Tüm alıştırma soruları

2237 soru

Tüm türler2,237 Çoktan seçmeli1,150 Çoklu seçim488 Sayısal30 Eşleştirme350 Sıralama201 Kısa cevap18

A network engineer is establishing a telemetry and metric collection framework across core switches over an unencrypted management network segment. The solution must support cryptographic authentication and payload encryption for device health polling, as well as low-overhead flow statistics collection for monitoring bandwidth usage across interfaces. Which of the following protocol configurations should the engineer implement? (Select TWO.)

Geçerli olan tümünü seçin

SNMPv3 configured with the authPriv security level for polling core device health and metric status.

IPFIX using UDP transport to export flow statistics and bandwidth utilization metrics.

SNMPv2c configured with read-only community strings to encrypt metric payloads transmitted to the monitoring system.

SNMPv3 configured over TCP port 162 to enable connection-oriented transport for regular agent polling queries.

Cevabı ve açıklamayı göster

Cevap: SNMPv3 configured with the authPriv security level for polling core device health and metric status.; IPFIX using UDP transport to export flow statistics and bandwidth utilization metrics.

Cevap

The engineer should implement SNMPv3 with authPriv security level for polling device health and metrics, and IPFIX over UDP transport for exporting flow-level bandwidth statistics.

Selecting SNMPv3 with authPriv ensures that device management metrics and authentication credentials are encrypted using modern algorithms (such as AES) over untrusted links. Concurrently, using IPFIX over UDP provides low-overhead flow telemetry for capturing traffic metrics across switch interfaces without imposing heavy TCP session management costs.

Adım Adım Çözüm

Identify the security requirements for device health metric polling over unencrypted management networks.

SNMPv3 with authPriv is required because it enforces both cryptographic authentication and data encryption (privacy).

SNMPv1 and SNMPv2c lack payload encryption and transmit credentials in cleartext.

Determine the optimal telemetry mechanism for detailed flow and interface utilization monitoring.

IPFIX over UDP provides scalable, low-overhead push-based flow telemetry for tracking bandwidth utilization.

Flow telemetry protocols like IPFIX stream IP network traffic information efficiently without the overhead of heavy transport layer setups.

Anahtar Kavram

Network Performance Monitoring and Telemetry Protocols

Tahmini Süre:1m 30s

Soru 1422Soru →

A network administrator is troubleshooting an issue where an application host with IPv4 address $192.168.4.25/24$ cannot transmit HTTPS management data to a target server at $10.200.5.50/24$ . Diagnostic tests reveal that the host can successfully ping its default gateway ( $192.168.4.1$ ), but a traceroute to $10.200.5.50$ stops at $192.168.4.1$ . Inspecting the gateway router shows the following configuration details:

text
ip route 10.200.5.0 255.255.255.0 192.168.4.1
access-list 105 permit udp host 192.168.4.25 host 10.200.5.50 eq 514

Which TWO of the following factors explain why HTTPS traffic (TCP port 443) fails to reach the destination? (Select TWO.)

Geçerli olan tümünü seçin

The static route entry uses the gateway router's local LAN IP address as the next hop rather than the upstream router's IP address.

The access control list lacks an explicit permit rule for TCP port 443, resulting in the traffic being blocked by the implicit deny.

The host IP address and its configured default gateway IP address reside on different usable subnets.

The destination IP address belongs to the same VLAN broadcast domain and must be reached via Layer 2 switching without routing.

Cevabı ve açıklamayı göster

Cevap: The static route entry uses the gateway router's local LAN IP address as the next hop rather than the upstream router's IP address.; The access control list lacks an explicit permit rule for TCP port 443, resulting in the traffic being blocked by the implicit deny.

Cevap

The routing failure occurs because the static route incorrectly references the local gateway's own interface IP address (

192.168.4.1

) as the next hop, and the Access Control List lacks a permit statement for TCP port 443, causing HTTPS packets to be dropped by the ACL implicit deny.

The issue stems from two distinct network layer misconfigurations: first, pointing a static route next hop to the router's own inbound interface IP address prevents proper forwarding to the next router; second, ACL 105 only permits UDP port 514 traffic, meaning TCP port 443 traffic hits the implicit deny rule at the end of the ACL.

Adım Adım Çözüm

Analyze the static route statement: 'ip route 10.200.5.0 255.255.255.0 192.168.4.1'.

Identify that 192.168.4.1 is the router's local LAN interface address, which is invalid as a next hop for outgoing traffic.

Static routes must point to a remote next-hop IP address on an adjacent router interface or an egress interface identifier.

Analyze the Access Control List: 'access-list 105 permit udp host 192.168.4.25 host 10.200.5.50 eq 514'.

Determine that only UDP syslog traffic (port 514) is explicitly permitted.

Standard ACL processing matches top-down and drops unmatched traffic at the final implicit deny all statement, blocking TCP port 443 (HTTPS).

