Tüm alıştırma soruları

2237 soru

Soru 1441Soru

A network administrator is troubleshooting an issue where hosts on a local subnet cannot reach a remote database server across a routed network boundary. Place the following diagnostic and remediation steps in the correct sequential order according to standard network troubleshooting methodology.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order follows the structured troubleshooting process: 1) Verify local host network configuration (IP/gateway), 2) Formulate a theory of probable cause regarding ACL filtering, 3) Test the theory using path tracing and ACL hit counters, 4) Implement the corrected ACL rule, 5) Verify end-to-end reachability and document the outcome.
The standard network troubleshooting workflow demands starting with local host checks (identifying the problem), forming a specific hypothesis (such as ACL filtering), empirically testing the hypothesis via diagnostic utilities (`traceroute` and hit counters), applying the corrective configuration change, and finally verifying end-to-end functionality while documenting results.

Adım Adım Çözüm

1
Gather host-level network configuration facts
Identified client parameters and confirmed local stack integrity
Always eliminate local client misconfigurations before inspecting network layer devices
2
Formulate hypothesis
Theoretical cause established (ACL packet dropping)
Developing a hypothesis guides targeted diagnostic testing
3
Test hypothesis with CLI tools
Empirical confirmation of ACL packet dropping at router boundary
Testing isolates exact failure mechanism prior to making network changes
4
Implement corrective action
ACL updated to permit required flow
Correcting ACL sequencing resolves the packet dropping issue
5
Verify and document
End-to-end communication confirmed and documented
Ensures no secondary issues exist and maintains change records

Anahtar Kavram

Sequential application of CompTIA troubleshooting methodology to gateway and ACL failures
Soru 1442Soru

A network technician receives a ticket stating that IP phones on VLAN 30 attached to Switch-B cannot communicate with the VoIP call manager connected to Switch-A. However, workstations on VLAN 10 attached to the same switches are communicating across the interconnecting 802.1Q trunk link without any issues.

An inspection of Switch-B's trunk port configuration reveals the following entry:
`switchport trunk allowed vlan 10,20`

Which of the following identifies the root cause of the connectivity failure for VLAN 30 traffic?

Cevabı ve açıklamayı göster

Cevap: VLAN 30 is absent from the trunk interface allowed list on Switch-B, causing the switch to drop all frames tagged for VLAN 30 at the trunk border.

Cevap

VLAN 30 is absent from the trunk interface allowed list on Switch-B, causing the switch to drop all frames tagged for VLAN 30 at the trunk border.
The correct answer identifies that VLAN 30 is excluded from the allowed VLAN list on Switch-B's trunk port. When `switchport trunk allowed vlan` is executed, it overrides the default behavior (which allows all VLANs) and strictly restricts trunk traffic to only the specified VLANs (in this case, 10 and 20). As a result, all VLAN 30 frames are filtered and dropped at the trunk interface.

Adım Adım Çözüm

1
Analyze the trunk configuration commands provided in the incident ticket.
The interface command `switchport trunk allowed vlan 10,20` explicitly restricts allowed VLAN traffic across the trunk link to only VLAN 10 and VLAN 20.
By default, 802.1Q trunks allow VLANs 1-4094 unless an explicit allowed list is defined.
2
Evaluate the impact on VLAN 30 (VoIP) traffic.
Because VLAN 30 is not in the allowed list (`10,20`), any frame tagged with VLAN ID 30 arriving at or departing from Switch-B's trunk port is dropped.
Trunk interfaces prune ingress and egress traffic for any VLAN not explicitly included in the allowed list.
3
Correlate with observed symptoms.
VLAN 10 traffic succeeds because VLAN 10 is allowed, whereas VLAN 30 fails completely because it is filtered out by the trunk allowed list.
This selective connectivity pattern confirms a trunk allowed-list restriction rather than a physical link or duplex error.

Anahtar Kavram

VLAN Trunk Allowed List Filtering
Soru 1443Soru

During a post-incident audit at a branch office, a security analyst discovers that an unauthorized device successfully connected to the internal network by plugging into an unassigned Ethernet wall port. Further inspection reveals that all unassigned switchports remain administrative enabled in their default state on VLAN 1. Which of the following actions represents the best practice to harden these unassigned ports against unauthorized physical network access?

Cevabı ve açıklamayı göster

Cevap: Administratively shut down all unused interfaces and reassign them to an unroutable blackhole VLAN.

Cevap

Administratively shut down all unused interfaces and reassign them to an unroutable blackhole VLAN.
The standard device hardening procedure for securing unused physical switch ports requires administratively disabling the interfaces (shutdown command) and moving them out of the default VLAN 1 into an unused, unroutable VLAN (often called a dummy or blackhole VLAN). This double layer of security prevents unauthorized devices from obtaining an IP address or communicating on the internal network.

Adım Adım Çözüm

1
Identify vulnerabilities on unassigned access ports
Unused interfaces left in an active state on default VLAN 1 allow immediate Layer 2 access to any plugged-in device.
Default configurations on enterprise switches leave ports in an active state assigned to VLAN 1 unless explicitly hardened.
2
Apply interface state hardening
Disabling unused interfaces (shutdown) prevents physical link establishment.
Administratively shutting down inactive ports stops network traffic negotiation at Layer 1 and Layer 2.
3
Isolate port assignment to a blackhole VLAN
Assigning unused interfaces to an isolated VLAN with no Layer 3 routing interface ensures zero network access even if a port is accidentally re-enabled.
Segregating unused ports from active management and production VLANs ensures defense-in-depth.

