Network Operations

362 soru

Soru 21Soru

Match each network logging and auditing protocol or concept on the left with its corresponding primary characteristic or function on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Default Syslog Transport
SNMPv3 authPriv
NetFlow Auditing
Syslog Severity Level 0

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Default Syslog Transport matches sending messages over UDP port 514; SNMPv3 authPriv matches providing authentication and encryption; NetFlow Auditing matches collecting traffic flow statistics; Syslog Severity Level 0 matches emergency conditions where the system is unusable.
Each logging and monitoring concept correctly maps to its foundational standard: Default Syslog uses UDP 514; SNMPv3 authPriv combines authentication with encryption; NetFlow tracks IP traffic session metrics; and Syslog severity 0 corresponds to emergency conditions.

Adım Adım Çözüm

1
Identify the standard transport mechanism for basic Syslog logging.
Syslog operates by default using unacknowledged UDP over port 514.
This establishes standard baseline event logging behavior on enterprise network infrastructure.
2
Determine the highest security model capabilities of SNMPv3.
The authPriv mode adds payload privacy (encryption) on top of user authentication.
Security mandates require understanding how authPriv differs from noAuthNoPriv and authNoPriv.
3
Distinguish network flow telemetry from event message logging.
NetFlow analyzes traffic headers to report traffic volumes and conversation statistics rather than log events.
Flow data provides audit visibility into network utilization and conversation endpoints.
4
Recall standard Syslog severity codes (0 through 7).
Level 0 is defined as Emergency (system unusable).
Log auditing relies on prioritizing event severity correctly during triage.

Anahtar Kavram

Core Network Logging and Auditing Protocols
Soru 22Soru

A network administrator needs to apply a firmware update to several enterprise network switches following standard operational procedures. In which sequential order should the administrator perform the steps of the patch management lifecycle?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for the patch management lifecycle is: 1) Identify and download the patch from the official vendor portal, 2) Validate and test the patch in an isolated lab environment, 3) Submit a formal change request and obtain maintenance window authorization, 4) Deploy the patch to production network devices during the approved window, and 5) Perform post-deployment auditing and monitor system logs for anomalies.
The correct order follows the established patch management process: Acquisition -> Lab Testing -> Change Management Approval -> Production Deployment -> Post-deployment Audit.

Adım Adım Çözüm

1
Identify patch availability and download official firmware.
Verified patch binary is obtained securely.
The patch lifecycle must begin by sourcing legitimate software directly from the manufacturer.
2
Perform lab testing in an isolated environment.
Firmware stability and feature compatibility are confirmed without risk to live operations.
Staging and testing prevent buggy updates from causing unexpected outages in production.
3
Initiate the change management approval process.
The maintenance window is authorized and stakeholders are notified.
Proper change control ensures operational visibility and aligns updates with organizational policies.
4
Execute the firmware installation on production hardware.
Switches are updated to the target software release.
Deployment must occur during the designated maintenance window to minimize business impact.
5
Conduct post-deployment auditing and log review.
Confirmation of normal network performance and absence of system errors.
Final auditing verifies that the patch resolved the intended issue without introducing new problems.

Anahtar Kavram

Patch Management Lifecycle
Soru 23Soru

A network technician needs to upgrade the firmware on a campus access switch following standard IT service management practices. In what chronological order should the technician execute the steps of the change management lifecycle from first to last?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with submitting the RFC, followed by securing CAB approval, deploying the update during the maintenance window, and concluding with a post-implementation review.
Standard change management follows a strict lifecycle: initiating an RFC with impact and rollback details, obtaining formal CAB authorization, implementing the change within an approved maintenance window, and concluding with a post-implementation review to verify success and document the updated baseline.

Adım Adım Çözüm

1
Identify the initial administrative step required prior to review.
The RFC must be drafted and submitted first with risk assessments and rollback plans.
Governance frameworks require documented justification and safety plans before evaluating proposed modifications.
2
Determine the governing authorization step.
The CAB reviews the submitted RFC and grants authorization.
Stakeholders must evaluate potential operational impacts before scheduling the change.
3
Identify the execution phase.
The technician installs the firmware during the scheduled maintenance window.
Authorized changes are performed during pre-approved windows to avoid disrupting production traffic.
4
Identify the final closeout phase.
Perform a post-implementation review (PIR) and update documentation.
Final validation ensures objectives were met and administrative records remain accurate.

