Tüm alıştırma soruları

2237 soru

Soru 1461Soru

A network technician is troubleshooting an issue where workstations in a remote branch office cannot resolve hostnames within the internal domain `internal.corp.com`, although external internet domains resolve normally. The technician runs diagnostic commands from a affected workstation with the following results:

> nslookup internal.corp.com
Server: 192.168.1.1
Address: 192.168.1.1#53

** server can't find internal.corp.com: SERVFAIL

> dig @10.10.20.5 internal.corp.com
;; QUESTION SECTION:
;internal.corp.com. IN A

;; ANSWER SECTION:
internal.corp.com. 3600 IN A 10.10.20.50

Based on the output, which TWO of the following are the most likely root causes of this name resolution failure? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The local router/resolver at 192.168.1.1 lacks a conditional forwarding rule configured for the `internal.corp.com` domain zone.; Firewall rules or access control lists (ACLs) are filtering DNS traffic between the local resolver (192.168.1.1) and the authoritative DNS server (10.10.20.5).

Cevap

The most likely root causes are that the local DNS resolver at 192.168.1.1 lacks a conditional forwarder for the internal domain, and network firewall or ACL policies are blocking DNS traffic (port 53) between the local resolver and the internal authoritative DNS server.
Directly querying the internal DNS server at 10.10.20.5 successfully returns the IP address, proving the DNS record exists and is valid. The failure only occurs when client workstations query their default local gateway/resolver (192.168.1.1), returning a SERVFAIL error. This occurs when the local resolver either does not have a conditional forwarder configured to send requests for `internal.corp.com` to 10.10.20.5, or when firewalls/ACLs block port 53 communication between 192.168.1.1 and 10.10.20.5.

Adım Adım Çözüm

1
Analyze the `nslookup` command output
The workstation queries its local DNS server (192.168.1.1), which returns a `SERVFAIL` status message for `internal.corp.com`.
SERVFAIL indicates the local resolver encountered an error attempting to process the query recursively or forward it.
2
Analyze the `dig` command output
Directly targeting the authoritative internal DNS server (`dig @10.10.20.5`) returns a valid A record (`10.10.20.50`).
This confirms that the record exists on the authoritative server and the server itself is functioning correctly.
3
Identify the break in the resolution path
The failure occurs specifically when 192.168.1.1 is tasked with resolving the query.
This points to either a misconfiguration on 192.168.1.1 (missing conditional forwarder) or network path blocking between 192.168.1.1 and 10.10.20.5.

Anahtar Kavram

Troubleshooting Split-Horizon DNS and Resolver Forwarding
Soru 1462Soru

A network technician is investigating why users on subnet 10.20.4.0/2410.20.4.0/24 cannot access a secure internal web portal at 10.20.10.1510.20.10.15 over HTTPS. The technician runs a traceroute command from a client workstation (10.20.4.5010.20.4.50), which yields the following output:

Traceroute to 10.20.10.15 over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms 10.20.4.1
2 2 ms 1 ms 2 ms 10.20.1.2
3 * * * Request timed out.

An inspection of the router at 10.20.1.210.20.1.2 reveals the following inbound Access Control List (ACL) applied on interface GigabitEthernet0/1:

access-list 105 permit tcp 10.20.4.0 0.0.0.255 host 10.20.10.15 eq 80
access-list 105 permit icmp 10.20.4.0 0.0.0.255 host 10.20.10.15

Based on these diagnostic outputs, which of the following is the root cause of the connection failure?

Cevabı ve açıklamayı göster

Cevap: The Access Control List permits HTTP traffic on TCP port 80 but lacks a permit entry for HTTPS traffic on TCP port 443, causing secure requests to be dropped by the implicit deny rule.

Cevap

The Access Control List permits HTTP traffic on TCP port 80 but lacks a permit entry for HTTPS traffic on TCP port 443, causing secure requests to be dropped by the implicit deny rule.
The traceroute output confirms that traffic successfully traverses the local gateway (10.20.4.110.20.4.1) and reaches router 10.20.1.210.20.1.2. However, the inbound ACL configured on router 10.20.1.210.20.1.2 only contains explicit permit statements for TCP port 80 (HTTP) and ICMP. Because HTTPS uses TCP port 443, HTTPS connections do not match any permit statements and are dropped by the implicit deny rule at the end of the access control list.

Adım Adım Çözüm

1
Analyze the traceroute diagnostic output
Hop 1 (10.20.4.1) and Hop 2 (10.20.1.2) respond promptly, but Hop 3 times out.
This indicates that local subnet routing and default gateway settings are functional up to router 10.20.1.2, where traffic is subsequently blocked.
2
Evaluate the router ACL rules against the requested service protocol
The ACL permits 'tcp eq 80' (HTTP) and 'icmp' (ping/traceroute messages), but contains no statement for HTTPS.
HTTPS uses TCP port 443. Standard IP ACLs evaluate rules top-down and end with an unwritten 'implicit deny all' rule.
3
Determine the effect of the implicit deny on HTTPS traffic
HTTPS packets destined for 10.20.10.15:443 match none of the explicit permit statements and are dropped at router 10.20.1.2.
Adding 'access-list 105 permit tcp 10.20.4.0 0.0.0.255 host 10.20.10.15 eq 443' to the access list will resolve the issue.