Anahtar Kavram

Switch Port Security & Baseline Interface Hardening
Tahmini Süre:1m 15s
Soru 1444Soru

A network administrator is investigating a name resolution failure on a corporate workstation. Standard DNS queries for small host records complete successfully, but queries returning large responses (such as DNSSEC queries) time out, as shown in the following CLI output:

$ dig +dnssec internal.example.com
;; Truncated, retrying in TCP mode.
;; communications error to 10.0.0.1#53: connection timed out
;; communications error to 10.0.0.1#53: connection timed out
;; no servers could be reached

Which of the following network misconfigurations is the most likely root cause of this failure?

Cevabı ve açıklamayı göster

Cevap: An Access Control List (ACL) on a perimeter firewall is blocking outbound TCP traffic on port 53.

Cevap

An Access Control List (ACL) on a perimeter firewall is blocking outbound TCP traffic on port 53.
DNS uses UDP port 53 for standard name queries. However, when responses are too large to fit in standard UDP packets—which commonly occurs with DNSSEC records or zone transfers—the DNS server sets the Truncated (`TC`) flag. The client resolver then initiates a TCP connection over port 53 to retrieve the complete data. Blocking TCP port 53 on a firewall allows basic host lookups to function normally but causes truncated and DNSSEC queries to time out.

Adım Adım Çözüm

1
Analyze the CLI output snippet provided in the command line prompt.
The tool successfully issues a UDP query, receives a truncation flag (`TC` bit set), and attempts to retry the query using TCP mode.
DNS uses UDP port 53 by default for small messages (typically under 512 bytes). When responses exceed buffer limits (common with DNSSEC keys and signatures), the DNS protocol specifies falling back to TCP port 53.
2
Evaluate the failure symptom upon retrying in TCP mode.
The command reports `communications error ... connection timed out` when attempting TCP resolution.
Timeouts specifically during the TCP retry phase indicate that UDP port 53 traffic is permitted, but TCP port 53 traffic is filtered or blocked by an intermediate firewall or Access Control List.
3
Select the root cause matching the diagnostic evidence.
Identify that an ACL blocking TCP port 53 causes truncated/DNSSEC queries to fail while standard UDP queries succeed.
Firewalls must allow both UDP and TCP port 53 for complete DNS functionality.

Anahtar Kavram

DNS TCP Port 53 Transport Fallback for Truncated and DNSSEC Payload Responses
Soru 1445Soru

Following a major power interruption at an off-site facility, a core router fails to initialize its IP protocol stack, rendering all in-band network interfaces completely unreachable. Which of the following access methods allows a network administrator to establish direct command-line interface (CLI) access to diagnose the device's boot process?

Cevabı ve açıklamayı göster

Cevap: Connecting via an out-of-band serial console server linked to an external cellular modem connection

Cevap

Connecting via an out-of-band serial console server linked to an external cellular modem connection provides independent access to the device when all network interfaces and IP stacks are down.
Out-of-band (OOB) management utilizes a dedicated access channel separate from the primary data network. Connecting through an RS-232 serial console port via a console server and cellular modem provides direct access to the device's serial bus and command-line interface, allowing administrators to monitor low-level boot messages and reconfigure settings even when the primary IP stack is inactive.

Adım Adım Çözüm

1
Analyze the operational constraint described in the scenario.
The core router's IP stack has failed to initialize, making all in-band management methods (SSH, Telnet, HTTPS) inaccessible due to lack of network layer connectivity.
In-band management requires functional Layer 3 IP routing and transport layer service operation on the target device.
2
Identify the required access method designed to bypass the primary network path.
Out-of-Band (OOB) management provides direct physical or secondary channel connectivity to device hardware.
OOB access operates independently of the primary LAN/WAN infrastructure and does not depend on the router's operating network interfaces.
3
Select the option that implements a true out-of-band management pathway.
Using a console server connected to the router's RS-232 serial console port paired with a cellular modem allows administrators to connect directly to the CLI hardware bus.
The serial console interface exposes low-level boot diagnostic logs (such as ROMMON or BIOS messages) without requiring an IP stack.

Anahtar Kavram

Out-of-Band (OOB) Management
Tahmini Süre:1m 15s
Soru 1446Soru

During a data center infrastructure audit, network engineers discover that a 70-meter Category 6A UTP cable run connecting an end-of-row switch to a server cabinet continuously negotiates down to 1 Gbps instead of establishing a stable 10GBASE-T link. A basic wire mapper confirms all eight conductors maintain correct end-to-end continuity without open or short circuits. Further testing with a cable certifier identifies severe Near-End Crosstalk (NEXT) originating at the patch panel termination point. Inspection reveals that 5 cm (2 inches) of conductor pairs were untwisted prior to punching them down into the Insulation Displacement Connector (IDC) blocks. What physical mechanism caused the NEXT failure, and how should it be remediated?