Anahtar Kavram

Troubleshooting Static Routes and ACL Rules

Soru 1423Soru →

A network administrator receives complaints about choppy audio and voice distortion during real-time VoIP sessions between two branch offices. Network monitoring shows low overall bandwidth utilization and an average round-trip latency of 30 ms, but packet inter-arrival times fluctuate wildly between 2 ms and 110 ms. Which performance metric is primarily degrading call quality, and which monitoring mechanism provides granular flow-level visibility to analyze this traffic?

Jitter is the primary metric degrading quality; NetFlow / IPFIX should be deployed for detailed flow-level telemetry.

Throughput is the primary metric degrading quality; SNMPv1 standard interface polling should be deployed for detailed flow-level telemetry.

Bandwidth saturation is the primary metric degrading quality; Syslog log forwarding over Telnet port 23 should be deployed for detailed flow-level telemetry.

Latency is the primary metric degrading quality; TCP handshake round-trip timing should be deployed for detailed flow-level telemetry.

Cevabı ve açıklamayı göster

Cevap: Jitter is the primary metric degrading quality; NetFlow / IPFIX should be deployed for detailed flow-level telemetry.

Cevap

Jitter is the primary metric degrading call quality; NetFlow / IPFIX should be deployed for detailed flow-level telemetry.

Jitter measures the fluctuation in packet delay (inter-arrival time variance). In VoIP networks, high jitter causes playout buffer underflows or overflows, resulting in choppy audio. NetFlow and IPFIX capture per-flow metadata across network devices, allowing engineers to isolate voice streams and evaluate packet metrics.

Adım Adım Çözüm

Analyze the observed symptoms and network metrics.

Bandwidth utilization is low and average latency is 30 ms (acceptable for VoIP), but packet inter-arrival times fluctuate significantly between 2 ms and 110 ms.

Variation in inter-arrival delay is defined as jitter, which directly impacts real-time voice reconstruction in playout buffers.

Identify the appropriate monitoring mechanism for granular traffic stream analysis.

NetFlow / IPFIX exports flow metadata (IP addresses, ports, TOS/DSCP tags, packet counts, inter-packet timing), enabling traffic analysis of individual voice streams.

SNMP interface counters only show aggregate traffic volume per interface, whereas flow telemetry provides individual session visibility.

Anahtar Kavram

VoIP Performance Metrics and Flow Telemetry

Soru 1424Soru →

A network security administrator is analyzing recorded security incident logs and anomaly reports across enterprise infrastructure. Match each observed security incident on the left to the corresponding network attack vector on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Incident 1 matches Smurf Attack, Incident 2 matches BGP Hijacking, Incident 3 matches Double-Tagging VLAN Hopping, and Incident 4 matches SSL Stripping.

Each attack vector directly aligns with its specific network manifestation: broadcast ICMP amplification reflects as a Smurf attack; forged routing prefix announcements constitute BGP hijacking; dual 802.1Q tag exploitation corresponds to double-tagging VLAN hopping; and interception that downgrades TLS/HTTPS to cleartext HTTP represents SSL stripping.

Adım Adım Çözüm

Analyze incident 1 involving ICMP Echo Reply flooding following a broadcast request.

Identify this mechanism as a Smurf attack.

Smurf attacks leverage ICMP broadcast amplification with a spoofed victim source address.

Analyze incident 2 involving malicious route announcements rerouting IP prefix traffic.

Identify this mechanism as Border Gateway Protocol (BGP) Hijacking.

Manipulating prefix announcements in BGP forces internet traffic through unauthorized Autonomous Systems.

Analyze incident 3 involving nested 802.1Q VLAN headers.

Identify this mechanism as Double-Tagging VLAN Hopping.

The outer tag matches the native VLAN and is removed by the switch, allowing the frame with the second tag to reach another VLAN without routing.

Analyze incident 4 involving the downgrade of encrypted HTTPS traffic to unencrypted HTTP.

Identify this mechanism as SSL Stripping.

SSL stripping forces secure web connections down to unencrypted HTTP so an on-path adversary can read data.

Anahtar Kavram

Common Network Attack Types and Vectors

Soru 1425Soru →

A network technician is troubleshooting an intermittent 10GBASE-LR single-mode fiber optic backbone link between two core switches. Interface telemetry reveals elevated bit error rates (BER) and an optical receiver power level well below the specified threshold. Which TWO of the following diagnostic steps or tools should the technician use to isolate the physical layer defect?

Geçerli olan tümünü seçin

Measure the optical power loss across the link using an optical power meter calibrated to the 1310 nm operating wavelength.

Inspect the fiber connector ferrule end-faces using a specialized fiber inspection probe to check for dust or surface scratches.

Connect a copper Time Domain Reflectometer (TDR) to locate split pair conditions along the cabling run.

Use a tone generator and probe kit to trace the conductors and verify T568B pinout color coding.

Cevabı ve açıklamayı göster

Cevap: Measure the optical power loss across the link using an optical power meter calibrated to the 1310 nm operating wavelength.; Inspect the fiber connector ferrule end-faces using a specialized fiber inspection probe to check for dust or surface scratches.