Anahtar Kavram

Troubleshooting ACL Filtering and Implicit Deny Rules
Tahmini Süre:1m 30s
Soru 1463Soru

A network technician plugs a newly deployed workstation into switch port GigabitEthernet0/12. The host successfully obtains an IP address in the default management network (192.168.1.0/24) and can reach local hosts in that same network, but it is unable to access any resources on the Finance subnet (192.168.30.0/24). An inspection reveals that the switch port is still using its factory default configuration. Which of the following is the most likely cause of this connectivity issue?

Cevabı ve açıklamayı göster

Cevap: The switch port is assigned to the default VLAN 1 rather than the designated Finance VLAN.

Cevap

The switch port is assigned to the default VLAN 1 rather than the designated Finance VLAN.
When a managed switch port remains in its default factory configuration, it is assigned to VLAN 1 (the default VLAN). As a result, any host connected to that port will reside in the VLAN 1 broadcast domain rather than the intended VLAN (such as VLAN 30 for Finance). To resolve the issue, the administrator must configure the interface as an access port and assign it to VLAN 30.

Adım Adım Çözüm

1
Analyze the observed IP addressing and port configuration status.
The host received an IP address in the default network (192.168.1.0/24) corresponding to VLAN 1 because the unconfigured switch port defaults to VLAN 1.
Unconfigured Ethernet ports on a managed switch belong to the default broadcast domain (VLAN 1).
2
Determine why the host cannot reach the Finance subnet (192.168.30.0/24).
Because the host port is in VLAN 1, it cannot reach VLAN 30 resources without proper port VLAN reassignment and routing.
VLANs isolate broadcast domains at Layer 2.

Anahtar Kavram

Default Access Port VLAN Assignment
Soru 1464Soru

A network technician is troubleshooting a workstation that cannot access external web services. Arrange the command-line network utilities in the correct logical sequence of execution to systematically isolate the issue from the local host configuration to external path reachability and name resolution.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct logical order of execution is: 1. ipconfig /all, 2. ping 192.168.1.1, 3. tracert 8.8.8.8, 4. nslookup www.example.com.
A structured troubleshooting approach starts on the local machine with ipconfig /all to verify interface settings, moves to testing the local gateway with ping, extends to remote internet path checking via tracert, and concludes with domain name resolution verification via nslookup.

Adım Adım Çözüm

1
Run ipconfig /all to examine local host IP settings.
Confirms the host has a valid IP address and identifies the configured default gateway.
Troubleshooting must begin by verifying that the local adapter is properly configured and functional.
2
Run ping against the default gateway IP address (192.168.1.1).
Confirms local network interface communication and switch port connectivity.
Verifying local gateway reachability ensures local network segment connectivity works before testing remote paths.
3
Run tracert to a known public IP address (8.8.8.8).
Maps the hop-by-hop path across external routers to isolate routing failures.
Testing IP routing to an external IP ensures IP packets can exit the local network independently of DNS name resolution.
4
Run nslookup for the target domain name (www.example.com).
Tests whether the configured DNS server can resolve domain names to IP addresses.
Name resolution testing should occur after basic IP connectivity and remote path reachability have been established.

Anahtar Kavram

Standard systematic CLI network troubleshooting methodology progresses from local host configuration verification up through local gateway ping, remote path tracing, and application domain name resolution.
Soru 1465Soru

A network administrator is performing baseline security hardening on a newly installed Layer 3 switch before introducing it to the production network. Place the administrative hardening tasks into the correct sequential order from first step to last step.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct administrative sequence begins with setting encrypted local credentials, generating RSA keys to enable SSH v2, configuring centralized TACACS+ AAA authentication with local fallback, restricting VTY line access to authorized management subnets using an ACL, and finally deactivating unencrypted services and unused ports.
Device hardening follows an orderly sequence: securing local fallback access, enabling encrypted management transport, binding centralized AAA authentication, restricting management source IPs via ACLs, and closing legacy protocols/unused ports to minimize exposure.

Adım Adım Çözüm

1
Set up encrypted local admin accounts and enable secret.
Initial local access is secured against lockout during remote AAA or network transport changes.
Administrative control must be established locally before modifying network management transport protocols.
2
Generate RSA keys and enable SSH v2.
The switch generates public/private key pairs necessary for encrypted remote terminal sessions.
Secure remote shell access requires cryptographic key material to encrypt session data.
3
Configure AAA authentication using TACACS+ with local fallback.
Centralized identity control and session logging are bound to management login attempts.
Enterprise policy mandates centralized authentication while retaining local credentials as a fallback mechanism.
4
Attach restrictive ACLs to VTY lines.
Network management connections are limited strictly to designated administrative IP subnets.
Restricting source IP addresses prevents unauthorized internal network devices from probing management ports.
5
Disable Telnet/HTTP and administratively shut down unused ports.
Plaintext management daemons are closed, and unused physical ports are assigned to an inactive state.
Deactivating unnecessary protocols and ports removes vulnerabilities and physical intrusion vectors as a final surface reduction measure.