Cevabı ve açıklamayı göster

Cevap: Excessive untwisting degrades the differential signal cancellation provided by pair twists; the cable must be re-terminated while keeping pair twists within 1.3 cm (0.5 inches) of the IDC point.

Cevap

Excessive untwisting degrades the differential signal cancellation provided by pair twists; the cable must be re-terminated while keeping pair twists within 1.3 cm (0.5 inches) of the IDC point.
Twisted pair cabling relies on precise pair twists to maintain differential signaling and mutual cancellation of electromagnetic interference between conductor pairs. When conductors are untwisted excessively (e.g., 5 cm instead of the TIA/EIA maximum allowed 1.3 cm), Near-End Crosstalk (NEXT) spikes dramatically because adjacent signals bleed into neighboring conductors near the transmitter. Re-terminating the cable to preserve twists up to the IDC contact points restores noise rejection and permits full 10GBASE-T operation.

Adım Adım Çözüm

1
Analyze the physical cable fault symptoms reported by the certifier
Identified high Near-End Crosstalk (NEXT) at the patch panel termination point despite full pin continuity.
Wire mappers only verify pinout continuity, whereas cable certifiers measure high-frequency signal metrics like NEXT, FEXT, and return loss.
2
Correlate physical termination findings with cabling performance standards
Excessive pair untwisting (5 cm) at the IDC block destroys the destructive interference effect that cancels electromagnetic noise between adjacent wire pairs.
TIA/EIA 568 standards require Category 6/6A conductor twists to be maintained within 1.3 cm (0.5 inches) of the termination point to prevent crosstalk.
3
Select the proper physical remediation technique
Re-strip and punch down the cable end while preserving pair twists up to the point of termination.
Correcting conductor geometry directly restores differential noise cancellation, resolving NEXT and enabling 10GBASE-T performance.

Anahtar Kavram

Near-End Crosstalk (NEXT) and Termination Pair Geometry
Soru 1447Soru

A network administrator is troubleshooting connectivity issues for a workstation assigned the static IPv4 address 192.168.50.140/26192.168.50.140/26. The workstation can communicate with local hosts on its subnet (192.168.50.128/26192.168.50.128/26), but cannot connect to a secure web portal hosted externally at 203.0.113.50:443203.0.113.50:443.

During diagnostic collection, the administrator notes the following settings:
- Workstation IPv4 Address: 192.168.50.140192.168.50.140
- Subnet Mask: 255.255.255.192255.255.255.192
- Configured Default Gateway: 192.168.50.1192.168.50.1
- Router Interface Inbound ACL Rule:
`permit tcp 192.168.50.128 0.0.0.63 host 203.0.113.50 eq 80`

Which TWO configuration issues are preventing the workstation from establishing a connection to the external web portal?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The default gateway address is assigned outside the workstation's local IP subnet range.; The router interface ACL lacks an explicit permit rule for TCP port 443 traffic and is dropped by the implicit deny.

Cevap

The two issues preventing access are that the configured default gateway resides outside the workstation's local IP subnet range, and the router ACL lacks an explicit permit rule for HTTPS (TCP port 443) traffic, causing it to be dropped by the implicit deny.
The host is unable to send traffic to external networks due to two misconfigurations. First, the configured default gateway address belongs to the subnet range 192.168.50.0/26192.168.50.0/26, whereas the host resides in the 192.168.50.128/26192.168.50.128/26 subnet; a gateway must reside on the same IP subnet as the host to be reachable. Second, the destination server connection requires HTTPS on port 443, but the ACL only permits HTTP on port 80. Since ACLs evaluate sequentially and end with an implicit deny statement, the HTTPS packets are blocked by the firewall/router.

Adım Adım Çözüm

1
Analyze the IP addressing and subnet mask boundary.
A /26/26 subnet mask (255.255.255.192255.255.255.192) creates block sizes of 64. For the host IP 192.168.50.140192.168.50.140, the subnet boundary spans from 192.168.50.128192.168.50.128 to 192.168.50.191192.168.50.191 (usable host range: 192.168.50.129192.168.50.129192.168.50.190192.168.50.190).
The host cannot forward traffic outside its local network because its gateway address (192.168.50.1192.168.50.1) lies in a completely different subnet (192.168.50.0/26192.168.50.0/26).
2
Evaluate the Access Control List (ACL) rule matching logic.
The configured ACL line explicitly permits traffic destination TCP port 80 (`eq 80`). The host is attempting to reach a secure portal on TCP port 443 (`203.0.113.50:443`).
Because network ACLs end with an implicit deny all rule, any traffic not matched by an explicit permit line (such as HTTPS port 443) will be silently dropped.