Cevap

The technician should measure optical loss using an optical power meter calibrated to 1310 nm and inspect the fiber end-faces with a fiber inspection scope.

Measuring optical attenuation with an optical power meter set to 1310 nm directly quantifies signal loss on single-mode fiber links, while using a fiber inspection scope inspects connector end-faces for microscopic contamination or scratches that cause high insertion loss.

Adım Adım Çözüm

Identify the media type and reported symptoms.

The link uses 10GBASE-LR single-mode fiber operating at 1310 nm, experiencing low optical power and high BER.

Choosing the appropriate physical troubleshooting tools requires matching tools to optical fiber media characteristics rather than copper twisted-pair.

Evaluate optical signal testing methods.

An optical power meter (OPM) calibrated for 1310 nm verifies actual light levels arriving at the receiver.

OPMs measure absolute optical power and signal attenuation against baseline standards.

Evaluate physical connector inspection requirements.

A fiber inspection scope allows visual verification of the polished ferrule surface.

Microscopic dust, oils, or scratches on fiber end-faces attenuate light signals and introduce optical return loss.

Anahtar Kavram

Fiber Optic Physical Layer Diagnostics and Tool Selection

Soru 1426Soru →

Following an internal security assessment, a system administrator is tasked with securing the administrative management plane of a core network switch against unauthorized remote access and brute-force authentication attacks. Which of the following hardening practices should the administrator implement on the device? (Select TWO.)

Geçerli olan tümünü seçin

Configure virtual terminal (VTY) lines to accept SSH connections exclusively while disabling cleartext Telnet access.

Reassign the SSH daemon listening port to standard TCP port 23 to obfuscate administrative services from external network probes.

Deploy SNMPv2c with read-only community strings on the management interface to secure remote telemetry monitoring.

Assign the switch management interface to the default untagged Native VLAN to ensure administrative access across all trunk links.

Implement local user login lockout thresholds and rate limiting for consecutive failed administrative authentication attempts.

Cevabı ve açıklamayı göster

Cevap: Configure virtual terminal (VTY) lines to accept SSH connections exclusively while disabling cleartext Telnet access.; Implement local user login lockout thresholds and rate limiting for consecutive failed administrative authentication attempts.

Cevap

The administrator should restrict VTY lines exclusively to encrypted SSH transport and establish local user account lockout thresholds to limit failed authentication attempts.

Hardening the administrative management plane requires restricting virtual terminal (VTY) access to SSH to guarantee encrypted communication, alongside configuring local account lockout thresholds to block brute-force authentication attacks.

Adım Adım Çözüm

Evaluate remote management protocol security controls.

Identify that Telnet broadcasts credentials in plaintext and must be replaced by SSH on VTY lines.

Cryptographic protection of management sessions prevents network interception and packet sniffing of administrative credentials.

Identify protection mechanisms against automated authentication attacks.

Implement account lockout controls and attempt limits for administrative logins.

Lockout thresholds stop brute-force script attempts from trying large numbers of password combinations sequentially.

Anahtar Kavram

Device Management Plane Hardening Best Practices

Soru 1427Soru →

A network technician is troubleshooting a wireless point-to-point bridge between two campus buildings situated 250 meters apart. Following a storm, maintenance crews re-anchored the directional antenna on Building B. Although there is a completely clear line of sight and transmit power settings remain unchanged on both units, the received signal strength indicator (RSSI) has dropped significantly from -58 dBm to -80 dBm. Inspection reveals that the antenna on Building A remains oriented with vertical polarization, whereas the antenna on Building B was reinstalled turned 90 degrees in horizontal polarization. Which of the following is the primary cause of the link degradation?

Antenna polarization mismatch between the transmitter and receiver

Co-channel interference from overlapping 2.4 GHz channels on neighboring access points

Subnet gateway misconfiguration on the wireless bridge interface

Automatic Private IP Addressing (APIPA) fallback on the bridge wireless management card

Cevabı ve açıklamayı göster

Cevap: Antenna polarization mismatch between the transmitter and receiver

Cevap

Antenna polarization mismatch between the transmitter and receiver is the primary cause of the severe RSSI drop.

Wireless signals travel as electromagnetic waves oriented in a specific spatial plane (polarization). For maximum energy transfer, directional bridge antennas must share the same polarization alignment. A 90-degree alignment difference between vertical and horizontal polarization introduces cross-polarization discrimination loss, typically causing a 20 dB to 30 dB drop in received signal power.

Adım Adım Çözüm

Analyze the physical and RF symptoms reported in the scenario.

The visual line of sight is clear, distance is unchanged, and transmit power settings are identical, yet RSSI dropped by 22 dB after physical reinstallation.

This isolates the problem to a physical radio antenna installation parameter rather than path distance, attenuation obstacles, or radio transmit power.

Evaluate the orientation difference between the two directional antennas.

Building A utilizes vertical polarization while Building B's antenna was rotated 90 degrees to horizontal polarization.

