Network Operations

362 soru

Soru 81Soru

An enterprise data center utilizes two edge routers, Edge-1 and Edge-2, configured with Hot Standby Router Protocol (HSRP) to provide default gateway redundancy for internal LAN clients. Edge-1 is configured with an HSRP priority of 120, while Edge-2 is configured with the default priority of 100. Both routers connect to downstream switches via their LAN interfaces and to separate ISP providers via their WAN interfaces. During a line cut on Edge-1's WAN circuit, internal LAN clients report a complete loss of internet connectivity. Network monitoring shows that Edge-1 remains the active HSRP router and continues accepting LAN traffic. Which of the following is the most likely cause of this failover failure?

Cevabı ve açıklamayı göster

Cevap: HSRP interface tracking was not configured on Edge-1's WAN interface to decrement its priority upon link failure.

Cevap

HSRP interface tracking was not configured on Edge-1's WAN interface to decrement its priority upon link failure.
The correct answer highlights the necessity of FHRP interface or object tracking. By default, HSRP only monitors the local interface where standby groups are configured. If an upstream WAN interface fails while the local LAN interface stays active, HSRP priority remains unchanged unless interface tracking is configured to decrement the priority below the standby router's priority.

Adım Adım Çözüm

1
Analyze the HSRP state and network symptoms.
Edge-1 has a higher priority (120) than Edge-2 (100) and remains the active HSRP router despite losing its WAN interface.
By default, HSRP routers only monitor the operational state of the interface on which HSRP is running (the LAN interface).
2
Evaluate why Edge-1 did not yield the active role to Edge-2.
Because the LAN interface on Edge-1 remained operational, Edge-1 continued transmitting HSRP hellos with priority 120.
Without tracking the upstream WAN interface status, HSRP has no mechanism to know that outbound internet traffic through Edge-1 will be black-holed.
3
Identify the required feature to resolve upstream failover issues.
Configuring HSRP interface/object tracking on Edge-1 decrements its priority (e.g., by 30 points to 90) when the WAN link drops.
When Edge-1's priority drops below Edge-2's priority (100), preemption allows Edge-2 to seamlessly assume the active role.

Anahtar Kavram

FHRP Interface/Object Tracking
Tahmini Süre:2m 0s
Soru 82Soru

A network administrator configures a pair of routers using a First Hop Redundancy Protocol (FHRP) to ensure high availability for a subnet. During scheduled maintenance on the primary router, the secondary router successfully assumes the active role according to the system logs. However, workstations on the subnet immediately lose access to external networks. Which of the following is the most likely cause of this connectivity failure?

Cevabı ve açıklamayı göster

Cevap: Workstations were configured with the physical IP address of the primary router as their default gateway instead of the shared virtual IP address.

Cevap

Workstations were configured with the physical IP address of the primary router as their default gateway instead of the shared virtual IP address.
First Hop Redundancy Protocols rely on clients directing default gateway traffic to a designated Virtual IP (VIP). If workstations are manually or dynamically configured with the physical IP address of one router, failover mechanisms will not redirect host traffic when that specific physical router goes offline.

Adım Adım Çözüm

1
Analyze the FHRP deployment model and host default gateway assignments.
FHRP protocols (such as HSRP or VRRP) create a single shared Virtual IP (VIP) and Virtual MAC address for host redundant default gateway operations.
For high availability to function seamlessly, end devices must point to the Virtual IP rather than any single physical router interface IP address.
2
Evaluate the reported symptom against host network settings.
Although the secondary router transitioned to active state correctly, host traffic reached a dead physical IP address because clients targeted the physical interface IP of the primary router.
If hosts use a physical IP, traffic destined for external networks fails as soon as that physical router is taken offline.

Anahtar Kavram

FHRP Virtual IP vs Physical IP Gateway Configuration
Soru 83Soru

During a scheduled maintenance window, a network technician updates the operating system of a primary enterprise router. Immediately after the device reboots with the newly installed firmware image, all recent ACL modifications and custom static routes disappear, causing routing failures across multiple subnets. An audit reveals that recent configuration changes resided solely in volatile memory when the firmware installer triggered the system reload. Which critical pre-patch maintenance procedure was omitted prior to executing the software update?

Cevabı ve açıklamayı göster

Cevap: Saving the running configuration to non-volatile startup storage and capturing a baseline configuration backup

Cevap

Saving the running configuration to non-volatile startup storage and capturing a baseline configuration backup
The correct option correctly identifies that running configurations stored only in volatile RAM are erased upon a device reboot. To prevent data loss during patch management, engineers must copy the running configuration to persistent startup memory and export a baseline backup prior to initiating software upgrades.