Anahtar Kavram

Management Plane Hardening Lifecycle
Soru 1466Soru

A network administrator is designing an out-of-band (OOB) management architecture for edge router console access and remote reboot capabilities during a primary network outage. Which of the following solutions should be implemented to achieve full OOB administrative control and power management under these conditions? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Connect device RS-232 console ports to a centralized terminal server linked to an auxiliary cellular modem network; Install a smart switched Power Distribution Unit (PDU) connected to an independent out-of-band management network

Cevap

The correct architecture requires connecting device serial console ports to a terminal server and deploying a smart switched PDU on an independent out-of-band network.
Out-of-band (OOB) management operates independently of the primary production network. Connecting device serial console ports to a terminal server grants command-line interface access even if the primary operating system or network link drops. Furthermore, deploying a smart switched PDU allows remote administrators to power-cycle unresponsive hardware over the dedicated OOB path when software-based reboots are impossible.

Adım Adım Çözüm

1
Evaluate the requirement for console access during network link failures.
In-band IP services fail when WAN links go down, requiring serial console access aggregated through a terminal server over an out-of-band connection.
Terminal servers provide access to the hardware CLI independently of the primary IP routing stack and network interfaces.
2
Evaluate remote power management needs for hung or frozen appliances.
Switched PDUs afford out-of-band power-cycling capabilities to hard-reset unresponsive network devices.
If an operating system crashes completely, software commands will not respond, necessitating physical power interruptions via a managed PDU.

Anahtar Kavram

Out-of-Band Management (OOB) Architecture
Soru 1467Soru

A network technician is troubleshooting a connectivity issue where hosts on VLAN 20 (192.168.20.0/24192.168.20.0/24) are unable to access an enterprise application server at 10.100.50.2510.100.50.25. Place the following diagnostic and remediation steps in the correct order according to standard CompTIA network troubleshooting methodology, from first step to last step.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct troubleshooting order begins with testing local gateway reachability, followed by using traceroute to locate the failing hop, inspecting the routing table at that hop, reviewing ACL rules on the interface, and finally implementing the fix to verify restored connectivity.
Network troubleshooting follows a logical divide-and-conquer path: verify local gateway access first, trace the path to locate the failure hop, verify routing table entries at that hop, audit interface ACL policies, and conclude by executing the fix and verifying full end-to-end application access.

Adım Adım Çözüm

1
Ping the local default gateway (192.168.20.1192.168.20.1)
Confirms local network link and IP configuration on the client workstation are working.
Troubleshooting should always begin at the local segment before analyzing remote network infrastructure.
2
Run traceroute to target IP 10.100.50.2510.100.50.25
Identifies the exact intermediate router where packet forwarding ceases.
Traceroute narrows down the problem area across a multi-hop routed infrastructure.
3
Check the routing table on the target router
Verifies if the router possesses an active next-hop route to 10.100.50.0/2410.100.50.0/24.
Unroutable traffic is immediately dropped by routers lacking a matching route entry.
4
Examine interface ACL configurations
Identifies any explicit deny statements or implicit deny rules dropping packets on the active path.
Security filters override routing logic when configured to drop specific source/destination traffic.
5
Apply resolution and perform end-to-end verification
Restores full communication between VLAN 20 hosts and 10.100.50.2510.100.50.25.
Standard methodology requires verifying full system functionality after implementing a fix.

Anahtar Kavram

Methodological troubleshooting of routed networks by isolating issues from local gateway reachability to path routing tables and ACL security filters.
Soru 1468Soru

A systems engineer is configuring a Layer 3 switch to relay DHCP requests from client devices on `Vlan 40` (10.40.0.0/2410.40.0.0/24) to a centralized DHCP server located on `Vlan 100` (172.16.100.10172.16.100.10). Workstations on `Vlan 40` fail to obtain IP leases and default to APIPA addresses (169.254.x.x169.254.x.x). Packet captures confirm that client DHCPDISCOVER broadcast packets reach interface `Vlan 40`, but the switch never forwards them to 172.16.100.10172.16.100.10. Reviewing the switch configuration reveals that `ip helper-address 172.16.100.10` was applied to interface `Vlan 100` instead of interface `Vlan 40`. Which of the following statements correctly explains why client leasing is failing and identifies the necessary correction?

Cevabı ve açıklamayı göster

Cevap: The relay agent must be placed on the client-facing gateway interface (`Vlan 40`) so it can intercept local layer 2 broadcasts, insert its interface IP into the gateway IP address (`giaddr`) field, and forward unicast packets to the DHCP server.

Cevap

The relay agent must be configured on the client-facing gateway interface (`Vlan 40`) to intercept local broadcasts, set the gateway IP address (`giaddr`) field to the switch's interface address, and unicast the DHCP request to the server.
DHCPDISCOVER messages are sent as local subnets broadcasts. A Layer 3 interface acting as the default gateway for clients must have `ip helper-address` enabled to listen for incoming UDP port 67 broadcasts on that specific interface. Once captured, the relay agent injects the incoming interface IP into the packet's `giaddr` field and forwards it via unicast routing to the designated DHCP server IP.

Adım Adım Çözüm

1
Analyze client broadcast domain dynamics.
Clients on `Vlan 40` issue Layer 2 broadcast DHCPDISCOVER packets that cannot cross Layer 3 boundaries without an active relay agent on their default gateway interface.
Routers and Layer 3 switches drop Layer 2/3 broadcast frames by default.
2
Evaluate the function of the Gateway IP Address (`giaddr`) field.
When `ip helper-address` is active on `Vlan 40`, the Layer 3 device receives the client broadcast, populates the `giaddr` field with its `Vlan 40` IP address (10.40.0.110.40.0.1), and unicasts the request to 172.16.100.10172.16.100.10.
The centralized DHCP server reads the `giaddr` field to determine which address pool/scope to draw the IP lease from.
3
Identify misconfiguration and remediation.
Configuring `ip helper-address` on `Vlan 100` fails to capture `Vlan 40` broadcasts. Moving the configuration to interface `Vlan 40` restores relay functionality.
The IP Helper feature only intercepts broadcasts arriving on the specific interface where the command is bound.