Radio waves propagate with electric field vectors aligned to the antenna orientation. Mismatched polarization planes between transmitter and receiver cause significant signal loss (typically 20 dB or more).

Select the correct root cause matching the physical findings.

Antenna polarization mismatch correctly accounts for the dramatic drop in RSSI.

Aligning both antennas back to the same spatial polarization plane (both vertical or both horizontal) will restore full RSSI.

Anahtar Kavram

Antenna Polarization and Alignment in Wireless Systems

Soru 1428Soru →

Match each wireless security standard to its corresponding cryptographic cipher and integrity mechanism.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

WEP corresponds to RC4 stream cipher with 24-bit IV and CRC-32. WPA corresponds to TKIP with the Michael algorithm. WPA2 corresponds to AES with CCMP. WPA3 corresponds to SAE key exchange with AES-GCMP encryption.

Each wireless security standard aligns with a specific generation of encryption ciphers and integrity mechanisms: WEP uses basic RC4 with a 24-bit IV, WPA introduced TKIP with the Michael MIC, WPA2 mandated AES-CCMP, and WPA3 upgraded authentication to SAE with modern AES-GCMP ciphers.

Adım Adım Çözüm

Identify legacy and deprecated legacy standards (WEP and WPA)

WEP uses RC4 with a 24-bit IV and CRC-32. WPA upgrades this by introducing TKIP and the Michael algorithm.

WEP was vulnerable due to small static keying flaws, leading WPA to implement per-packet keying via TKIP while retaining hardware compatibility.

Identify modern standards (WPA2 and WPA3)

WPA2 standardizes AES-CCMP encryption. WPA3 advances authentication with SAE and utilizes AES-GCMP.

WPA2 required dedicated hardware upgrades for AES-CCMP processing, while WPA3 enforces protected management frames, SAE, and stronger GCMP ciphers.

Anahtar Kavram

Evolution of Wireless Encryption Protocols and Integrity Controls

Soru 1429Soru →

A network operations team is preparing to modify BGP path selection attributes across enterprise border routers to optimize traffic flow. Place the steps of the standard change management process in the correct order from initial proposal to final completion.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational order for change management is: 1) Submit a detailed Request for Change (RFC) document detailing the proposed BGP modifications, potential business impact, and a clear rollback plan -> 2) Present the RFC to the Change Advisory Board (CAB) for formal review, risk assessment, and deployment authorization -> 3) Validate and test the BGP route policy updates in an isolated lab environment to ensure configuration syntax and expected traffic steering behavior -> 4) Apply the BGP configuration changes to the production border routers during an authorized maintenance window -> 5) Perform post-implementation verification testing and update the official enterprise network configuration baseline documentation.

A structured change management process follows a strict sequence: defining the scope and rollback plan in an RFC, securing stakeholder approval from the CAB, staging and testing in a lab, applying changes during an authorized maintenance window, and concluding with verification and documentation baseline updates.

Adım Adım Çözüm

Identify the initial phase of the change management lifecycle.

Creating and submitting the Request for Change (RFC) with complete documentation (scope, risk analysis, rollback plan) occurs first.

Changes cannot be evaluated or scheduled without a formally documented proposal.

Determine the governing authorization step.

Presenting the RFC to the Change Advisory Board (CAB) for approval occurs second.

Stakeholders and management must authorize the change and approve the scheduled timeline before implementation activities proceed.

Identify pre-deployment validation procedures.

Testing and staging the configuration in a lab/sandbox environment occurs third.

Technical validation confirms command syntax and behavior before touching production systems.

Identify the execution phase.

Deploying changes to production network devices during the scheduled maintenance window occurs fourth.

Implementation must occur within approved outage/maintenance windows to protect service availability.

Identify the final wrap-up activities.

Performing post-implementation verification and updating configuration baselines occurs fifth.

Confirming functional status and recording the new state into documentation prevents configuration drift and closes out the change.

Anahtar Kavram

Structured Change Management Lifecycle

Tahmini Süre:1m 30s

Soru 1430Soru →

A network technician is investigating poor application throughput and significant packet loss on an enterprise host connected to switch interface FastEthernet 0/12. Output from the switch console reveals a high count of late collisions, frame check sequence (FCS) errors, and deferred transmissions on the port. A review of device settings shows that the host network interface card (NIC) was manually forced to 100 Mbps Full Duplex, while the connected switchport is configured with default auto-negotiation parameters. Which of the following best explains the root cause of this performance issue?

The switchport failed auto-negotiation, defaulting to half-duplex mode and creating a duplex mismatch with the full-duplex host.

The switchport's 802.1Q native VLAN is mismatched with the untagged management VLAN assigned to the host NIC.

The switchport is experiencing Spanning Tree Protocol (STP) topology change notifications due to an invalid STP root bridge priority setting.

The host is attempting to communicate with devices on another VLAN without an operational Layer 3 routing interface.

Cevabı ve açıklamayı göster

Cevap: The switchport failed auto-negotiation, defaulting to half-duplex mode and creating a duplex mismatch with the full-duplex host.