Anahtar Kavram

Subnet Mask Boundaries and Access Control List Filtering Mechanics
Soru 1448Soru

A network administrator is diagnosing several Layer 2 switching and trunking issues across a enterprise campus network. Match each observed switch diagnostic symptom or log message on the left to its corresponding underlying root cause on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Console log repeatedly outputs `%CDP-4-NATIVE_VLAN_MISMATCH` on interface GigabitEthernet0/1.
Interface status reports `FastEthernet0/12 is err-disabled` immediately after an unauthorized switch is attached.
Trunk port allows VLAN 10 traffic across switches, but frames belonging to VLAN 30 are dropped.
Switchport statistics show a steady increase in late collisions and CRC error counters during high traffic.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Console log %CDP-4-NATIVE_VLAN_MISMATCH matches opposing trunk interfaces configured with mismatched native VLAN identifiers. Interface status err-disabled due to bpduguard matches BPDU Guard disabling the port upon receiving unexpected STP BPDUs. Trunk link dropping VLAN 30 traffic matches the required VLAN ID being absent from the allowed VLAN list. High late collisions and CRC errors match a duplex mismatch between connected devices.
Each diagnostic indicator corresponds to a specific Layer 2 operational fault: CDP explicitly identifies native VLAN discrepancies on trunk links; BPDU Guard disables ports receiving rogue BPDUs; trunk allowed lists filter specific VLAN traffic; and late collisions are the classic hallmark indicator of a half-duplex/full-duplex mismatch.

Adım Adım Çözüm

1
Analyze the console warning message `%CDP-4-NATIVE_VLAN_MISMATCH`.
Identified that CDP explicitly flags native VLAN mismatches across trunk links.
802.1Q trunks must share identical native VLAN configurations on both connected switch interfaces to avoid untagged frame leakage.
2
Examine the `err-disabled` port state triggered by BPDU receipt.
Linked the state to BPDU Guard enforcement on an access port.
BPDU Guard safeguards network topology by disabling access ports if an incoming Bridge Protocol Data Unit is detected.
3
Evaluate selective VLAN traffic failure on a trunk link.
Determined VLAN 30 is pruned by the allowed VLAN list configuration.
Trunk interfaces only forward traffic for VLANs explicitly allowed in their trunking profile.
4
Inspect interface performance counters showing late collisions.
Associated late collisions and CRC errors with a full/half duplex setting mismatch.
Half-duplex ports listen before transmitting but collide with full-duplex transmissions that occur simultaneously.

Anahtar Kavram

VLAN, Trunking, and Switching Diagnostic Troubleshooting
Soru 1449Soru

Users on a corporate subnet (10.20.4.0/2410.20.4.0/24) intermittently experience network connectivity loss accompanied by IP address conflict warnings. A network technician discovers that a new network printer was manually configured with the static IP address 10.20.4.1510.20.4.15. The local DHCP server scope is configured for 10.20.4.1/2410.20.4.1/24 with a distribution pool ranging from 10.20.4.1010.20.4.10 through 10.20.4.25410.20.4.254. Which of the following actions on the DHCP server is the best resolution to permanently prevent this conflict?

Cevabı ve açıklamayı göster

Cevap: Configure an exclusion range on the DHCP scope for the static IP address assigned to the printer.

Cevap

Configure an exclusion range on the DHCP scope for the static IP address assigned to the printer.
The issue is caused by overlapping address allocations: the static IP address (10.20.4.1510.20.4.15) assigned to the printer lies within the DHCP scope's active lease pool (10.20.4.1010.20.4.1010.20.4.25410.20.4.254). Creating an exclusion range for 10.20.4.1510.20.4.15 on the DHCP server prevents the server from issuing that address to dynamic clients, eliminating duplicate IP address collisions.

Adım Adım Çözüm

1
Identify the root cause of the IP address conflict
The static IP address (10.20.4.1510.20.4.15) falls inside the active DHCP distribution pool range (10.20.4.1010.20.4.10 to 10.20.4.25410.20.4.254).
When a dynamic client requests an IP address, the DHCP server may lease 10.20.4.1510.20.4.15, causing two devices to claim the same IP.
2
Determine the appropriate DHCP server administrative action
Create an exclusion entry on the DHCP server scope specifically omitting 10.20.4.1510.20.4.15 (or a block containing it).
Exclusions guarantee the DHCP server will never lease specified addresses to dynamic clients while keeping them within the defined subnet scope.

Anahtar Kavram

DHCP Scope Exclusions and Static Address Management
Soru 1450Soru

A network technician is assigned to troubleshoot a user workstation that cannot access local network resources. Place the following diagnostic and resolution steps in the correct order, starting from the initial physical check to the final connectivity verification.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The standard troubleshooting sequence follows a structured bottom-up model: inspect physical link connectivity first, check for an APIPA address using command-line tools, request a fresh DHCP lease, and finally verify network reachability by pinging the default gateway.
The sequence follows the standard bottom-up troubleshooting methodology: first confirm physical connectivity (Layer 1), next evaluate current addressing state (detecting APIPA), then issue a DHCP lease renewal request, and finally verify Layer 3 connectivity using ping.

Adım Adım Çözüm

1
Inspect physical cable and Ethernet status LED indicators
Confirms Layer 1 signaling and link connection.
Physical layer connectivity is a prerequisite for all higher-layer network operations.
2
Check IP settings using `ipconfig /all`
Reveals an auto-configured APIPA IP address (169.254.x.x169.254.x.x) indicating DHCP failure.
Determines whether host addressing is functional or defaulting to link-local scope.
3
Request a new DHCP lease using `ipconfig /renew`
Triggers a DHCP DISCOVER and REQUEST exchange to fetch valid network configuration parameters.
Attempts resolution by actively re-establishing communications with the DHCP server.
4
Send ICMP echo requests to the default gateway IP
Confirms bidirectional Layer 3 communication on the local subnet.
Verifies that addressing and gateway configuration are operating correctly.