Anahtar Kavram

DHCP Relay Agent Interface Placement and `giaddr` Insertion
Soru 1469Soru

A network administrator is conducting a post-implementation review of a enterprise wireless deployment across various campus zones. Match each observed wireless signal anomaly to its underlying radio frequency (RF) or configuration cause.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Client devices experience severe throughput degradation and latency spikes in the cafeteria during lunch hours without any increase in Wi-Fi network traffic.
Ground-level patio users report negligible Wi-Fi signal directly beneath a high-gain omnidirectional antenna mounted flat on a third-story roof deck.
Laptops moving into an edge conference room maintain low-data-rate connections to a central hallway access point despite standing directly beneath a fully functional local access point.
Wi-Fi signal strength drops by over 25 dBm after passing through newly installed office partitions featuring architectural tinted low-emissivity (Low-E) glass.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

1. Cafeteria performance drop matches Non-802.11 RF interference within the shared 2.4 GHz ISM band. 2. Roof antenna patio dead zone matches Vertical beamwidth limitations and elevation pattern dead zones. 3. Conference room roaming delay matches Sticky client behavior caused by unoptimized roam trigger thresholds. 4. Low-E glass attenuation matches RF signal attenuation and absorption due to metallic film coatings.
Each symptom directly corresponds to a specific physical RF property or client behavior: Non-802.11 microwave emissions cause cafeteria interference; high-gain omnidirectional antenna patterns create vertical dead zones underneath; sticky client driver thresholds cause delayed roaming to closer APs; and metallic Low-E glass coatings introduce strong signal attenuation.

Adım Adım Çözüm

1
Analyze the cafeteria symptom where non-Wi-Fi activity impairs performance during lunch hours.
Identify that microwave ovens and Bluetooth devices release raw RF energy in the 2.4 GHz spectrum, increasing the noise floor.
Non-802.11 interference causes frame retransmissions without showing up as decodable Wi-Fi frames.
2
Examine the antenna pattern characteristics of the elevated high-gain omnidirectional antenna.
Recognize that higher gain compresses the elevation beamwidth horizontally, diminishing signal directly above and below the antenna axis.
Omnidirectional high-gain antennas direct energy outward horizontally, creating vertical dead zones underneath.
3
Evaluate the roaming behavior of laptops entering the edge conference room.
Identify sticky client behavior, where the client device decision algorithm holds onto an existing association until signal degrades significantly.
Clients drive roaming decisions, and unoptimized roaming thresholds cause devices to stay connected to distant APs.
4
Assess the impact of Low-E glass partitions on signal attenuation.
Determine that metallic oxide layers on Low-E glass absorb and reflect RF signals, drastically reducing received signal strength (RSSI).
Dense construction materials coated with metals act as severe RF attenuators.

Anahtar Kavram

Identifying wireless RF propagation anomalies, antenna propagation patterns, non-Wi-Fi interference sources, and client roaming behavior during wireless network troubleshooting.
Soru 1470Soru

A security analyst is reconfiguring the wireless network for a regional medical center's mobile workstation carts to meet stringent health data protection standards. The organization mandates upgrading to WPA3-Enterprise 192-bit mode. Which of the following requirements must be implemented to achieve this configuration? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: 802.1X authentication integrated with a RADIUS server supporting EAP-TLS; GCMP-256 (Galois/Counter Mode Protocol) cipher suite for data payload encryption

Cevap

The configuration requires implementing 802.1X authentication with RADIUS EAP-TLS and configuring the GCMP-256 encryption cipher suite.
WPA3-Enterprise 192-bit mode provides maximum security for enterprise wireless networks. It mandates 802.1X RADIUS authentication using EAP-TLS with enterprise PKI certificates, alongside GCMP-256 (Galois/Counter Mode Protocol) for payload encryption.

Adım Adım Çözüm

1
Identify the authentication requirements for WPA3-Enterprise 192-bit mode.
WPA3-Enterprise requires centralized authentication via an 802.1X RADIUS architecture, with 192-bit mode specifically mandating EAP-TLS.
Centralized credential verification and mutual certificate authentication prevent unauthorized network access and rogue access point association.
2
Identify the cryptographic encryption cipher suite for 192-bit mode.
WPA3-Enterprise 192-bit mode replaces standard 128-bit ciphers with GCMP-256.
GCMP-256 provides higher-grade 256-bit Galois/Counter Mode encryption and message integrity required for high-security environments.

Anahtar Kavram

WPA3-Enterprise 192-bit Security Mode Requirements
Soru 1471Soru

A network technician is inspecting a newly terminated Cat 6 Ethernet patch cable that is failing to transmit data. To confirm that each of the eight individual conductors is connected to its corresponding pin on both ends without any open circuits or shorts, which diagnostic tool should the technician use?

Cevabı ve açıklamayı göster

Cevap: Wire mapper

Cevap

The technician should use a wire mapper to test wire continuity and pin assignments on both ends of the cable.
A wire mapper is the primary tool used to verify that all eight conductors in a twisted-pair copper cable are terminated correctly according to T568A or T568B pinout standards, verifying continuity and identifying miswires, opens, or shorts.