Cevap

The switchport failed auto-negotiation, defaulting to half-duplex mode and creating a duplex mismatch with the full-duplex host.

When an Ethernet interface configured for auto-negotiation connects to a link partner configured for forced (manual) full-duplex, auto-negotiation fails to detect the duplex mode. By IEEE standard convention, the auto-negotiation interface sets its speed using parallel detection but defaults its duplex setting to half-duplex. This mismatch causes the full-duplex side to transmit at will while the half-duplex side detects collisions during transmission after the standard 64-byte slot time (late collisions), leading to FCS errors and severe throughput degradation.

Adım Adım Çözüm

Analyze the interface statistics and configuration settings.

The switch interface records late collisions and FCS errors, while the host NIC is set to forced 100 Mbps Full Duplex and the switch port is set to Auto-Negotiation.

Late collisions are a signature symptom of a duplex mismatch on an Ethernet segment.

Apply Ethernet auto-negotiation standard behavior rules (IEEE 802.3).

Because the host NIC does not transmit auto-negotiation pulses, the switch cannot negotiate duplex and falls back to half-duplex mode.

Standard Ethernet auto-negotiation defaults to half-duplex when speed can be sensed via parallel detection but duplex cannot be negotiated.

Determine the impact of half-duplex operating against full-duplex.

The host transmits whenever it has data ready (full-duplex), while the switch listens before transmitting and senses collisions after the 64-byte window (late collisions), causing corrupted frames and FCS errors.

This confirms a duplex mismatch as the root cause.

Anahtar Kavram

Duplex Mismatch Troubleshooting & Auto-Negotiation Fallback Rules

Soru 1431Soru →

A network administrator configures a new extended IPv4 Access Control List (ACL) on a router interface serving an R&D subnet ( $172.16.30.0/24$ ). The administrator creates specific rules to permit hosts on this subnet to access an internal file server ( $10.5.5.10$ ) via FTP. Immediately after applying the ACL inbound on the interface, users on the $172.16.30.0/24$ subnet report that they have lost connectivity to the internet and all other company subnets. What is the primary cause of this widespread connectivity failure?

The ACL ends with an invisible implicit deny statement that drops all traffic not explicitly permitted by preceding rules.

Applying an inbound ACL forces the router to reset its Port Address Translation (PAT) overload table, dropping active non-FTP traffic sessions.

Extended ACLs filter network traffic exclusively at OSI Layer 2, causing Layer 3 IPv4 packets destined for other subnets to be rejected.

The router automatically converts unlisted TCP connection requests into UDP datagrams, which destination firewalls drop.

Cevabı ve açıklamayı göster

Cevap: The ACL ends with an invisible implicit deny statement that drops all traffic not explicitly permitted by preceding rules.

Cevap

The connectivity failure occurs because Access Control Lists contain an unwritten implicit deny rule at the end of the rule set, which blocks all traffic that is not explicitly allowed by a preceding permit statement.

Network Access Control Lists operate using sequential evaluation and end with an unwritten implicit 'deny all' rule. When the administrator created permit statements solely for FTP traffic, any packet not matching those specific criteria fell through to the end of the ACL and was dropped by the implicit deny rule.

Adım Adım Çözüm

Analyze the reported symptom following the ACL application.

Specific traffic (FTP to

10.5.5.10

) was permitted, but all other outbound traffic from subnet

172.16.30.0/24

was blocked.

This indicates that unlisted traffic flows are being filtered out by the router interface.

Evaluate standard ACL execution mechanics.

ACLs process packets top-down until a match is found. If no explicit rule matches a packet, it reaches the end of the list where an implicit 'deny all' rule executes.

Because only FTP traffic was permitted, all internet and inter-subnet traffic hit the implicit deny rule and was dropped.

Determine the necessary configuration fix.

Add explicit permit rules or an 'permit ip any any' statement at the end of the list if general traffic should be allowed.

Explicit permit statements override the default implicit deny behavior for designated traffic.

Anahtar Kavram

ACL Implicit Deny Behavior

Soru 1432Soru →

A network technician is troubleshooting an Ethernet connection in an office building and suspects that an unshielded twisted-pair (UTP) cable run inside a wall has been physically severed. Which hardware tool should the technician use to determine the exact distance along the cable to the location of the break?

Time Domain Reflectometer (TDR)

Cable continuity tester

Tone generator and probe kit

Multimeter

Cevabı ve açıklamayı göster

Cevap: Time Domain Reflectometer (TDR)

Cevap

Time Domain Reflectometer (TDR)

The correct tool is a Time Domain Reflectometer (TDR). TDRs send electrical pulses along copper conductors and analyze the reflected waveforms to determine the distance to opens, shorts, or impedance mismatches.

Adım Adım Çözüm

Identify the primary requirement of the scenario

The technician needs to locate the specific physical location (distance) of a cable break in a UTP run.

Knowing that a cable is broken is insufficient; locating the distance pinpoints where the cable run needs repair.