Anahtar Kavram

Standard Change Management Lifecycle
Soru 24Soru

A network administrator is preparing to perform a routine firmware update on enterprise network switches during a scheduled maintenance window. Which TWO of the following tasks should be completed prior to deploying the patch to the production environment? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Test the firmware update in an isolated lab or staging environment.; Create a baseline backup of the current operating system image and configuration file.

Cevap

The administrator should test the firmware update in an isolated lab environment and create a baseline backup of the current configuration and operating system image prior to production deployment.
Before deploying patches to production, administrators must test updates in a lab or staging environment to identify potential operational issues and back up active configurations and system software to allow for rapid rollback if failure occurs.

Adım Adım Çözüm

1
Identify risk mitigation steps prior to software deployment.
Staging in a lab environment verifies patch stability, and creating a configuration backup provides a rollback mechanism.
Best practices in patch management require pre-deployment testing and rollback preparation before applying changes to production equipment.

Anahtar Kavram

Best practices for network patch management and maintenance window planning.
Tahmini Süre:45s
Soru 25Soru

During a scheduled maintenance window, a network engineer deploys a critical configuration update to an edge router to enable new BGP routing policies. Immediately following the change, internal monitoring alerts show severe packet loss across multiple subnets, and remote sites lose connectivity to the primary datacenter. The engineer suspects a misconfigured route map but realizes that testing during the window ran out of time. According to standard change management procedures, which of the following is the MOST appropriate immediate action for the engineer to take?

Cevabı ve açıklamayı göster

Cevap: Execute the documented rollback plan to restore the router to its pre-change configuration baseline.

Cevap

The network engineer must immediately execute the documented rollback plan to return the edge router to its known good pre-change baseline.
Executing the pre-documented rollback plan is the mandatory action under change management frameworks when an update fails validation or causes an unplanned disruption. This action rapidly restores network services to a verified baseline state while preventing unapproved configuration drift.

Adım Adım Çözüm

1
Assess the impact of the change implementation
Severe packet loss and site disconnects indicate severe network instability resulting directly from the BGP change.
When a change causes unintended downtime and cannot be immediately rectified within the approved maintenance window bounds, change control rules require stopping implementation.
2
Evaluate remediation options against change control governance
Troubleshooting live in production risks prolonged downtime and unapproved drift, whereas executing the rollback plan returns services to operational status safely.
Rollback procedures are specifically designed and approved by the Change Advisory Board (CAB) prior to execution to handle implementation failures.
3
Execute the rollback procedure and perform post-incident review
The network returns to the baseline configuration, allowing for root-cause analysis in a sandbox environment before re-submitting a new Request for Change (RFC).
Returning to a stable state prioritizes business continuity while respecting configuration management policies.

Anahtar Kavram

Change Management Rollback Execution & Baseline Preservation
Tahmini Süre:2m 0s
Soru 26Soru

A network administrator is upgrading device monitoring and logging protocols across the enterprise network to enforce strict encryption and data integrity standards during auditing. Which of the following configuration options fulfill these secure logging requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure SNMPv3 with the authPriv security level.; Enable Syslog transmission over TCP port 6514 using TLS encryption.

Cevap

Configuring SNMPv3 with the authPriv security level and enabling Syslog transmission over TCP port 6514 using TLS encryption.
Configuring SNMPv3 with the authPriv security level ensures both authentication and encryption of management traffic. Additionally, transmitting Syslog events over TCP port 6514 using TLS encryption satisfies secure log transport and integrity requirements.

Adım Adım Çözüm

1
Identify secure SNMP protocol features.
SNMPv3 with authPriv supplies cryptographic authentication and encryption for telemetry.
SNMPv1 and SNMPv2c lack payload encryption and utilize clear-text community strings.
2
Identify secure Syslog transport and port specifications.
Syslog over TLS utilizes TCP port 6514 for secure and encrypted log transport.
Standard Syslog uses UDP 514, whereas secure encrypted Syslog operates over TCP 6514.