Adım Adım Çözüm

1
Analyze the operational failure mode post-update
Unsaved routing changes were stored only in RAM (running-config) and lost when the firmware update reloaded the appliance.
Firmware upgrades require a system reboot, which clears volatile memory.
2
Identify the mandatory pre-patch preparation standard
Commit all active changes (`copy running-config startup-config`) and export an off-box baseline configuration file.
Ensures active settings persist across reboots and provides a rollback point if the new patch behaves unexpectedly.

Anahtar Kavram

Pre-patch staging and configuration baseline persistence in patch management lifecycles.
Soru 84Soru

Following an emergency vulnerability disclosure, a network engineering team must apply a critical operating system patch to a high-availability core switch cluster without causing network downtime. Which of the following procedures should the team execute to ensure continuous service availability and full recovery capability during this maintenance operation? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Perform a rolling upgrade by patching the standby secondary chassis first and validating traffic failover prior to patching the active primary chassis.; Verify out-of-band management connectivity and capture verified system configuration and firmware image backups before initiating the installation.

Cevap

The correct procedures are executing a rolling upgrade by updating the standby node first while verifying failover, and establishing out-of-band management access alongside complete configuration and image backups prior to update initiation.
To maintain zero downtime in high-availability enterprise environments, patch management protocols require rolling upgrades (updating the standby unit first, testing failover, then updating the active unit). Additionally, operational best practices dictate verifying out-of-band management pathways and taking complete image and configuration snapshots before modifying production software to guarantee rollback capability.

Adım Adım Çözüm

1
Establish out-of-band access and complete baseline system state backups
Guarantees administrative access independent of production data paths and provides a full rollback point.
Network operations procedures require securing recovery tools before applying changes to critical core infrastructure.
2
Execute a phased rolling software update across the redundant cluster
Production traffic continues flowing through the active node while the secondary standby node is upgraded and verified.
Staggering updates across high-availability pairs preserves fault tolerance and prevents downtime during patch cycles.

Anahtar Kavram

High-Availability Rolling Upgrades and Pre-Patch Risk Mitigation
Soru 85Soru

During a post-incident audit of a multi-tier data center environment, an engineer discovers that inter-VLAN routing failure and unexpected high-availability failovers occurred because secondary database nodes were improperly connected to trunk ports missing native VLAN tags, while hosts were statically configured with individual physical interface IP addresses rather than shared gateway abstractions. Additionally, technicians were unable to physically locate the corresponding patch panel switchports during the outage due to missing physical layout records. Which of the following documentation components and procedural updates must be corrected and updated to fully remediate this environment? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the logical network topology diagram to clearly reflect VLAN IDs, subnet boundaries, 802.1Q trunking parameters, and the First Hop Redundancy Protocol (FHRP) Virtual IP (VIP) addresses used for default gateways.; Update physical rack elevation diagrams and cable run schedules detailing switch U-positions, patch panel port mappings, and cable labeling standards across all equipment racks.

Cevap

The correct updates are updating the logical network topology diagram (to document VLANs, subnets, trunking parameters, and FHRP Virtual IPs) and updating the physical rack elevation diagrams and cable run schedules (to detail U-positions, patch panel mappings, and port labeling).
To fully document and remediate the environment, both logical and physical documentation must be updated. Updating the logical network topology diagram ensures that VLAN IDs, subnets, trunk configurations, and FHRP Virtual IP (VIP) addresses are accurately mapped for layer 2/3 operations and high-availability failover. Updating physical rack elevation diagrams and cable run schedules ensures that physical hardware positioning, patch panel terminations, and cable runs can be quickly audited and traced during physical maintenance.

Adım Adım Çözüm

1
Analyze the logical network issues in the scenario.
Identified misconfigurations involving VLAN tags, trunking, subnets, and default gateway failovers.
Resolving logical routing and gateway issues requires an accurate logical network topology diagram showing subnets, trunk ports, and FHRP Virtual IPs.
2
Analyze the physical layer issues in the scenario.
Identified missing records for switchport and patch panel physical locations during troubleshooting.
Resolving physical tracing issues requires detailed rack elevation diagrams and cable run schedules mapping switch U-positions and patch panel ports.
3
Evaluate and eliminate distractors.
Rejected assigning physical interface IPs as default gateways, using unencrypted SNMPv1, and selecting simple continuity testers for distance-to-fault measurements.
These options introduce security vulnerabilities, break gateway redundancy, or misapply physical testing tools.