Evaluate the capabilities of network testing tools

A Time Domain Reflectometer (TDR) transmits a signal down a copper cable and calculates distance based on the time it takes for the signal to bounce back from an impedance mismatch or open wire.

TDR technology specifically measures signal reflection time to estimate distance to faults.

Anahtar Kavram

Using Time Domain Reflectometry (TDR) to pinpoint cable fault locations.

Tahmini Süre:45s

Soru 1433Soru →

A client computer configured with the IP address $10.0.1.25/24$ is unable to access resources on remote networks. An administrator inspects the IP configuration and discovers that the default gateway is set to $10.0.2.1$ . Which TWO statements accurately describe the cause of this issue and the necessary resolution?

Geçerli olan tümünü seçin

The host cannot communicate with the gateway because the configured default gateway IP address resides on a different subnet.

The host interface requires a VLAN trunking protocol configuration change to communicate with a gateway on another subnet.

Updating the default gateway address on the host to a valid router interface address within

10.0.1.0/24

will resolve the issue.

Changing the subnet mask on the host to

255.255.255.255

(/32) will allow traffic to cross over to the

10.0.2.0/24

gateway.

Cevabı ve açıklamayı göster

Cevap: The host cannot communicate with the gateway because the configured default gateway IP address resides on a different subnet.; Updating the default gateway address on the host to a valid router interface address within $10.0.1.0/24$ will resolve the issue.

Cevap

The client computer cannot reach remote networks because its configured default gateway resides on an adjacent subnet rather than its own local IP subnet. Reconfiguring the default gateway address to a valid IP within the local subnet resolves the connectivity failure.

For an IP endpoint to send traffic to external networks, its configured default gateway must be on the same logical IP subnet as the host itself. The host's IP of

10.0.1.25/24

places it on the

10.0.1.0/24

subnet, whereas the configured gateway of

10.0.2.1

resides on the

10.0.2.0/24

subnet. Reconfiguring the host's default gateway address to a router interface within the local

10.0.1.0/24

subnet allows the host to send ARP requests for the gateway and route traffic off the local network.

Adım Adım Çözüm

Analyze host IP address and subnet mask.

Host IP

10.0.1.25

with a

/24

mask (

255.255.255.0

) defines the local subnet range as

10.0.1.1

through

10.0.1.254

Determines the boundaries of the host's local broadcast domain and valid local IPs.

Evaluate the configured default gateway IP address.

The configured gateway

10.0.2.1

falls outside the local

10.0.1.0/24

subnet.

A host cannot send packets to a default gateway unless the gateway's IP address resides within the host's local subnet.

Identify corrective actions to restore routing.

Change the default gateway setting on the host to an active router interface IP within the

10.0.1.0/24

subnet.

Allows the host to resolve the gateway's MAC address using ARP and forward off-network traffic properly.

Anahtar Kavram

Default Gateway Subnet Mismatch

Soru 1434Soru →

A workstation connected to a FastEthernet port on a local switch experiences extremely slow speeds and dropped packets. When examining the switch interface statistics, a network administrator observes a high count of late collisions and frame check sequence (FCS) errors on the port. Which of the following configuration issues is the most likely cause of these symptoms?

A duplex mismatch between the switch port and the connected host interface

A native VLAN mismatch across an 802.1Q trunk link connecting two switches

An incorrect Spanning Tree Protocol (STP) root bridge priority setting

The absence of a Layer 3 router to forward traffic between broadcast domains

Cevabı ve açıklamayı göster

Cevap: A duplex mismatch between the switch port and the connected host interface

Cevap

A duplex mismatch between the switch port and the connected host interface is the cause of late collisions and FCS errors.

A duplex mismatch occurs when one end of an Ethernet connection is configured for full-duplex while the other operates in half-duplex. The full-duplex host transmits data continuously without carrier sensing, leading the half-duplex host to detect collisions late in its frame transmission, registering late collisions and FCS/CRC errors.

Adım Adım Çözüm

Analyze the interface error counters.

Identified high numbers of late collisions and FCS errors on an access port.

Late collisions occur when a device detects a collision after transmitting the first 64 bytes of a frame.

Correlate error counters with known Layer 2 duplex operational characteristics.

Full-duplex interfaces transmit without checking for collisions, while half-duplex interfaces listen for collisions. When connected together, the half-duplex side receives incoming frames while transmitting, triggering late collision flags.

This behavior directly produces late collisions, alignment errors, and FCS errors on the interface.

Anahtar Kavram

Duplex Mismatch Symptoms

Soru 1435Soru →

A desktop computer connected to an office Ethernet port is unable to communicate with external web servers or internal resources. A technician reviews the network interface status and observes an assigned IPv4 address of $169.254.108.99$ with a subnet mask of $255.255.0.0$ . Which of the following conditions is the most likely cause of this issue?

The client failed to contact a DHCP server and self-assigned an Automatic Private IP Addressing (APIPA) address.

The host interface was manually assigned an invalid default gateway address.