Adım Adım Çözüm

1
Identify the goal of the physical layer test.
The requirement is to verify pin-to-pin wiring continuity and conductor alignment on an RJ-45 twisted-pair copper patch cable.
Improper pin terminations, disconnected conductors, or crossed wires prevent link establishment.
2
Select the tool dedicated to verifying conductor pinouts.
A wire mapper is designed specifically to detect open conductors, short circuits, and pin mapping mismatches across copper Ethernet pairs.
It is the direct and standard tool for verifying proper RJ-45 conductor pin assignments.

Anahtar Kavram

Pinout and Continuity Testing with a Wire Mapper
Soru 1472Soru

A network administrator is troubleshooting network reachability for a newly installed server in an enterprise datacenter. The host is assigned the IPv4 address 172.16.50.130172.16.50.130 with a subnet mask of 255.255.255.192255.255.255.192 (/26/26). The administrator discovers that while the host can ping its local loopback address, it cannot establish SSH connections to a remote server at 172.16.50.200/26172.16.50.200/26 or reach external networks.

The host IP configuration is verified as follows:
- IPv4 Address: 172.16.50.130172.16.50.130
- Subnet Mask: 255.255.255.192255.255.255.192
- Default Gateway: 172.16.50.126172.16.50.126

The router interface servicing this VLAN is configured as follows:
text
interface GigabitEthernet0/0.50
encapsulation dot1Q 50
ip address 172.16.50.129 255.255.255.192
ip access-group VLAN50_IN in
!
ip access-list extended VLAN50_IN
permit tcp 172.16.50.128 0.0.0.63 any eq 22
permit icmp 172.16.50.128 0.0.0.63 any

Which of the following identifies the primary root cause of the connectivity failure?

Cevabı ve açıklamayı göster

Cevap: The configured default gateway (172.16.50.126172.16.50.126) resides in a different IP subnet than the host (172.16.50.128/26172.16.50.128/26), preventing ARP resolution for off-subnet destinations.

Cevap

The primary root cause of the connectivity failure is that the configured default gateway (172.16.50.126) resides on a different IP subnet than the source host (172.16.50.128/26), which prevents Layer 2 ARP resolution for off-subnet traffic.
The host IP address 172.16.50.130172.16.50.130 with mask 255.255.255.192255.255.255.192 (/26/26) places the host in the 172.16.50.128/26172.16.50.128/26 subnet, which has a usable address range of 172.16.50.129172.16.50.129 through 172.16.50.190172.16.50.190. The configured default gateway (172.16.50.126172.16.50.126) falls into the preceding subnet (172.16.50.64/26172.16.50.64/26). Because the gateway address is outside the host's local subnet, the host cannot send ARP requests to resolve the gateway's MAC address, completely blocking off-subnet routing.

Adım Adım Çözüm

1
Calculate the subnet boundaries for the host IP address using the subnet mask 255.255.255.192255.255.255.192 (/26/26).
A /26/26 mask yields block sizes of 64 (256192=64256 - 192 = 64). Subnet ranges are Subnet 0 (172.16.50.0/26172.16.50.0/26), Subnet 1 (172.16.50.64/26172.16.50.64/26), Subnet 2 (172.16.50.128/26172.16.50.128/26), and Subnet 3 (172.16.50.192/26172.16.50.192/26).
Determining exact subnet boundaries establishes which IP addresses reside on the same broadcast domain.
2
Identify the subnet belonging to the host IP 172.16.50.130172.16.50.130 and determine its valid usable IP range.
The host IP 172.16.50.130172.16.50.130 falls into Subnet 2 (172.16.50.128/26172.16.50.128/26). Network address is 172.16.50.128172.16.50.128, broadcast address is 172.16.50.191172.16.50.191, and usable host IPs range from 172.16.50.129172.16.50.129 to 172.16.50.190172.16.50.190.
Host IP verification confirms that 172.16.50.130172.16.50.130 is a valid usable address within Subnet 2.
3
Evaluate the location of the configured default gateway IP 172.16.50.126172.16.50.126 relative to Subnet 2.
The IP 172.16.50.126172.16.50.126 falls into Subnet 1 (172.16.50.64/26172.16.50.64/26), where usable IPs span 172.16.50.65172.16.50.65 to 172.16.50.126172.16.50.126. The router's actual interface IP for VLAN 50 is 172.16.50.129172.16.50.129.
A host must have a default gateway that resides within its own local IP subnet to complete local ARP requests and forward frames to its Layer 3 exit point.
4
Determine the impact of a default gateway subnet mismatch on traffic forwarding.
When the host attempts to reach an off-subnet destination (172.16.50.200172.16.50.200), it determines that 172.16.50.126172.16.50.126 is off-link (outside 172.16.50.128/26172.16.50.128/26) and fails to generate ARP requests for 172.16.50.126172.16.50.126, dropping packet transmission locally.
Hosts cannot send traffic to a default gateway that does not share their local subnet.