Anahtar Kavram

Secure Network Logging and SNMP Telemetry Protocols
Soru 27Soru

A network administrator deploys two Layer 3 switches (Switch-Alpha and Switch-Beta) using Hot Standby Router Protocol (HSRP) to provide default gateway redundancy for a server subnet (10.50.10.0/2410.50.10.0/24). Switch-Alpha is designated as the primary gateway with an HSRP priority of 120, while Switch-Beta is configured with the default priority of 100. Interface tracking is enabled on Switch-Alpha to decrement its priority by 30 if its uplink interface fails. During a simulated link failure on Switch-Alpha's uplink, its priority drops to 90, allowing Switch-Beta (priority 100) to assume the active gateway role. However, after the uplink link on Switch-Alpha is fully restored and its priority returns to 120, Switch-Beta remains the active gateway while Switch-Alpha stays in standby mode. Which of the following root causes best explains why Switch-Alpha failed to reclaim the active gateway role upon uplink restoration?

Cevabı ve açıklamayı göster

Cevap: Switch-Alpha was not configured with the HSRP preempt command.

Cevap

Switch-Alpha was not configured with the HSRP preempt command.
In First Hop Redundancy Protocols such as HSRP, an active router that has assumed control will remain the active router even if another router on the segment comes online with a higher priority value. To force the higher-priority router (Switch-Alpha with priority 120) to reclaim the active role from Switch-Beta (priority 100) after link restoration, the `standby preempt` command must be explicitly configured on Switch-Alpha.

Adım Adım Çözüm

1
Analyze HSRP priority behavior during uplink failure
Switch-Alpha's priority dropped from 120 to 90 (due to -30 decrement), which is lower than Switch-Beta's priority of 100. Switch-Beta legitimately took over the active role.
When a tracked object fails, the reduced priority allows a secondary router with higher current priority to take over active routing.
2
Analyze HSRP behavior upon link restoration
Switch-Alpha's priority recovered to 120, which is higher than Switch-Beta's priority of 100.
Restoring the tracked uplink interface cancels the priority decrement.
3
Identify the mechanism required for a higher-priority router to reclaim the active role
By default, HSRP does not allow a router with a higher priority to forcibly take over the active role from an currently active router unless preemption (`standby preempt`) is explicitly enabled on the higher-priority router.
Preemption allows a router with a higher priority to assume control as the active virtual router immediately upon becoming available.

Anahtar Kavram

FHRP Priority, Interface Tracking, and Preemption Mechanics
Soru 28Soru

Match each remote access or out-of-band management technology on the left with the enterprise scenario on the right for which it is the most appropriate management solution.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Cellular Out-of-Band (OOB) Modem connected to a Terminal Server
IP-KVM Switch with Virtual Media capabilities
Baseboard Management Controller (BMC) via IPMI / lights-out management
Switched Smart Power Distribution Unit (PDU)
In-Band SSH over IPsec Remote Access VPN

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The technology items correctly align with their deployment scenarios based on whether access relies on the production network path (in-band) or dedicated non-production hardware paths (out-of-band serial, power, or lights-out management interfaces).
Each management technology addresses specific operational conditions: Cellular OOB modems with terminal servers restore console access during primary link loss; IP-KVM switches enable keyboard/video/mouse control and remote ISO mounting without an OS; IPMI/BMC provides low-level system health metrics directly from the motherboard micro-controller; switched PDUs enable remote AC outlet power cycling when device control planes lock up; and SSH over IPsec VPN provides secure, encrypted in-band CLI access over operational networks.

Adım Adım Çözüm

1
Analyze primary network availability constraints for each scenario.
Identified scenarios requiring alternative network access (WAN outage requiring cellular OOB) versus production network access (routine maintenance requiring SSH over VPN).
Out-of-band solutions bypass primary network infrastructure failures.
2
Evaluate hardware control level requirements.
Differentiated between OS-level installation needs (IP-KVM virtual media), motherboard/sensor hardware access (IPMI/BMC), and physical AC power cycle needs (Smart PDU).
Different failure states require intervention at distinct layers of the hardware stack.
3
Pair each management method to its optimal operational requirement.
Matched cellular terminal server to WAN outage console access, IP-KVM to OS mounting, IPMI to thermal/power diagnostics, Smart PDU to switch hard resets, and SSH/VPN to routine in-band administrative tasks.
Ensures minimal downtime and secure, targeted remote administrative access.

