- Which IEEE standard defines the protocol and compatible interconnection for data communication devices using a method of carrier-sensing multiple access with collision detection CSMA/CD?
- IEEE 802.1 for bridging campus segments
- IEEE 802.2 for framing logical channels
- IEEE 802.3 for delivering copper frames
- IEEE 802.4 for circulating token frames
Correct answer: IEEE 802.3 for delivering copper frames
IEEE 802.3 is the Ethernet family, and carrier sense multiple access with collision detection is the media access method it specifies for stations sharing one wired segment. IEEE 802.1 covers bridging and VLAN behaviour between segments rather than access to a single segment. IEEE 802.2 defines the logical link control sublayer that sits above the access method and never arbitrates the medium. IEEE 802.4 defines token bus, which avoids collisions by passing a token instead of sensing a carrier.
- What type of address is FF02::1?
- An IPv6 assigned static address
- An IPv6 multicast group address
- An IPv6 anycast service address
- An IPv6 routable public address
Correct answer: An IPv6 multicast group address
Addresses beginning FF00::/8 are IPv6 multicast, and FF02::1 is the link-local all-nodes group, so this address names a group of receivers rather than a single interface. A statically assigned address is ordinary unicast configured by hand and carries no group semantics. An anycast address is syntactically a unicast address shared by several nodes, so it cannot be recognised from its prefix at all. A routable public address is global unicast from 2000::/3 and identifies exactly one interface.
- Which type of cable is used to connect a computer to a switch in a typical Ethernet network?
- A crossover cable with pair-swapped wiring
- A rollover cable with console-port pinning
- A coaxial cable with solid-core insulation
- A straight-through cable with matched pins
Correct answer: A straight-through cable with matched pins
A workstation and a switch are unlike devices whose transmit and receive pairs already oppose one another, so the correct patch is a straight-through cable carrying pin one to pin one at both ends. A crossover cable deliberately swaps the transmit and receive pairs and belongs between two like devices on legacy equipment. A rollover cable reverses the whole pin order and terminates at a router or switch console port. Coaxial cable carries one centre conductor inside a solid dielectric and cannot terminate in an RJ45 switch port at all.
- What is the primary function of a DHCP relay agent in a network?
- Forwarding client broadcasts to a remote server
- Granting addresses from a locally defined scope
- Answering client requests using a static record
- Rejecting rogue offers arriving on access ports
Correct answer: Forwarding client broadcasts to a remote server
DHCP discovery is a broadcast and broadcasts stop at the router, so the agent listens on the local subnet and forwards those messages as unicast to a server sitting on another subnet. Granting addresses out of a configured scope is the work of the DHCP server itself. Answering a particular client from a fixed reservation is again server configuration. Rejecting untrusted server replies on an access port is DHCP snooping, a switch security feature unrelated to forwarding.
- In a network, what is the function of a VLAN?
- Blocking redundant uplinks to break switching loops
- Dividing one switch into separate broadcast domains
- Combining parallel uplinks into one logical channel
- Mirroring selected traffic onto one monitoring port
Correct answer: Dividing one switch into separate broadcast domains
A VLAN is a logically separate Layer 2 network carried on shared switch hardware, so each VLAN forms its own broadcast domain and traffic between VLANs has to be routed. Breaking loops by blocking redundant uplinks is Spanning Tree Protocol. Combining parallel uplinks into one logical channel is link aggregation. Mirroring traffic to a monitoring port duplicates frames for analysis and moves no broadcast boundary.
- Which protocol is used for securely transferring files over a network and operates on port 22?
Correct answer: SFTP
SFTP is the file transfer subsystem of SSH, so it inherits SSH's TCP port 22 and encrypts both credentials and payload, matching the stem exactly. FTPS is also encrypted but wraps ordinary FTP in TLS and uses the FTP control port rather than port 22. TFTP is a trivial UDP transfer used for firmware and configuration loads with no authentication and no encryption. HTTP is a cleartext web transfer protocol and offers no secure file transfer service at all.
- In the context of wireless networking, what does MIMO technology stand for?
- Modulation Index Method Output
- Managed Interface Media Output
- Multiple Input Multiple Output
- Multiplexed Inline Mode Output
Correct answer: Multiple Input Multiple Output
MIMO expands to Multiple Input Multiple Output, describing a radio link that uses several transmit and several receive antennas at once to carry independent spatial streams. The other three expansions borrow genuine radio and switching vocabulary but none is the accepted reading of the acronym. Modulation index, media interfaces and multiplexing modes all exist in networking, yet none of them explains why MIMO is measured in spatial streams. Only the multiple antenna reading matches how the technology is specified.
- What type of device is used in networking to forward data only to the port where the destination system is connected?
- A network switch
- An unmanaged hub
- A fiber repeater
- A wireless modem
Correct answer: A network switch
A switch learns the source MAC address of every frame it receives and builds a table, so it can forward a unicast frame out only the single port where that destination sits. A hub is a shared collision domain and repeats every incoming bit out of all remaining ports. A repeater regenerates a weak signal to extend a segment and makes no forwarding decision at all. A modem converts between digital data and a carrier signal for a broadband circuit and does not switch frames between local ports.
- In a network, what is the main function of a protocol analyzer?
- Decoding captured packet headers for closer review
- Measuring reflections to pinpoint one copper fault
- Mapping listening services across one subnet range
- Generating traffic to confirm a circuit throughput
Correct answer: Decoding captured packet headers for closer review
A protocol analyzer captures frames off the wire and decodes each header layer by layer, so an engineer can see exactly what was exchanged and where a conversation broke down. Measuring reflections to find a cable fault is a time domain reflectometer. Mapping which services are listening across a subnet is a port scanner. Generating synthetic traffic to prove a circuit reaches its rated speed is a throughput tester, which creates traffic instead of dissecting it.
- What does a 'collision domain' in a network refer to?
- The set of hosts receiving one flooded broadcast frame
- The set of hosts sharing one contended physical medium
- The set of hosts occupying one routable network prefix
- The set of hosts carrying one matching VLAN identifier
Correct answer: The set of hosts sharing one contended physical medium
A collision domain is the group of stations that share one transmission medium, so two of them transmitting at the same instant corrupt each other and both must back off and retry. The group reached by a flooded broadcast is the broadcast domain, which a router bounds. The group occupying one routed prefix is a subnet, a Layer 3 boundary. The group carrying one tag is a VLAN, a logical segment that can span switches without sharing any physical medium.
- In which layer of the OSI model do IP addresses operate?
- The physical layer of the OSI reference model
- The transport layer of the OSI standard model
- The session layer of the OSI networking model
- The network layer of the OSI conceptual model
Correct answer: The network layer of the OSI conceptual model
Logical addressing and the path selection that uses it belong to the network layer, so an IP address is a network layer construct. The physical layer moves raw bits as electrical, optical or radio signals and has no addresses. The transport layer identifies applications with port numbers and provides segmentation and reliability, not host addressing. The session layer sets up and tears down dialogues between applications and never inspects an address.
- What is the primary purpose of a subnet mask in IP networking?
- Mapping a private address onto one public address
- Reserving a block of leased addresses for clients
- Marking the address bits forming a network prefix
- Choosing the next router for remote traffic flows
Correct answer: Marking the address bits forming a network prefix
A subnet mask is a run of one bits that tells a host how many leading bits of an address identify the network, which is what lets a device decide whether a destination is local or remote. Mapping a private address to a public one is network address translation. Reserving a block of leased addresses is DHCP scope configuration. Choosing the next router for off-network traffic is done by the routing table and the default gateway.
- In networking, what is the function of an ARP (Address Resolution Protocol)?
- Translating a server name to an IPv4 address
- Leasing an IPv4 address to a booting station
- Resolving an IPv4 address into a MAC address
- Reporting a failed delivery back to one host
Correct answer: Resolving an IPv4 address into a MAC address
ARP broadcasts a request for the hardware address that owns a known IPv4 address on the local link, so the sender can build the Ethernet header it needs to deliver the frame. Translating a name into an address is DNS. Leasing an address to a station that has just booted is DHCP. Reporting that a delivery failed is ICMP, which carries error and diagnostic messages rather than address bindings.
- Which wireless encryption standard is considered the most secure as of the latest CompTIA Network+ examination?
Correct answer: WPA3
WPA3 is the current Wi-Fi Alliance certification and is the strongest of the four, replacing the pre-shared key handshake with Simultaneous Authentication of Equals and mandating protected management frames. WPA2 is the earlier certification and remains vulnerable to offline dictionary attack on a captured handshake. TKIP is the legacy cipher retained for WEP hardware compatibility and is deprecated. CCMP is the AES based cipher used by WPA2, a component rather than the most secure standard.
- What is the primary purpose of Quality of Service (QoS) in networking?
- Blocking unwanted traffic at one internal network border
- Caching repeated traffic closer to the requesting client
- Counting traffic volumes for a monthly capacity forecast
- Queueing delay sensitive traffic ahead of bulk transfers
Correct answer: Queueing delay sensitive traffic ahead of bulk transfers
Quality of Service classifies traffic and then services the sensitive classes first, so voice and video keep low latency and jitter while bulk transfers wait in a lower priority queue. Blocking unwanted traffic at a border is a firewall or access control list function. Caching repeated content nearer the client is a proxy or content delivery role. Counting traffic volumes for a forecast is monitoring, which measures congestion without changing how any packet is scheduled.
- In the context of networking, what does the term 'latency' refer to?
- The transit delay between two remote network points
- The traffic volume one circuit delivers each second
- The variation seen between two packet arrival times
- The proportion of packets each circuit loses hourly
Correct answer: The transit delay between two remote network points
Latency is a delay measurement, the elapsed time between a packet leaving a sender and arriving at the far end, and it is normally reported in milliseconds. The volume a circuit delivers per second is bandwidth or throughput, a rate rather than a delay. The variation between successive arrivals is jitter, which is derived from latency but is not latency itself. The proportion of packets that never arrive is packet loss, a reliability measure.
- Which protocol is responsible for automatic IP address assignment in a local network?
Correct answer: DHCP
DHCP hands a client a lease containing an address, mask, gateway and resolver details after a discover, offer, request and acknowledgement exchange, which is exactly the automatic assignment the stem asks about. ICMP carries reachability and error messages such as echo requests and destination unreachable. SNMP polls and traps management data from devices for monitoring. IGMP lets hosts join and leave multicast groups so switches and routers know where to forward group traffic.
- What is the primary purpose of an SNMP (Simple Network Management Protocol) in a network?
- Polling managed devices for their interface counters
- Streaming recorded event messages to their collector
- Distributing accurate clock updates to network nodes
- Advertising neighbour identity across one local link
Correct answer: Polling managed devices for their interface counters
SNMP reads counters and status objects from an agent's management information base and can also receive unsolicited traps, which is how a management station watches device health. Streaming event messages to a collector is syslog. Distributing clock updates is NTP. Advertising a neighbour's identity on a local link is LLDP or its vendor equivalent, a discovery protocol that carries no performance data at all.
- In networking, what does the term 'unicast' refer to?
- Delivery from one host to the whole local segment
- Delivery from one host to a subscribed host group
- Delivery from one host to one nearby group member
- Delivery from one host to a single chosen station
Correct answer: Delivery from one host to a single chosen station
Unicast is one to one delivery: the frame carries the address of exactly one destination and only that station processes it. Delivery to the whole local segment is broadcast, sent to the all ones address. Delivery to a subscribed group is multicast, which reaches only stations that asked to join. Delivery to the nearest member of a group is anycast, where several nodes share an address and routing picks the closest one.
- Which technology allows multiple VLANs to be transported across a single network link?
- IEEE 802.1D for blocking switched loops
- IEEE 802.1X for securing switched ports
- IEEE 802.1Q for tagging switched frames
- IEEE 802.1s for grouping switched trees
Correct answer: IEEE 802.1Q for tagging switched frames
IEEE 802.1Q inserts a four byte tag carrying a VLAN identifier into the Ethernet header, so one link can carry frames from many VLANs and the far switch can still tell them apart. IEEE 802.1D is the original spanning tree standard and blocks redundant paths. IEEE 802.1X authenticates a device before its port is opened. IEEE 802.1s is multiple spanning tree, which maps groups of VLANs to tree instances but never labels a frame.
- In a network topology, what is the primary function of an aggregation switch?
- Terminating desktop connections within a wiring cabinet
- Consolidating uplinks from several access edge switches
- Forwarding traffic between two separate routing domains
- Connecting distant branches across the provider network
Correct answer: Consolidating uplinks from several access edge switches
An aggregation or distribution switch sits between the access layer and the core, gathering uplinks from many access switches so the core needs far fewer high speed ports. Terminating desktop connections in a wiring cabinet is the access layer role. Forwarding between separate routing domains is border routing performed with an exterior gateway protocol. Connecting distant branches over a carrier network is the job of a WAN edge router.
- What is the primary purpose of using HSRP in a network?
- Bundling parallel links into one logical channel group
- Blocking redundant uplinks to suppress a bridging loop
- Spreading client sessions across a busy server cluster
- Presenting one shared gateway address to local clients
Correct answer: Presenting one shared gateway address to local clients
HSRP is a first hop redundancy protocol: two or more routers share a virtual IP and MAC address, hosts are configured with that virtual address, and a standby router assumes it if the active one fails. Bundling parallel links into one channel is link aggregation. Blocking redundant uplinks to suppress a loop is spanning tree. Spreading sessions across a server cluster is load balancing, which shares work between servers rather than protecting the exit point.
- Which protocol is used to prioritize voice traffic in a network, ensuring Quality of Service (QoS)?
- IEEE 802.1p for marking frame priority
- IEEE 802.1D for pruning switched loops
- IEEE 802.1X for gating unknown clients
- IEEE 802.1s for mapping regional trees
Correct answer: IEEE 802.1p for marking frame priority
IEEE 802.1p defines the three bit priority code point carried in the VLAN tag, so a switch can place voice frames in a higher priority queue than bulk data and honour class of service end to end. IEEE 802.1D is spanning tree and removes loops. IEEE 802.1X performs port based access control before a device is admitted. IEEE 802.1s maps VLANs to spanning tree instances. None of the three alters how a queue is serviced.
- In the context of wireless networking, what does MIMO technology improve?
- The outdoor coverage distance
- The receiver battery lifetime
- The aggregate data throughput
- The frame encryption strength
Correct answer: The aggregate data throughput
MIMO sends independent spatial streams over several antennas at the same time, so the aggregate data rate across the link rises roughly with the number of usable streams. Coverage distance is driven by transmit power, antenna gain and the band in use rather than by stream count. Battery lifetime is helped by power save features, and extra radio chains generally cost power. Encryption strength is set by the security suite in use, which is independent of the antenna arrangement.
- What is the primary purpose of the Spanning Tree Protocol (STP) in a network?
- Disabling a redundant path to prevent broadcast storms
- Bundling parallel links into one logical channel group
- Providing one virtual gateway address to local clients
- Copying selected frames onto an attached analyser port
Correct answer: Disabling a redundant path to prevent broadcast storms
A Layer 2 frame carries no hop count, so a single broadcast caught in a switching loop circulates forever and multiplies into a storm that saturates the segment. Spanning Tree Protocol computes a loop free topology and disables the surplus paths so that cannot happen. Bundling parallel links into one channel is link aggregation, and providing a shared virtual gateway address is a first hop redundancy protocol. Copying frames to an analyser port is port mirroring, which adds traffic rather than removing a loop.
- Which network device operates at Layer 3 of the OSI model and makes forwarding decisions based on IP addresses?
- An Ethernet bridge
- A passive repeater
- An Ethernet switch
- An upstream router
Correct answer: An upstream router
A router terminates a broadcast domain and consults a routing table of destination prefixes, so its forwarding decision is made on the Layer 3 address in the packet. A bridge and a switch both forward on the Layer 2 MAC address and pass IP packets without examining them. A repeater works at Layer 1 and simply regenerates the signal so a segment can run longer. Only the router rewrites the frame header and chooses a next hop for each network.
- In a WAN, what is the main function of a demarcation point?
- The router advertising local prefixes to each provider
- The circuit carrying traffic between two distant sites
- The boundary dividing provider plant from local wiring
- The hardware converting Ethernet onto a serial circuit
Correct answer: The boundary dividing provider plant from local wiring
The demarcation point is the agreed handover between the carrier's plant and the subscriber's inside wiring, so it fixes where the provider's responsibility stops and the customer's begins and is the first place to test in an outage. A router advertising prefixes is customer premises equipment sitting behind that boundary. A circuit between two carrier sites is backbone transport. Hardware that converts Ethernet onto a serial circuit is an interface converter, which is equipment rather than a boundary.
- What is the primary purpose of a Virtual Private Network (VPN) concentrator in a network infrastructure?
- Inspecting outbound page requests against a category list
- Terminating many remote access tunnels inside one chassis
- Distributing new client sessions throughout a server pool
- Matching packet payloads against a signed attack database
Correct answer: Terminating many remote access tunnels inside one chassis
A VPN concentrator exists to build, authenticate and tear down large numbers of simultaneous tunnels, so a single appliance can serve a whole remote workforce and enforce one policy on all of them. Inspecting outbound requests against a category list is content filtering. Distributing client sessions through a server pool is load balancing. Matching payloads against a signature database is intrusion detection or prevention, which inspects traffic rather than terminating tunnels.
- What type of network device is used to connect multiple devices on a Local Area Network (LAN) and operates at the Data Link layer of the OSI model?
- The Ethernet switch
- The wireless router
- The signal repeater
- The border firewall
Correct answer: The Ethernet switch
A switch reads the source and destination MAC addresses in the Ethernet header, which places it at the data link layer, and it gives every attached device its own port and collision domain. A router works at the network layer on IP addresses and separates broadcast domains. A repeater operates at the physical layer and only regenerates the signal. A firewall filters on addresses, ports and session state and is deployed as a boundary control rather than as the LAN connection point.
- In a wireless network, what does the term "SSID" stand for?
- Secure Signal Identity
- Signal Strength Rating
- Shared Server Identity
- Service Set Identifier
Correct answer: Service Set Identifier
SSID expands to Service Set Identifier, the name that labels a basic or extended service set so clients can tell one wireless network from another. The other three expansions reuse genuine wireless vocabulary without matching the acronym. Received signal strength is a real measurement reported by clients, but it is abbreviated RSSI and describes radio conditions, not a network name. Neither identity phrase corresponds to any Wi-Fi term, and neither would appear in a beacon frame.
- What is the primary purpose of a load balancer in a network infrastructure?
- Caching frequent objects nearer to their requesting clients
- Rewriting internal addresses onto one shared public address
- Spreading inbound requests across a mirrored server cluster
- Filtering inbound packets against a written firewall policy
Correct answer: Spreading inbound requests across a mirrored server cluster
A load balancer accepts client connections on a virtual address and hands each one to a member of a server cluster using a scheduling method and health checks, which raises capacity and removes any single server as a point of failure. Caching objects nearer the client is a proxy or content delivery role. Rewriting internal addresses onto one public address is network address translation. Filtering packets against a written policy is a firewall function.
- Which of the following is a characteristic of a mesh network topology?
- Each station sharing one cable backbone
- Many separate links joining the devices
- One central switch linking the branches
- One unbroken circuit passing the tokens
Correct answer: Many separate links joining the devices
A mesh topology gives nodes direct links to several other nodes, so traffic has more than one route and the loss of a single link or node does not partition the network. A shared cable backbone is a bus, where one break can take the whole segment down. A central device with branches radiating from it is a star, whose hub is a single point of failure. An unbroken circuit passing a token is a ring, which offers one path in each direction.
- What is the function of a WAP (Wireless Access Point) in a wireless network?
- Amplifying weak wireless signals towards far rooms
- Controlling channel plans across one wireless cell
- Bridging wireless clients onto their wired network
- Handing leased addresses to joining wireless hosts
Correct answer: Bridging wireless clients onto their wired network
An access point converts between radio frames and Ethernet frames, so associated wireless stations reach the wired network and its resources through it. Amplifying a weak signal to extend reach is a repeater or range extender. Setting channel and power plans across a cell is a wireless controller function. Handing out leased addresses is DHCP, a service the access point normally relays toward rather than provides.
- In network security, what is the primary purpose of a Unified Threat Management (UTM) device?
- Terminating encrypted tunnels for a mobile workforce
- Recording sampled flow records for capacity planning
- Retaining security events from other logging systems
- Combining several security services in one appliance
Correct answer: Combining several security services in one appliance
Unified Threat Management folds firewalling, intrusion prevention, antimalware, web filtering and often tunnel termination into a single managed platform, which is the defining characteristic the stem asks for. Terminating tunnels for a mobile workforce is one such service, not the whole device. Recording sampled flow records is a collector role. Retaining events from many logging systems is what a log management or SIEM platform does.
- In network operations, what is the primary purpose of a syslog server?
- Collecting event messages from many network devices
- Polling network interface counters for trend graphs
- Distributing one reference clock across the network
- Answering address requests made by network stations
Correct answer: Collecting event messages from many network devices
A syslog server listens for the event messages that routers, switches, firewalls and servers emit, then stores them in one searchable place with a facility and severity attached to each record. Polling interface counters for trend graphs is SNMP based monitoring. Distributing a reference clock is NTP. Answering address requests from stations is DHCP. Only the syslog service exists to gather and retain the log records themselves.
- What is the main purpose of a network baseline?
- A written agreement promising one constant uptime figure
- A snapshot showing the expected network traffic readings
- A drawing documenting each terminated cable route onsite
- A stored file holding one firewall running configuration
Correct answer: A snapshot showing the expected network traffic readings
A baseline captures how the network behaves while it is healthy, including throughput, latency, utilisation and error rates, so a later measurement can be set against it and any deviation investigated. A written agreement promising an uptime figure is a service level agreement. A drawing of terminated cable routes is a physical diagram. A stored running configuration is a device backup, which restores settings but says nothing about performance.
- What is the primary purpose of a SIEM (Security Information and Event Management) system in network operations?
- Rejecting malicious traffic inline at network edges
- Correlating security events into ranked live alerts
- Encrypting archived records held on offsite volumes
- Scanning internal hosts for absent security patches
Correct answer: Correlating security events into ranked live alerts
A SIEM ingests logs and events from across the estate, normalises them, correlates related activity and raises prioritised alerts while an incident is still developing. Rejecting malicious traffic inline is an intrusion prevention system. Encrypting archived records is a data protection control. Scanning internal hosts for absent patches is vulnerability management, which reports exposure rather than analysing live events.
- In network operations, what is the main function of a TACACS+ server?
- Issuing verified certificates to network endpoints
- Encrypting tunnels between paired boundary routers
- Translating internal names into routable addresses
- Validating administrator logins for command access
Correct answer: Validating administrator logins for command access
TACACS+ is an AAA protocol that separates authentication, authorization and accounting, so it checks an administrator's credentials and then decides which commands that administrator may run on the device. Issuing verified certificates is a certificate authority function. Encrypting tunnels between boundary routers is IPsec. Translating names into addresses is DNS. Only TACACS+ centralises the login and command decision for device administration.
- What is the primary role of an IDS (Intrusion Detection System) in network security?
- Alerting one operator about suspicious traffic flows
- Discarding matched packets within the traffic stream
- Masking internal addresses behind one public address
- Encrypting each branch circuit crossing the internet
Correct answer: Alerting one operator about suspicious traffic flows
An intrusion detection system inspects a copy of the traffic and compares it against signatures and behaviour baselines, then raises an alert for a human to act on, which is detection rather than enforcement. Discarding matched packets in the forwarding path is what an intrusion prevention system does. Masking internal addresses behind one public address is network address translation. Encrypting a branch circuit across the internet is a VPN function.
- What is the primary purpose of a Network Time Protocol (NTP) server in a network environment?
- Resolving published names for clients on the network
- Leasing addresses to hosts joining the local network
- Aligning network device clocks to one trusted source
- Collecting event records from devices on the network
Correct answer: Aligning network device clocks to one trusted source
NTP distributes time down a stratum hierarchy so every device converges on the same clock, which keeps log timestamps comparable and lets certificate and ticket validity checks behave correctly. Resolving published names for clients is DNS. Leasing addresses to hosts as they join is DHCP. Collecting event records from devices is syslog. Only NTP adjusts the device clocks themselves.
- Which device is primarily used for filtering and securing network traffic at the perimeter of a network?
- An upstream gateway
- An unmanaged switch
- A hardware firewall
- A wireless repeater
Correct answer: A hardware firewall
A firewall enforces a written policy on traffic crossing the network boundary, permitting or denying by address, port, protocol and session state, which is exactly the perimeter filtering role the stem describes. A gateway router forwards between networks and applies no security policy by default. An unmanaged switch forwards frames inside the LAN with no filtering at all. A repeater extends a wireless cell and inspects nothing.
- In network operations, what does the term 'failover' refer to?
- The spreading of sessions across one server pool
- The archiving of a configuration before a change
- The staging of one firmware bundle before reboot
- The switching of service onto one standby system
Correct answer: The switching of service onto one standby system
Failover is the automatic transfer of a service from a failed component to a standby one, so the service stays available while the fault is repaired. Spreading sessions across a server pool is load balancing, which shares work in normal operation rather than reacting to a failure. Archiving a configuration before a change is a rollback precaution. Staging a firmware bundle before a reboot is part of an upgrade procedure.
- What is the primary purpose of using SNMP traps in network management?
- Polling stored interface counters on one schedule
- Changing device settings with one write community
- Pushing unsolicited event alerts toward a console
- Encrypting outbound messages with one private key
Correct answer: Pushing unsolicited event alerts toward a console
An SNMP trap is an unsolicited message an agent originates on its own when an event occurs, such as a link going down or a threshold being crossed, and sends to the management station without waiting to be asked. Scheduled retrieval of interface counters is manager-initiated polling using GET requests, which is the opposite direction of a trap. Altering a device's configuration is what a SET request with a write community string does. Encrypting the message payload is the privacy service added in SNMPv3; it protects any SNMP message and is not what makes a trap a trap.
- Which technology is primarily used for securely extending a private network across a public network?
- VPN, a private encrypted overlay
- VLAN, a logical broadcast domain
- MPLS, a label switched transport
- NAT, a public address translator
Correct answer: VPN, a private encrypted overlay
A VPN builds an encrypted tunnel between endpoints so private traffic can cross an untrusted public network as though the endpoints were on the same private link. A VLAN divides one switched infrastructure into separate broadcast domains; it never leaves that infrastructure and adds no encryption. MPLS forwards traffic across a carrier core by swapping labels rather than by inspecting addresses, and on its own it provides no confidentiality. NAT rewrites addresses so hosts can share a routable public address, which conserves address space but neither tunnels nor encrypts.
- Which tool is used for testing reachability of devices in an IP network and diagnosing connectivity issues?
- Traceroute, which lists hops handling a passing packet
- Nslookup, which resolves names using a selected server
- Netstat, which shows connections belonging to one host
- Ping, which confirms one distant endpoint is reachable
Correct answer: Ping, which confirms one distant endpoint is reachable
Ping sends ICMP echo requests to a target and waits for echo replies, which is the direct test of whether a device is reachable and how long the round trip takes. Enumerating the intermediate routers is what a path-tracing tool does; it answers where traffic stops, not simply whether the target responds. Turning a name into an address is a name-resolution lookup against a DNS server. Showing which sockets a machine has open reports local connection state and never touches the remote device.
- What is the purpose of a VLAN Trunking Protocol (VTP) in a switched network?
- Attaching VLAN identifiers to frames traversing each trunk
- Distributing one VLAN database to other connected switches
- Selecting one designated root bridge inside separate VLANs
- Routing traffic between VLANs through one routed interface
Correct answer: Distributing one VLAN database to other connected switches
VTP is a management protocol that propagates a single VLAN database from a server switch to the other switches in the domain, so a VLAN created once is learned everywhere without being typed in again. Inserting a VLAN identifier into each frame as it crosses a trunk is the job of the 802.1Q tagging standard, which VTP relies on but does not perform. Choosing a root bridge per VLAN is spanning tree's loop-prevention election. Moving traffic from one VLAN to another requires a routed interface, which is inter-VLAN routing rather than VLAN administration.
- In a network, what is the primary function of a RADIUS server?
- Assigning address leases and renewing expiring bindings
- Checking user credentials and tracking session activity
- Resolving domain names and returning matching addresses
- Collecting device messages and archiving them centrally
Correct answer: Checking user credentials and tracking session activity
A RADIUS server is the central AAA point: it validates the credentials presented by a user or device, decides what that identity is allowed to do, and records the session so usage can be accounted for. Handing out and renewing address leases is DHCP's function. Turning names into addresses is DNS. Receiving and storing event messages from many devices is what a logging server does; it records what happened but grants nobody access.
- Which protocol is primarily used for securely accessing a remote computer or server over a network?
- HTTP, cleartext hypertext page delivery
- FTP, unencrypted archive file transfers
- SNMP, periodic device counter retrieval
- SSH, encrypted interactive shell access
Correct answer: SSH, encrypted interactive shell access
SSH opens an encrypted channel to a remote system and carries an interactive command shell inside it, so both the login and everything typed afterwards are protected on an untrusted network. Hypertext delivery without TLS moves web content in the clear and offers no remote command line. Classic file transfer moves files but sends its control channel, including the password, unprotected. Periodic counter retrieval is a monitoring conversation with an agent, not a login to the operating system.
- What is the primary function of 802.1X in a network environment?
- Authenticating a device before opening its network port
- Encrypting wireless frames using a rotating session key
- Labeling frames so switches identify each distinct VLAN
- Blocking extra links to prevent switching loops forming
Correct answer: Authenticating a device before opening its network port
802.1X is port-based network access control: the switch or access point holds the port in an unauthorized state, passes the supplicant's EAP credentials to an authentication server, and only opens the port once that identity is accepted. Encrypting the wireless payload with a session key is the confidentiality service of the wireless security suite that runs after association. Inserting VLAN identifiers into frames is a trunking function that decides which segment a frame belongs to, not who may send it. Disabling redundant paths is spanning tree's loop control.
- Which of the following best describes a Man-in-the-Middle (MitM) attack?
- Overwhelming a public service with more requests than capacity
- Repeatedly guessing password digests until any of them matches
- Relaying traffic between two parties while quietly altering it
- Injecting crafted input into a weakly validated database query
Correct answer: Relaying traffic between two parties while quietly altering it
A man-in-the-middle attacker positions themselves in the conversation path, forwards the traffic so both ends still appear to be talking to each other, and can read or modify what passes through. Overwhelming a service with volume denies availability but never places the attacker inside a session. Working through candidate passwords is an offline or online credential attack against a stored secret. Feeding hostile input into a query that is not validated targets an application's database and does not intercept a conversation.
- In network security, what is the primary role of a WAF (Web Application Firewall)?
- Inspecting HTTP requests aimed at one hosted web application
- Blocking packets by address at the network firewall boundary
- Ending the secured tunnels carrying remote staff web traffic
- Comparing signatures against each packet on the network link
Correct answer: Inspecting HTTP requests aimed at one hosted web application
A web application firewall understands HTTP, so it examines the requests and responses exchanged with a specific web application and blocks the ones that carry application-layer attacks. Deciding on packets by address and port pair is what a traditional stateful firewall does, and it cannot see inside an HTTP request. Ending encrypted tunnels for remote workers is the role of a VPN concentrator. Comparing all traffic against a signature set is a general intrusion prevention function that is not tied to one application.
- What does the term "DLP" stand for in network security, and what is its primary purpose?
- Data Link Protection; shielding each frame crossing one backbone
- Dynamic Label Processing; steering labeled flows across one core
- Data Loss Prevention; blocking onward transfers of company files
- Distributed Lease Provisioning; giving free numbers to new hosts
Correct answer: Data Loss Prevention; blocking onward transfers of company files
DLP stands for data loss prevention. It classifies regulated or confidential content, watches the channels by which that content could leave, and blocks or quarantines transfers that break policy. Protecting frames as they cross a single link describes link-layer encryption, which secures a hop rather than governing what data may exit. Steering flows across a provider core by label describes label-switched forwarding, a transport mechanism. Handing addresses to client hosts describes dynamic address assignment, which has nothing to do with content control.
- In the context of network security, what is the function of an IPS (Intrusion Prevention System)?
- Copying passing frames and raising alerts afterwards
- Examining live traffic and stopping detected attacks
- Permitting listed sessions and blocking unknown ones
- Gathering system messages and storing them centrally
Correct answer: Examining live traffic and stopping detected attacks
An intrusion prevention system sits in the traffic path, inspects packets as they pass, and drops or resets the flows it identifies as malicious, so the attack is stopped rather than merely noticed. Working from a copy of the traffic and reporting afterwards describes a detection-only sensor, which cannot block anything because it is not inline. Allowing or refusing sessions from a fixed list of addresses and ports is access-list filtering and inspects no payload. Collecting and storing messages from devices is centralized logging.
- Which protocol is used for securely transmitting log messages over the network to a logging server?
- SNMP traps pushed toward a management station
- SMTP mail relayed between two message servers
- FTPS files pushed across an encrypted channel
- Syslog alerts carried inside a TLS connection
Correct answer: Syslog alerts carried inside a TLS connection
Log messages are secured by carrying the syslog protocol inside a TLS session, which encrypts the records in transit and lets the collector and the sender authenticate each other. Traps carry device events to a management station but are a monitoring notification rather than the log stream, and the classic versions are unencrypted. Mail relay moves messages between mail servers, not log records to a collector. Encrypted file transfer does protect what it carries, but it moves files on demand instead of streaming log entries as they are generated.
- What is the main purpose of port security in network switches?
- Encrypting the payload frames that one backbone link carries
- Reserving the bandwidth that one voice conference call needs
- Disabling the ports that superior bridge protocol data reach
- Constraining the learned MAC addresses that one port accepts
Correct answer: Constraining the learned MAC addresses that one port accepts
Port security binds a switch port to a limited set of source MAC addresses, so an unexpected device that plugs into the jack, or a flood of forged source addresses, triggers a violation action instead of being forwarded. Encrypting frames on a trunk is link-layer encryption, a confidentiality service that does not restrict which devices may attach. Reserving capacity for voice is a quality-of-service policy about bandwidth, not about identity. Shutting a port that receives a superior bridge protocol message is a spanning tree protection feature aimed at topology changes.
- Which type of network security attack involves overwhelming a service with excessive requests, rendering it unavailable?
- A forged message that tricks people into revealing passwords
- A request flood that exhausts the available server resources
- A relayed session that lets outsiders read exchanged traffic
- A crafted query that manipulates a protected database record
Correct answer: A request flood that exhausts the available server resources
A denial-of-service attack consumes a target's finite resources, whether connections, bandwidth, or processing, by sending far more requests than it can serve, so legitimate users are refused. Deceiving a person into handing over credentials is a social-engineering attack on the user rather than on the service. Sitting in the middle of a session to read what two parties exchange is an interception attack that leaves the service available. Manipulating a database through unvalidated input is an injection attack against the application logic.
- In network security, what is the primary purpose of VLAN segregation?
- Bundling several physical links into one aggregate channel
- Prioritizing voice frames ahead of background data traffic
- Placing sensitive hosts inside a separate broadcast domain
- Handing address leases to freshly connected client devices
Correct answer: Placing sensitive hosts inside a separate broadcast domain
Splitting a switched network into VLANs puts sensitive systems into their own broadcast domain, so traffic between segments must pass a routed boundary where filtering can be enforced and a compromised host cannot reach its neighbors directly. Combining several physical links into one logical channel raises throughput and adds redundancy. Giving voice frames preferential treatment is a quality-of-service measure aimed at delay and jitter. Issuing address leases to attached clients is dynamic addressing, which happens inside whatever segment already exists.
- Which cryptographic protocol is used to secure communication over an insecure network, such as the Internet?
- TLS, which protects sessions over the transport layer
- WPA2, which secures frames crossing one wireless link
- SNMP, which carries counters toward a polling station
- PPP, which delimits traffic across serial point links
Correct answer: TLS, which protects sessions over the transport layer
TLS negotiates keys and then encrypts and authenticates an application session end to end, which is why it protects web, mail, and other traffic crossing the public Internet. The wireless security suite protects only the radio hop between a client and its access point; once the frame leaves the access point it is no longer covered. The management protocol moves counters and events to a monitoring station and, in its early versions, does so in the clear. The serial framing protocol defines how bytes are delimited on a point-to-point link and provides no confidentiality.
- What is the main function of a proxy server in a network environment?
- Spreading incoming sessions across a cluster of computers
- Swapping private addresses for a reachable public address
- Forwarding browser requests onward on the caller's behalf
- Leasing addresses to joining workstations as they connect
Correct answer: Forwarding browser requests onward on the caller's behalf
A proxy receives a client's request, makes the request to the destination itself, and returns the response, which lets it cache content, hide the client, and apply content policy. Distributing arriving sessions over a group of identical servers is load balancing, which faces the servers rather than acting for the client. Rewriting internal addresses to a shared public address is address translation performed by the router at the edge. Issuing addresses to hosts as they join is dynamic address assignment.
- In network security, what is the purpose of implementing a honeypot?
- A protected jump host that administrators log into
- A screened subnet that holds public facing servers
- A spare appliance that replaces a defective device
- A decoy system that records how adversaries behave
Correct answer: A decoy system that records how adversaries behave
A honeypot is a deliberately exposed decoy that holds nothing of value; because no legitimate user has any reason to touch it, every interaction is suspicious and can be studied to learn an attacker's tools and intent. A hardened intermediate host that administrators pass through is a controlled management entry point. A screened segment that holds public-facing servers isolates services that must be reachable from outside. A spare unit held to replace a failure is a resiliency measure and gathers no attacker behavior.
- What is the primary security concern with using outdated network protocols such as Telnet?
- It accepts anonymous logins as valid without credentials
- It transmits logins and passwords as readable characters
- It verifies commands and encrypts the returning response
- It compresses conversations and hides the client address
Correct answer: It transmits logins and passwords as readable characters
Telnet carries the whole session, including the login name and the password, without encryption, so anyone able to capture traffic between the client and the device reads the credentials directly. Accepting logins with no credential at all describes anonymous access on a legacy file service, not Telnet, which does prompt for a password. Signing commands and encrypting the reply describes the secure replacement protocol, which is exactly what Telnet lacks. Compressing traffic and concealing the source address are functions of tunneling and translation products.
- In the context of network security, what does NAT (Network Address Translation) primarily accomplish?
- Rewriting local source addresses into one public address
- Dividing one address block among several smaller subnets
- Mapping numeric addresses back onto memorable host names
- Matching addresses to hardware addresses on each segment
Correct answer: Rewriting local source addresses into one public address
NAT replaces the private source address in outbound packets with a routable public address and keeps a table so replies are returned to the right internal host, which lets many internal devices share very few public addresses. Dividing an address block into smaller ranges is subnetting, a design activity done before any traffic flows. Turning an address back into a name is a reverse name lookup. Learning which hardware address belongs to a neighbor's address is local address resolution, which never leaves the segment.
- Which of the following best describes a Zero Trust security model in networking?
- Authenticating each person and device at each connection
- Trusting hosts inside the firewall and barring outsiders
- Encrypting site links and rotating one shared passphrase
- Granting privileges by job title and reviewing quarterly
Correct answer: Authenticating each person and device at each connection
Zero trust removes any assumption of safety based on location: identity, device posture, and authorization are checked for each access attempt, whether the request comes from a branch office or from the public Internet. Treating everything inside the firewall as safe is precisely the perimeter model that zero trust replaces. Encrypting the links between sites protects data in transit but says nothing about who may reach a resource. Assigning rights by job role with a periodic review is an access-governance practice that still grants standing trust between reviews.
- When troubleshooting a network issue, what does a traceroute (or tracert in Windows) command help determine?
- The number of sessions one server currently holds
- The ordered list of gateways one packet traverses
- The published records a name server holds locally
- The signal quality measured on a wireless channel
Correct answer: The ordered list of gateways one packet traverses
Traceroute reveals the path by sending probes with increasing time-to-live values, so each router along the way returns an expired-packet message and identifies itself in order, which shows where traffic is going and where it stops. Counting the sessions a machine has open reports local socket state. Returning stored resource records is a name-server query. Measuring signal quality on a channel is a radio survey measurement that says nothing about the routed path.
- Which tool would be most effective for identifying the presence of a broadcast storm in a network?
- A cable certifier reporting crosstalk between the copper pairs
- A spectrum analyzer plotting energy across busy radio channels
- A syslog collector storing event messages from several devices
- A packet capture displaying the repeated broadcast frame flood
Correct answer: A packet capture displaying the repeated broadcast frame flood
A broadcast storm is defined by what is on the wire, so capturing traffic on the affected segment and seeing the same broadcast frames repeating endlessly both confirms the storm and identifies the source. A certifier measures the electrical quality of a copper run and reports nothing about frame content. A spectrum plot shows radio energy and cannot see a wired switching loop at all. A log collector stores whatever messages devices choose to send, which may hint at a problem but does not show the flooded frames themselves.
- What does the nslookup or dig command primarily help determine in network troubleshooting?
- Which gateways one packet crosses on its outbound path
- Which sessions one listening host holds open right now
- Which mappings a name server advertises for one domain
- Which hardware address matches an address on this link
Correct answer: Which mappings a name server advertises for one domain
Both nslookup and dig query DNS directly, so they show whether a name resolves, which server answered, and what the stored records contain, which is how name-resolution faults are separated from connectivity faults. Enumerating the routers along a path is done by a path-tracing tool. Listing the sessions a machine currently holds open reports local connection state. Matching a neighbor's address to its hardware address is local address resolution.
- What is the primary purpose of a TDR (Time-Domain Reflectometer) in network troubleshooting?
- The volume of traffic crossing a switch uplink
- The distance along copper toward a cable fault
- The strength of a signal reaching one receiver
- The delay a datagram encounters at each router
Correct answer: The distance along copper toward a cable fault
A time-domain reflectometer sends a pulse down a metallic cable and times the reflection, so it reports how far along the run a break, short, or impedance change lies, which is what makes it a physical-layer fault finder. Traffic volume on an uplink is a utilization figure read from interface counters. Signal strength at a client is a wireless measurement. Per-hop delay is measured by sending probes through the routed path and belongs to a path-tracing tool.
- Which network monitoring tool is used to inspect incoming and outgoing network traffic at the interface level?
- A capture utility reading each frame crossing an interface
- A flow exporter reducing sessions into short usage records
- A log collector receiving event messages from many devices
- A polling agent replying to queries about adapter counters
Correct answer: A capture utility reading each frame crossing an interface
A packet sniffer puts an interface into a capture mode and records the frames that cross it, so the full contents of the traffic can be decoded field by field. A flow exporter reduces traffic to summary records describing who talked to whom and how much, which is useful for trends but discards the payload. A log collector receives only the event messages a device chooses to emit. A polling agent answers queries about counters it maintains and never exposes the traffic itself.
- In network troubleshooting, what is the primary function of an OTDR (Optical Time-Domain Reflectometer)?
- Measuring stray radio energy across each wireless channel
- Verifying copper wiring against its rated category limits
- Pinpointing a fracture somewhere along one optical strand
- Recording how much traffic one attached interface carried
Correct answer: Pinpointing a fracture somewhere along one optical strand
An optical time-domain reflectometer launches light pulses into a fiber and measures backscatter and reflections, so it reports the distance to a break, a sharp bend, or a bad splice along the strand. Measuring interference across a radio band is a wireless spectrum task. Confirming that copper meets its rated category is what a cable certifier does on twisted pair. Recording how much traffic an interface carried is a utilization statistic that says nothing about the optical path.
- What is the primary use of the netstat command in network troubleshooting?
- Sending echo probes to confirm a computer responds
- Querying a name server for one advertised resource
- Showing the subnet mask configured on an interface
- Listing the sockets a machine currently holds open
Correct answer: Listing the sockets a machine currently holds open
Netstat reads the local network stack and reports the active connections and listening sockets, together with their addresses, ports, and states, which is how an unexpected listener or a stuck connection is found. Sending echo probes to see whether a host answers is a reachability test aimed at a remote device. Asking a name server for a stored record is a name-resolution query. Displaying the address and mask on an interface reports configuration rather than connection state.
- Which device is used to test the connectivity and signal strength of a wired Ethernet network?
- A tone generator tracing separate cables inside tangled runs
- A spectrum monitor charting energy across nearby radio bands
- A network probe mirroring traffic toward one capture station
- A cable certifier proving wiring meets its declared category
Correct answer: A cable certifier proving wiring meets its declared category
A cable certifier drives test signals down an installed run and measures wire map, length, attenuation, crosstalk, and return loss against the limits for the cable's category, producing a pass or fail result for the link. A tone generator and probe only identify which cable is which inside a bundle, so it proves nothing about transmission quality. Charting radio energy is a wireless measurement made off the wire. Mirroring traffic toward a capture host delivers frames for analysis but tests nothing about the physical link.
- When experiencing intermittent network issues, which tool is most effective for monitoring and logging network performance over time?
- A protocol decoder capturing one short live traffic recording
- A baseline document recording the normal operating rates once
- A polling system storing performance figures over many months
- A syslog collector archiving event messages when they surface
Correct answer: A polling system storing performance figures over many months
Intermittent faults are only visible in history, so a system that polls each device on a schedule and keeps the results builds the long trend against which a brief spike or dip can be located and timed. A decoder that captures a short sample sees only the window it was running in, and an intermittent fault will usually happen outside it. A baseline captured once is a fixed reference and is not itself a continuous record. A log collector stores events a device chose to report, which misses conditions that never raise a message.
- What does the MTR (My Traceroute) tool provide in network troubleshooting?
- Repeated per hop loss statistics updated with each sample
- A single reply time measured against one distant endpoint
- A path inventory built from one solitary measurement pass
- MAC entries learned on one attached local network segment
Correct answer: Repeated per hop loss statistics updated with each sample
MTR combines the two classic tools: it discovers the hops toward a destination and then keeps probing them, so the display continuously updates loss percentage and response time for each hop and reveals which one is degrading. A single round-trip figure to the far end is what a plain reachability test returns and hides where the loss occurs. A path listing produced by one pass names the hops but carries no ongoing statistics. Hardware addresses learned on a segment come from local address resolution.
- Which device is used to monitor and analyze both wired and wireless network traffic in real-time?
- A meter checking wired copper runs for pairing failures
- A probe capturing live wired plus wireless data streams
- A reflectometer timing pulses sent along a copper cable
- A collector storing wired network flow records each day
Correct answer: A probe capturing live wired plus wireless data streams
A network probe is a dedicated monitoring device attached to the network that captures and analyzes traffic as it happens, and with a wireless radio fitted it can do the same for the air interface, which is why it covers both wired and wireless. A wiring tester checks continuity and pairing on copper and sees no traffic. A reflectometer times pulses to locate a physical fault. A flow collector stores summarized records after the conversations have finished, so it is neither live nor complete.
- What is the main purpose of the tcpdump command in network troubleshooting?
- It captures packets then prints their protocol fields
- It reports the addresses configured on each interface
- It measures throughput between two matched test hosts
- It resolves hostnames by querying the selected server
Correct answer: It captures packets then prints their protocol fields
Tcpdump attaches to an interface, captures traffic according to a filter expression, and prints or saves the packets, which makes it the command-line equivalent of a graphical capture tool. Reporting the addresses configured on an interface is what an interface configuration command does. Measuring throughput between two hosts requires a cooperating pair running a bandwidth test. Resolving a hostname against the configured server is a name-resolution lookup.
- In network troubleshooting, which tool is used to graphically display the interfaces between systems and the paths packets take?
- A capture tool dissecting intercepted frames in extreme detail
- A metering tool graphing throughput on each selected interface
- A modeling tool predicting behavior before a deployment begins
- A mapping tool drawing devices with their interconnected links
Correct answer: A mapping tool drawing devices with their interconnected links
A network mapper discovers the devices present and how they are connected, then renders that topology graphically, so the interfaces between systems and the paths traffic can take are visible at a glance. A capture tool decodes individual frames and shows detail about traffic rather than layout. A throughput graph reports how busy one interface is over time. A modeling tool predicts how a design would behave and describes a proposed network rather than the live one.
- Which tool or feature can be used to compare the performance of a network against established standards and baselines?
- A realtime recording of the datagrams traversing each interface
- A running indicator of the current processor utilization figure
- A stored record showing typical performance under ordinary load
- A dissector separating each datagram into its individual fields
Correct answer: A stored record showing typical performance under ordinary load
A baseline is a recorded set of measurements taken while the network is behaving normally, and it is the reference that later readings are compared against to decide whether current behavior is degraded. A live capture shows what is happening right now with nothing to compare it against. A dashboard of current utilization is also a present-tense reading and holds no historical norm. A decoder that breaks packets into protocol fields analyzes content rather than measuring performance.
- What is the primary function of a loopback test in network troubleshooting?
- It confirms that a shielded cable meets category limits
- It confirms that a network adapter alone works properly
- It confirms that a route exists toward external subnets
- It confirms that a name server answers queries reliably
Correct answer: It confirms that a network adapter alone works properly
A loopback test returns the transmitted signal to the sending interface, either through a loopback plug or in software, so a successful test proves the adapter can transmit and receive and isolates the fault to the cable or the far end. Confirming that a copper run meets its category is a certification measurement on the cabling. Confirming a route exists toward a remote subnet tests the routed path well beyond the adapter. Confirming a name server answers is a name-resolution check.
- Which network troubleshooting tool is used to identify the existence and strength of wireless networks?
- A spectrum analyzer charting wireless network power across bands
- A packet decoder showing contents inside captured network frames
- A radio scanner identifying adjacent networks using signal level
- A certifier confirming copper wiring meets its declared category
Correct answer: A radio scanner identifying adjacent networks using signal level
A Wi-Fi analyzer listens on each channel, reports the networks it hears with their identifiers and channels, and shows the received signal level for each, which is how coverage gaps and channel overlap are found. A spectrum analyzer charts raw radio power across the band, including non-Wi-Fi interference, but does not enumerate networks. A packet decoder shows the fields inside frames that have already been captured. A cable certifier tests copper and has no radio at all.
- What is the main use of the whois command in network troubleshooting?
- It returns the address records a public name server publishes
- It returns the registration record held for each named domain
- It returns the hops crossed between two distant network hosts
- It returns the connections a single host currently holds open
Correct answer: It returns the registration record held for each named domain
Whois queries the registry databases, so it returns the registration details for a domain or an address block: the registrant, the responsible contacts, the registrar, and the creation and expiry dates. Returning the address records a name server publishes is a DNS lookup, which answers where a name points rather than who registered it. Returning the routers between two endpoints is path tracing. Returning the sockets a host holds open reports local connection state.
- A technician needs to explain where a network switch primarily operates within the OSI reference model. At which layer does a traditional unmanaged Layer 2 switch make its forwarding decisions?
- Data Link, forwarding traffic by destination MAC addresses
- Physical, boosting raw signals without reading any headers
- Network, directing datagrams toward the intended IP subnet
- Transport, following each conversation by its port numbers
Correct answer: Data Link, forwarding traffic by destination MAC addresses
A traditional switch is a Layer 2 device: it learns source MAC addresses into a table and forwards each frame out the port where the destination MAC was seen, flooding only when the destination is unknown. Layer 1 devices such as hubs and repeaters regenerate the signal and read no addressing or headers at all. Layer 3 forwarding uses IP addresses and is what a router performs between subnets. Layer 4 identifies applications by port number and is where segmentation and session tracking happen.
- While teaching a fundamentals class, an instructor lists the seven layers of the OSI model from top to bottom. Which sequence is correct?
- Application, Session, Presentation, Transport, Network, Data Link, Physical
- Application, Presentation, Session, Network, Transport, Data Link, Physical
- Application, Presentation, Session, Transport, Data Link, Network, Physical
- Application, Presentation, Session, Transport, Network, Data Link, Physical
Correct answer: Application, Presentation, Session, Transport, Network, Data Link, Physical
Numbered from the top, the OSI layers run Application, Presentation, Session, Transport, Network, Data Link, Physical, which the mnemonic All People Seem To Need Data Processing follows. Presentation sits above Session because formatting and encryption are applied to data before a dialogue is established. Transport sits above Network because segmentation and end-to-end delivery rely on routing beneath them. Data Link sits above Physical because framing is applied to bits before they are placed on the medium, so any sequence that swaps one of those pairs is wrong.
- A help-desk ticket says a user cannot reach any website by name, but can reach servers by typing their IP addresses directly. Which network service is most likely failing?
- ARP, which links addresses to nearby hardware addresses
- DNS, which translates names into numeric host addresses
- DHCP, which leases addresses to freshly connected hosts
- NAT, which rewrites addresses as traffic leaves outward
Correct answer: DNS, which translates names into numeric host addresses
Reaching a server by typing its address proves that routing, addressing, and the path itself are working, so the only broken piece is the step that turns a typed name into an address, which is name resolution. Address resolution binds an address to a hardware address and operates only within the local segment, so its failure would break local connectivity too. A failed address lease would leave the host without a usable address, so nothing would work by address either. Address translation failing would block outbound traffic regardless of whether a name or an address was typed.
- A network administrator must summarize the key difference between IPv4 and IPv6 addressing. Which statement correctly describes the address sizes?
- IPv4 uses 128 bits while IPv6 uses 32 bits
- IPv4 uses 48 bits while IPv6 uses 128 bits
- IPv4 uses 64 bits while IPv6 uses 128 bits
- IPv4 uses 32 bits while IPv6 uses 128 bits
Correct answer: IPv4 uses 32 bits while IPv6 uses 128 bits
An IPv4 address is 32 bits, written as four dotted decimal octets, and an IPv6 address is 128 bits, written as eight hexadecimal groups; the larger field is what removes the address exhaustion that drove the change. Reversing the two figures inverts the whole point of the newer protocol. A 48-bit field is the length of a hardware address, not of any IP address. A 64-bit figure is the size of the interface identifier that forms the second half of an IPv6 address, not the whole address.
- A workstation boots and broadcasts a request for network configuration. Which protocol automatically assigns it an IP address, subnet mask, default gateway, and DNS server?
- DNS, which resolves host address records for waiting clients
- ICMP, which reports path delivery failures for sending hosts
- DHCP, which leases full address settings for booting clients
- SNMP, which gathers device state counters for polled servers
Correct answer: DHCP, which leases full address settings for booting clients
DHCP answers the boot-time broadcast by leasing the client a complete configuration: IP address, subnet mask, default gateway and DNS server, drawn from a scope the administrator defines. DNS only translates names a host already knows how to reach, so it cannot supply that host its own addressing. ICMP moves diagnostic and error traffic such as echo requests and unreachable notices, and SNMP moves management counters between agents and a monitoring station; neither hands out configuration. The lease exchange runs over UDP port 67 on the server and UDP port 68 on the client.
- A developer is choosing a transport protocol for a real-time voice application where occasional lost packets are acceptable but low latency is critical. Which protocol best fits, and why?
- UDP, which skips handshakes and sends datagrams with minimal delay
- TCP, which opens handshakes and resends segments after packet loss
- IP, which forwards datagrams between subnets and ignores lost data
- ICMP, which carries error messages and echo probes between routers
Correct answer: UDP, which skips handshakes and sends datagrams with minimal delay
UDP is connectionless: it performs no handshake, keeps no state, acknowledges nothing and retransmits nothing, so its header overhead and its delay are both small, which is exactly what interactive voice needs when an occasional lost packet is tolerable. TCP is reliable but its handshake, acknowledgements and retransmissions add round trips and jitter that damage a live conversation. IP is the network layer that moves datagrams between subnets and is not a transport choice at all, and ICMP is a control and diagnostic protocol that never carries application payloads.
- During a networking lab, a student asks what a MAC address actually identifies. Which description is correct?
- A logical address granted by the local DHCP server
- A service number claimed by an active TCP endpoint
- A readable label stored inside the public DNS zone
- A hardware address printed onto the small NIC chip
Correct answer: A hardware address printed onto the small NIC chip
A MAC address is a 48-bit physical identifier assigned to the network interface itself, usually written as six hexadecimal pairs such as 00:1A:2B:3C:4D:5E, and switches use it to deliver frames at Layer 2 on the local segment. A logical address handed out by a DHCP server is an IP address, a Layer 3 value that belongs to the network rather than to the card. A number opened by a transport socket is a port, which selects an application rather than an interface, and a name held in a DNS zone is resolved to an address before any frame is built.
- A junior technician confuses MAC addresses with IP addresses. Which statement accurately distinguishes them?
- A MAC address arrives from the DHCP server, while an IP address ships with the hardware
- A MAC address stays fixed in the hardware, while an IP address changes with the network
- A MAC address is routed between subnets, while an IP address is flooded across one link
- A MAC address is discovered through DNS names, while an IP address is located using ARP
Correct answer: A MAC address stays fixed in the hardware, while an IP address changes with the network
The MAC address is a Layer 2 identifier that belongs to the interface and normally travels with the card, while the IP address is a Layer 3 identifier that belongs to the network a device has joined and therefore changes when the device moves to another subnet. Switches forward using MAC addresses inside a segment; routers forward using IP addresses between segments. DHCP hands out IP addresses, not MAC addresses; MAC addresses never leave the local link, so they are not routed; and DNS maps names to IP addresses while ARP maps an IP address to a MAC address, which is the reverse of the pairing described.
- A subnet mask of 255.255.255.224 is applied to a network. In CIDR notation, what is this prefix length, and how many usable host addresses does each subnet provide?
- /26, affording 62 usable node addresses
- /27, providing 30 usable host addresses
- /28, issuing 14 usable client addresses
- /25, giving 126 usable device addresses
Correct answer: /27, providing 30 usable host addresses
255.255.255.224 is 11100000 in the final octet, so 27 bits are network bits and the prefix is /27. Five host bits remain, giving 32 total addresses per subnet, and subtracting the subnet address and the broadcast address leaves 30 that can be assigned to hosts. The other pairings are each correct for a different mask: 255.255.255.192 is /26 with 62 usable, 255.255.255.240 is /28 with 14 usable, and 255.255.255.128 is /25 with 126 usable.
- A home router lets many internal devices using private addresses share a single public IP for internet access. Which technology makes this possible?
- STP, which disables the redundant links on switched networks
- VLAN, which divides a switch into separate broadcast domains
- DNS, which resolves the typed hostnames to numeric addresses
- NAT, which overwrites the source address on outbound packets
Correct answer: NAT, which overwrites the source address on outbound packets
Network Address Translation rewrites the source address of traffic leaving the network, and with port translation it multiplexes many inside conversations onto one public address, which is what lets a household of private hosts share a single ISP-assigned IP. It also conserves public IPv4 space and keeps internal addressing out of view. Spanning tree only decides which switch ports forward and which block, VLANs only divide a switch into separate broadcast domains, and DNS only turns names into addresses; none of the three changes the address in a packet header.
- A network engineer must run a fiber link across a 30-kilometer campus-to-campus span. Which fiber type and rationale is most appropriate?
- Single-mode fiber, whose narrow core carries one beam over great spans
- Single-mode fiber, whose broad core suits cheap emitters on short runs
- Multimode fiber, whose narrow core resists modal blur across long runs
- Multimode fiber, whose broad core channels laser light over long hauls
Correct answer: Single-mode fiber, whose narrow core carries one beam over great spans
Single-mode fiber has a core of roughly nine microns, narrow enough that light travels a single path, so modal dispersion is effectively removed and a laser-driven link holds together over tens of kilometres; a 30 km campus span is squarely in its range. Multimode fiber has a core of 50 or 62.5 microns that admits many simultaneous paths, and the resulting modal dispersion limits it to a few hundred metres regardless of the light source used. The statements pairing a broad core with single-mode fiber and a narrow core with multimode fiber invert the physical construction of each type.
- A technician must explain the core functional difference between a switch and a router. Which statement is correct?
- A switch repeats each signal it receives, while a router filters traffic by port numbers
- A switch splits each port into a broadcast domain, while a router combines many networks
- A switch forwards frames by MAC address, while a router forwards packets by IP addresses
- A switch maps names into addresses, while a router leases addresses to its local clients
Correct answer: A switch forwards frames by MAC address, while a router forwards packets by IP addresses
A switch is a Layer 2 device: it learns MAC addresses and forwards frames inside one local network. A router is a Layer 3 device: it examines destination IP addresses and forwards packets between different networks, and in doing so it also terminates broadcast domains. Repeating every incoming signal describes a hub, not a switch; filtering by port number describes a firewall rule rather than basic routing; a plain switch keeps one broadcast domain rather than one per port, and routers separate networks rather than merge them; and name resolution and address leasing are the work of DNS and DHCP servers.
- An administrator wants the name ftp.example.com to be an alias that always resolves to whatever address www.example.com points to. Which DNS record type accomplishes this?
- CNAME records, which point one host name at a second host name
- A records, which point one host name at a numeric IPv4 address
- MX records, which point one domain name at a primary mail host
- PTR records, which point one raw address at a stored host name
Correct answer: CNAME records, which point one host name at a second host name
A canonical name record makes one hostname an alias for a second hostname, so a resolver that asks for the alias is told to continue at that second name and ends up wherever it currently resolves; changing the target therefore changes every alias at once, which is exactly the behaviour requested. An address record maps a name straight to an IPv4 address, so it would have to be edited separately whenever the target moved. Mail exchanger records list the hosts that accept mail for a domain, and pointer records supply the reverse lookup from an address back to a name.
- A DNS administrator sets a TTL value of 300 on a record before a planned IP change. What does this TTL value control?
- How many hops a packet may travel before a router discards it
- How often a backup server may fetch the zone from its primary
- How long a resolver may cache the record before it asks again
- How soon a stub resolver may retry a question after a timeout
Correct answer: How long a resolver may cache the record before it asks again
In DNS a time-to-live is a number of seconds: it tells every caching resolver how long it is permitted to reuse the answer before it must query an authoritative server again. Lowering it to 300 means caches hold the old answer for at most five minutes, which is why administrators reduce it ahead of a planned address change and raise it again afterwards. The hop-count meaning of the same phrase belongs to the IP header rather than to a DNS record; how often a secondary refreshes a zone from its primary is set by the refresh field of the SOA record; and how long a resolver waits before retrying a query is a local resolver timeout, not a record value.
- Given a /24 network, a technician subnets it into multiple /26 subnets. How many /26 subnets are created and how many usable hosts does each contain?
- 8 subnets, each affording 30 usable node addresses
- 4 subnets, each providing 62 usable host addresses
- 2 subnets, each giving 126 usable device addresses
- 16 subnets, each having 14 usable client addresses
Correct answer: 4 subnets, each providing 62 usable host addresses
Going from a /24 to a /26 borrows two bits from the host portion, and two borrowed bits create four equal subnets. Each /26 keeps six host bits, so it holds 64 addresses, and removing the subnet address and the broadcast address leaves 62 that can be assigned. The other rows describe different borrowings from the same /24: three bits give eight /27 subnets of 30 usable, one bit gives two /25 subnets of 126 usable, and four bits give sixteen /28 subnets of 14 usable.
- A student is asked to summarize the purpose of the OSI model. Which description best captures it?
- A structured cabling standard that specifies the connector pinouts
- A path-vector routing protocol that carries the reachable prefixes
- A single-vendor protocol suite that suits one proprietary platform
- A seven-layer reference model that organizes the network functions
Correct answer: A seven-layer reference model that organizes the network functions
The Open Systems Interconnection model is a conceptual framework that divides communication into seven ordered layers, from Physical at the bottom to Application at the top, so that vendors can build interoperable products and engineers can isolate a fault to one layer. It is a teaching and design reference, not something that ships in a box. A cabling standard describes connectors and pinouts, a path-vector protocol advertises reachable prefixes between networks, and a single-vendor suite is by definition the opposite of the open interoperability the model exists to enable.
- An email administrator must publish which servers accept inbound mail for a domain. Which DNS record type does this, and what extra value does it carry?
- An SRV record, whose weight value spreads the client load
- A TXT record, whose policy value lists the approved hosts
- A PTR record, whose pointer value names the reverse hosts
- An MX record, whose preference value ranks the mail hosts
Correct answer: An MX record, whose preference value ranks the mail hosts
A mail exchanger record publishes the hosts that accept inbound mail for a domain and carries a preference number with each one; the lowest preference is tried first, and the remaining entries provide failover when it is unreachable. A service record does carry weight and priority, but it locates services such as SIP or LDAP rather than SMTP delivery for a domain. A text record holds free-form strings such as an SPF policy listing permitted senders, and a pointer record supports reverse lookup from an address to a name; neither publishes the inbound mail hosts.
- A technician must decide between half-duplex and full-duplex on a link. Which statement correctly contrasts them?
- Full duplex needs collision checks, while half duplex avoids these completely
- Full duplex sends both ways together, while half duplex alternates directions
- Full duplex requires hubs nearby, while half duplex requires switches instead
- Full duplex halves each direction, while half duplex doubles total throughput
Correct answer: Full duplex sends both ways together, while half duplex alternates directions
A full-duplex link uses separate transmit and receive paths, so a station can send and receive simultaneously and no collision is possible; a half-duplex link shares one path, so only one station may transmit at a time. Because collisions can only occur when transmission is shared, CSMA/CD belongs to half duplex and is switched off on full-duplex links, which reverses the second statement. Hubs are half-duplex shared media while switches support full duplex, so the device pairing is also backwards, and full duplex raises aggregate throughput rather than halving each direction.
- A host needs to send a packet to a destination on a different network. Which configured value tells the host where to forward traffic destined outside its own subnet?
- The subnet mask, the bit comparison used for local traffic decisions
- The DNS server, the name translator used for public hostname lookups
- The default gateway, the local router port used for outbound traffic
- The broadcast address, the shared target used for local flood frames
Correct answer: The default gateway, the local router port used for outbound traffic
The default gateway is the address of the router interface on the local subnet, and a host sends any packet whose destination is not local to that address so the router can forward it onward. The mask is what the host uses to decide whether a destination is local or remote, but it names no forwarder. A DNS server turns a hostname into an address and plays no part once the address is known, and the broadcast address addresses every station on the local segment rather than reaching anything beyond it. Without a gateway a host can still talk locally but cannot leave its subnet.
- A DNS zone needs to map the hostname web01.example.com directly to the IPv4 address 198.51.100.20. Which record type is used?
- An A record, pointing a hostname onto one numeric IPv4 address
- A PTR record, returning a saved hostname for a numeric address
- A CNAME record, aliasing each hostname onto a chosen host name
- An NS record, delegating one zone to its assigned name servers
Correct answer: An A record, pointing a hostname onto one numeric IPv4 address
An address record is the basic forward-lookup entry in DNS: it binds a hostname directly to a 32-bit IPv4 address such as 198.51.100.20, which is what a resolver needs before it can open a connection. A pointer record runs the other way, returning a name for an address during a reverse lookup. A canonical name record resolves to another name rather than to an address, so it cannot terminate the lookup, and a name server record only delegates a zone to the servers authoritative for it.
- A large internet service provider must exchange routing information with other providers across the global internet between separate autonomous systems. Which routing protocol is designed for this?
- OSPF, the link-state protocol that floods inside separate autonomous areas
- BGP, the path-vector protocol that peers across several autonomous systems
- RIP, the distance-vector protocol that runs in separate autonomous systems
- EIGRP, the hybrid metric protocol that spreads routing information locally
Correct answer: BGP, the path-vector protocol that peers across several autonomous systems
Border Gateway Protocol is the exterior gateway protocol of the public internet: it is a path-vector protocol whose peers exchange reachability between separately administered autonomous systems and choose paths from AS-path length and local policy rather than from a simple metric. The other three are interior gateway protocols, designed to route inside a single autonomous system: OSPF floods link states within areas, RIP counts hops to a maximum of fifteen, and EIGRP combines bandwidth and delay into a composite metric with feasible successors held as backups.
- An enterprise wants a link-state interior routing protocol that builds a complete topology map and calculates shortest paths using cost based on bandwidth. Which protocol fits?
- OSPF, which builds a complete topology map and runs Dijkstra over it
- RIP, which broadcasts a full routing table and caps paths at fifteen
- BGP, which compares the AS path length and enforces an operator rule
- EIGRP, which mixes the bandwidth and the delay into one routing cost
Correct answer: OSPF, which builds a complete topology map and runs Dijkstra over it
Open Shortest Path First is a link-state interior protocol: every router floods link-state advertisements, assembles an identical topology database for the area, and then runs Dijkstra's shortest-path-first algorithm using a cost derived from interface bandwidth. RIP is distance-vector, advertising its whole table periodically and treating anything past fifteen hops as unreachable, so it builds no topology map. BGP is a path-vector exterior protocol driven by AS-path and policy, and EIGRP is an advanced distance-vector protocol whose composite metric weighs bandwidth and delay rather than running a link-state calculation.
- A network architect compares OSPF and BGP. Which statement correctly distinguishes their roles?
- OSPF ranks routes by administrative policy, while BGP ranks routes by link cost
- OSPF carries the whole internet core, while BGP carries just one campus network
- OSPF hands out the client addresses, while BGP maps public names into addresses
- OSPF runs inside one autonomous system, while BGP runs between two such systems
Correct answer: OSPF runs inside one autonomous system, while BGP runs between two such systems
OSPF is an interior gateway protocol: it routes within a single autonomous system using link-state cost. BGP is an exterior gateway protocol: it exchanges reachability between autonomous systems and selects paths using attributes and administrative policy. A typical enterprise therefore runs OSPF throughout its internal network and speaks BGP only at the internet edge. Swapping their metrics, claiming OSPF carries the internet core while BGP serves one campus, and assigning them address leasing or name resolution all describe something neither protocol does.
- A technician must identify whether the address 172.20.5.10 is routable on the public internet. How should it be classified?
- A loopback address, which a computer uses for its internal testing
- A link-local address, which a client claims when no server answers
- A private address, which an internal host uses behind a translator
- A multicast address, which a group of receivers joins upon request
Correct answer: A private address, which an internal host uses behind a translator
172.20.5.10 sits inside 172.16.0.0 through 172.31.255.255, one of the three blocks RFC 1918 reserves for internal use alongside 10.0.0.0/8 and 192.168.0.0/16. Addresses in those blocks are filtered by internet routers, so a host using one reaches outside networks only through address translation. The loopback block is 127.0.0.0/8 and never leaves the host. The self-assigned link-local block used when DHCP fails is 169.254.0.0/16, and multicast group addresses come from 224.0.0.0/4; none of those ranges contains this address.
- A host is configured with the IP 172.16.5.130 and a /25 mask. What are the network address and broadcast address for its subnet?
- Network 172.16.5.128 with broadcast 172.16.5.191
- Network 172.16.5.192 with broadcast 172.16.5.255
- Network 172.16.5.128 with broadcast 172.16.5.255
- Network 172.16.5.160 with broadcast 172.16.5.191
Correct answer: Network 172.16.5.128 with broadcast 172.16.5.255
A /25 is 255.255.255.128, which divides the final octet into two blocks of 128 addresses, 0 to 127 and 128 to 255. The host value 130 falls in the upper block, so its subnet address is 172.16.5.128 and its broadcast address is 172.16.5.255, with 172.16.5.129 through 172.16.5.254 available for hosts. The remaining pairs are boundaries of narrower masks over the same range: 128 to 191 and 192 to 255 are /26 blocks, and 160 to 191 is a /27 block, none of which is the subnet a /25 mask produces.
- An organization wants to extend its on-premises data center into a public cloud provider while keeping the cloud resources logically isolated and addressable with its own private IP range. Which cloud connectivity concept provides this isolated, customer-defined network space inside the provider?
- A content delivery network, an isolated copy tier inside the public cloud
- A demilitarized zone, a guarded public segment inside its own data center
- A spanning tree instance, a loop-free network path inside the whole cloud
- A virtual private cloud, an isolated tenant space with its own addressing
Correct answer: A virtual private cloud, an isolated tenant space with its own addressing
A virtual private cloud is a logically isolated slice of a public cloud provider in which the customer defines its own private address ranges, subnets, route tables and security boundaries, so cloud workloads can be addressed and controlled as though they sat in the organisation's own data centre. That isolation plus customer-defined addressing is exactly what extending an on-premises network into the cloud requires. A content delivery network caches copies of static objects near users, a demilitarized zone is a screened perimeter segment of an existing network, and a spanning tree instance only computes a loop-free switching topology.
- A company needs a dedicated, private, high-bandwidth link between its on-premises network and its public cloud provider that does not traverse the public internet, to achieve consistent latency for sensitive workloads. Which cloud connectivity option best meets this requirement?
- A dedicated private circuit that bypasses the public internet entirely
- An encrypted private tunnel that traverses the public internet instead
- A managed address translator that masks the private internal addresses
- A provider edge cache that replicates requested objects near end-users
Correct answer: A dedicated private circuit that bypasses the public internet entirely
A direct connection is a private physical circuit between the customer's network and the cloud provider, ordered at a fixed capacity and carried on the provider's own infrastructure rather than the public internet, which is what gives it committed bandwidth and stable latency for sensitive workloads. A site-to-site tunnel protects confidentiality but still crosses the internet, so its delay and loss vary with whatever congestion the path meets that day. An address translator only rewrites headers, and an edge cache node only serves copies of content nearer users; neither creates a private path.
- A developer must choose a transport protocol for transferring a financial report file where every byte must arrive intact and in the correct order, even if that adds overhead. Which transport behavior makes one protocol the appropriate choice over the other for this transfer?
- It numbers each datagram, skips the acknowledgement, and repairs the losses
- It numbers each segment, waits for acknowledgements, and resends the losses
- It opens no sessions, orders each arrival, and silently discards duplicates
- It buffers each segment, delays acknowledgement, and drops the old arrivals
Correct answer: It numbers each segment, waits for acknowledgements, and resends the losses
Sequencing every segment, waiting for the receiver to acknowledge it, and retransmitting anything left unacknowledged is the behaviour that guarantees a file arrives complete and in order, and it is what the connection-oriented transport provides at the cost of extra round trips. A transport that skips acknowledgement cannot know what was lost, so it cannot repair anything. A transport that opens no session keeps no sequence state either, so it cannot reorder arrivals or recognise duplicates. And a transport that deliberately discards segments that arrive late destroys the very completeness the transfer requires.
- A network engineer is comparing two wireless standards for a new deployment. One older standard operates only in the 2.4 GHz band, while the engineer wants a standard that can also use the 5 GHz band for higher throughput and less interference. Which characteristic correctly distinguishes the higher-throughput option?
- It uses the 5 GHz band, whose channels interfere much less than 2.4 GHz
- It uses the 6 GHz band, whose channels an older station radio can reach
- It uses the 60 GHz band, whose channels pass through any walls the best
- It uses the 2.4 GHz band, whose channels hold the highest raw data rate
Correct answer: It uses the 5 GHz band, whose channels interfere much less than 2.4 GHz
The distinguishing feature of the newer standard is that it also operates at 5 GHz, where the spectrum is wide enough to provide many non-overlapping channels instead of the three that 2.4 GHz allows, and where wider channels and less neighbour interference translate into higher throughput. The 6 GHz band is reachable only by Wi-Fi 6E and Wi-Fi 7 radios, so older clients cannot join it. The 60 GHz band is absorbed by walls rather than passing through them, and 2.4 GHz is the crowded, slower band the deployment is trying to move beyond.
- A network architect is placing security and traffic appliances in a new design. The architect wants a device that sits in front of the organization's internal web servers, accepts client requests from the internet, and forwards them to back-end servers while hiding the servers' real identities. Which appliance and placement is described?
- A forward proxy stationed in front of the internal client desktops
- A jump host placed inside the small isolated admin network segment
- A NAT gateway positioned at the border of the outbound connections
- A reverse proxy positioned in front of the internal server cluster
Correct answer: A reverse proxy positioned in front of the internal server cluster
A reverse proxy terminates inbound client requests on behalf of the servers behind it and then forwards each request to a back-end host, so external clients only ever see the proxy and the real server addresses, names and software versions stay hidden. It commonly adds TLS termination, caching and filtering at the same point. A forward proxy sits on the client side and brokers outbound requests, which is the opposite direction of travel; a jump host provides administrative access into a protected segment; and a NAT gateway rewrites addresses for outbound flows rather than fronting a server farm.
- A network team must decide where to place a load balancer versus a proxy and at what layer each typically operates. Which statement correctly distinguishes the two appliances?
- A load balancer maps host names into addresses, while a proxy leases addresses to clients
- A load balancer blocks the redundant switch ports, while a proxy bundles the member links
- A load balancer spreads sessions over a server pool, while a proxy relays client requests
- A load balancer encrypts the wireless frames, while a proxy tags frames onto trunk cables
Correct answer: A load balancer spreads sessions over a server pool, while a proxy relays client requests
A load balancer distributes incoming connections across a pool of back-end servers, typically at the transport layer, using schemes such as round robin, least connections or hashing, which adds both scale and resilience. A proxy works at the application layer, receiving a request and issuing it on behalf of the original party so it can cache, filter, inspect or anonymise. Name resolution belongs to DNS and address leasing to DHCP, loop blocking to spanning tree and link bundling to LACP, and frame encryption and VLAN tagging belong to wireless security and 802.1Q trunking.
- A user opens the list of available wireless networks on a laptop and sees names such as "GuestWiFi" and "CorpNet". What is the term for this human-readable wireless network name that an access point advertises?
- The BSSID, the radio address a wireless access point advertises
- The SSID, the readable network name one access point advertises
- The MAC address, the hardware name a network interface supplies
- The DHCP scope, the assignable address list a server advertises
Correct answer: The SSID, the readable network name one access point advertises
The service set identifier is the human-readable name of up to 32 characters that an access point announces in its beacons and that appears in a client's list of available networks, so it is what a user actually chooses. The basic service set identifier is the MAC address of the access point radio and identifies one cell rather than the network name a user sees. A hardware MAC address identifies an interface, and a DHCP scope is a configured pool of leasable addresses; neither is advertised as a wireless network name.
- A network administrator wants all 40 computers in the accounting department to share one broadcast domain regardless of which floor or switch they physically connect to. Which technology accomplishes this segmentation on the existing switches?
- A DMZ, which puts the public servers into one existing network space
- A NAT pool, which places private hosts behind a few public addresses
- An STP instance, which puts the redundant links into a blocked state
- A VLAN, which gathers the far switch ports into one broadcast domain
Correct answer: A VLAN, which gathers the far switch ports into one broadcast domain
A virtual LAN groups switch ports into a single logical broadcast domain regardless of which switch or floor each port lives on, so all forty accounting machines can share one Layer 2 segment while remaining physically dispersed; trunk links carry the tagged traffic between the switches involved. A demilitarized zone is a security zone for internet-facing servers, an address translation pool maps inside hosts onto public addresses, and a spanning tree instance decides which redundant links block; none of them defines membership of a broadcast domain.
- A junior technician asks how a VLAN differs from a subnet. Which statement best describes the relationship between the two?
- A VLAN is a physical cable closet group, and a subnet is a data link collision domain
- A VLAN is a network layer routed zone, and a subnet is a transport layer socket group
- A VLAN is a data link broadcast domain, and a subnet is a network layer address range
- A VLAN is a transport layer port pool, and a subnet is a physical metal wire standard
Correct answer: A VLAN is a data link broadcast domain, and a subnet is a network layer address range
A VLAN is a Layer 2 construct: it defines the boundary of a broadcast domain on the switches. A subnet is a Layer 3 construct: it defines a contiguous range of IP addresses sharing a mask. They are different layers describing the same group of hosts from different angles, which is why designs normally map exactly one subnet onto each VLAN so that inter-VLAN traffic is also inter-subnet traffic and can be routed. Placing either at the physical or transport layer, or treating a VLAN as a routing area, misassigns both constructs.
- A switch port connects to a single desktop that should carry traffic for only one VLAN, untagged. How should this port be configured?
- Trunk port, which carries the tagged frames from a single switch chassis
- Access port, which carries the untagged frames from a single client VLAN
- Routed port, which exchanges its switch duties for a single IP interface
- Mirror port, which copies the desktop traffic for a single analyzer host
Correct answer: Access port, which carries the untagged frames from a single client VLAN
An access port belongs to exactly one VLAN and sends and receives ordinary untagged Ethernet frames, which is what an end device such as a desktop, printer or camera expects, since such devices do not read VLAN tags. A trunk port adds an 802.1Q tag so one link can carry several VLANs, and is used between switches or to a router. A routed port abandons switching to hold its own IP address at Layer 3, and a mirror port copies traffic to an analyser; neither is appropriate for a single desktop.
- Two switches must carry traffic for VLANs 10, 20, and 30 across a single physical cable between them. Which interface configuration is required on both ends of that cable?
- A trunk port, which marks each frame with its designated VLAN identifier
- A loopback interface, which remains up for the local router reboot tests
- An EtherChannel bundle, which merges the links into one big logical pipe
- A powered access port, which supplies a handset through the copper pairs
Correct answer: A trunk port, which marks each frame with its designated VLAN identifier
Carrying VLANs 10, 20 and 30 over one cable requires a trunk on both ends, because a trunk inserts a tag identifying the VLAN each frame belongs to, and the receiving switch reads that tag to place the frame back into the right VLAN. An access port belongs to a single VLAN, so it would strand the other two. A loopback is a logical interface used for testing and router identity, an EtherChannel bundles several links for bandwidth rather than separating VLANs, and Power over Ethernet only adds electrical power to a port.
- Which IEEE standard defines the frame-tagging method that inserts a 4-byte VLAN tag containing a 12-bit VLAN identifier into an Ethernet frame?
- 802.1X, the standard that allocates a VLAN after the login passes
- 802.1Q, the standard that encodes each frame with its VLAN number
- 802.3af, the standard that sends the power along an Ethernet pair
- 802.11ac, the standard that widens channels inside the 5 GHz band
Correct answer: 802.1Q, the standard that encodes each frame with its VLAN number
802.1Q defines VLAN tagging: it inserts a four-byte field into the Ethernet header, and twelve bits of that field hold the VLAN identifier, which is why a trunk can keep up to 4,094 usable VLANs distinct on one link. 802.1X is port-based access control that authenticates a supplicant before the port forwards traffic, and although a RADIUS server can hand a port a VLAN after that authentication, the standard defines no frame format. 802.3af is the original Power over Ethernet specification and 802.11ac is a wireless standard for the 5 GHz band, so neither touches tagging.
- On an 802.1Q trunk, frames belonging to one specific VLAN are sent untagged while all other VLANs are tagged. Which trunk feature explains this behavior?
- The voice VLAN, whose frames transport phone traffic with a priority bit
- The private VLAN, whose ports remain isolated from one another by design
- The native VLAN, whose frames traverse the trunk without any tag applied
- The management VLAN, whose frames serve the switch control plane at boot
Correct answer: The native VLAN, whose frames traverse the trunk without any tag applied
On an 802.1Q trunk exactly one VLAN is designated native, and its frames traverse the link untagged while every other VLAN on the trunk is tagged; this exists so that untagged traffic arriving on a trunk still has a home. Because both ends must agree, a native VLAN mismatch is a classic misconfiguration that silently merges two VLANs. A voice VLAN separates IP phone traffic and is still tagged, a private VLAN restricts communication between ports within one VLAN, and a management VLAN simply carries switch administration traffic.
- A campus network has several redundant links between switches to survive cable failures. Which protocol blocks the resulting redundant paths to prevent Layer 2 loops while keeping a backup ready?
- STP, which blocks a redundant port until the primary path fails
- LACP, which joins the redundant links into one shared data pipe
- HSRP, which holds a backup gateway between the two router peers
- OSPF, which finds a network path across a routed campus network
Correct answer: STP, which blocks a redundant port until the primary path fails
Spanning Tree Protocol elects a root bridge, computes the lowest-cost path to it from every switch, and puts the remaining redundant ports into a blocking state, leaving exactly one active path through the Layer 2 topology; if that path fails, a blocked port transitions to forwarding and the backup takes over. LACP aggregates links into one bundle rather than blocking any, HSRP provides a redundant default gateway at Layer 3, and OSPF is a routing protocol that operates above the switching loop problem entirely.
- An administrator bundles four physical 1 Gbps switch ports into one logical 4 Gbps interface to increase bandwidth and provide redundancy between two switches. What is this technique called?
- Port mirroring, which copies chosen frames toward an analyzing host
- VLAN trunking, which labels outgoing frames for many separate VLANs
- Spanning tree, which idles the looping ports through switched cores
- Link aggregation, which combines member ports into one working link
Correct answer: Link aggregation, which combines member ports into one working link
Link aggregation combines several physical interfaces into one logical interface whose capacity is the sum of its members, so four gigabit ports present a single four-gigabit path, and traffic continues over the survivors if one member fails. Port mirroring duplicates traffic to a monitoring station and adds no capacity, VLAN trunking carries several VLANs across one link but does not increase its bandwidth, and spanning tree deliberately blocks redundant ports rather than using them together.