Anahtar Kavram

Default Gateway Subnet Mismatch Diagnosis
Tahmini Süre:3m 0s
Soru 1473Soru

Match each physical network cabling fault or diagnostic condition on the left with its underlying physical cause on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Excessive Near-End Crosstalk (NEXT) detected on a Cat 6A link test
Unusually high optical signal attenuation (dB loss) measured across a fiber patch link
Wire mapper reports split pairs despite showing correct pin-to-pin electrical continuity
Intermittent optical link degradation occurring whenever a server rack door is closed

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

1. Excessive NEXT matches untwisted conductor pairs beyond TIA/EIA limits near the punch-down block.
2. High optical dB attenuation matches microscopic dust/oil on the ferrule end-face.
3. Split pairs with valid continuity match pins connected using conductors from separate physical pairs.
4. Intermittent fiber drops when rack door closes match fiber pinching that exceeds minimum bend radius.
Each diagnostic finding directly correlates with its underlying physical layer failure mechanism. Excessive conductor untwisting at termination causes high NEXT by eliminating inductive noise cancellation. Ferrule contamination causes light scattering and elevated optical dB loss. Split pairs preserve electrical continuity while pairing incorrect conductors together. Physical cable pinching causes macrobending, violating the minimum bend radius and leaking optical signal when rack doors exert pressure.

Adım Adım Çözüm

1
Analyze the physical cause of Near-End Crosstalk (NEXT).
Identify that pair twisting cancels out electromagnetic interference; untwisting conductors beyond TIA/EIA standards at termination points degrades pair isolation and spikes NEXT.
NEXT measures internal cross-talk noise leaking between adjacent wire pairs near the local transmitter.
2
Evaluate the cause of optical insertion loss / dB attenuation.
Recognize that surface contamination on the optical ferrule end-face prevents clean optical contact and refracts light away from the core.
Cleanliness is critical for fiber connections; microscopic debris blocks light transmission.
3
Differentiate split pair defects from standard miswires.
Determine that split pairs maintain pin-to-pin continuity but mismatch physical twist pairings, breaking noise cancellation.
Standard continuity testers miss split pairs because current flows correctly pin-to-pin, but twist shielding benefits are lost.
4
Diagnose cabinet door pressure on fiber cables.
Link physical pressure from closed rack doors to macrobending losses caused by exceeding the fiber's minimum bend radius.
Excessive bending changes the critical angle of internal reflection within the optical fiber core, causing light to escape into the cladding.

Anahtar Kavram

Physical layer cabling defects and diagnostic indicators in copper and fiber networks
Tahmini Süre:2m 0s
Soru 1474Soru

A network administrator is configuring a new wireless network for a corporate branch office. Company security policy mandates that every employee must authenticate using their individual domain accounts against a centralized RADIUS server, preventing the use of a shared network passphrase. Which WPA3 security mode and authentication mechanism should the administrator configure on the Wireless LAN Controller (WLC)?

Cevabı ve açıklamayı göster

Cevap: WPA3-Enterprise using 802.1X RADIUS authentication

Cevap

WPA3-Enterprise using 802.1X RADIUS authentication
The correct option is WPA3-Enterprise using 802.1X RADIUS authentication because WPA3-Enterprise relies on the 802.1X framework to pass user credentials to an external AAA RADIUS server, fulfilling the requirement for individual user login via domain accounts.

Adım Adım Çözüm

1
Identify the authentication requirement from the scenario.
The requirement mandates individual employee authentication via centralized domain accounts and a RADIUS server, excluding shared passwords.
Different wireless security modes determine whether access is granted via a shared credential or unique user identities.
2
Compare WPA3 security modes.
WPA3-Personal uses Simultaneous Authentication of Equals (SAE) for shared passphrases, whereas WPA3-Enterprise integrates with 802.1X and RADIUS servers.
Enterprise networks requiring individual user auditing and credential management depend on 802.1X framework integration.
3
Select the option that correctly pairs the enterprise mode with 802.1X RADIUS.
WPA3-Enterprise using 802.1X RADIUS authentication meets all criteria.
This combination ensures user-level authentication and dynamic key generation for each connected station.

Anahtar Kavram

WPA3 Enterprise vs. Personal Modes and 802.1X RADIUS Authentication
Soru 1475Soru

A workstation on a corporate network is unable to connect to local network resources or access the internet. A technician executes `ipconfig /all` on the workstation and observes an IPv4 address of 169.254.45.12169.254.45.12 with a subnet mask of 255.255.0.0255.255.0.0. Which of the following is the most likely cause of this connectivity issue?

Cevabı ve açıklamayı göster

Cevap: The workstation failed to obtain an IP lease from a DHCP server and assigned itself an Automatic Private IP Addressing (APIPA) address.

Cevap

The workstation failed to contact a DHCP server to acquire an IP address lease, resulting in the self-assignment of an Automatic Private IP Addressing (APIPA) address.
An IP address starting with 169.254.x.x169.254.x.x (specifically in the 169.254.0.0/16169.254.0.0/16 range) is an Automatic Private IP Address (APIPA). Operating systems assign an APIPA address when a DHCP client is unable to contact a DHCP server to obtain an IP address lease. Because APIPA addresses are non-routable, the host cannot communicate beyond its local layer 2 segment.