Anahtar Kavram

Remote Access and Out-of-Band Management Methods
Soru 29Soru

A network technician is setting up SNMPv3 on a managed switch to send performance monitoring data securely to a network management server using the authPriv security level. Which TWO of the following algorithms or features must be enabled to satisfy the requirements of this specific security level? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Secure Hash Algorithm (SHA) for data authentication and integrity; Advanced Encryption Standard (AES) for payload privacy and encryption

Cevap

Secure Hash Algorithm (SHA) for data authentication and Advanced Encryption Standard (AES) for payload encryption.
The SNMPv3 authPriv mode requires both authentication and encryption. Secure Hash Algorithm (SHA) provides user authentication and data integrity, while Advanced Encryption Standard (AES) provides packet payload confidentiality through encryption.

Adım Adım Çözüm

1
Identify the requirements of the SNMPv3 authPriv security level.
The authPriv (Authentication and Privacy) level mandates both user authentication and payload encryption.
SNMPv3 defines three security levels: noAuthNoPriv (no security), authNoPriv (authentication without encryption), and authPriv (both authentication and encryption).
2
Select the appropriate authentication protocol.
Secure Hash Algorithm (SHA) or Message Digest 5 (MD5) satisfies the authentication requirement.
Hashing algorithms provide cryptographic verification of data origin and integrity.
3
Select the appropriate privacy/encryption protocol.
Advanced Encryption Standard (AES) or Data Encryption Standard (DES) satisfies the privacy requirement.
Symmetric encryption algorithms encrypt the packet payload to prevent eavesdropping.

Anahtar Kavram

SNMPv3 Security Levels (authPriv)
Soru 30Soru

A network administrator needs to establish a remote management connection to a core router located at an unstaffed branch office. The solution must grant low-level command-line interface (CLI) access for emergency troubleshooting even if the router's primary operating system network interfaces or main WAN links experience a complete failure. Which of the following solutions best satisfies these requirements?

Cevabı ve açıklamayı göster

Cevap: An out-of-band serial console server connected to the router's console port with a dedicated cellular modem link

Cevap

An out-of-band serial console server connected to the router's console port with a dedicated cellular modem link
Out-of-band (OOB) management provides an alternate, isolated communication path to network hardware. By connecting a serial console server directly to the router's physical console port and routing traffic over an independent channel such as a cellular modem, administrators retain full CLI access to troubleshoot device failures even when primary IP interfaces or WAN circuits are down.

Adım Adım Çözüm

1
Analyze the operational constraints and availability requirements
Management access must function even when primary WAN links fail and main OS interfaces are down.
In-band management paths depend on active primary network interfaces and operational IP routing, which fail during link or interface outages.
2
Differentiate between in-band and out-of-band (OOB) management architectures
Out-of-band management provides a separate physical or logical communication channel outside the primary data network path.
Connecting directly to a physical console port via a terminal/console server paired with an alternate WAN connection (like cellular) guarantees administrative access during primary outages.

Anahtar Kavram

Out-of-Band (OOB) Remote Management
Soru 31Soru

A network administrator receives a critical security update for an enterprise core router's operating system. Which of the following actions should the administrator take first to ensure network stability before deploying the patch to production?

Cevabı ve açıklamayı göster

Cevap: Test the patch in a isolated staging environment that mimics the production network.

Cevap

Testing the patch in an isolated staging environment that mimics the production network is the essential first step before any live deployment.
In proper patch management lifecycles, testing patches within a non-production lab or staging environment is always the first operational requirement. This isolates bugs and validates performance before live implementation.