Anahtar Kavram

Structured IP and DHCP Troubleshooting Order
Soru 1451Soru

A network administrator needs to apply an inbound extended Access Control List (ACL) on a router interface connected to the user subnet 192.168.1.0/24192.168.1.0/24 to secure access to a server located at 10.0.0.1010.0.0.10. The policy must enforce the following requirements:

1. Allow administrator workstation 192.168.1.50192.168.1.50 SSH access (TCP port 22) to the server.
2. Block host 192.168.1.100192.168.1.100 from accessing HTTP services (TCP port 80) on the server.
3. Allow all other hosts on the 192.168.1.0/24192.168.1.0/24 subnet to access HTTP services (TCP port 80) on the server.
4. Block all other unauthorized IP traffic.

Arrange the given ACL statements in the correct top-to-bottom processing sequence to enforce this security policy without rule shadowing.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order from top to bottom is: 1) permit tcp host 192.168.1.50 host 10.0.0.10 eq 22, 2) deny tcp host 192.168.1.100 host 10.0.0.10 eq 80, 3) permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq 80, and 4) deny ip any any.
ACL entries are evaluated sequentially in top-down order. Specific entries must always precede broader entries to prevent rule shadowing. Placing the specific host SSH permit rule first ensures administrative access is evaluated immediately. Placing the specific host HTTP deny rule second ensures that host 192.168.1.100 is blocked before reaching the general subnet HTTP permit rule. The general subnet HTTP permit rule follows third to allow remaining subnet hosts, while the catch-all deny rule is placed at the end.

Adım Adım Çözüm

1
Identify specific host exceptions that require dedicated access.
Place the specific host permit rule for SSH (`permit tcp host 192.168.1.50 host 10.0.0.10 eq 22`) near the top so administrative access is granted before any general filtering.
ACLs process rules sequentially from top to bottom, stopping at the first matching entry.
2
Place specific host deny rules above broader subnet permit rules.
Place `deny tcp host 192.168.1.100 host 10.0.0.10 eq 80` before the subnet-wide HTTP permit statement.
If the broader subnet permit rule were placed first, traffic from 192.168.1.100 would match the permit rule and be allowed, shadowing the specific deny rule.
3
Add the general subnet permit rule for remaining web traffic.
Position `permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq 80` directly after the specific host deny rule.
This allows all non-restricted hosts on the 192.168.1.0/24 subnet to reach HTTP port 80.
4
Append the explicit/implicit catch-all deny statement.
Place `deny ip any any` at the bottom of the list.
All traffic not explicitly allowed by earlier rules must be dropped.

Anahtar Kavram

Access Control List Top-to-Bottom Sequential Evaluation and Rule Shadowing
Soru 1452Soru

A network administrator is investigating a report that a newly provisioned workstation cannot access an internal line-of-business portal at `portal.dev.company.local`. The administrator executes two command-line diagnostic queries from the workstation:

Query 1:

> nslookup portal.dev.company.local
Server: 192.168.1.1
Address: 192.168.1.1#53

** server can't find portal.dev.company.local: NXDOMAIN

Query 2:

> nslookup portal.dev.company.local 10.10.10.5
Server: 10.10.10.5
Address: 10.10.10.5#53

Name: portal.dev.company.local
Address: 10.10.10.45

Which of the following is the most likely root cause of this name resolution failure?

Cevabı ve açıklamayı göster

Cevap: The workstation is configured to use a default network gateway DNS proxy (192.168.1.1) that lacks internal domain forwarders, rather than the authoritative corporate DNS server (10.10.10.5).

Cevap

The workstation is configured to use a default network gateway DNS proxy (192.168.1.1) that lacks internal domain forwarders, rather than the authoritative corporate DNS server (10.10.10.5).
The correct option correctly identifies that the workstation's default DNS server configuration (192.168.1.1) points to a gateway or recursive resolver that lacks routing/forwarding rules for the private domain `.company.local`. Explicitly supplying the target DNS server IP `10.10.10.5` in the second command successfully resolves the address to `10.10.10.45`, demonstrating that the internal DNS server and record are healthy.

Adım Adım Çözüm

1
Analyze the output of Query 1 (`nslookup portal.dev.company.local`).
The system queries its default configured DNS resolver (192.168.1.1), which returns an NXDOMAIN error (Non-Existent Domain).
This shows that the client's default resolver does not know about the `.company.local` zone.
2
Analyze the output of Query 2 (`nslookup portal.dev.company.local 10.10.10.5`).
Bypassing the default resolver by directing the lookup explicitly to 10.10.10.5 yields an authoritative answer (`10.10.10.45`).
This confirms that the host record exists and the internal DNS server is functioning correctly.
3
Synthesize findings to determine the root cause.
The issue is a local IP configuration mistake where the client workstation points to an unintegrated network device/gateway (192.168.1.1) instead of the internal DNS infrastructure (10.10.10.5).
Reconfiguring the host's primary DNS IP address to 10.10.10.5 (or adjusting DHCP settings) will resolve name queries across the workstation.