Anahtar Kavram

Differentiation between logical network topology diagrams and physical rack/cabling documentation
Tahmini Süre:3m 0s
Soru 86Soru

A network operations team is auditing the event management and polling security parameters on core routers to meet strict regulatory compliance mandates. The regulatory framework requires two key controls: all remote system logging messages must be delivered using a connection-oriented protocol that guarantees transport-layer encryption, and all telemetry polling performed by network management stations must enforce both cryptographic user authentication and packet payload encryption.

Which of the following configuration steps must the administrator perform to satisfy these auditing mandates? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Syslog forwarding to use TCP port 6514 with Transport Layer Security (TLS) encapsulation.; Configure SNMPv3 polling using the authPriv security level.

Cevap

The administrator must enable Syslog forwarding over TCP port 6514 with TLS encapsulation and configure SNMPv3 using the authPriv security level.
Enabling Syslog over TCP port 6514 with TLS encapsulation satisfies the requirement for connection-oriented, encrypted system log transport. Configuring SNMPv3 with the authPriv security level satisfies the requirement for authenticated and encrypted network telemetry polling.

Adım Adım Çözüm

1
Analyze transport and security requirements for remote log collection.
Standard Syslog operates over UDP port 514 without native encryption. To enforce reliable connection-oriented transport and payload confidentiality, Syslog over TLS (TCP port 6514) must be specified.
RFC 5425 defines secure Syslog transmission over TLS using TCP port 6514.
2
Analyze security models for SNMP network management polling.
SNMPv1 and SNMPv2c use cleartext community strings. SNMPv3 introduces three User-based Security Model (USM) levels: noAuthNoPriv (no auth, no encryption), authNoPriv (authentication, no encryption), and authPriv (authentication and encryption).
Only authPriv satisfies the mandate requiring both identity verification and payload privacy/encryption.

Anahtar Kavram

Secure Network Logging (Syslog over TLS) and SNMPv3 Security Models (authPriv)
Soru 87Soru

An enterprise deployment connects dual-homed application servers to two separate top-of-rack access switches using LACP (IEEE 802.3ad) NIC teaming for link redundancy, while two core routers run Virtual Router Redundancy Protocol (VRRP) to provide default gateway resiliency. Following a network migration, users report intermittent traffic loss during router failover tests, and LACP bundles on the servers fail to form properly. Which TWO of the following technical misconfigurations or architectural oversights are the primary causes of these issues?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: LACP was configured across two independent, non-stacked access switches without implementing Multi-Chassis Link Aggregation (mLAG) or switch stacking between them.; Host default gateway addresses were statically configured with the physical IP address of the primary router instead of the VRRP Virtual IP (VIP) address.

Cevap

The primary causes are that LACP was configured across separate standalone switches without Multi-Chassis Link Aggregation (mLAG), and host default gateways were set to the physical router IP address rather than the VRRP Virtual IP (VIP).
LACP requires a single logical switch plane (achieved via switch stacking or multi-chassis link aggregation / mLAG) when bundling interfaces connected across physical switch chassis. Furthermore, VRRP requires endpoints to target the shared Virtual IP (VIP) address rather than physical interface IP addresses to maintain seamless default gateway failover.

Adım Adım Çözüm

1
Analyze the LACP negotiation failure across distinct access switches.
Standard LACP (IEEE 802.3ad) requires all bundle members to terminate on a single logical control plane. Split connections across non-stacked standalone switches fail to establish a combined aggregation bundle without mLAG or stacking technology.
LACP Control Protocol Data Units (LACPDUs) from different physical switches carry different system IDs, preventing unified link group formation.
2
Evaluate host gateway reachability during VRRP failover.
Hosts configured with the physical interface IP of the primary router continue directing traffic to that specific hardware address during failover, causing connection drops.
VRRP relies on hosts sending default gateway traffic to the shared Virtual IP (VIP) and virtual MAC address so the backup router can take over seamlessly upon primary device failure.