Adım Adım Çözüm

1
Analyze the reported IPv4 address snippet from ipconfig output.
The workstation reports 169.254.45.12169.254.45.12 with subnet mask 255.255.0.0255.255.0.0.
The address range 169.254.0.0/16169.254.0.0/16 is reserved by IANA for IPv4 link-local addressing (APIPA).
2
Identify the mechanism that generates addresses in the 169.254.0.0/16 range.
Host OS automatically generates an APIPA address when dynamic configuration (DHCP) fails.
When a client sends a DHCPDISCOVER broadcast and receives no DHCPOFFER within the timeout period, it defaults to APIPA to allow limited local link communication.
3
Select the option describing failed DHCP acquisition and APIPA generation.
Confirm that failing to reach a DHCP server and assigning an APIPA address is the root symptom.
This directly explains both the specific IP address assigned and the inability to route to external or non-link-local network resources.

Anahtar Kavram

Automatic Private IP Addressing (APIPA) Diagnosis
Soru 1476Soru

Following a recent core switch update, enterprise workstations connected to VLAN 30 (10.30.0.0/2410.30.0.0/24) fail to communicate outside their local subnet. Preliminary reports indicate workstations are assigning themselves addresses in the range 169.254.0.0/16169.254.0.0/16. Place the following diagnostic and remediation steps in the correct chronological sequence to isolate and resolve this DHCP assignment failure according to standard network troubleshooting methodology.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with verifying the client's APIPA state, followed by checking the local gateway's DHCP relay helper address, auditing intermediate firewall filtering rules for UDP ports 67/68, inspecting DHCP server scope statistics, and finally renewing the client IP lease.
The correct troubleshooting sequence follows the standard CompTIA troubleshooting framework, moving logically from host symptom verification to local gateway relay inspection, intermediate network path filter checks, backend server scope verification, and final client validation.

Adım Adım Çözüm

1
Inspect client network configuration using `ipconfig /all`.
Confirms host has an Automatic Private IP Addressing (169.254.x.x169.254.x.x) address, indicating DHCPDISCOVER requests timed out.
Establishing the baseline symptom on the local host isolates the scope of the problem to IP address auto-configuration failure.
2
Check the VLAN 30 interface configuration on the default gateway switch.
Verifies whether the `ip helper-address` directive is properly configured to forward DHCP broadcasts across subnet boundaries as unicast packets.
Since clients reside on a separate subnet from the central DHCP server, missing relay configuration is the most common cause of multi-VLAN DHCP failure.
3
Audit ACLs and security rules along the path between relay agent and DHCP server.
Ensures that unicast DHCP requests (UDP port 67) and responses (UDP port 68) are permitted through network firewalls.
Even with a valid helper address, network transport controls can drop unicast relay packets before reaching the server.
4
Examine the DHCP server scope statistics for 10.30.0.0/2410.30.0.0/24.
Determines if the IP address pool has been exhausted or if the scope is deactivated.
If the relay agent successfully reaches the server, the server must have an active pool with unassigned addresses to grant a lease.
5
Re-issue a DHCP request on the client via `ipconfig /renew`.
Confirms the host acquires a valid 10.30.0.0/2410.30.0.0/24 IP address, subnet mask, default gateway, and DNS servers.
Verifying functionality directly on the affected host ensures the issue is fully remediated and tests the complete end-to-end lease acquisition process.

Anahtar Kavram

Troubleshooting DHCP Relay and IP Addressing Services across Subnets
Soru 1477Soru

A network analyst suspects that an improper MTU size configuration on a newly deployed site-to-site IPsec VPN gateway is causing large HTTPS file transfers to fail. The analyst performs a ping sweep using unfragmented packets (14001400 bytes with the Don't Fragment flag set) and confirms that packets exceeding 13801380 bytes are dropped at the tunnel interface. Having verified the cause of the issue, which step should the analyst take next according to the CompTIA troubleshooting methodology?

Cevabı ve açıklamayı göster

Cevap: Develop a plan of action to adjust the interface MTU and TCP MSS settings while identifying potential side effects.

Cevap

Develop a plan of action to adjust the interface MTU and TCP MSS settings while identifying potential side effects.
The correct response reflects Step 4 of the CompTIA troubleshooting methodology: 'Establish a plan of action to resolve the problem and identify potential side effects.' Because the analyst just finished testing and validating the theory (Step 3) via ping tests with the DF flag, the direct next requirement is to plan the resolution and evaluate potential side effects before executing changes.

Adım Adım Çözüm

1
Identify the current step in the CompTIA troubleshooting methodology.
The technician tested the theory using unfragmented ping tests and confirmed the cause (Step 3: Test the theory to determine cause).
Determining the completed phase establishes where the analyst currently sits in the sequential methodology.
2
Determine the required next step in the standard 6-step CompTIA process.
Following Step 3 (Test theory), the next sequential step is Step 4: Establish a plan of action to resolve the problem and identify potential side effects.
Before making changes to production network equipment, a comprehensive plan and risk assessment must be established.

Anahtar Kavram

CompTIA Troubleshooting Methodology Step Order
Tahmini Süre:1m 15s
Soru 1478Soru

A network administrator is designing a performance monitoring strategy for an enterprise infrastructure. Match each performance telemetry protocol or monitoring mechanism on the left with its primary operational characteristic on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

NetFlow / IPFIX
SNMPv3 with authPriv
Syslog
ICMP Echo Baseline Probing

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

NetFlow / IPFIX matches with exporting flow-level metadata for traffic profiling; SNMPv3 with authPriv matches with encrypted and authenticated polling of MIB variables; Syslog matches with delivering event-driven system notifications; ICMP Echo Baseline Probing matches with measuring round-trip time (RTT) and packet loss.
Each performance telemetry tool satisfies a distinct monitoring role: NetFlow/IPFIX provides traffic flow metadata, SNMPv3 authPriv secures active polling of MIB device counters, Syslog aggregates event notifications, and ICMP probing evaluates latency and packet loss performance baselines.