Anahtar Kavram

DNS Server Targeting and Resolver Misconfiguration
Soru 1453Soru

Match each physical network cabling fault or symptom on the left with its most likely physical root cause on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Near-End Crosstalk (NEXT)
High Optical Attenuation
Open Pair
Short Circuit

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Near-End Crosstalk (NEXT) pairs with excessive untwisting of conductor pairs during modular connector termination. High Optical Attenuation pairs with dust, dirt, or oil contamination on the fiber optic ferrule end-face. Open Pair pairs with a completely severed internal copper conductor wire breaking continuity. Short Circuit pairs with damaged wire insulation causing two separate copper conductors to touch.
Each physical symptom links to a specific physical fault mechanism: excessive pair untwisting degrades the noise-cancellation properties of UTP cables resulting in Near-End Crosstalk (NEXT); dirty fiber ferrules obstruct light flow causing optical loss; broken conductors cause open circuits; and touching conductors cause short circuits.

Adım Adım Çözüm

1
Analyze copper signal interference causes
Untwisting cable pairs reduces their cancellation effect, resulting in crosstalk (NEXT).
Twisted pairs rely on continuous twists to cancel out electromagnetic interference between adjacent pairs.
2
Analyze fiber optical signal loss causes
Contaminants on ferrule tips absorb and scatter optical light pulses.
Microscopic dust or skin oil on fiber end-faces is the leading cause of insertion loss.
3
Analyze electrical continuity defects
A break in a copper wire prevents signal current flow (Open Pair), whereas unintended electrical contact between wires causes signal path degradation (Short Circuit).
An open circuit means infinite resistance/no path; a short circuit means low resistance/unintended current path.

Anahtar Kavram

Physical Cabling Fault Identification and Causes
Soru 1454Soru

A network technician is equipping a field kit with diagnostic tools for physical and protocol-level troubleshooting. Match each diagnostic tool to the scenario where it provides the required functionality.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Optical Time-Domain Reflectometer (OTDR)
Tone Generator and Probe
Multimeter
Packet Analyzer

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Optical Time-Domain Reflectometer (OTDR) matches determining distance to fault and light loss in single-mode fiber; Tone Generator and Probe matches locating unlabelled copper cable in a patch panel; Multimeter matches checking DC voltage output from a power injector; Packet Analyzer matches inspecting TCP handshake flags and DHCP offer options.
Each diagnostic tool is aligned with its specific physical medium and domain: OTDR analyzes fiber optic reflection, the tone generator and probe locate metallic copper wire paths, the multimeter measures electrical properties like voltage, and the packet analyzer inspects protocol headers and frame contents.

Adım Adım Çözüm

1
Analyze each troubleshooting scenario to determine whether the issue is optical, copper physical identification, electrical power measurement, or upper-layer protocol analysis.
Fiber light loss requires optical reflectometry; cable tracing in copper requires an audio tone/probe; power testing requires an electrical multimeter; packet-level flag inspection requires a packet analyzer.
Selecting the correct hardware tester or software tool depends on matching the tool's physical or logical operation domain with the specific symptom.

Anahtar Kavram

Hardware Testers and Packet Analyzers
Soru 1455Soru

Match each Layer 2 switching diagnostic symptom or log output on the left with its primary underlying root cause on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Switch console continuously outputs `%CDP-4-NATIVE_VLAN_MISMATCH` log messages while untagged control traffic is dropped across the interconnect link.
Interface counter metrics display a rapidly incrementing count of late collisions and frame check sequence (FCS) errors on a 100 Mbps Ethernet link.
Hosts on VLAN 20 cannot communicate across the switch interconnect, and running `show interfaces trunk` reveals VLAN 20 is missing from the active allowed list.
The switching domain experiences persistent MAC address table instability and periodic frame unicast flooding driven by continuous topology change notifications (TCNs).

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

1. CDP native VLAN mismatch logs match mismatched native VLAN ID settings across trunk interfaces. 2. Incrementing late collisions and FCS errors match a duplex mismatch between full-duplex and half-duplex auto-negotiation. 3. Absence of VLAN 20 from allowed VLAN output matches explicit trunk allowed list filter exclusion. 4. Persistent MAC table instability and TCN flooding match an unstable Spanning Tree Protocol priority triggering perpetual root bridge elections.
Each diagnostic indicator corresponds to a standard Layer 2 troubleshooting signature: native VLAN mismatches produce CDP console errors; duplex mismatches trigger late collisions and FCS frame drops; missing allowed VLAN entries prune trunk traffic; and STP root bridge priority conflicts cause continuous topology changes and MAC table instability.

Adım Adım Çözüm

1
Analyze CDP log messages
CDP log messages explicitly report native VLAN mismatches between connected switch interfaces.
802.1Q untagged frame forwarding requires identical native VLAN configurations on both sides of a trunk link.
2
Evaluate interface collision statistics
Late collisions indicate frame collisions detected past the 512th bit time of transmission.
This error pattern uniquely identifies a speed/duplex mismatch where one side operates in half-duplex while the other operates in full-duplex.
3
Inspect trunk allowed VLAN list
VLAN 20 missing from `show interfaces trunk` indicates VLAN pruning or filtering.
Trunk interfaces prune and drop traffic for any VLAN not explicitly allowed in the trunk configuration vector.
4
Diagnose STP network instability
Continuous TCN BPDUs cause premature MAC address aging.
Unstable STP root bridge elections trigger constant topology changes and flushing of switch forwarding tables.

