equals a total packet size of 1500 bytes.
Incrementally decreasing the payload value using '-l' pinpoints the exact MTU threshold supported across the VPN tunnel.

Anahtar Kavram

Path MTU Discovery using ICMP ping options (-f for Don't Fragment, -l for payload length)
Tahmini Süre:1m 15s
Soru 735Soru

An enterprise organization deploys two Layer 3 core switches, Core-A and Core-B, to provide default gateway redundancy for VLAN 10 (192.168.10.0/24192.168.10.0/24) using VRRPv3. Core-A is configured as the VRRP Master with a priority of 110, while Core-B acts as the Backup with a priority of 100. Preemption is enabled on both routers. To prevent black-holing traffic if Core-A loses its WAN connection, an interface tracking object is configured on Core-A to decrement its VRRP priority by 20 upon WAN uplink failure. Core-A is also manually configured as the Spanning Tree Protocol (STP) Primary Root Bridge for VLAN 10.

During a WAN link failure test on Core-A, tracking successfully decrements Core-A's priority to 90, and Core-B transitions to the VRRP Master state. However, telemetry shows that outbound host traffic from VLAN 10 experiences significant path latency and traverses the inter-switch trunk twice before leaving the network.

Which of the following root causes best explains why traffic is traversing the inter-switch trunk redundantly following the failover?

Cevabı ve açıklamayı göster

Cevap: Core-A remains the STP Root Bridge for VLAN 10, forcing access switches to continue forwarding Layer 2 traffic to Core-A first, which must then relay frames across the trunk to Core-B.

Cevap

Core-A remains the STP Root Bridge for VLAN 10, forcing access switches to continue forwarding Layer 2 traffic to Core-A first, which must then relay frames across the trunk to Core-B.
First Hop Redundancy Protocols (such as VRRP or HSRP) manage Layer 3 gateway availability but do not automatically adjust Layer 2 Spanning Tree Protocol (STP) topologies. When Core-A loses its WAN uplink, interface tracking lowers its VRRP priority, allowing Core-B to become the active gateway. However, Core-A remains the STP Root Bridge for VLAN 10. Access switches continue forwarding frames to Core-A according to the STP active topology. Upon receiving these frames, Core-A must forward them across the inter-switch trunk to Core-B (the active VRRP Master), which performs the routing out to the external network. To prevent this 'traffic hairpinning' or 'tromboning', STP bridge priorities should be aligned or tracked alongside FHRP state changes.

Adım Adım Çözüm

1
Analyze the state of the First Hop Redundancy Protocol (VRRP) after the WAN link failure.
Core-A's priority decremented from 110 to 90 via interface tracking. Core-B (priority 100) successfully preempted and became the VRRP Master, taking ownership of the Virtual IP (VIP) and Virtual MAC address.
Tracking mechanism functions as designed at Layer 3 to transfer default gateway routing responsibility.
2
Analyze the state of Spanning Tree Protocol (STP) after the WAN link failure.
STP operates independently of VRRP. Core-A's bridge priority was not modified by the VRRP interface tracking event, so Core-A remains the STP Primary Root Bridge for VLAN 10.
FHRP protocol state changes do not dynamically update Layer 2 STP bridge priorities.
3
Trace the path of an outbound frame sent by a host on VLAN 10.
1. Host resolves the default gateway VIP to the VRRP Virtual MAC.
2. Access switch receives the frame destined for Virtual MAC and sends it toward the Layer 2 STP Root (Core-A).
3. Core-A receives the frame, recognizes it does not own the active Virtual MAC state, and bridges it over the trunk to Core-B.
4. Core-B receives the frame and routes it out its functional WAN interface.
Misalignment between the Layer 2 STP Root Bridge and Layer 3 FHRP Master creates hairpinned/tromboned traffic across the inter-switch trunk.

Anahtar Kavram

Alignment of Layer 2 Spanning Tree Protocol (STP) Root Bridge role with Layer 3 First Hop Redundancy Protocol (FHRP) Active/Master state
Tahmini Süre:2m 0s
Soru 736Soru

A network administrator is designing a centralized access control solution for managing network infrastructure devices, such as switches and routers. The security policy requires that the authorization component must be completely decoupled from authentication, allowing custom command-level access privileges per user group. Additionally, the entire protocol payload, including all administrative commands transmitted during interactive sessions, must be encrypted over a reliable connection. Which protocol best satisfies all of these requirements?

Cevabı ve açıklamayı göster

Cevap: TACACS+

Cevap

TACACS+ is the correct choice because it encrypts the entire body of the packet, uses reliable TCP transport (port 49), and separates authentication and authorization processes to allow granular command-level access controls.
The protocol that meets all listed requirements is TACACS+. It operates over TCP port 49, provides full packet body encryption (protecting both credentials and command payloads), and explicitly separates authentication, authorization, and accounting functions, allowing administrators to restrict and authorize individual CLI commands per user group.

Adım Adım Çözüm

1
Analyze protocol encryption requirements.
The requirement calls for full payload encryption during administrative sessions. TACACS+ encrypts the entire packet payload, whereas RADIUS only encrypts the user password.
Protecting command execution and authorization traffic requires full transport/payload encryption.
2
Analyze AAA functional decoupling requirements.
TACACS+ decouples Authentication, Authorization, and Accounting, allowing per-command authorization checks independently of the authentication mechanism.
RADIUS combines authentication and authorization into single Access-Request/Access-Accept exchanges, making granular command-by-command authorization difficult.
3
Evaluate transport layer reliability.
TACACS+ operates over TCP port 49, providing connection-oriented reliability for device management.
Connection reliability ensures administrative commands are accurately acknowledged and logged without UDP packet loss issues.