Anahtar Kavram

Multi-Chassis Link Aggregation (mLAG) requirements and First Hop Redundancy Protocol (FHRP) Virtual IP host configuration.
Soru 88Soru

A network engineer is upgrading an enterprise log auditing and monitoring infrastructure. Corporate compliance policies require that all network event logs sent to the central server, as well as SNMP polling traffic, provide confidentiality and integrity verification in transit. Which of the following configuration choices should the engineer implement to fulfill these security requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Encapsulate Syslog traffic using Transport Layer Security (TLS) over TCP port 6514.; Configure SNMPv3 using the authPriv security level for remote device monitoring.

Cevap

The secure configuration requires using Syslog over TLS (TCP port 6514) and configuring SNMPv3 with the authPriv security level.
Securing log messages and network telemetry in transit requires protocols that support cryptographic encryption and message integrity. Encapsulating Syslog via TLS over TCP port 6514 secures log records from unauthorized interception. For SNMP polling, SNMPv3 under the authPriv security model ensures authentication and payload encryption.

Adım Adım Çözüm

1
Evaluate secure Syslog transport protocols
Standard Syslog over UDP port 514 transmits messages in unencrypted plaintext. Secure log aggregation requires Syslog over TLS using TCP port 6514.
Compliance policies demand encryption and tamper-evident transport for event logs.
2
Evaluate SNMP versions and security levels
SNMPv1 and SNMPv2c use cleartext community strings without payload encryption. SNMPv3 with authPriv provides both authentication and privacy (encryption).
authPriv satisfies both confidentiality and integrity requirements for SNMP telemetry.

Anahtar Kavram

Secure Network Logging and SNMP Audit Protocols
Soru 89Soru

A network technician is preparing to update the operating system firmware on several enterprise switches. Which of the following actions should the technician take prior to applying the update in the production environment? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a complete backup of device configuration files and existing firmware images.; Evaluate the firmware update within an isolated sandbox or staging environment.

Cevap

The technician should create a complete backup of switch configuration files and current firmware images, as well as evaluate the update inside an isolated sandbox or staging environment before live deployment.
Proper patch maintenance requires creating full backups of configuration files and existing software images to ensure rollback capability, while staging the update in an isolated environment prevents untested code from causing live network outages.

Adım Adım Çözüm

1
Identify fundamental risk-mitigation steps in the network patch lifecycle.
Recognize that establishing a known baseline backup and testing in a safe environment are mandatory pre-patch steps.
Backing up configurations guarantees a rollback path, while staging tests verify patch stability before affecting production traffic.

Anahtar Kavram

Pre-deployment patch management lifecycle and risk mitigation practices
Soru 90Soru

A network technician is deploying high availability for enterprise servers connected to redundant access switches. Which TWO of the following technologies or mechanisms directly provide link aggregation and adapter redundancy at Layer 2?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Link Aggregation Control Protocol (LACP) configured on connected switch ports to bundle physical links into a single logical channel.; NIC Teaming (network interface card bonding) enabled on the servers to combine multiple physical adapters into a redundant group.

Cevap

The correct options are Link Aggregation Control Protocol (LACP) on switch ports and NIC Teaming on server network adapters.
Link Aggregation Control Protocol (LACP) aggregates physical switch links into a single logical EtherChannel, maintaining network connectivity if an individual cable or port fails. NIC Teaming joins multiple server network adapters together in active-active or active-passive arrangements to shield the server from single network card failures.

Adım Adım Çözüm

1
Identify the high availability requirements specified in the scenario
The requirement specifies Layer 2 link aggregation and network adapter redundancy between host servers and access switches.
High availability at the physical and data link layers requires redundancy for both the host interfaces and the switch port channels.
2
Evaluate technologies that bundle physical links between switches and servers
LACP combines multiple physical switch ports into a single logical channel, providing link failover and aggregate bandwidth. NIC Teaming binds multiple server network interface cards into a fault-tolerant group.
Together, LACP and NIC Teaming eliminate single cable or network adapter points of failure at Layer 2.

Anahtar Kavram

Layer 2 High Availability and Link Aggregation (LACP & NIC Teaming)
Soru 91Soru

A network administrator is designing a high-availability infrastructure for a datacenter rack connected to dual switches and redundant edge routers. The design must support link aggregation across physical network interfaces on dual-homed servers while also ensuring rapid Layer 3 gateway failover if an upstream WAN link drops. Which TWO of the following technical configurations should the administrator implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Link Aggregation Control Protocol (LACP) in conjunction with multi-chassis or stacked switches to provide dual-homed NIC redundancy and combined link capacity.; Enable interface tracking and preemption within a First Hop Redundancy Protocol (FHRP) on the primary edge router to trigger gateway failover if the upstream uplink fails.