The local switch disabled the Ethernet port due to an IP address conflict detection.

The subnet mask calculation omitted reserved network and broadcast addresses.

Cevabı ve açıklamayı göster

Cevap: The client failed to contact a DHCP server and self-assigned an Automatic Private IP Addressing (APIPA) address.

Cevap

The client failed to contact a DHCP server and self-assigned an Automatic Private IP Addressing (APIPA) address.

When a network host configured for dynamic IP assignment sends DHCP discovery requests and does not receive a response from a DHCP server, the operating system assigns a link-local IPv4 address in the

169.254.0.0/16

range (APIPA). This indicates a failure in reaching or receiving a lease from the DHCP service.

Adım Adım Çözüm

Analyze the IP address assigned to the host

The address

169.254.108.99

falls into the

169.254.0.0/16

IPv4 address block.

Addresses within

169.254.0.1

through

169.254.255.254

are designated specifically for APIPA link-local usage.

Identify the underlying trigger for APIPA generation

APIPA occurs automatically when a host configured for dynamic addressing cannot locate or obtain a lease from a DHCP server.

When DHCPDISCOVER packets receive no DHCPOFFER response within the timeout period, the OS assigns a link-local address to allow basic local segment connectivity.

Anahtar Kavram

APIPA Address Range and DHCP Failure Symptoms

Soru 1436Soru →

A network administrator needs to determine the exact distance along a 90-meter copper Ethernet cable run to locate an open circuit break hidden inside a wall. Which tool should the administrator use to measure the distance to the fault?

Time-Domain Reflectometer (TDR)

Tone generator and probe

Optical power meter

Continuity wire mapper

Cevabı ve açıklamayı göster

Cevap: Time-Domain Reflectometer (TDR)

Cevap

Time-Domain Reflectometer (TDR)

A Time-Domain Reflectometer (TDR) sends high-frequency electrical pulses down copper cable pairs. When a pulse encounters an open break or short, energy reflects back to the source. By measuring the elapsed time of the reflection, the TDR calculates the precise distance to the cable defect.

Adım Adım Çözüm

Identify the symptom and requirements

The scenario requires measuring the exact physical distance along a copper cable to locate a wire break.

Determining distance to a fault avoids tearing down wall sections unnecessarily.

Select the proper diagnostic tool for copper distance measuring

A Time-Domain Reflectometer (TDR) transmits electrical pulses down copper conductors and analyzes signal reflections.

The timing of signal reflections allows the device to compute the precise length to impedance changes or breaks.

Anahtar Kavram

Using a Time-Domain Reflectometer (TDR) to locate distance to copper cabling faults.

Soru 1437Soru →

A network engineer is troubleshooting high CRC frame error rates and severe throughput degradation on a newly installed 90-meter Category 6A UTP cable drop connecting a server to a 10GBASE-T switch port. A basic wiremap continuity test shows all eight conductors properly terminated in pin-to-pin alignment, and a standard Time-Domain Reflectometer (TDR) reports no opens, shorts, or impedance discontinuities along the cable run. However, the link fails to sustain 10Gbps auto-negotiation without dropping packets. Which diagnostic hardware tool or measurement parameter is specifically required to pinpoint the root cause of this performance failure?

A cable certifier measuring high-frequency Near-End Crosstalk (NEXT) and Return Loss across the 500 MHz frequency band

An Optical Time-Domain Reflectometer (OTDR) evaluating backscatter attenuation and optical return loss along the metallic conductors

A packet analyzer running a capture filter for IEEE 802.3x PAUSE frames on Port 443 to identify Layer 4 transport layer saturation

A digital multimeter measuring static DC loop resistance across pair 1-2 to isolate dynamic UDP port allocation errors

Cevabı ve açıklamayı göster

Cevap: A cable certifier measuring high-frequency Near-End Crosstalk (NEXT) and Return Loss across the 500 MHz frequency band

Cevap

A cable certifier measuring high-frequency Near-End Crosstalk (NEXT) and Return Loss across the 500 MHz frequency band

High-frequency Ethernet standards like 10GBASE-T require copper cabling capable of operating without excessive crosstalk or signal reflection up to 500 MHz. While basic wiremap testers confirm electrical pin continuity and TDRs locate physical breaks or shorts, neither tool measures signal quality parameters across the full frequency spectrum. A cable certifier tests parameters such as Near-End Crosstalk (NEXT) and Return Loss, identifying subtle physical errors such as untwisted wire pairs at terminations or split pairs.

Adım Adım Çözüm

Analyze the physical layer cabling symptoms and existing test results

Basic wiremap verification confirms proper pin-to-pin continuity, and TDR confirms physical cable integrity (no cuts or shorts), ruling out complete physical breaks.

Simple continuity testers and TDRs only verify low-frequency DC continuity and distance to physical impedance anomalies.

Identify the high-speed requirements of 10GBASE-T over Cat 6A cabling

10GBASE-T operation requires full compliance up to 500 MHz frequency performance to prevent signal degradation caused by electromagnetic coupling between adjacent wire pairs.