Anahtar Kavram

Layer 2 Switching, Trunking, Duplex, and STP Troubleshooting
Soru 1456Soru

A network administrator receives multiple alerts indicating severe latency and packet drops across a enterprise wireless network deployment following a software update on the central wireless LAN controller (WLC). Arrange the technician's troubleshooting actions in the correct sequence according to the CompTIA troubleshooting methodology, from first step to last step.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence of the CompTIA troubleshooting methodology is: Gather network logs and query affected users (Identify the problem) → Formulate a hypothesis regarding the RRM firmware bug (Establish a theory of probable cause) → Execute a spectrum analyzer scan on a test AP (Test the theory) → Draft a change request and identify potential side effects (Establish a plan of action) → Conduct heat map tests to ensure baseline performance (Verify full system functionality) → Update the organizational knowledge base (Document findings, actions, and outcomes).
The correct order follows CompTIA's official standard methodology: 1. Identify the problem (gather logs and user feedback), 2. Establish a theory of probable cause (hypothesize firmware/RRM issue), 3. Test the theory (use spectrum analyzer on a test AP), 4. Establish a plan of action and identify potential effects (draft change request and rollback plan), 5. Verify full system functionality (run RF heat map tests to verify baseline metrics), and 6. Document findings, actions, and outcomes (update the organizational knowledge base).

Adım Adım Çözüm

1
Identify the problem
Network logs and user interviews define the problem scope and symptoms.
Troubleshooting must begin with gathering facts and defining the issue before assuming a cause.
2
Establish a theory of probable cause
A working hypothesis pointing to RRM firmware channel overlap is established.
Considering recent changes like firmware updates helps form a logical theory.
3
Test the theory to determine cause
Spectrum analysis confirms elevated noise floor on test equipment.
The theory must be verified scientifically before making production changes.
4
Establish a plan of action and identify potential effects
A rollback plan and risk assessment are documented.
Planning ensures changes are controlled and potential side effects are anticipated.
5
Verify full system functionality
RF heat maps verify signal metrics are back to normal standards.
System verification confirms that the resolution actually resolved the original issue completely.
6
Document findings, actions, and outcomes
Knowledge base updated for future reference.
Documentation creates an audit trail and assists future troubleshooting efforts.

Anahtar Kavram

CompTIA 7-Step Troubleshooting Methodology
Soru 1457Soru

A system administrator is troubleshooting network reachability on a newly provisioned server configured with IP address 172.16.14.78172.16.14.78 and subnet mask 255.255.255.192255.255.255.192 (/26/26). The server can communicate with local host devices on its broadcast domain, but fails to send packets to remote subnets. The default gateway interface on the switch router is assigned 172.16.14.65/26172.16.14.65/26. Upon reviewing the server's network configuration, the administrator notes that the default gateway entry is configured as 172.16.14.62172.16.14.62. Which of the following accurately identifies the root cause of this routing issue?

Cevabı ve açıklamayı göster

Cevap: The host IP address and configured default gateway reside on different subnets, preventing local Layer 2 frame delivery to the gateway.

Cevap

The host IP address and its configured default gateway belong to different subnets, causing Layer 2 resolution and IP routing to fail.
The server's IP address (172.16.14.78/26172.16.14.78/26) is located within the 172.16.14.64/26172.16.14.64/26 subnet (usable host range 172.16.14.65172.16.14.65 to 172.16.14.126172.16.14.126). The misconfigured gateway address (172.16.14.62172.16.14.62) belongs to the neighboring subnet (172.16.14.0/26172.16.14.0/26). Because hosts can only send ARP requests for default gateways on their own local IP subnet, the server cannot establish Layer 2 communication with its gateway, preventing any outbound packet routing to remote networks.

Adım Adım Çözüm

1
Determine the subnet boundaries for the server's assigned IP address and mask.
A mask of 255.255.255.192255.255.255.192 corresponds to a /26/26 prefix length with a block size of 6464 (256192=64256 - 192 = 64). For IP 172.16.14.78172.16.14.78, the network boundary is 172.16.14.64/26172.16.14.64/26, giving a usable host range of 172.16.14.65172.16.14.65 to 172.16.14.126172.16.14.126 and broadcast address 172.16.14.127172.16.14.127.
Calculating the subnet range identifies which IP addresses are local to the host.
2
Evaluate the location of the configured default gateway address 172.16.14.62172.16.14.62.
The IP 172.16.14.62172.16.14.62 falls into the range 172.16.14.0172.16.14.63172.16.14.0 - 172.16.14.63 (172.16.14.0/26172.16.14.0/26), which is a separate IP subnet.
A host must reside on the same IP subnet as its default gateway to resolve its MAC address via ARP.
3
Identify the cause of remote unreachability.
Because 172.16.14.62172.16.14.62 is on a foreign subnet relative to 172.16.14.78/26172.16.14.78/26, the server cannot send ARP requests locally to deliver frame payloads destined for off-subnet targets. Reconfiguring the gateway to 172.16.14.65172.16.14.65 resolves the issue.
Layer 2 adjacency to the default gateway is mandatory for forwarding off-subnet traffic.