Cevap

The administrator should implement Link Aggregation Control Protocol (LACP) across stacked or multi-chassis switches for server NIC redundancy, and enable FHRP interface tracking with preemption on the edge routers for upstream-aware gateway failover.
Combining LACP across stackable/multi-chassis switches provides resilient, bandwidth-aggregated Layer 2 connections for servers. Paired with FHRP interface tracking and preemption on Layer 3 edge routers, the network achieves both switch link redundancy and dynamic gateway failover triggered by upstream connection drops.

Adım Adım Çözüm

1
Identify the requirement for Layer 2 link aggregation and switch redundancy for dual-homed servers.
Selected LACP combined with switch stacking/MCLAG to bundle multiple physical interfaces into a logical link across separate physical switch chassis.
LACP provides dynamic link aggregation and fault tolerance, while switch stacking/MCLAG permits cross-switch link termination without creating Layer 2 loops.
2
Identify the requirement for upstream-aware Layer 3 gateway redundancy.
Selected FHRP interface tracking and preemption.
Interface tracking lowers the active router's priority upon WAN interface failure, and preemption allows the secondary router to take over the active Virtual IP (VIP) role dynamically.

Anahtar Kavram

Multi-Layer High Availability & FHRP Tracking
Tahmini Süre:1m 30s
Soru 92Soru

An enterprise network engineering team is designing a high-security log forwarding and auditing infrastructure across multi-site edge routers. The compliance policy mandates that event log forwarding to the centralized SIEM must guarantee transport reliability and payload encryption, while active remote device telemetry queries must enforce both cryptographic user authentication and data payload privacy encryption. Which of the following configuration choices and protocols satisfy these requirement criteria? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Forward Syslog events using TCP port 6514 encapsulated with Transport Layer Security (TLS); Configure SNMPv3 polling and trap generation using the authPriv security model

Cevap

The correct configurations are forwarding Syslog events over TCP port 6514 using TLS encapsulation, and implementing SNMPv3 using the authPriv security model.
Secure log aggregation requiring encrypted and reliable transport must use Syslog over TLS on TCP port 6514. Device telemetry requiring both authentication and encryption mandates SNMPv3 at the authPriv security level.

Adım Adım Çözüm

1
Analyze log transport encryption and reliability requirements
Syslog over TLS utilizes TCP port 6514 to deliver connection reliability, message integrity, and payload encryption.
Standard UDP port 514 lacks guaranteed delivery and transport-layer encryption capabilities.
2
Evaluate SNMPv3 security levels for authentication and privacy
SNMPv3 authPriv enforces both cryptographic user authentication (HMAC-SHA/MD5) and packet privacy encryption (AES/DES).
The authNoPriv level provides authentication without encryption, failing the requirement for payload privacy.

Anahtar Kavram

Secure Logging and SNMP Security Models
Soru 93Soru

A network team is preparing a maintenance window to perform a software operating system update on a high-availability core switch cluster operating in an active/standby state. Which TWO actions must the engineers execute to maintain service continuity and ensure rapid recovery if an issue arises?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Export current configuration files off-box and verify the software image file integrity against vendor checksums prior to installation; Execute a rolling upgrade by applying the software patch to the standby node first, verifying system stability, and triggering a controlled failover

Cevap

The correct procedures are exporting configuration files off-device and verifying image checksums prior to installation, as well as performing a rolling upgrade by patching the standby node first before failing over active traffic.
Safe software maintenance on high-availability network infrastructure requires a rolling upgrade strategy. Patching the standby node first maintains active traffic processing on the primary node. Confirming image hashes and exporting configuration backups off-device guarantees that corrupted code is not flashed and that device state can be restored immediately in a recovery scenario.

Adım Adım Çözüm

1
Perform pre-upgrade baseline data preservation and image integrity checks.
System configurations are backed up to secure external storage and software images are confirmed non-corrupt.
If an upgrade fails or corrupts system state, having an external configuration backup and confirmed binary hash guarantees rollback feasibility.
2
Apply software update to the standby cluster node.
The passive node is updated while active network traffic continues uninterrupted on the primary node.
Sequential node updating maintains overall cluster operational readiness and prevents network-wide outages.
3
Verify secondary node health and initiate controlled failover.
Active traffic shifts seamlessly to the newly updated node, allowing the remaining node to undergo software maintenance.
Controlled switchover tests the stability of the upgraded image under live load while preserving fault tolerance.

Anahtar Kavram

High-Availability Rolling Upgrades and Pre-Maintenance Validation
Soru 94Soru

A systems engineer is preparing to upgrade the operating system across multiple network security firewalls. Which of the following administrative tasks must be completed prior to applying the update to maintain change governance and ensure rapid system recovery? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Export a full backup of the current operating system image and configuration files to a remote repository.; Obtain explicit authorization through the change advisory board and document baseline performance metrics.

Cevap

Prior to flashing device software, administrators must back up existing system images and configurations off-device, and verify change management authorization alongside baseline performance capture.
Safe software updates require preserving a clean rollback state (backing up current configurations and firmware off-device) and adhering to organizational governance (securing change management approval and recording health baselines before making changes).

Adım Adım Çözüm

1
Identify risk mitigation requirements for software maintenance.
Determined that off-device backups of configuration and OS images are mandatory for rollback capability.
If an update causes boot failures or feature regression, having off-device backups allows quick rollback to the prior operational state.
2
Identify operational governance requirements.
Verified that change advisory board (CAB) approval and baseline metric capturing must occur prior to deployment.
Change control prevents unapproved network disruption, and health metrics allow validation after maintenance completes.

Anahtar Kavram

Software Maintenance Governance and Rollback Planning
Soru 95Soru

An enterprise network utilizes two Layer 3 switches, Switch-A and Switch-B, to provide default gateway redundancy for VLAN 30 (172.16.30.0/24172.16.30.0/24). Switch-A is configured as the HSRP Active router with a priority of 120 and preemption enabled, using Virtual IP (VIP) 172.16.30.1172.16.30.1 (physical IP 172.16.30.2172.16.30.2). Switch-B is the HSRP Standby router with a default priority of 100 and physical IP 172.16.30.3172.16.30.3. Switch-A is also configured as the STP Root Bridge for VLAN 30. During a routine host setup, a technician manually sets a critical server's default gateway address to 172.16.30.2172.16.30.2 instead of the HSRP VIP. Later, Switch-A's tracked WAN uplink fails, decreasing its HSRP priority by 30 points and causing Switch-B to assume the HSRP Active role. Which of the following best describes the immediate pathing behavior for outbound traffic originating from this server?

Cevabı ve açıklamayı göster

Cevap: Outbound packets from the server continue targeting Switch-A's physical MAC address, forcing Switch-A to route the traffic across the inter-switch trunk link to Switch-B for external forwarding.

Cevap

Outbound packets from the server continue targeting Switch-A's physical MAC address, forcing Switch-A to route the traffic across the inter-switch trunk link to Switch-B for external forwarding.
When host workstations are incorrectly configured to use the physical IP address of a redundant router instead of the FHRP Virtual IP (VIP), they resolve ARP directly to the physical interface's MAC address. If an HSRP failover occurs, the physical interface of the former active router remains online and continues to receive and route packets sent directly to it. However, because external outbound paths may now prefer or traverse the newly active router, traffic from misconfigured hosts must cross the inter-switch trunk, leading to suboptimal hairpin routing and negating true gateway redundancy for that host.

Adım Adım Çözüm

1
Analyze host gateway address resolution
The host server uses IP 172.16.30.2172.16.30.2 (Switch-A physical IP) as its default gateway rather than VIP 172.16.30.1172.16.30.1.
Host traffic targeting a physical IP is encapsulated with the specific destination MAC address of that physical interface.
2
Evaluate FHRP state changes and interface operational status
Switch-A's priority drops from 120 to 90 (12030120 - 30), causing Switch-B (priority 100) to become Active for HSRP. However, Switch-A's physical LAN interface remains up and functional.
FHRP standby transition only changes ownership of the Virtual IP/MAC; physical interfaces remain active unless physically down.
3
Trace packet flow from misconfigured host
Packets arrive at Switch-A, which routes them toward their external destination via Switch-B over the inter-switch trunk link.
Switch-A retains Layer 3 routing functionality and forwards packets matching its routing table, even when acting as HSRP Standby.

Anahtar Kavram

First Hop Redundancy Protocol (FHRP) Virtual IP Configuration vs Physical Interface Forwarding
Soru 96Soru

A network administrator is configuring SNMP management on a core network switch. Organizational policy mandates that telemetry and monitoring traffic must support both cryptographic user authentication and payload encryption. Which SNMPv3 security level meets these requirements?