Faults such as split pairs maintain pin-to-pin continuity but severely degrade high-frequency performance due to loss of pair twisting cancellation.

Select the appropriate hardware diagnostic tool for frequency-based physical certification

A Category 6A cable certifier performs swept-frequency testing for parameters including Near-End Crosstalk (NEXT), Power Sum NEXT (PS-NEXT), and Return Loss.

Only a cable certifier can validate whether a copper cable run meets the TIA/EIA standards required for 10Gbps Ethernet transmission.

Anahtar Kavram

Copper Cable Certification vs. Basic Continuity and TDR Testing

Soru 1438Soru →

During a routine network security audit, an administrator notices that internal workstation traffic destined for external web services is being redirected to an unauthorized local host on the same switch segment. An inspection of local workstation cache tables reveals that the default gateway's IP address has been mapped to the attacker's network interface card address, allowing the attacker to inspect and modify traffic prior to forwarding it. Which of the following attack types has occurred?

ARP Poisoning

DNS Poisoning

Port Scanning

DNS Amplification

Cevabı ve açıklamayı göster

Cevap: ARP Poisoning

Cevap

ARP Poisoning

ARP Poisoning occurs when an attacker broadcasts spoofed Address Resolution Protocol messages across a local area network. This links the attacker's MAC address with the IP address of a legitimate target, such as the default gateway, enabling the attacker to intercept, inspect, or modify local network traffic.

Adım Adım Çözüm

Analyze the observed anomaly in the scenario

Workstation traffic destined for the default gateway is being routed to an unauthorized host on the local ethernet segment.

The attacker has modified local workstation address resolution tables.

Evaluate the underlying mechanism causing the address cache corruption

The mapping between the default gateway's IP address and a physical MAC address was altered in the local ARP table.

Address Resolution Protocol (ARP) translates Layer 3 IP addresses into Layer 2 MAC addresses on local subnets.

Identify the specific network attack matching this mechanism

The attack is ARP Poisoning (or ARP Spoofing).

Unsolicited or malicious ARP responses overwrite legitimate MAC address bindings in the target host's ARP cache.

Anahtar Kavram

Address Resolution Protocol (ARP) Poisoning and Man-in-the-Middle (MitM) Attacks

Tahmini Süre:1m 15s

Soru 1439Soru →

A network technician needs to inspect a local workstation to view all currently active TCP connections, listening ports, and protocol statistics. Which command-line utility should the technician execute?

netstat

nslookup

ipconfig

ping

Cevabı ve açıklamayı göster

Cevap: netstat

Cevap

The technician should execute netstat to view active TCP connections and listening ports on the system.

The netstat (network statistics) command-line utility displays active TCP connections, ports on which the computer is listening, network adapter statistics, and the local IP routing table.

Adım Adım Çözüm

Determine the diagnostic requirement

The scenario requires listing active network connections, active sockets, and open listening ports on the local host.

Choosing the appropriate troubleshooting tool requires matching the command function to the desired operational metric.

Evaluate the functions of available network utilities

netstat (Network Statistics) provides detailed information about active connections, listening ports, and protocol statistics.

Other utilities serve different purposes such as name resolution (nslookup), IP address assignment display (ipconfig), or ICMP connectivity testing (ping).

Anahtar Kavram

Utilizing Command-Line Network Troubleshooting Utilities

Soru 1440Soru →

A network administrator is deploying a wireless network for standalone IoT inventory scanners in a logistics warehouse. Corporate security policies mandate protection against offline dictionary attacks through Simultaneous Authentication of Equals (SAE) without relying on a centralized RADIUS authentication server. Which wireless security standard should the administrator implement to fulfill these requirements?

WPA3-Personal

WPA3-Enterprise

WPA2-Personal

WPA2-Enterprise

Cevabı ve açıklamayı göster

Cevap: WPA3-Personal

Cevap

WPA3-Personal is the correct selection because it utilizes Simultaneous Authentication of Equals (SAE) to secure passphrase-based authentication against offline dictionary attacks without requiring a centralized RADIUS server.

WPA3-Personal incorporates Simultaneous Authentication of Equals (SAE), based on the Dragonfly handshake protocol. SAE secures passphrase authentication against offline dictionary attacks and ensures forward secrecy without requiring the deployment of an 802.1X RADIUS server.

Adım Adım Çözüm

Analyze the scenario constraints.

The requirements mandate protection against offline dictionary attacks using SAE and explicitly prohibit requiring a central RADIUS server.

Evaluating requirements isolates the exact wireless security framework needed.

Differentiate between WPA3 operation modes.

SAE is the defining feature of WPA3-Personal, whereas WPA3-Enterprise mandates 802.1X authentication.

WPA3-Personal replaces legacy PSK with SAE for robust standalone authentication.

Anahtar Kavram

WPA3-Personal and Simultaneous Authentication of Equals (SAE)

Tahmini Süre:1m 0s

ÖncekiSayfa 72 / 112Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram