Network Operations

362 soru

Soru 141Soru

During an unpredicted core link failure, a lead network engineer executed an approved Emergency Change (ECAB) by manually applying temporary static routing overrides directly on live edge routers to restore connectivity. Three hours later, an automated configuration management pipeline executed its scheduled compliance audit and synchronized the routers against the central version-controlled repository, inadvertently wiping out the manual emergency modifications and restoring the outage. Which of the following procedures should have been completed immediately following the emergency implementation to permanently prevent this configuration drift?

Cevabı ve açıklamayı göster

Cevap: Update the authoritative version-controlled repository with the modified configuration parameters and commit a post-implementation baseline update before the automated synchronization cycle runs.

Cevap

Update the authoritative version-controlled repository with the modified configuration parameters and commit a post-implementation baseline update before the automated synchronization cycle runs.
In modern automated network environments, central repositories (Infrastructure as Code / configuration baselines) define the source of truth. When emergency changes are applied manually directly to devices, the central repository must be updated and committed immediately during post-implementation reconciliation. This ensures automated compliance engines recognize the new state as authorized, preventing automated configuration drift remediation from undoing emergency fixes.

Adım Adım Çözüm

1
Analyze the cause of configuration drift
Identified that the automated pipeline enforced the established repository baseline, which lacked the live emergency static route changes.
Automated network orchestration systems enforce state based on the version-controlled central repository.
2
Identify proper post-emergency change workflow steps
Determined that emergency change procedures require retroactively updating the formal baseline documentation and code repository.
Updating the repository ensures the automated management system recognizes the emergency changes as the new desired configuration state.
3
Select the correct preventative action
Committing the changes to the version-controlled repository aligns live devices with automated compliance engines.
This maintains operational continuity while adhering to strict change control governance.

Anahtar Kavram

Configuration Baseline Synchronization and Post-Emergency Change Management
Soru 142Soru

Match each high-availability concept or protocol on the left with its correct operational description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

HSRP
LACP
VIP
CARP

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

HSRP matches with Cisco-proprietary First Hop Redundancy Protocol; LACP matches with IEEE standard link aggregation protocol; VIP matches with shared IP address for default gateway failover; CARP matches with open-source redundancy protocol allowing shared IP and MAC addresses.
Each concept correctly matches its underlying technology: HSRP is Cisco's proprietary gateway failover protocol, LACP performs IEEE 802.3ad interface aggregation, VIP acts as the shared virtual gateway address, and CARP provides open-source address redundancy.

Adım Adım Çözüm

1
Identify the primary function of HSRP.
Pair HSRP with its Cisco-proprietary first-hop gateway redundancy function.
HSRP was developed by Cisco to enable seamless switchover between active and standby routers.
2
Identify the standard purpose of LACP.
Pair LACP with the IEEE 802.3ad link aggregation protocol description.
LACP negotiates combining multiple physical interfaces into a single logical trunk interface.
3
Define the role of a Virtual IP (VIP) in network redundancy.
Pair VIP with the shared IP address targeted by client default gateways.
Clients send traffic to the Virtual IP so that failover between redundant physical routers is transparent to hosts.
4
Identify the characteristics of CARP.
Pair CARP with the open-source address redundancy protocol description.
CARP is an open-source protocol used primarily in BSD systems to allow multiple routers to share IP/MAC addresses.

Anahtar Kavram

High Availability and Gateway/Link Redundancy Protocols
Soru 143Soru

A network technician needs to configure a network management system to monitor router performance metrics using SNMP. To meet security compliance standards, the communication must ensure both message authentication and payload encryption. Which SNMP version and security level should be selected?

Cevabı ve açıklamayı göster

Cevap: SNMPv3 with authPriv

Cevap

SNMPv3 configured with authPriv provides both cryptographic authentication and data privacy via payload encryption.
SNMPv3 using the authPriv security setting ensures complete security by implementing user authentication (auth) via hashing algorithms as well as payload privacy (priv) through encryption standards like AES.

Adım Adım Çözüm

1
Identify the required monitoring protocol security parameters
The requirements demand both identity authentication and message encryption for performance monitoring traffic.
Authentication prevents unauthorized management sources, while encryption protects sensitive telemetry data from eavesdropping.
2
Select the appropriate SNMP version and User-based Security Model (USM) level
SNMPv3 authPriv combines message digest authentication (MD5/SHA) with encryption algorithms (DES/AES).
Legacy versions (v1 and v2c) transmit data in plain text, and lower SNMPv3 security levels omit either authentication or privacy.

Anahtar Kavram

SNMPv3 Security Levels (authPriv)
Tahmini Süre:45s
Soru 144Soru

Match each high-availability technology or protocol on the left with its primary operational characteristic on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Virtual Router Redundancy Protocol (VRRP)
Link Aggregation Control Protocol (LACP)
Active-Active Server Clustering
Multipath I/O (MPIO)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Virtual Router Redundancy Protocol (VRRP) matches default gateway redundancy via a shared virtual IP; Link Aggregation Control Protocol (LACP) matches combining physical connections into a single logical link; Active-Active Server Clustering matches concurrent workload distribution across all nodes; Multipath I/O (MPIO) matches establishing redundant physical paths to SAN storage volumes.
Each technology corresponds to a distinct layer of high availability: VRRP delivers Layer 3 default gateway resilience through virtual IP sharing; LACP provides Layer 2 link aggregation and link failover; Active-Active clustering processes workloads across all nodes simultaneously; and MPIO provides redundant physical connections between server HBAs and SAN storage.

Adım Adım Çözüm

1
Identify the protocol providing Layer 3 default gateway failover.
Virtual Router Redundancy Protocol (VRRP) shares a single virtual IP across multiple redundant routers.
VRRP ensures continuous default gateway availability if the active router fails.
2
Identify the standard protocol for switch link aggregation.
Link Aggregation Control Protocol (LACP) bundles physical links into a single logical Channel/Trunk.
LACP operates according to IEEE 802.3ad to provide throughput enhancement and link redundancy.
3
Determine the cluster model that processes requests simultaneously across members.
Active-Active Server Clustering handles workloads across all available cluster nodes concurrently.
Unlike Active-Passive configurations, Active-Active utilizes all hardware resources simultaneously during normal operation.
4
Determine the fault-tolerance mechanism for host-to-storage interconnects.
Multipath I/O (MPIO) manages redundant storage interface hardware and cabling.
MPIO prevents storage access outages by rerouting block storage traffic if an HBA, cable, or switch port fails.

Anahtar Kavram

High Availability and Redundancy Concepts across Network Layers
Soru 145Soru

During a routine compliance audit, a network analyst discovers that several perimeter firewalls contain unapproved Access Control List (ACL) rule modifications. Investigation reveals that an on-call administrator applied these inline changes two weeks ago to mitigate an active service disruption, but bypassed standard approval procedures. The temporary fix stabilized traffic but resulted in configuration drift between the active firewall state and the documented network baseline. To resolve this non-compliant state while adhering to formal change management governance, which action should the analyst take first?

Cevabı ve açıklamayı göster

Cevap: Submit a retroactive Request for Change (RFC) including post-implementation risk analysis and baseline documentation for Change Advisory Board (CAB) review.

Cevap

Submit a retroactive Request for Change (RFC) including post-implementation risk analysis and baseline documentation for Change Advisory Board (CAB) review.
When emergency changes are implemented out-of-band to resolve a critical incident, standard change management governance mandates submitting a retroactive Request for Change (RFC). This process documents the modification, conducts post-implementation risk assessment, updates official baseline documentation, and secures formal Change Advisory Board (CAB) authorization without causing unexpected network downtime.

Adım Adım Çözüm

1
Identify the cause of configuration drift and assess operational impact.
Recognized that the running configuration contains necessary emergency operational fixes that deviate from the approved baseline.
Reverting changes immediately could re-trigger a critical service outage.
2
Initiate formal retroactive change management procedures.
Prepare an RFC documenting the incident, the exact delta in configuration, and the justification for bypassing standard pre-approval.
Governance frameworks require emergency changes to be formally documented and reviewed post-incident to align active configurations with official baselines.
3
Submit the RFC to the Change Advisory Board (CAB).
The CAB reviews the operational risks and approves updating the official configuration baseline.
CAB approval ensures organizational visibility, accountability, and compliance alignment.

Anahtar Kavram

Configuration Drift Remediation and Retroactive Change Authorization
Tahmini Süre:2m 0s
Soru 146Soru

A network operations team is upgrading its centralized monitoring and logging architecture to ensure regulatory compliance and robust forensic capabilities. Match each network logging or telemetry mechanism on the left with its primary operational auditing function on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

NTP Timestamping
NetFlow / IPFIX Telemetry
TACACS+ Accounting
SNMPv3 Trap / Inform

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Each network logging mechanism matches its corresponding functional requirement: NTP Timestamping matches synchronized time references for log correlation; NetFlow / IPFIX Telemetry matches IP flow metadata for traffic and bandwidth auditing; TACACS+ Accounting matches tracking user sessions and administrative CLI commands; and SNMPv3 Trap / Inform matches sending immediate asynchronous event notifications for threshold violations.
Each mechanism serves a distinct role in network operations: NTP guarantees consistent timestamping required for forensic event correlation across systems; NetFlow/IPFIX supplies IP traffic flow metadata for bandwidth and throughput auditing; TACACS+ Accounting maintains strict audit logs of administrative CLI actions and user sessions; and SNMPv3 Traps/Informs deliver immediate asynchronous push notifications for device status changes.

Adım Adım Çözüm

1
Identify the primary role of time synchronization in log auditing.
NTP Timestamping aligns log timestamps across disparate devices, enabling accurate chronological sequence correlation.
Without unified NTP synchronization, logs from different routers and firewalls cannot be reliably sequenced during security audits.
2
Distinguish flow statistics from administrative session logs.
NetFlow/IPFIX captures traffic metadata (IPs, ports, byte counts), whereas TACACS+ Accounting logs specific user commands and session activity.
Traffic flow auditing requires packet metadata analysis, while administrative accountability requires user action tracking.
3
Determine the asynchronous alert generation mechanism.
SNMPv3 Traps and Informs send push alerts immediately upon critical system events or hardware status changes.
Unlike periodic polling, SNMP Traps notify management systems instantaneously when specific device event conditions are met.

Anahtar Kavram

Network Logging and Telemetry Mechanisms
Soru 147Soru

An enterprise network storage system suffered a catastrophic volume failure on Thursday at 14:15. The network administrator maintains a disaster recovery plan with the following backup schedule:

- Full Backup: Executed every Sunday at 00:00
- Differential Backup: Executed daily Monday through Wednesday at 23:00
- Incremental Backup: Executed hourly on Thursday between 01:00 and 14:00
- Transaction Log Backup: Executed every 15 minutes

To restore the system to the point of failure in the shortest total downtime while maintaining complete data integrity, in what order should the network administrator execute the restoration steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct restoration sequence is: 1) Restore the Sunday 00:00 full backup, 2) Restore the Wednesday 23:00 differential backup, 3) Apply Thursday's hourly incremental backups sequentially from 01:00 through 14:00, 4) Apply the 14:15 transaction log backup, and 5) Execute filesystem consistency checks and restore client network access.
Optimal recovery requires restoring the full backup baseline first (Sunday 00:00). Next, restoring the latest differential backup (Wednesday 23:00) brings the volume current through Wednesday night in a single step, bypassing the redundant Monday and Tuesday differentials. All incremental backups taken on Thursday (01:00 through 14:00) must then be applied sequentially because each incremental relies on the state of the preceding backup. Applying the 14:15 transaction log backup recovers remaining transactions to achieve zero data loss. Finally, running consistency checks before opening client connections validates system health.

Adım Adım Çözüm

1
Restore the initial baseline image.
The target array is populated with the Sunday 00:00 full backup.
All recovery processes require a full backup as the primary foundation image.
2
Apply the latest cumulative differential backup.
The Wednesday 23:00 differential backup is restored over the baseline.
Differential backups record all changes since the last full backup. Applying Wednesday's differential restores all data changes from Monday, Tuesday, and Wednesday in a single operation.
3
Apply subsequent delta changes chronologically.
Thursday's hourly incremental backups (01:00 through 14:00) are restored in strict sequential order.
Incremental backups capture changes made only since the preceding backup. Because the Wednesday differential reset the cumulative marker, all Thursday incrementals must be applied in order.
4
Replay point-in-time transaction logs.
The 14:15 transaction log backup is applied to bridge the gap between 14:00 and 14:15.
Transaction log replays bring database and file metadata to the precise moment before crash, minimizing RPO.
5
Verify storage volume integrity and reconnect network shares.
Volume consistency checks pass and production services are re-enabled.
System verification ensures data consistency and prevents exposing corrupt file handles to network clients.

Anahtar Kavram

Disaster recovery backup restoration sequencing combining full, differential, incremental, and transaction log backups.
Soru 148Soru

A network technician is preparing to integrate several new access switches into an existing enterprise network. Before making any configuration changes, the technician records the current operating system versions, interface settings, and active services across all network devices. Which of the following terms best describes this documented initial snapshot used to detect unauthorized modifications over time?

Cevabı ve açıklamayı göster

Cevap: Configuration baseline

Cevap

Configuration baseline
Establishing a configuration baseline creates an official reference benchmark of device settings, software versions, and active configurations. This documentation allows administrators to identify configuration drift, conduct compliance audits, and restore devices to a known stable baseline if issues arise.

Adım Adım Çözüm

1
Identify the goal described in the scenario.
The technician needs to establish a standard record of settings and versions before making modifications.
Documenting current settings allows network administrators to compare future operational states against a known good state.
2
Match the goal to standard change and configuration management concepts.
Recording initial operating parameters creates a baseline configuration.
A baseline acts as a benchmark for compliance auditing and configuration drift detection.

Anahtar Kavram

Configuration Baseline and Drift Detection
Soru 149Soru

A senior network infrastructure engineer is planning a major architectural revision to implement micro-segmentation policies across an enterprise data center core network. To maintain service availability and comply with IT service management best practices, the engineering team must follow a structured configuration and change management lifecycle. In what chronological order should the engineer execute the change management phases from first to last?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence begins with drafting the Request for Change (RFC), followed by Change Advisory Board (CAB) approval, staging environment testing, stakeholder notification and maintenance window scheduling, production execution with immediate testing, and concludes with a Post-Implementation Review (PIR) and baseline documentation updates.
A standard change management process begins with drafting a detailed RFC (including risk analysis and rollback plans). Next, the change undergoes formal CAB evaluation and authorization. Once approved, the change is tested in a sandbox or staging environment to ensure technical validity. Following successful testing, maintenance windows are scheduled and notifications sent to stakeholders. The change is then executed in production within the maintenance window, followed immediately by post-change testing. Finally, a PIR is held, and the CMDB and network baselines are updated to reflect the new state.

Adım Adım Çözüm

1
Define the change requirements by preparing a detailed Request for Change (RFC).
Establishes technical scope, risk evaluation, and rollback parameters.
Governance requires complete technical documentation before requesting authorization.
2
Present the RFC to the Change Advisory Board (CAB).
Secures organizational authorization and ensures alignment with business risk management.
Unauthorized changes increase network vulnerability and violate IT compliance.
3
Perform sandbox and staging environment validation.
Confirms script syntax, protocol interoperation, and rollback execution under controlled conditions.
Testing mitigates risk before touching production network hardware.
4
Schedule the maintenance window and notify affected stakeholders.
Ensures business alignment and minimizes operational disruption.
Users and operations teams must prepare for planned downtime or potential latency.
5
Execute the change on production devices during the maintenance window.
Applies micro-segmentation configurations and verifies active traffic flow.
Production changes must strictly adhere to the approved execution window.
6
Perform Post-Implementation Review (PIR) and update CMDB baselines.
Finalizes the change record and eliminates configuration drift between physical state and documentation.
Accurate network baselines and logging are required for future troubleshooting and audits.

Anahtar Kavram

Standard ITIL-aligned Network Change Management Lifecycle
Soru 150Soru

A senior network operations engineer is implementing a centralized telemetry and performance monitoring solution for core routers transmitting sensitive enterprise data across a shared infrastructure. The monitoring design requires real-time interface throughput polling and immediate alert notifications whenever link utilization breaches critical thresholds. Additionally, security compliance mandates that all monitoring data, including administrative credentials and metric payloads, must provide both message integrity verification and cryptographic privacy during transmission over untrusted network segments. Which of the following protocol configurations correctly satisfies all performance monitoring and security compliance requirements?

Cevabı ve açıklamayı göster

Cevap: Implement SNMPv3 utilizing the User-based Security Model (USM) configured at the authPriv security level with SHA for authentication and AES for payload encryption.

Cevap

Implement SNMPv3 utilizing the User-based Security Model (USM) configured at the authPriv security level with SHA for authentication and AES for payload encryption.
The correct answer provides complete message integrity and privacy by deploying SNMPv3 under the User-based Security Model (USM) at the authPriv level. This combination enforces HMAC SHA for authenticating packets and AES for encrypting performance monitoring data payloads.

Adım Adım Çözüm

1
Analyze the functional and security monitoring requirements.
The scenario demands polling interface metrics, receiving alert notifications (traps/informs), verifying message integrity, and enforcing payload privacy (encryption).
Security compliance requires both data origin authentication and payload confidentiality.
2
Evaluate SNMP versions and security levels.
SNMPv1 and SNMPv2c only use cleartext community strings (noAuthNoPriv equivalent). SNMPv3 introduces USM with three security levels: noAuthNoPriv (no authentication, no encryption), authNoPriv (authentication, no encryption), and authPriv (both authentication and encryption).
Only SNMPv3 at the authPriv level fulfills the requirement for combined cryptographic authentication and payload privacy.
3
Verify protocol port assignments and privacy settings across options.
SNMPv3 authPriv with SHA and AES satisfies all security and operational criteria, whereas options specifying authNoPriv, cleartext SNMPv2c, or mismatched standard service ports fail required parameters.
authPriv ensures data cannot be intercepted or modified while traveling across untrusted network segments.

Anahtar Kavram

SNMPv3 Security Levels and Telemetry Encryption
Soru 151Soru

A network security administrator must apply a critical security patch to an enterprise perimeter firewall cluster to remediate a disclosed remote code execution vulnerability. Place the following patch management lifecycle steps in the correct chronological order from first step to last step.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The proper chronological patch management sequence is: (1) Verify file integrity and release notes, (2) Test the patch in an isolated lab staging environment, (3) Submit a formal change request ticket with rollback plan, (4) Perform a baseline backup of the production system, and (5) Install the patch during the maintenance window and validate operational status.
Standard network engineering best practices require a sequential lifecycle: initial verification of patch integrity, staging/testing in a non-production environment, formal change request authorization with documented rollback procedures, pre-deployment system backup, and post-installation verification testing.

Adım Adım Çözüm

1
Verify patch integrity and vendor documentation.
Ensures the installer package is authentic, uncorrupted, and suitable for testing.
Validating file hashes prevents corrupt or malicious software from entering the deployment pipeline.
2
Execute staging and lab testing.
Provides empirical evidence of patch stability and functional compatibility.
Staging identifies hidden bugs without risking operational network downtime.
3
Obtain change management approval.
Schedules an official maintenance window and secures stakeholder authorization.
Formal change approval enforces accountability and ensures a vetted rollback strategy exists.
4
Create a pre-patch production baseline backup.
Establishes an up-to-date snapshot of system state immediately prior to modification.
If patch installation fails, the system can be reverted quickly to its pre-update configuration.
5
Deploy the patch to production and execute verification tests.
Remediates the vulnerability and verifies normal firewall operations.
Executing changes within the approved window and verifying connectivity confirms successful patch implementation.

Anahtar Kavram

Structured Network Patch Management Lifecycle and Change Management Control
Soru 152Soru

An enterprise network operations team is analyzing complex performance anomalies and telemetry configurations across a hybrid WAN deployment. Match each observed network symptom or monitoring configuration requirement on the left with the correct network performance monitoring metric or protocol mechanism on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

High variation in end-to-end packet delivery delay causing buffer underruns and garbled audio in real-time UDP voice streams despite adequate total bandwidth.
Exporting statistical packet-header sampling directly from ASIC hardware across high-density 100 GbE core switches without maintaining stateful flow cache tables.
Polling infrastructure device metrics with cryptographic user authentication and payload encryption using AES to protect sensitive OID data in transit.
Aggregating IP traffic flow statistics based on matching 5-tuple attributes into cached records to identify top bandwidth-consuming applications across Layer 3 interfaces.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct pairings are: Packet delay variation affecting VoIP corresponds to Jitter; Stateless hardware packet sampling across 100 GbE interfaces corresponds to sFlow; Authenticated and encrypted OID polling corresponds to SNMPv3 using authPriv; Stateful 5-tuple flow aggregation corresponds to IPFIX / NetFlow Telemetry.
Each observed monitoring requirement correctly maps to its functional metric or protocol: Jitter measures packet arrival time variance; sFlow provides stateless hardware packet sampling for ultra-high-speed links; SNMPv3 authPriv provides authenticated and AES-encrypted management queries; IPFIX/NetFlow aggregates traffic flows based on 5-tuple attributes to identify top talkers.

Adım Adım Çözüm

1
Analyze real-time traffic degradation metrics.
Variation in delivery latency for UDP audio streams defines Jitter (Packet Delay Variation).
VoIP audio degradation caused by irregular arrival timing without packet loss is caused by jitter.
2
Differentiate high-speed packet sampling mechanisms from flow caching.
Stateless ASIC sampling corresponds to sFlow, whereas cached flow tracking corresponds to NetFlow/IPFIX.
sFlow operates statelessly at the hardware level, suitable for 100 GbE links.
3
Evaluate SNMP security levels for data protection.
Cryptographic authentication combined with AES encryption requires SNMPv3 authPriv.
noAuthNoPriv offers no security, authNoPriv provides authentication without encryption, and authPriv provides both authentication and payload encryption.
4
Identify flow aggregation mechanisms for top-talker reporting.
5-tuple cached flow record aggregation corresponds to IPFIX / NetFlow.
NetFlow and IPFIX aggregate packet metadata matching key fields (5-tuple) into stateful flow records.

Anahtar Kavram

Distinguishing Network Performance Metrics, Flow Telemetry, and Secure Device Management Protocols
Soru 153Soru

During a routine audit, a network engineer notices that multiple access-layer switches are running an outdated operating system version vulnerable to memory leaks under high traffic load. Before initiating the upgrade across the entire enterprise network during a scheduled window, which procedure should the engineer perform first to prevent unforeseen outages?

Cevabı ve açıklamayı göster

Cevap: Deploy the firmware update into a non-production staging environment to validate stability, feature compatibility, and dependency behavior.

Cevap

Deploy the firmware update into a non-production staging environment to validate stability, feature compatibility, and dependency behavior.
Deploying the firmware update into a non-production staging environment allows administrators to observe device behavior, verify protocol compatibility, and test rollback scripts without risking active user traffic. This is a foundational best practice in network patch management lifecycle operations.

Adım Adım Çözüm

1
Analyze the operational risk of deploying untested software updates across enterprise network switches.
Identified the risk of widespread service failure due to unforeseen software bugs or configuration incompatibilities.
Production deployments should never be the initial testing ground for network firmware updates.
2
Apply standard network patch management lifecycle best practices.
Determined that staging, testing in a lab/pilot environment, and verifying baseline system functionality must precede production rollout.
Lab testing verifies software stability and ensures rollback plans can be executed cleanly if issues arise.

Anahtar Kavram

Patch Staging and Pre-Deployment Validation
Soru 154Soru

A network administrator needs to configure centralized log forwarding from edge switches to a SIEM collector across an untrusted WAN connection. Corporate compliance mandates that log transmission must guarantee delivery confirmation to prevent log loss during congestion and secure event details against eavesdropping in transit. Which configuration best satisfies both requirements?

Cevabı ve açıklamayı göster

Cevap: Forward Syslog messages over TCP port 6514 using TLS encryption

Cevap

Syslog forwarding using TCP port 6514 with Transport Layer Security (TLS) encryption
Configuring Syslog to transmit over TCP port 6514 with TLS provides both connection-oriented reliability (preventing log loss during WAN congestion via TCP acknowledgments) and strong cryptographic privacy (ensuring audit logs remain encrypted across untrusted networks).

Adım Adım Çözüm

1
Analyze transport reliability requirements
Identified TCP as the required transport protocol to ensure guaranteed delivery and acknowledgment over congested WAN links.
UDP is connectionless and drops packets silently during congestion, whereas TCP uses acknowledgments and retransmissions.
2
Analyze encryption and privacy requirements
Identified TLS encapsulation as necessary for encrypting telemetry data in transit across untrusted connections.
Plaintext protocols expose sensitive audit logs and network telemetry to eavesdropping.
3
Select protocol standard and port assignment
Selected Syslog over TLS operating on standard port TCP 6514.
RFC 5425 specifies TCP port 6514 for secure Syslog transport utilizing TLS.

Anahtar Kavram

Secure and Reliable Syslog Transport (Syslog-TLS on TCP 6514)
Soru 155Soru

A network administrator configures a redundant gateway topology using a First Hop Redundancy Protocol (FHRP) to provide high availability for a corporate subnet. During a scheduled failover test, the primary router is powered off. Although logs confirm that the standby router successfully transitioned to the active role, all client workstations immediately lose outbound internet connectivity. Troubleshooting reveals that workstation traffic continues to be routed toward the MAC and IP addresses of the powered-off primary router interface. Which of the following configuration errors is the most likely cause of this issue?

Cevabı ve açıklamayı göster

Cevap: The DHCP scope is distributing the physical interface IP address of the primary router as the default gateway rather than the virtual IP address of the FHRP group.

Cevap

The DHCP scope is distributing the physical interface IP address of the primary router as the default gateway rather than the virtual IP address of the FHRP group.
The correct answer identifies that First Hop Redundancy Protocols (such as HSRP, VRRP, or CARP) rely on end hosts pointing to a shared Virtual IP (VIP) as their default gateway. If the DHCP scope is mistakenly configured to distribute the physical interface IP of the primary router, workstations will bypass the virtual gateway abstraction. Consequently, when the primary router shuts down, client traffic continues targeting the physical IP of the offline router, resulting in total loss of external connectivity despite the standby router successfully assuming the active state.

Adım Adım Çözüm

1
Analyze the operational role of First Hop Redundancy Protocols (FHRPs) like HSRP or VRRP.
FHRP creates a shared Virtual IP (VIP) and Virtual MAC address shared between active and standby routers.
End devices must send traffic to the VIP so that whichever router is active receives and forwards the packets.
2
Evaluate host behavior during the failover event.
Host workstations continued sending frames to the physical IP/MAC of the powered-off primary router.
This indicates hosts were pointing directly to the primary router's physical IP address instead of the FHRP Virtual IP.
3
Identify the root configuration error in network infrastructure services.
The DHCP scope option 003 (Router / Default Gateway) was set to the physical interface IP instead of the VIP.
Correcting the DHCP scope to issue the VIP ensures host traffic seamlessly redirects to the standby router upon failover.

Anahtar Kavram

FHRP Virtual Gateway IP Configuration
Tahmini Süre:1m 30s
Soru 156Soru

An auditor notes that an organization's network monitoring traffic is transmitted without encryption and that critical log messages are lost during periods of high link utilization. The network administrator must reconfigure telemetry protocols on core switches to ensure reliable log transport, cryptographic confidentiality, and authenticated management querying. Which of the following implementations address the auditor's security and reliability findings? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Forward Syslog messages using TLS encryption over TCP port 6514.; Deploy SNMPv3 configured with the authPriv security model.

Cevap

The network administrator should forward Syslog messages using TLS over TCP port 6514 and deploy SNMPv3 configured with the authPriv security level.
Implementing Syslog over TLS using TCP port 6514 resolves both log dropouts and unencrypted traffic by providing connection-oriented transport with strong TLS encryption. Additionally, configuring SNMPv3 with the authPriv security level ensures that monitoring queries and trap messages are cryptographically authenticated and fully encrypted (providing both authentication and privacy).

Adım Adım Çözüm

1
Identify transport reliability and log confidentiality requirements for centralized logging.
Standard Syslog uses UDP port 514, which lacks reliability and encryption. Migrating to Syslog over TCP port 6514 with TLS provides connection-oriented delivery and encryption.
TCP ensures logs are acknowledged and retransmitted if dropped, while TLS encrypts the log payload.
2
Select an authenticated and encrypted SNMP version and security mode for device management and polling.
SNMPv3 with authPriv (Authentication and Privacy) provides MD5/SHA authentication and DES/AES encryption.
SNMPv1 and SNMPv2c send community strings in cleartext, whereas SNMPv3 authPriv secures both credentials and message content.

Anahtar Kavram

Secure Logging and Management Telemetry (Syslog over TLS and SNMPv3 Security Models)
Tahmini Süre:1m 30s
Soru 157Soru

Match each high-availability technology or operational mechanism on the left with its primary redundancy behavior on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

VRRP Preemption
Multi-Chassis Link Aggregation (mLAG)
Stateful Switchover (SSO)
Multipath I/O (MPIO)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

VRRP Preemption matches with reclaiming the active primary router role upon recovery; Multi-Chassis Link Aggregation (mLAG) matches with bundling links across two separate physical switches without STP blocking; Stateful Switchover (SSO) matches with synchronizing control plane state for seamless supervisor module failover; Multipath I/O (MPIO) matches with managing server-to-SAN storage hardware paths.
Each listed technology targets high availability at a distinct architectural layer: VRRP Preemption manages gateway node recovery, mLAG provides multi-switch Layer 2 link redundancy, Stateful Switchover (SSO) maintains internal chassis supervisor state, and Multipath I/O (MPIO) provides host-to-SAN storage layer failover.

Adım Adım Çözüm

1
Analyze First Hop Redundancy Protocol (FHRP) behavior
Identify VRRP Preemption as the mechanism that forces a recovered router with higher priority to resume the Master role from the Backup router.
Preemption controls active node election in gateway redundancy when primary nodes recover.
2
Examine switch link aggregation mechanisms across dual chassis
Identify mLAG as the technology that terminates a single port-channel onto two separate physical switches while preventing Layer 2 loops.
Standard LACP requires single-switch termination; mLAG extends this across dual chassis.
3
Evaluate chassis controller and supervisor redundancy
Identify Stateful Switchover (SSO) as the process syncing control plane state between primary and secondary supervisors.
SSO prevents session drops during switch management board failures.
4
Differentiate network interface redundancy from host storage redundancy
Identify Multipath I/O (MPIO) as host OS software that provides failover and load distribution across redundant HBA-to-SAN paths.
MPIO targets storage network resiliency at the host OS layer.

Anahtar Kavram

High Availability and Redundancy Concepts across Network Infrastructure Layers
Soru 158Soru

A network administrator is executing a planned change during a maintenance window to implement new quality of service (QoS) dynamic bandwidth allocation rules on a primary distribution switch pair. Ten minutes into the post-implementation validation phase, automated network monitoring system alerts indicate that real-time telemetry traffic has breached defined latency and packet loss thresholds, failing the pre-established change success metrics. Which of the following is the most appropriate action for the administrator to take next?

Cevabı ve açıklamayı göster

Cevap: Initiate the documented rollback plan to restore the switch pair to its pre-change configuration baseline.

Cevap

Initiate the documented rollback plan to restore the switch pair to its pre-change configuration baseline.
According to standard IT service management andCompTIA change management practices, every Request for Change (RFC) must include explicit post-implementation testing criteria and a rollback plan. When automated checks reveal that a change has breached SLA metrics or failed validation during the maintenance window, the administrator must immediately execute the pre-approved rollback plan to restore the network to its known, stable configuration baseline.

Adım Adım Çözüm

1
Evaluate post-implementation validation metrics against established change plan acceptance criteria.
Validation fails because telemetry traffic latency and loss exceed acceptable SLA thresholds.
Changes must meet defined acceptance criteria during the maintenance window to be considered successful.
2
Identify the mandatory standard operational procedure when change validation criteria fail.
Determine that unapproved troubleshooting during a live maintenance window is forbidden.
Ad-hoc live changes violate change management guidelines and risk widespread outage.
3
Select the correct change management action.
Execute the pre-approved rollback procedure to return devices to the pre-change baseline.
Executing the rollback plan guarantees network stability and restores services to a known good state.

Anahtar Kavram

Change Management Rollback Execution and Validation Criteria
Soru 159Soru

A network technician is drafting a standard Request for Change (RFC) proposal to modify configuration parameters on a company's primary router. Which of the following key components must be included in the RFC document prior to submitting it for approval? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A detailed rollback plan outlining steps to revert the configuration if the change causes unexpected outages; A comprehensive risk and impact assessment evaluating potential service disruptions during implementation

Cevap

A standard Request for Change (RFC) must include a detailed rollback plan to revert changes upon failure and a risk and impact assessment to evaluate potential service disruption.
A standard Request for Change (RFC) must include a detailed rollback plan to safely revert modifications if unexpected failures occur, alongside a comprehensive risk and impact assessment to evaluate how the change affects network availability and business operations.

Adım Adım Çözüm

1
Identify the mandatory components of formal IT change management documentation.
Standard RFC documentation requires a clear description of the change, business justification, risk/impact assessment, and rollback procedures.
The Change Advisory Board (CAB) needs complete information to assess operational risk before authorizing network modifications.
2
Evaluate the answer choices against RFC documentation requirements.
The rollback plan and the risk and impact assessment are mandatory inclusion items.
The rollback plan minimizes downtime during failed changes, while the impact assessment informs scheduling and approval decisions.

Anahtar Kavram

Request for Change (RFC) documentation elements
Soru 160Soru

A network administrator is deploying a performance monitoring solution to track switch CPU and memory utilization across a enterprise network. The solution must support encrypted management traffic and allow standard polling queries to pass through internal firewalls. Which of the following configurations and protocols should the administrator implement? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure SNMPv3 using the authPriv security level to ensure data encryption and authentication.; Permit UDP port 161 on internal firewalls to allow SNMP polling traffic between the manager and agents.

Cevap

The administrator should configure SNMPv3 with authPriv for encrypted payload transmission and permit UDP port 161 on internal firewalls for standard SNMP agent polling.
Selecting SNMPv3 with the authPriv security level satisfies the requirement for payload encryption and message integrity. Allowing UDP port 161 on intermediate firewalls enables the central monitoring system to issue SNMP GET and SET requests to network switches.

Adım Adım Çözüm

1
Identify the SNMP version and security level that provides payload encryption.
SNMPv3 with the authPriv setting provides both authentication and privacy (AES encryption).
Security compliance requires encrypted telemetry data in transit, which earlier SNMP versions cannot provide.
2
Determine the transport protocol and port number required for standard SNMP polling requests.
SNMP queries use UDP port 161.
Firewall rules must permit UDP port 161 traffic from the NMS to monitored switch agents.

Anahtar Kavram

SNMPv3 Security Levels and Port Operations
ÖncekiSayfa 8 / 19Sonraki
Network Operations Alıştırma Soruları — CompTIA Network+ — Sayfa 8 | Examkin