Cevabı ve açıklamayı göster

Cevap: authPriv

Cevap

The authPriv security level is required because it provides both authentication and privacy (encryption) for SNMP messages.
The authPriv setting enforces both cryptographic message authentication (Auth) and data confidentiality through encryption (Priv), fulfilling all compliance requirements.

Adım Adım Çözüm

1
Identify the required security parameters from the question prompt.
The requirements demand both cryptographic user authentication and payload encryption.
Protecting management traffic requires ensuring both origin verification and confidentiality.
2
Compare SNMPv3 security levels against the identified criteria.
noAuthNoPriv offers neither, authNoPriv offers authentication only, and authPriv offers both authentication and privacy.
SNMPv3 categorizes its security model into three distinct levels of protection.
3
Select the matching security level.
authPriv matches both authentication and privacy (encryption) requirements.
Only authPriv implements payload encryption ('Priv') in addition to authentication ('Auth').

Anahtar Kavram

SNMPv3 Security Levels
Soru 97Soru

An enterprise network technician is responding to recurring frame check sequence (FCS) and CRC error bursts on a 10GbE fiber optic link connecting a core switch to a newly installed modular SAN storage array across separate rooms in a data center. The fiber connection passes through multiple intermediate fiber distribution panels (FDPs) and structured patch bays. To systematically trace the specific optical strand IDs, bulkhead coupler locations, port assignments, and physical path terminations before dispatching a field engineer with an Optical Time-Domain Reflectometer (OTDR), which network document should the technician analyze first?

Cevabı ve açıklamayı göster

Cevap: Cable run schedule and patch panel port matrix

Cevap

The cable run schedule and patch panel port matrix is the primary documentation required to locate specific optical strands and physical termination endpoints.
The cable run schedule and patch panel port matrix documents point-to-point physical infrastructure, specifying cable labeling conventions, fiber strand numbers, patch panel jack allocations, and endpoint locations necessary to physically trace fiber optic link paths across intermediate patch bays.

Adım Adım Çözüm

1
Identify the technical requirement from the scenario
The technician needs to trace physical fiber strand IDs, bulkhead coupler positions, and patch bay port assignments across multiple rooms.
Resolving Layer 1 physical link errors like CRC/FCS across structured cabling requires exact physical media path details.
2
Evaluate document types against Layer 1 physical trace requirements
Logical topology diagrams display Layer 2/3 concepts, rack elevations detail cabinet space utilization, and baselines measure statistical traffic metrics.
None of these secondary documents contain point-to-point cable labels, strand color codes, or port matrix mappings.
3
Select the correct documentation artifact
The cable run schedule and port matrix contains explicit mappings for cable IDs, fiber pair/strand numbers, wall jack/FDP port designations, and end-to-end physical paths.
This documentation equips the technician to isolate the exact optical segment prior to physical OTDR testing.

Anahtar Kavram

Physical Network Documentation and Cable Schedules
Soru 98Soru

An enterprise network infrastructure utilizes dual core switches configured with Virtual Router Redundancy Protocol (VRRP) to provide default gateway redundancy for multiple VLANs. Downstream access switches connect to both core switches via multi-chassis trunking. During traffic baseline audits, network engineers notice significant asymmetric traffic flow and sub-optimal hairpinning (tromboning) across the inter-switch link between the core switches. Which of the following configuration changes and architectural adjustments will optimize Layer 2/Layer 3 path symmetry and eliminate unnecessary inter-switch link transit? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Align the VRRP Master router assignment for each VLAN with the Spanning Tree Protocol (STP) Root Bridge priority for that same VLAN.; Implement Multi-Chassis Link Aggregation (MC-LAG) with active-active local forwarding enabled on both core switches.

Cevap

To resolve asymmetric routing and inter-switch link hairpinning, the network design must ensure that the VRRP Master router priority and the STP Root Bridge priority are aligned on the same switch per VLAN, and deploy Multi-Chassis Link Aggregation with local active-active Layer 3 forwarding capabilities.
Aligning the VRRP Master role with the STP Root Bridge role for a given VLAN ensures that the shortest Layer 2 spanning-tree path directly coincides with the active Layer 3 default gateway interface. Additionally, implementing Multi-Chassis Link Aggregation with local forwarding enables both core switches to process and route ingress traffic locally on their physical ports, avoiding suboptimal transit over the inter-switch peer link.