Adım Adım Çözüm

1
Identify the standard operating procedure for patch deployment.
Recognize that patch management requires risk mitigation steps including testing, baseline backing up, and scheduled maintenance windows.
Applying untested firmware or software updates directly to live devices can lead to unexpected outages or feature breakage.
2
Evaluate the safest initial action among the available options.
Deploying the update in a controlled sandbox or staging environment allows verification of stability and compatibility without impacting users.
Staging environments mirror production hardware and configurations, ensuring unexpected behavior is resolved prior to change advisory board (CAB) final approval and production rollout.

Anahtar Kavram

Patch Staging and Pre-deployment Testing
Soru 32Soru

A network security auditor is reviewing an enterprise organization's network logging and monitoring infrastructure to meet stringent compliance regulations. The audit reveals two major vulnerabilities: (1) SNMP management traffic captures reveal cleartext interface statistics and OID payloads despite network administrators requiring password access to the monitoring console, and (2) during periodic core switch link saturation, critical Syslog alerts from edge devices are consistently dropped before reaching the centralized SIEM. Which combination of configuration updates will resolve both compliance findings by ensuring cryptographic privacy of network management payloads and reliable, tamper-resistant log delivery?

Cevabı ve açıklamayı göster

Cevap: Migrate SNMP monitoring to SNMPv3 configured for authPriv using SHA authentication and AES encryption, and reconfigure Syslog transport to use TLS over TCP port 6514.

Cevap

Migrate SNMP monitoring to SNMPv3 configured for authPriv using SHA authentication and AES encryption, and reconfigure Syslog transport to use TLS over TCP port 6514.
SNMPv3 authPriv combines cryptographic user authentication (such as SHA) with symmetric payload encryption (such as AES), preventing eavesdroppers from reading cleartext OID values and interface stats. Furthermore, configuring Syslog over TLS using TCP port 6514 ensures both cryptographic log security and reliable, acknowledged packet delivery that prevents log loss during network congestion.

Adım Adım Çözüm

1
Identify the required SNMP security model for management traffic privacy
SNMPv3 with the authPriv security level is required because authNoPriv only provides message integrity/authentication, whereas authPriv adds symmetric encryption (such as AES) to protect payload confidentiality.
Cleartext OIDs and statistics must be encrypted in transit to satisfy compliance regulations.
2
Analyze the log packet drop issue during network congestion
Standard Syslog uses UDP port 514, which is connectionless and unacknowledged, leading to silently dropped log packets when buffers overflow during traffic spikes.
A connection-oriented transport protocol (TCP) is necessary to ensure acknowledgment and delivery reliability.
3
Select the correct secure, reliable Syslog transport configuration
Syslog over TLS utilizes TCP port 6514, delivering both transport-layer security/encryption and reliable TCP delivery semantics.
Port 6514 is the standard IANA-assigned port for Syslog over TLS (RFC 5425).

Anahtar Kavram

SNMPv3 Security Levels (authPriv) and Secure Syslog Transport (TLS/TCP Port 6514)
Soru 33Soru

Match each network documentation type to its primary operational purpose.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Physical Topology Diagram
Network Baseline Documentation
Change Management Log
IDF/MDF Floor Layout Diagram

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The physical topology diagram matches identifying physical port connections and cable runs; network baseline documentation matches establishing standard operating performance metrics; change management log matches tracking historical network modifications; and the IDF/MDF floor layout diagram matches visualizing physical room locations and rack positioning.
Each item correctly matches its operational documentation purpose: physical topology diagrams detail cabling and interface connections; network baselines document typical performance levels to identify anomalies; change management logs record historic infrastructure modifications; and IDF/MDF layout diagrams visually map telecommunications rooms and rack arrangements.

Adım Adım Çözüm

1
Analyze the purpose of a Physical Topology Diagram
Physical topology maps depict actual hardware cables, physical ports, and device interfaces.
This corresponds directly to identifying physical port connections and cable runs.
2
Analyze the purpose of Network Baseline Documentation
Baseline records capture standard network performance metrics during normal operation.
This provides a reference point for comparing future performance anomalies.
3
Analyze the purpose of a Change Management Log
Change logs keep track of who changed what, when, and why across network infrastructure.
This corresponds to tracking historical network modifications and updates.
4
Analyze the purpose of an IDF/MDF Floor Layout Diagram
IDF/MDF layout diagrams depict physical building space, telecommunications closets, and equipment racks.
This corresponds to visualizing room locations and spatial rack placement.

Anahtar Kavram

Network Documentation Types and Use Cases
Tahmini Süre:1m 0s
Soru 34Soru

A network technician is documenting a newly commissioned telecommunications room to assist on-site staff with pinouts, cable runs, wall outlet terminations, and patch panel port locations. The documentation must detail exact physical conductor connections and jack numbers without detailing IP addressing schemes or device rack unit placements. Which document type should the technician prepare?

Cevabı ve açıklamayı göster

Cevap: Wiring schematic

Cevap

The correct document to prepare is a wiring schematic, as it specifies low-level physical wiring paths, pinouts, patch panel terminations, and port labeling.
A wiring schematic (or cable run diagram) focuses explicitly on Layer 1 infrastructure details, such as color code standards (T568A/T568B), cable run IDs, wall jack labels, and patch panel port assignments.

Adım Adım Çözüm

1
Analyze the requirements stated in the scenario.
Identified the need to document physical cable paths, pinouts, patch panel terminations, and wall jack IDs at Layer 1.
The scenario emphasizes physical cable tracing rather than device placement or logical IP configuration.
2
Evaluate candidate documentation types against Layer 1 physical requirements.
Wiring schematics focus specifically on pinout diagrams, cable run details, and physical port terminations.
Wiring schematics provide granular connection mapping for technicians performing physical installation and cable troubleshooting.
3
Differentiate from alternative diagram types.
Logical diagrams cover IP/VLAN layouts; rack elevations cover physical unit heights; baselines cover performance metrics.
Selecting the incorrect diagram type leads to missing essential pinout and termination details during physical maintenance.

Anahtar Kavram

Wiring Schematics and Cable Documentation
Soru 35Soru

A principal network architect is designing a high-availability out-of-band (OOB) management framework for a remote enterprise data center. The solution must guarantee secure administrative access to core network appliances and power controls even during a complete collapse of the primary WAN infrastructure and internal LAN control planes. Which TWO of the following deployment strategies directly satisfy these out-of-band access and security requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy an encrypted cellular modem connected to a centralized serial console server that interfaces directly with the console ports of network appliances.; Utilize remote-managed Power Distribution Units (PDUs) reachable via an isolated OOB management network segment to perform hardware power cycling.

Cevap

The correct strategies are deploying an encrypted cellular modem connected to a serial console server for terminal console access, and using remote-managed PDUs on an isolated OOB network segment for power management.
True out-of-band (OOB) management requires complete architectural isolation from production network channels. Connecting a central serial console server to appliance serial console ports via an encrypted cellular modem ensures administrators retain direct shell access during total WAN/LAN failures. Complementing this with intelligent PDUs on an isolated management network enables power-cycling frozen hardware remotely.

Adım Adım Çözüm

1
Analyze the operational constraints of out-of-band management during primary network failures.
OOB management infrastructure must remain operational over alternative mediums (such as cellular or dedicated dial-up) when primary WAN routers and LAN switches fail.
In-band mechanisms depend on active data plane routing and switching, rendering them unavailable during major infrastructure outages.
2
Select components that provide direct device control and power management without relying on local network stacks.
Serial console servers provide low-level terminal access via RS-232 serial links, while remote smart PDUs allow cold-rebooting frozen devices.
Serial console access bypasses standard IP networking stacks on target appliances, and remote PDUs solve kernel hang scenarios.

Anahtar Kavram

Out-of-band (OOB) management architectures separate administrative control channels from production data networks using independent physical paths, secure serial console servers, and remote PDU power management.
Tahmini Süre:3m 0s
Soru 36Soru

During a physical fiber cut, an enterprise branch site experiences complete loss of its primary and secondary WAN transport links. Network engineers must urgently perform low-level command-line reconfiguration on the core switches and execute a hard power cycle on an unresponsive edge router at the location. Which of the following infrastructure deployment models provides secure emergency administrative access to these hardware assets without depending on the production transport network?