- Which protocol is used to dynamically negotiate and maintain a link aggregation group between two switches so member links are added or removed automatically?
- LACP, which negotiates the members of one aggregated port bundle
- ARP, which resolves an address into the matched hardware address
- CDP, which advertises a neighbor identity along a connected link
- STP, which designates a root bridge across each switched network
Correct answer: LACP, which negotiates the members of one aggregated port bundle
Link Aggregation Control Protocol, standardised as IEEE 802.3ad and now part of 802.1AX, exchanges control frames between two devices so that compatible links are admitted to the bundle automatically and a member that stops responding is removed, which also protects against miscabling that static bundling would not catch. ARP maps an IP address to a MAC address, CDP advertises device identity to a directly connected neighbour, and STP blocks loops; none of them manages membership of an aggregation group.
- A facilities team must install a ceiling-mounted wireless access point where running a separate electrical outlet is impractical. Which technology lets the single network cable supply both data and electrical power to the AP?
- Multiprotocol Label Switching, which relies on the short path tags
- Power over Ethernet, which sends electricity across the data pairs
- Uninterruptible Power Supply, which holds a load through an outage
- Universal Serial Bus, which powers a peripheral over short cabling
Correct answer: Power over Ethernet, which sends electricity across the data pairs
Power over Ethernet delivers direct current and data over the same twisted-pair cable, so a ceiling access point, IP phone or camera needs only the network drop already being pulled to it and no separate electrical outlet; the switch acts as the power sourcing equipment and negotiates how much the device may draw. Label switching is a WAN forwarding technique, an uninterruptible power supply backs up equipment already connected to mains power, and USB carries power only a few metres and is not a structured cabling technology.
- A switch must power an outdoor pan-tilt-zoom camera with a heater that draws roughly 60 watts at the switch port. Which Power over Ethernet standard is required to supply this level of power?
- 802.3at, which uses two pairs to double the first power class
- 802.3af, which feeds two pairs at the earlier low power class
- 802.3az, which idles the quiet circuits to cut the power draw
- 802.3bt, which drives four pairs to reach the top power class
Correct answer: 802.3bt, which drives four pairs to reach the top power class
802.3bt, marketed as PoE++, uses all four twisted pairs and defines Type 3 at roughly 60 watts and Type 4 at roughly 90 watts from the switch, so a heated pan-tilt-zoom camera drawing about 60 watts falls in its range. The original 802.3af supplies about 15.4 watts at the port and 802.3at about 30 watts, both far short of what the camera needs. 802.3az is Energy-Efficient Ethernet, a power-saving mechanism for idle links, and defines no power class at all.
- A router receives a packet for a destination address that matches no specific entry in its routing table, but a default route is configured. What does the router do with the packet?
- It floods the packet out each router interface except the inbound port
- It buffers the packet until a matching route reaches the routing table
- It forwards the packet along the default route towards the next router
- It returns the packet to the sender inside one ICMP unreachable notice
Correct answer: It forwards the packet along the default route towards the next router
A default route, written 0.0.0.0/0 and called the gateway of last resort, is the least specific entry in the table, so it matches any destination that nothing more specific covers and the router forwards the packet to the next hop it names. Flooding out every interface is switch behaviour for unknown unicast frames, not router behaviour. Routers do not buffer packets waiting for a route to appear, and the destination-unreachable message is what a router sends when no route matches at all, which is precisely the case the default route prevents.
- An administrator views a router's routing table to determine how the device will forward traffic. What information does each routing-table entry primarily provide?
- Each entry pairs a hardware address with the switch port behind it
- Each entry pairs a leased address with the client already using it
- Each entry pairs a destination network with the next hop toward it
- Each entry pairs an active endpoint with the process now behind it
Correct answer: Each entry pairs a destination network with the next hop toward it
A routing table is a list of destination networks with the next-hop address or outgoing interface used to reach each one, together with the route's source and metric, and the router selects the longest prefix that matches a packet's destination. Pairing a hardware address with a port describes a switch's MAC address table, pairing a leased address with a client describes a DHCP binding table, and pairing a socket with a process describes what a connection listing on the device itself would show.
- A branch office has one internet connection, and the administrator wants the simplest configuration that does not consume CPU or bandwidth exchanging routing updates. Which approach best fits?
- A BGP peer session created with the provider's border router
- An OSPF adjacency set with the peer provider's border router
- An EIGRP neighbor set with the peer provider's border router
- A static default route aimed at the provider's border router
Correct answer: A static default route aimed at the provider's border router
With a single exit there is only one possible path, so a manually configured default route is enough: it is entered once, sends no updates, keeps no neighbour state and costs the router neither CPU nor bandwidth. A dynamic protocol would spend both maintaining adjacencies and exchanging information about a topology that cannot change. BGP additionally requires an autonomous system number and policy configuration, OSPF must flood and recompute link states, and EIGRP must maintain neighbour relationships and a topology table.
- A network engineer is deciding between static and dynamic routing for a growing multi-site network with several redundant paths. Which statement correctly contrasts the two?
- Dynamic routing must be re-entered by hand; static routing tracks link cost
- Dynamic routing recalculates paths on its own; static routing needs an edit
- Dynamic routing consumes no CPU cycles at all; static routing consumes many
- Dynamic routing collapses in a larger mesh; static routing scales up nicely
Correct answer: Dynamic routing recalculates paths on its own; static routing needs an edit
A dynamic routing protocol exchanges updates with its neighbors and recomputes its own paths, so it notices a failed link and reroutes without help; a static route stays exactly as typed until an administrator edits it. Dynamic routing is the technology that consumes router CPU and link bandwidth, not the one that avoids it, and it is dynamic routing that scales in a large redundant mesh while static routing becomes unmanageable. The claim that static routing self-heals reverses the two outright.
- A routing table shows two routes to the same network: one learned via OSPF and one learned via a different protocol with a lower administrative distance. Which route does the router install in the forwarding table?
- The OSPF route, since link-state data outranks a distance value
- The route the routing protocol installed on this router earlier
- The route whose forwarding table entry shows the longest prefix
- The route with the smaller administrative distance in the table
Correct answer: The route with the smaller administrative distance in the table
Administrative distance ranks how far a router trusts each source of routing information, and when two sources offer a path to the same destination the router installs the one with the smaller value. OSPF carries a distance of 110, so a protocol advertising a smaller number wins regardless of how the route was learned; being link-state confers no automatic priority. Recency of learning is not a tiebreaker between protocols, and longest-prefix matching only applies when the prefixes differ, which they do not here.
- A wireless designer must choose a band for a high-density office with many devices and frequent interference from neighboring networks. Which statement accurately compares 2.4 GHz and 5 GHz?
- 5 GHz offers more channels at shorter reach; 2.4 GHz carries farther
- 5 GHz penetrates thicker walls better; 2.4 GHz fades within one room
- 5 GHz supplies fewer clean channels here; 2.4 GHz supplies many more
- 5 GHz duplicates 2.4 GHz channel for channel; just the power differs
Correct answer: 5 GHz offers more channels at shorter reach; 2.4 GHz carries farther
The 5 GHz band is much wider, so it holds many more non-overlapping channels and supports higher throughput, but its shorter wavelength is absorbed more readily and it covers less distance; 2.4 GHz travels farther and passes through walls better while offering only three non-overlapping channels and picking up interference from neighbors and other devices. Wall penetration therefore favours 2.4 GHz, not 5 GHz, the channel counts are not reversed, and the two bands are not equivalent.
- In the 2.4 GHz band using standard 20 MHz channels in North America, which set of channels does not overlap and is recommended to avoid co-channel interference?
- Channels 1, 5, and 9, separated widely apart
- Channels 3, 6, and 9, grouped rather tightly
- Channels 1, 6, and 11, positioned five apart
- Channels 2, 4, and 6, crammed close together
Correct answer: Channels 1, 6, and 11, positioned five apart
A 20 MHz transmission in the 2.4 GHz band occupies roughly five channel numbers of spectrum, so two access points only avoid overlapping each other when their channel numbers differ by at least five. Channels 1, 6, and 11 are the only trio inside the North American allocation that meets that separation, which is why it is the standard reuse plan. Sets separated by four, three, or two channel numbers all overlap in frequency and produce adjacent-channel interference even though the numbers look distinct.
- An organization compares Wi-Fi 5 and Wi-Fi 6 for a dense office full of simultaneous clients. Which improvement is unique to Wi-Fi 6 and helps most in that crowded environment?
- Beamforming, which aims RF energy toward a single client
- Channel bonding, which combines two RF channels into one
- MU-MIMO streams, which Wi-Fi 5 already sent downlink too
- OFDMA, which splits one channel among many client radios
Correct answer: OFDMA, which splits one channel among many client radios
Orthogonal frequency-division multiple access divides a channel into resource units and hands different units to different stations within the same transmission, so many small frames are served at once instead of each client waiting its turn. That is the change Wi-Fi 6 introduced and it is exactly what a crowded office needs. Beamforming and channel bonding both predate Wi-Fi 6, and downlink MU-MIMO arrived with Wi-Fi 5, so none of them is unique to the newer generation.
- Which list correctly pairs each Wi-Fi generation marketing name with its underlying IEEE 802.11 amendment?
- Wi-Fi 4 = 802.11n, Wi-Fi 5 = 802.11ac, Wi-Fi 6 = 802.11ax
- Wi-Fi 4 = 802.11ac, Wi-Fi 5 = 802.11n, Wi-Fi 6 = 802.11ax
- Wi-Fi 4 = 802.11ax, Wi-Fi 5 = 802.11ac, Wi-Fi 6 = 802.11n
- Wi-Fi 4 = 802.11n, Wi-Fi 5 = 802.11ax, Wi-Fi 6 = 802.11ac
Correct answer: Wi-Fi 4 = 802.11n, Wi-Fi 5 = 802.11ac, Wi-Fi 6 = 802.11ax
The Wi-Fi Alliance numbered the generations in the order the amendments were ratified, so 802.11n became Wi-Fi 4, 802.11ac became Wi-Fi 5, and 802.11ax became Wi-Fi 6. Every other arrangement puts a later amendment on an earlier generation number: 802.11ac cannot be Wi-Fi 4 because it postdates 802.11n, and 802.11ax cannot sit below either of them because it is the most recent of the three.
- A technician configures an access point to combine two adjacent 20 MHz channels into a single 40 MHz channel to increase throughput. What is this technique called?
- Band steering, relocating a dual-band client to the quieter radio
- Beamforming, focusing the radio signal at one busy client station
- Channel bonding, fusing two nearby channels into one wide channel
- Fast roaming, transferring a local client to another access point
Correct answer: Channel bonding, fusing two nearby channels into one wide channel
Channel bonding joins adjacent 20 MHz channels into a single wider channel, so a 40 MHz channel carries roughly twice the data of one 20 MHz channel at the cost of consuming more spectrum. Band steering only decides which band a dual-band client joins, beamforming shapes the antenna pattern toward a station without changing channel width, and fast roaming shortens the handoff between access points. None of those three widens a channel.
- A network 192.168.40.0/24 is subnetted into /27 networks. A host is assigned the address 192.168.40.100. What is the network (subnet) address for that host?
- 192.168.40.64
- 192.168.40.96
- 192.168.40.32
- 192.168.40.95
Correct answer: 192.168.40.96
A /27 mask leaves five host bits, so subnets step in blocks of thirty two addresses: .0, .32, .64, .96, .128 and onward. The host .100 falls inside the block that runs from 192.168.40.96 to 192.168.40.127, so 192.168.40.96 is its network address. 192.168.40.64 and 192.168.40.32 are the starts of earlier blocks that end well below .100, and 192.168.40.95 is the broadcast address of the block below rather than the start of any subnet.
- An administrator must create at least 30 subnets from the block 172.16.8.0/24, with each subnet supporting at least 4 usable hosts. Which subnet mask meets both requirements with the least waste?
- /26 (255.255.255.192)
- /27 (255.255.255.224)
- /29 (255.255.255.248)
- /30 (255.255.255.252)
Correct answer: /29 (255.255.255.248)
Splitting a /24 into /29 blocks, a mask of 255.255.255.248, borrows five bits and produces thirty two subnets of eight addresses each; removing the network and broadcast addresses leaves six usable hosts, so both requirements are met with the least waste. A /26 yields four subnets and a /27 yields eight, far short of the thirty needed, while a /30 yields sixty four subnets but only two usable hosts, below the four each subnet must support.
- A point-to-point link between two routers needs the smallest classful-style subnet that still provides two usable host addresses. Which prefix length should be used?
- /28 (255.255.255.240)
- /30 (255.255.255.252)
- /29 (255.255.255.248)
- /32 (255.255.255.255)
Correct answer: /30 (255.255.255.252)
A /30, or 255.255.255.252, defines a four-address block holding one network address, one broadcast address, and exactly two usable host addresses, which is the traditional sizing for a router-to-router link and wastes nothing. A /29 and a /28 also work but strand six and fourteen usable addresses on a link that needs only two, and a /32 describes a single host route rather than a subnet with two endpoints.
- An engineer must divide 10.0.0.0/24 into four equally sized subnets for four departments. Which mask creates exactly four subnets, and how many usable hosts does each provide?
- /25 (255.255.255.128), 64 usable hosts per group
- /27 (255.255.255.224), 30 usable hosts per block
- /28 (255.255.255.240), 14 usable hosts per space
- /26 (255.255.255.192), 62 usable hosts per range
Correct answer: /26 (255.255.255.192), 62 usable hosts per range
Borrowing two bits from the host field of a /24 creates exactly four equal subnets, which is a /26 or 255.255.255.192. Each block spans sixty four addresses, and removing the network and broadcast addresses leaves 62 usable hosts per department. Borrowing one bit gives only two subnets, borrowing three gives eight, and borrowing four gives sixteen, so no other mask divides the block into four parts, and a /25 leaves 126 usable hosts rather than 64.
- A device is configured with the address 10.10.10.20 and subnet mask 255.255.255.240. What is the broadcast address for this host's subnet?