Adım Adım Çözüm

1
Analyze flow telemetry characteristics
NetFlow / IPFIX collects conversation traffic details (IP addresses, protocol ports, and volume).
Flow collection records traffic patterns rather than polling discrete device hardware status counters.
2
Analyze secure device management standards
SNMPv3 with authPriv secures MIB query telemetry.
The authPriv mode adds cryptographic authentication and privacy encryption to polling interactions.
3
Analyze message logging mechanisms
Syslog pushes event-based operational notifications.
Devices use Syslog to automatically push event logs when state changes or errors occur.
4
Analyze path quality probing mechanisms
ICMP Echo probing calculates delay and loss metrics.
Transmitting periodic ICMP echo probes measures basic path latency baselines and dropped packet rates.

Anahtar Kavram

Network Telemetry and Performance Monitoring Protocols
Soru 1479Soru

A network technician is responding to connectivity issues reported by forklift operators in a distribution warehouse. The operators report that handheld Wi-Fi scanners frequently disconnect and fail to roam when driving deep into storage aisles. A wireless site survey indicates that while ceiling-mounted omnidirectional Access Points (APs) along the central walkway maintain strong signal strength of 60 dBm-60\text{ dBm}, the signal drops significantly to 85 dBm-85\text{ dBm} inside the aisle rows filled with metallic racks and densely stacked inventory. Which of the following is the primary cause of this issue, and what is the most effective solution?

Cevabı ve açıklamayı göster

Cevap: RF absorption and attenuation caused by physical metallic structures; install directional patch antennas focused down each storage aisle.

Cevap

The primary cause is RF absorption and attenuation caused by physical metallic structures. The recommended solution is to install directional patch antennas focused down each storage aisle.
Dense metallic shelving and warehouse inventory absorb and reflect radio frequency (RF) signals, causing high attenuation and creating wireless dead zones in aisles. Installing directional patch antennas aims the wireless beam down the corridor of each aisle, concentrating signal strength where handheld scanners operate.

Adım Adım Çözüm

1
Analyze the site survey data and environment description.
The signal drops from 60 dBm-60\text{ dBm} in the main walkway to a weak 85 dBm-85\text{ dBm} inside the aisles surrounded by metal shelving and inventory.
Dense metal structures act as physical RF barriers, causing signal attenuation and reflection.
2
Evaluate the current antenna design versus environmental requirements.
Omnidirectional antennas radiate signal in a 360-degree pattern, which gets blocked and absorbed by high metal shelves.
Omnidirectional antennas are ineffective when RF propagation is restricted by narrow, metallic corridors.
3
Select the appropriate antenna type for aisle coverage.
Directional patch antennas focus the RF radiation beam pattern down specific paths.
Aiming directional antennas down the length of each aisle overcomes localized attenuation and ensures reliable roaming for warehouse clients.

Anahtar Kavram

RF Attenuation & Directional Antenna Selection
Tahmini Süre:1m 30s
Soru 1480Soru

A network engineer configures a stateless router Access Control List (ACL) to allow client workstations on subnet 10.50.1.0/2410.50.1.0/24 to access an internal web server at 172.16.10.20172.16.10.20. The engineer applies the inbound rule `permit tcp 10.50.1.0 0.0.0.255 host 172.16.10.20 eq 80` on the interface facing the web server. Although initial packets reach the server, workstation browsers consistently time out when attempting to load web pages. Which configuration change will resolve this connection failure?

Cevabı ve açıklamayı göster

Cevap: Add an outbound ACL rule allowing TCP traffic from host 172.16.10.20 using the established keyword back to the 10.50.1.0/24 subnet.

Cevap

Add an outbound ACL rule allowing TCP traffic from host 172.16.10.20 using the established keyword back to the 10.50.1.0/24 subnet.
Stateless ACLs evaluate each packet in isolation and do not keep track of active connection states. While the inbound rule permits HTTP client requests to reach the web server, the server's TCP return traffic (SYN-ACK / ACK) is blocked by the router interface's implicit deny rule. Adding an outbound rule matching return traffic from the web server using the `established` keyword permits return packets belonging to established TCP connections.

Adım Adım Çözüm

1
Analyze the stateless nature of the configured ACL.
Stateless ACLs evaluate packets individually and do not track connection states.
Because state is not tracked, permitting inbound traffic from client to server does not automatically permit return traffic from server to client.
2
Identify the cause of the connection timeout.
The web server receives HTTP requests but its TCP SYN-ACK return packets are blocked by the default implicit deny rule on the router interface.
Without an explicit return rule or stateful inspection, return packets are dropped.
3
Determine the necessary configuration fix.
Permit return traffic outbound from host 172.16.10.20172.16.10.20 to subnet 10.50.1.0/2410.50.1.0/24 with the `established` keyword (matching TCP packets with ACK or RST flags set).
This allows return communication for established TCP sessions while preventing external hosts from initiating unauthorized connections back to internal clients.

Anahtar Kavram

Stateless vs Stateful ACL Filtering and Return Traffic
ÖncekiSayfa 74 / 112Sonraki
Tüm alıştırma soruları — CompTIA Network+ | Examkin