Adım Adım Çözüm

1
Analyze the cause of Layer 2/Layer 3 path asymmetry in dual-homed core topologies.
Identified that when the active STP root path terminates on Switch 1 while the VRRP active gateway resides on Switch 2, frames must cross the inter-switch link to reach their gateway.
Aligning STP Root Bridge election with VRRP Master status forces Layer 2 frames to flow directly to the active Layer 3 interface.
2
Evaluate link aggregation mechanisms across core switches.
Determined that using MC-LAG with active-active local forwarding allows both core switches to terminate Layer 2 LAG trunks and perform local Layer 3 routing.
Local forwarding eliminates the requirement to send packets across the inter-switch peer link prior to routing.

Anahtar Kavram

FHRP and STP Alignment with MC-LAG Active-Active Local Forwarding
Soru 99Soru

A network technician is setting up a Virtual Router Redundancy Protocol (VRRP) group between two routers to provide default gateway redundancy for hosts on Subnet 10.10.20.0/2410.10.20.0/24. Router 1 has interface IP 10.10.20.210.10.20.2, Router 2 has interface IP 10.10.20.310.10.20.3, and the Virtual IP (VIP) is configured as 10.10.20.110.10.20.1. Which IP address must be configured as the default gateway on client computers within this subnet?

Cevabı ve açıklamayı göster

Cevap: 10.10.20.1

Cevap

10.10.20.1 should be configured as the default gateway on all client workstations.
In First Hop Redundancy Protocols such as VRRP or HSRP, host endpoints must use the Virtual IP (VIP) address as their default gateway. This ensures that if the active master router fails, the standby router seamlessly takes over the VIP without requiring configuration updates on host workstations.

Adım Adım Çözüm

1
Identify the purpose of First Hop Redundancy Protocols (FHRP) like VRRP.
VRRP creates a single logical virtual router with a shared Virtual IP (VIP) out of multiple physical routers.
Client devices need a static gateway target that remains active even if one physical device fails.
2
Determine the IP address that hosts should point to for default gateway services.
Hosts must point to the Virtual IP address (10.10.20.1) rather than any physical interface address (10.10.20.2 or 10.10.20.3).
When the master router fails, the backup router assumes control of the Virtual IP seamlessly without host reconfiguration.

Anahtar Kavram

FHRP Virtual IP Gateway Assignment
Soru 100Soru

An organization deploys an active/standby pair of network gateways configured with a First Hop Redundancy Protocol to provide default gateway resiliency. During scheduled maintenance testing, when the primary active gateway is powered off, workstations on the local subnet immediately lose all outbound internet connectivity. Inspection reveals that internal workstations are receiving traffic normally within their local LAN, but failover routing does not resume internet access until the primary gateway is powered back on. Which misconfiguration is the most likely cause of this issue?

Cevabı ve açıklamayı göster

Cevap: The workstations have their default gateway setting pointing to the physical IP address of the primary gateway rather than the shared virtual IP address.

Cevap

The workstations have their default gateway setting pointing to the physical IP address of the primary gateway rather than the shared virtual IP address.
In high-availability network designs utilizing First Hop Redundancy Protocols (such as HSRP or VRRP), host endpoints must be configured to use the shared Virtual IP (VIP) as their default gateway. If hosts are incorrectly configured with the physical IP address of the primary router, outbound packets will continue targeting that specific physical device. Consequently, when the primary device fails or is powered down for maintenance, the secondary router cannot intercept that traffic, resulting in a complete loss of external network connectivity.

Adım Adım Çözüm

1
Analyze the reported symptom during high availability failover testing.
Local LAN traffic functions normally, but outbound internet traffic fails completely when the primary active gateway is powered off.
This indicates that local Layer 2 connectivity is operational, but Layer 3 default gateway traffic is not properly transitioning to the standby device.
2
Evaluate how First Hop Redundancy Protocols (FHRP) manage virtual and physical IP addresses.
FHRP protocols assign a shared Virtual IP (VIP) and virtual MAC address that move between primary and backup routers.
Host clients must send outbound packets to the VIP so that traffic is automatically received by whichever router is currently active.
3
Identify the configuration discrepancy on host workstations.
Pointing hosts directly to the physical interface IP of the primary router bypasses the FHRP virtual gateway mechanism.
When the primary router fails, traffic directed to its physical IP drops, rendering the redundant backup router unused.

Anahtar Kavram

FHRP Virtual Gateway IP Configuration
ÖncekiSayfa 5 / 19Sonraki
Network Operations Alıştırma Soruları — CompTIA Network+ — Sayfa 5 | Examkin