Anahtar Kavram

Default Gateway Subnet Mismatch Diagnosis
Soru 1458Soru

An enterprise security Operations center detects two distinct anomalous network activities. First, an external threat actor transmits forged requests to public time servers, causing heavy response traffic to flood an internal web server's public IP interface. Second, an internal rogue host answers local broadcast Link-Local Multicast Name Resolution (LLMNR) queries to redirect workstations to a fake login portal. Which of the following attack types and vectors are present in this scenario? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Reflected Denial of Service using NTP amplification; On-path credential harvesting via LLMNR poisoning

Cevap

The scenario describes a Reflected Denial of Service using NTP amplification and On-path credential harvesting via LLMNR poisoning.
The correct choices accurately identify both attack vectors: NTP amplification leverages public time servers with spoofed source IPs to reflect amplified traffic onto a victim, while LLMNR poisoning intercepts local broadcast hostname queries to establish an on-path position for credential harvesting.

Adım Adım Çözüm

1
Analyze the first anomaly involving external time servers.
Identified NTP amplification attack vector where spoofed requests cause public servers to generate large volumes of traffic targeting the victim.
Forging source IPs to generate disproportionate response traffic from third-party servers defines a reflected amplification DDoS attack.
2
Analyze the second anomaly involving local multicast name resolution requests.
Identified LLMNR poisoning attack vector where malicious hosts answer local name requests to intercept user credentials.
Spoofing broadcast/multicast local name resolution responses positions the attacker as an on-path entity to collect user authentication details.

Anahtar Kavram

Identifying Common Network Attack Vectors and Amplification Techniques
Soru 1459Soru

A network administrator is troubleshooting poor Wi-Fi performance and frequent disconnections in an enterprise office space. A site survey reveals severe adjacent-channel interference on the 2.4 GHz band due to access points (APs) operating on channels 3 and 8. Furthermore, users working at the outer perimeter of the building experience signal degradation, with RSSI readings dropping below 85 dBm-85\text{ dBm} on the 5 GHz band. Which of the following actions should the network administrator take to resolve these wireless connectivity issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Reconfigure the 2.4 GHz radios on all access points to operate exclusively on non-overlapping channels 1, 6, and 11.; Increase the transmit power on the 5 GHz radios servicing the building perimeter areas.

Cevap

The administrator should reconfigure the 2.4 GHz radios to operate exclusively on non-overlapping channels 1, 6, and 11, and increase the transmit power on the 5 GHz radios servicing the perimeter areas.
Reconfiguring the 2.4 GHz radios to channels 1, 6, and 11 prevents adjacent-channel interference caused by non-standard channels 3 and 8. Raising the 5 GHz transmit power near the perimeter boosts RSSI values above the unreliable 85 dBm-85\text{ dBm} threshold, ensuring stable client connectivity.

Adım Adım Çözüm

1
Analyze the 2.4 GHz channel allocation issue.
Channels 3 and 8 overlap with surrounding standard channels (1, 6, 11), causing adjacent-channel interference (ACI).
In North America, standard 2.4 GHz Wi-Fi deployments require using non-overlapping channels 1, 6, and 11 to avoid frequency collision.
2
Address the 5 GHz signal attenuation issue at the building perimeter.
An RSSI reading below 85 dBm-85\text{ dBm} indicates excessive signal attenuation and weak coverage.
Increasing transmit power on the 5 GHz AP radios expands the coverage cell size, bringing signal strength into an acceptable operating range (typically 65 dBm-65\text{ dBm} to 70 dBm-70\text{ dBm}).

Anahtar Kavram

Wireless RF Channel Planning & Transmit Power Management
Tahmini Süre:1m 30s
Soru 1460Soru

A network administrator must implement a continuous telemetry solution to monitor interface bandwidth utilization and device CPU metrics on core switches located across a remote branch link. Company security policy dictates that all monitoring data must be protected against eavesdropping and unauthorized tampering while in transit. Which protocol and configuration level should the administrator select to meet these security and performance monitoring requirements?

Cevabı ve açıklamayı göster

Cevap: SNMPv3 configured with the authPriv security level

Cevap

SNMPv3 configured with the authPriv security level is the correct configuration because it provides both user authentication and payload encryption for network metric polling.
SNMPv3 with the authPriv (Authentication and Privacy) security level uses cryptographic protocols such as HMAC-SHA for authentication and AES for payload encryption. This ensures performance monitoring metrics remain confidential and tamper-proof across unsecure remote links.

Adım Adım Çözüm

1
Identify the primary requirement
The scenario demands polling interface and CPU metrics while guaranteeing data privacy (encryption) and packet integrity/authentication over a remote link.
Security policy compliance mandates protection against passive interception and unauthorized polling.
2
Evaluate SNMP version security features
SNMPv1 and SNMPv2c lack cryptographic encryption and use cleartext community strings. SNMPv3 introduces user-based security models (USM).
SNMPv3 is required for secure enterprise network performance monitoring.
3
Determine the exact SNMPv3 security level
noAuthNoPriv offers no security, authNoPriv offers authentication without payload encryption, whereas authPriv enforces both authentication and AES packet encryption.
authPriv is the only mode that satisfies both confidentiality and integrity requirements.

Anahtar Kavram

SNMPv3 Security Levels and Telemetry Security
ÖncekiSayfa 73 / 112Sonraki
Tüm alıştırma soruları — CompTIA Network+ | Examkin