Cevabı ve açıklamayı göster

Cevap: Connecting a dedicated terminal server and switched Power Distribution Unit (PDU) to an isolated cellular gateway, managing serial console lines using SSH and power sockets using HTTPS.

Cevap

Connecting a dedicated terminal server and switched Power Distribution Unit (PDU) to an isolated cellular gateway, managing serial console lines using SSH and power sockets using HTTPS.
Out-of-band (OOB) management provides a dedicated, secondary path into network infrastructure that functions even when the primary production network fails completely. Combining a cellular gateway with a console terminal server and a remotely managed switched PDU enables network engineers to establish encrypted SSH serial console sessions to configure switches and access HTTPS management pages to cycle power on frozen hardware.

Adım Adım Çözüm

1
Analyze network failure constraints.
Primary and secondary in-band WAN transport links are completely down, ruling out any management system reliant on production IP routing pathways.
Out-of-band (OOB) connectivity must utilize an independent communication path such as cellular modems or POTS lines.
2
Evaluate access requirements for hardware recovery.
Serial console access (terminal server) is required for CLI changes on headless devices, and remote power control (switched PDU) is required to hard reboot unresponsive routers.
In-band administrative protocols (SSH/RDP to primary IP addresses) are unavailable when network OS components or transport interfaces crash.
3
Evaluate transport security and protocol characteristics.
SSH (TCP port 22) and HTTPS (TCP port 443) provide strong encryption over the cellular out-of-band link, while Telnet, SNMPv2c, and incorrect UDP protocol selections introduce severe security vulnerabilities or total protocol failures.
Security mandates encrypted administration even over out-of-band channels.

Anahtar Kavram

Out-of-Band (OOB) Remote Management Architecture
Soru 37Soru

A network administrator configures an active/passive firewall cluster to ensure high availability for an enterprise network. During a failover test, the passive firewall successfully assumes the active role, and newly initiated web traffic flows normally. However, all established, long-lived TCP sessions (such as SSH connections and database transactions) are immediately dropped, forcing users to reconnect. Which of the following is the most likely cause of this issue?

Cevabı ve açıklamayı göster

Cevap: Stateful session synchronization between the cluster nodes was not enabled.

Cevap

Stateful session synchronization between the cluster nodes was not enabled.
In a stateful high-availability deployment, active and standby nodes replicate connection tracking tables, NAT tables, and VPN state information across a dedicated heartbeat link. If state synchronization is missing or disabled (stateless failover), the standby unit has no record of established connections when it becomes active, forcing it to drop existing stateful TCP sessions while accepting new connections.

Adım Adım Çözüm

1
Analyze the symptoms described in the scenario.
Takeover succeeded, and new traffic flows as expected, but active TCP connections dropped.
This indicates that Layer 2/3 IP failover (such as Virtual IP transfer) worked correctly, but state information was missing on the newly active node.
2
Differentiate between stateless and stateful high-availability failover.
Stateless failover moves IP addresses without sharing state tables; stateful failover continuously replicates state tables.
Without stateful session synchronization, the new active device treats incoming packets for pre-existing TCP connections as invalid (since they do not match any known session entry) and sends RST packets to reset them.
3
Select the configuration requirement that prevents session termination upon takeover.
Enabling stateful failover / state synchronization between HA nodes maintains active connection state across transitions.
This matches the exact root cause of dropped established connections during an otherwise successful failover.

Anahtar Kavram

Stateful vs. Stateless High Availability Failover
Soru 38Soru

A network administrator needs to monitor performance metrics on core switches while ensuring that all polling traffic is authenticated and payload data is encrypted across the network. Which of the following SNMP configurations should the administrator deploy?

Cevabı ve açıklamayı göster

Cevap: SNMPv3 with authPriv security level

Cevap

SNMPv3 with authPriv security level
SNMPv3 with the authPriv security level meets both requirements by utilizing cryptographic authentication along with payload encryption.