Anahtar Kavram

AAA Protocol Differentiation (RADIUS vs. TACACS+)
Soru 737Soru

A network administrator is tasked with deploying a centralized AAA solution specifically for administrative CLI access to enterprise network switches. The security baseline mandates that all administrative command authorization details and session logs transmitted between the switches and the AAA server must have their entire packet payloads encrypted. Additionally, the authentication service must operate over a connection-oriented transport protocol to guarantee packet delivery. Which protocol and default port configuration should the administrator implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: TACACS+ using TCP port 49

Cevap

TACACS+ using TCP port 49
TACACS+ (Terminal Access Controller Access-Control System Plus) separates Authentication, Authorization, and Accounting into distinct functions, encrypts the entire packet payload (beyond the header), and runs over TCP port 49. This makes it ideal for administrative device access control where full command encryption and connection reliability are mandatory.

Adım Adım Çözüm

1
Analyze transport protocol requirements
The requirement specifies a reliable, connection-oriented transport layer protocol, which points to TCP rather than connectionless UDP.
TCP guarantees delivered segments via acknowledgments, whereas UDP is connectionless and unacknowledged.
2
Evaluate payload encryption capabilities of AAA protocols
TACACS+ encrypts the complete packet payload (everything after the TACACS+ header), whereas RADIUS only encrypts the password attribute in Access-Request packets.
Full payload encryption protects sensitive authorization commands and accounting details in transit.
3
Map protocol to standard port numbers
TACACS+ operates over TCP port 49. RADIUS uses UDP ports 1812 (Authentication) and 1813 (Accounting) or legacy UDP 1645/1646.
Matching the correct protocol, transport protocol, and standard port identifier confirms the required configuration.

Anahtar Kavram

RADIUS vs TACACS+ Protocol Feature Differentiation & Transport Requirements
Soru 738Soru

A network administrator is updating core switch configurations to align with a security mandate requiring both cryptographic authentication and full payload encryption for network monitoring traffic. The legacy implementation relies on unencrypted management queries using community strings. Which protocol version and security level combination should the administrator configure to meet this mandate?

Cevabı ve açıklamayı göster

Cevap: SNMPv3 with authPriv security level

Cevap

SNMPv3 configured with the authPriv security level is required because it provides both cryptographic authentication and data privacy through payload encryption.
SNMPv3 with the authPriv (Authentication and Privacy) security level uses cryptographic hashing (such as SHA) for authentication and symmetric encryption algorithms (such as AES) to encrypt all management payloads. This satisfies the requirement for authenticated access and encrypted telemetry.

Adım Adım Çözüm

1
Identify the mandate requirements
The requirement specifies cryptographic authentication AND full payload encryption.
Security policies for administrative network monitoring often require protection against both spoofing and eavesdropping.
2
Evaluate Simple Network Management Protocol (SNMP) security models
SNMPv1 and SNMPv2c use cleartext community strings (noPriv/noAuth). SNMPv3 introduces USM with three security levels: noAuthNoPriv, authNoPriv, and authPriv.
Only SNMPv3 features modern User-based Security Model (USM) capabilities.
3
Select the SNMPv3 level matching both authentication and privacy requirements
authPriv offers authentication (using MD5/SHA) and privacy/encryption (using DES/AES).
authNoPriv lacks payload privacy (encryption), while authPriv fulfills both criteria.

Anahtar Kavram

SNMPv3 Security Models (authPriv vs authNoPriv)
Soru 739Soru

A network administrator is configuring centralized event logging on core switches using the standard Syslog protocol. Which port and transport protocol combination does standard Syslog use by default to transmit log messages to a central log server?

Cevabı ve açıklamayı göster

Cevap: UDP port 514

Cevap

Standard Syslog defaults to using UDP port 514 for sending log messages to a central server.
Standard Syslog logging services default to using UDP port 514 to transmit system notifications and log messages from network devices to a centralized log host.

Adım Adım Çözüm

1
Identify the primary service and protocol being configured.
The target service is centralized event logging via standard Syslog.
The scenario asks specifically for the default transport specifications of Syslog.
2
Recall the standard transport protocol and well-known port number for Syslog.
Standard Syslog messages are sent unencrypted over User Datagram Protocol (UDP) on port 514.
Syslog was designed as a lightweight, connectionless log transport mechanism using UDP port 514.

Anahtar Kavram

Syslog Protocol Transport and Port Configuration
Soru 740Soru

A network administrator is implementing TACACS+ for centralized administration of network routers and switches. Which TWO of the following are distinct operational characteristics of the TACACS+ protocol?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Encrypts the entire payload of the packet; Operates over TCP port 49 for transport

Cevap

TACACS+ encrypts the entire payload of the packet and operates over TCP port 49.
TACACS+ is designed for network device administration, encrypting the entire packet payload and using TCP port 49 for reliable transport.

Adım Adım Çözüm

1
Determine the transport layer protocol and port number for TACACS+.
TACACS+ uses TCP port 49.
Connection-oriented TCP ensures reliable transmission of administrative commands and AAA traffic.
2
Identify the encryption capability of TACACS+ compared to RADIUS.
TACACS+ encrypts the entire packet payload.
Full packet payload encryption protects administrative credentials and command data from eavesdropping.

Anahtar Kavram

TACACS+ AAA Protocol Characteristics
ÖncekiSayfa 37 / 112Sonraki
Tüm alıştırma soruları — CompTIA Network+ | Examkin