Adım Adım Çözüm

1
Identify the security requirements for network performance monitoring.
The requirement mandates both authentication and payload encryption for monitoring traffic.
Unencrypted polling traffic exposes sensitive system OIDs and operational data to network eavesdropping.
2
Select the SNMP version and security mode that satisfies both requirements.
SNMPv3 with authPriv provides cryptographic user authentication (such as SHA) and data privacy (such as AES encryption).
SNMPv1 and SNMPv2c lack cryptographic protection, and lower SNMPv3 security levels do not encrypt the data payload.

Anahtar Kavram

SNMP Security Levels and Versions
Soru 39Soru

Match each remote management protocol or access method on the left to its correct primary characteristic on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

SSH (Secure Shell)
Telnet
Cellular Out-of-Band Modem
RDP (Remote Desktop Protocol)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

SSH matches with encrypted command-line access; Telnet matches with unencrypted cleartext access; Cellular Out-of-Band Modem matches with alternative connectivity during primary connection failure; RDP matches with graphical user interface sessions.
Each management solution is paired directly with its core operational distinction: SSH offers encrypted command-line sessions, Telnet provides unencrypted command-line sessions, Cellular Out-of-Band modems deliver secondary connectivity during primary network failures, and RDP supplies graphical desktop interface sessions.

Adım Adım Çözüm

1
Identify the primary encrypted command-line remote access method.
SSH provides secure, encrypted terminal access over network connections.
SSH encrypts session communications to protect against eavesdropping.
2
Identify the legacy unencrypted terminal access protocol.
Telnet transmits command-line traffic in unencrypted plain text.
Telnet lacks native encryption capabilities.
3
Identify the alternative access mechanism used during primary network outage.
Cellular Out-of-Band Modem provides backup network access independent of standard WAN links.
Out-of-band cellular connections bypass local infrastructure failures.
4
Identify the graphical desktop remote access protocol.
RDP enables full graphical user interface remote management.
RDP streams the graphical desktop environment to remote administrators.

Anahtar Kavram

Remote Access Protocols and Out-of-Band Management Methods
Soru 40Soru

A network operations team is updating telemetry rules and syslog configurations for enterprise core routers and firewalls. Match each network logging mechanism or Syslog severity level on the left with its corresponding operational description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Syslog Severity Level 0 (Emergency)
Syslog Severity Level 3 (Error)
Syslog Severity Level 6 (Informational)
SNMPv3 authPriv Mode

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Syslog Severity Level 0 (Emergency) matches with 'Signals a complete system panic or failure, indicating that the device is unusable.' Syslog Severity Level 3 (Error) matches with 'Reports non-fatal operating error conditions, such as interface module failure or connection timeouts.' Syslog Severity Level 6 (Informational) matches with 'Captures normal operational state events, such as link state transitions or user authentication success logs.' SNMPv3 authPriv Mode matches with 'Provides HMAC packet authentication using SHA/MD5 along with payload encryption using AES/DES.'
Each item correctly aligns standard network administration auditing protocols and severity scales. Syslog severity 0 represents system panic/unusable conditions, severity 3 represents error conditions, severity 6 represents informational status updates, and SNMPv3 authPriv provides both authentication and privacy/encryption.

Adım Adım Çözüm

1
Analyze Syslog numeric severity levels (0 through 7).
Identify Level 0 as Emergency/Panic (system unusable), Level 3 as Error (non-fatal error conditions), and Level 6 as Informational (normal operation state messages).
Standard RFC 5424 Syslog severity ratings assign lower numerical values to higher severity events.
2
Evaluate SNMPv3 security levels (noAuthNoPriv, authNoPriv, authPriv).
Match authPriv to the requirement for both hashing/authentication and encryption/privacy.
The 'auth' portion ensures message source validation and integrity, while 'priv' adds symmetric payload encryption.
3
Map each term to its exact operational definition.
Pair Level 0 with panic/unusable, Level 3 with non-fatal errors, Level 6 with operational state logs, and SNMPv3 authPriv with SHA/MD5 authentication plus AES encryption.
Aligns device logging mechanisms and management security models with enterprise auditing standards.

Anahtar Kavram

Syslog Severity Levels and SNMP Security Models
ÖncekiSayfa 2 / 19Sonraki
Network Operations Alıştırma Soruları — CompTIA Network+ — Sayfa 2 | Examkin