- 10.10.10.31
- 10.10.10.15
- 10.10.10.16
- 10.10.10.32
Correct answer: 10.10.10.31
A mask of 255.255.255.240 is a /28, so subnets step in blocks of sixteen addresses: .0, .16, .32 and upward. The host 10.10.10.20 sits in the block that runs from 10.10.10.16 to 10.10.10.31, making 10.10.10.16 the network address and 10.10.10.31 the broadcast address for that subnet. 10.10.10.15 is the broadcast address of the block below, and 10.10.10.32 is the network address of the block above.
- An installer must run a copper cable for a new 10GBASE-T link that needs to reach the full 100-meter channel distance. Which cabling category is the minimum recommended choice?
- Category 6a, the augmented grade with fine tolerances
- Category 5e, the enhanced grade behind gigabit speeds
- Category 6, the unshielded variety popular in offices
- Category 3, the antiquated grade for analog telephony
Correct answer: Category 6a, the augmented grade with fine tolerances
Category 6A is the lowest cabling grade the standards bodies rate for 10GBASE-T over a complete 100-meter channel, because its tighter construction controls the alien crosstalk that appears at 500 MHz. Category 6 can carry 10GBASE-T only for about 55 meters, so it cannot reach the full channel length. Category 5e is specified to 100 MHz and tops out at gigabit speeds, and Category 3 was a voice-grade product never intended for high-speed data.
- A technician must terminate a fiber run into a transceiver using a small connector that holds two fibers in one rectangular housing to conserve panel space. Which fiber connector fits this description?
- SC, a square push-pull connector with a 2.5 mm ferrule
- ST, a round twist-lock connector with a 2.5 mm ferrule
- LC, a compact latched connector with a 1.25 mm ferrule
- FC, a threaded ceramic connector with a 2.5 mm ferrule
Correct answer: LC, a compact latched connector with a 1.25 mm ferrule
The LC is a small-form-factor connector built on a 1.25 mm ferrule, half the diameter used by the earlier designs, and its duplex housing clips two of those ferrules into one rectangular body so a transceiver is served from a very small footprint. SC, ST, and FC all use the older 2.5 mm ferrule and terminate a single fiber each, so a two-fiber link needs a pair of them and takes up far more panel space.
- A wireless controller manages several access points that all broadcast the same SSID so clients roam seamlessly between them. What is this collection of coordinated APs sharing one SSID called?
- The basic service set, one single access point's private cell
- The extended service set, several cells under one shared name
- The independent basic service set, one ad hoc peering network
- The basic service set identifier, the radio's own MAC address
Correct answer: The extended service set, several cells under one shared name
An extended service set is formed when two or more access points advertise the same SSID and are joined by a distribution system, so a client can move from one cell to the next without changing networks. A basic service set is the coverage of a single access point, an independent basic service set is a peer-to-peer group with no access point at all, and the basic service set identifier is the MAC address a radio uses to label its own cell.
- A managed-services contract states the provider must keep a customer's internet circuit available 99.9 percent of the time each month and respond to outages within one hour. Which document defines these measurable commitments between the provider and the customer?
- The memorandum of understanding, noting the broad shared intent
- The acceptable use policy, listing limits for network customers
- The change management plan, governing how updates get agreement
- The service-level agreement, fixing how much uptime is promised
Correct answer: The service-level agreement, fixing how much uptime is promised
A service-level agreement is the contract clause set that states the numbers a provider is held to, such as the share of each month a circuit must be reachable and the time allowed to answer an outage, together with what happens when those numbers are missed. A memorandum of understanding records intent without binding commitments, an acceptable use policy tells users what they may do on the network, and a change management plan governs how work is approved.
- An SLA promises 99.9 percent monthly availability for a service. Roughly how much total downtime per 30-day month does that allowance permit?
- Roughly 73 minutes over the whole month
- Barely 28 minutes across a single month
- About 43 minutes within one given month
- Nearly 58 minutes during one full month
Correct answer: About 43 minutes within one given month
A 30-day month contains 43,200 minutes, and one tenth of one percent of that is roughly 43 minutes, so a 99.9 percent commitment allows about 43 minutes of outage before the target is breached. Tighter figures correspond to stricter promises: about 28 minutes matches roughly 99.94 percent, while 58 and 73 minutes are looser than the stated allowance and would let the provider exceed the agreed availability.
- A network team wants automated alerts when a router's CPU utilization crosses a threshold, plus the ability to poll interface counters from a central management station. Which protocol is designed for this device monitoring and management?
- SNMP, which reads device counters from a control station
- SMTP, which moves mail between two central relay servers
- SSH, which builds an encrypted shell to router terminals
- ICMP, which reports interface errors to the local router
Correct answer: SNMP, which reads device counters from a control station
Simple Network Management Protocol was built for exactly this pairing of tasks: a management station polls objects such as interface counters from an agent on each device, and the agent sends an unsolicited trap or inform when a monitored value such as processor load crosses a configured threshold. SMTP carries mail, SSH provides an encrypted administrative session, and ICMP reports delivery problems, so none of them polls or alerts on device metrics.
- A security review flags that the organization is still using SNMPv2c across its switches. Which improvement does SNMPv3 add that SNMPv2c lacks?
- Batch retrievals of complete interface tables immediately
- Community strings transmitted as unencrypted visible text
- Trap notifications that switches transmit without polling
- User authentication with encryption of management traffic
Correct answer: User authentication with encryption of management traffic
SNMPv3 introduced a user-based security model that authenticates each message and can encrypt the payload, so management traffic is no longer readable or forgeable by anyone on the path. Everything else listed already existed: bulk retrieval arrived with version 2c, traps date back to version 1, and community strings are precisely the weak clear-text credential that version 3 was designed to replace rather than an improvement it added.
- After correlating logs across several devices, an engineer finds the timestamps are minutes apart, making it impossible to reconstruct the order of events. Which protocol should be deployed to keep all device clocks synchronized?
- DHCP, which hands out addresses with set lease timers
- NTP, which steers each local clock toward common time
- DNS, which resolves host names into bare IP addresses
- LDAP, which queries a directory for the user accounts
Correct answer: NTP, which steers each local clock toward common time
Network Time Protocol distributes a reference time down a hierarchy and lets each client discipline its own clock, correcting for network delay, so logs gathered from different devices can be placed in a single ordered sequence. DHCP assigns addresses and lease durations but does not set the clock, DNS maps names to addresses, and LDAP answers directory queries, so none of them removes the timestamp drift the engineer is seeing.
- In an NTP hierarchy, a server that takes its time directly from a GPS or atomic reference clock is described by which stratum value?
- Stratum level 0, as the standard defines it
- Stratum level 1, as the protocol names them
- Stratum level 2, as the hierarchy labels it
- Stratum level 3, as the design numbers them
Correct answer: Stratum level 1, as the protocol names them
Stratum 1 describes a time server attached directly to a reference source such as a GPS receiver or an atomic clock, which is why it sits at the top of the usable hierarchy. Stratum 0 is the reference hardware itself rather than a server that can be queried, and stratum 2 and stratum 3 servers take their time from a stratum 1 or stratum 2 peer over the network, one and two hops further from the source.
- A VoIP rollout suffers from choppy calls during busy periods even though raw bandwidth is available, because voice packets queue behind large file transfers. Which capability prioritizes the time-sensitive voice traffic to fix this?
- Link aggregation, boosting bandwidth by combining ports as one
- Spanning tree, disabling one redundant pathway to stop looping
- Jumbo frames, permitting each transfer to send bigger payloads
- Quality of service, queuing tagged traffic above heavy streams
Correct answer: Quality of service, queuing tagged traffic above heavy streams
Quality of service classifies traffic and gives each class its own queue and scheduling treatment, so small voice packets are sent ahead of a large file transfer instead of waiting behind it. That is a scheduling problem rather than a capacity problem, which is why adding bandwidth through link aggregation does not fix it. Spanning tree only removes switching loops, and larger frames make the queuing delay worse rather than better.
- A network administrator marks voice packets with a DSCP value so downstream routers give them priority handling. At which layer of the protocol stack does Differentiated Services Code Point marking occur?
- The IPv4 header, handled at the internet layer
- The TCP header, handled at the transport layer
- The Ethernet header, handled at the link layer
- The user payload, handled at the topmost layer
Correct answer: The IPv4 header, handled at the internet layer
Differentiated Services Code Point marking lives in the differentiated services field of the IPv4 header, the traffic class field in IPv6, which is Layer 3 of the OSI model and the internet layer of the TCP/IP model, so every router along the path can read it without inspecting anything above. Layer 2 uses a separate priority field carried in an 802.1Q tag, the transport header holds ports and sequence numbers, and the payload is opaque to forwarding devices.
- An organization wants every router, switch, and firewall to forward its event messages to one central collector for storage and analysis. Which protocol is purpose-built to send these event messages to a central logging server?
- TFTP, a basic file transfer protocol for firmware storage
- SNMP, a polling protocol that one central station directs
- Syslog, a message protocol aimed at the central collector
- RADIUS, an authentication protocol that a switch will use
Correct answer: Syslog, a message protocol aimed at the central collector
Syslog exists to carry event messages from a device to a collector, tagging each one with a facility and a severity so the receiving server can store, filter, and search them centrally. TFTP moves files rather than events, SNMP is built around polling and trap notifications instead of free-form log text, and RADIUS authenticates users and administrators, so none of them is the logging transport the design calls for.
- While tuning a syslog collector, an engineer wants to capture only messages indicating actual failures and worse, filtering out routine informational entries. Which syslog severity level represents a normal informational message, the lowest-priority category to filter out?
- Warning, raised for one condition nearing genuine trouble
- Critical, raised when a subsystem reports actual failures
- Emergency, raised when this syslog collector falls silent
- Informational, raised for a plain routine operating entry
Correct answer: Informational, raised for a plain routine operating entry
The informational severity is the label syslog gives to ordinary operational notices, the everyday chatter a device emits when nothing is wrong, so filtering at that boundary removes the noise and leaves the fault reports behind. Warning marks a condition that has not yet caused a failure, critical marks a subsystem that has already failed, and emergency marks a device that is unusable, so all three sit above the routine traffic the engineer wants removed.
- A company's disaster-recovery plan specifies that operations must be fully restored within four hours of a major outage. Which metric does that four-hour target represent?
- Mean time between failures, the average uptime expectation
- Recovery point objective, the tolerable data loss exposure
- Recovery time objective, the deadline for full restoration
- Mean time to repair, the average troubleshooting timescale
Correct answer: Recovery time objective, the deadline for full restoration
A recovery time objective states how long the business will accept being without a service, measured from the moment of the outage to the moment operations are running again, so a four-hour restoration target is exactly that figure. A recovery point objective measures data loss rather than elapsed downtime, mean time between failures describes how long equipment runs before breaking, and mean time to repair describes the average repair itself.
- A backup strategy states the business can tolerate losing at most 15 minutes of data if a database fails. Which disaster-recovery metric does the 15-minute window define?
- Mean time to repair, the average minutes spent on repairs
- Recovery point objective, the span of recent data at risk
- Mean time between failures, an average run before a fault
- Recovery time objective, the allowed span of one bad hour
Correct answer: Recovery point objective, the span of recent data at risk
A recovery point objective states how much recent work the business is willing to lose, which fixes how far back the last good copy may sit and therefore how often backups or replication must run; a fifteen-minute tolerance is that figure. A recovery time objective would describe how quickly service must return instead, while mean time between failures and mean time to repair are reliability measures of the hardware, not backup design targets.
- An organization budgets for an inexpensive recovery facility that provides space, power, and cooling but no installed servers or current data, requiring equipment and backups to be brought in after a disaster. Which type of recovery site is this?
- A cold site, an empty shelter needing tools brought later
- A warm site, half stocked with servers awaiting real data
- A hot site, a running duplicate of that existing facility
- A cloud site, rented space appearing after the real event
Correct answer: A cold site, an empty shelter needing tools brought later
A cold site is a shell: floor space with power, cooling, and connectivity but no computing equipment and no copy of the organization's data, so recovery means shipping in hardware and restoring backups before anything runs. That is why it is the cheapest option and the slowest to bring up. A warm site already holds some equipment, a hot site mirrors production continuously, and a rented cloud facility carries a very different cost model.
- Two firewalls are deployed so that both forward production traffic simultaneously and share the load, with either able to carry the full load if its partner fails. Which high-availability configuration is described?
- Active-active, with both units forwarding at any time
- Active-passive, with one spare waiting for a failover
- Cold standby, with that hardware sitting powered down
- Round-robin DNS, with clients sharing the entire load
Correct answer: Active-active, with both units forwarding at any time
An active-active pair has every member passing production traffic at the same time and sharing the aggregate load, and each member is sized so it can absorb the whole load alone if its partner drops out. In an active-passive pair the second unit forwards nothing until a failover, a cold standby is not even powered on, and round-robin DNS spreads client requests across separate addresses rather than clustering the firewalls.
- A network designer deploys two routers sharing a single virtual IP so that hosts always have a working default gateway even if one router fails. Which category of protocol provides this gateway redundancy?
- Spanning tree protocol, which prunes into one loop-free pathway
- First hop redundancy protocol, which floats one virtual address
- Link aggregation protocol, which bundles the two physical links
- Border gateway protocol, which carries routes between two peers
Correct answer: First hop redundancy protocol, which floats one virtual address
First hop redundancy protocols let two or more routers share one virtual IP address and virtual MAC address that hosts use as their default gateway, so the surviving router answers for that address when its partner fails and the hosts never change their configuration. Spanning tree removes switching loops at Layer 2, link aggregation bundles physical links into one logical link, and border gateway protocol exchanges routes between autonomous systems.
- Which open-standard first hop redundancy protocol allows routers from different vendors to back up a shared virtual gateway address?
- HSRP, a design that legacy routers commonly run
- GLBP, a design that also balances outbound load
- VRRP, a design that multiple router vendors run
- STP, a design that keeps switched loops cleared
Correct answer: VRRP, a design that multiple router vendors run
Virtual Router Redundancy Protocol is defined by the IETF in a public specification, so implementations from competing manufacturers can join the same virtual router group and back up one shared gateway address between them. HSRP and GLBP are proprietary designs that only work among devices from the vendor that created them, and STP is a Layer 2 loop-prevention mechanism rather than any form of gateway redundancy.
- A team is building documentation that shows the IP addressing scheme, VLANs, and Layer 3 routing relationships between subnets, ignoring exact cable runs and rack positions. Which type of diagram best fits this purpose?
- A rack diagram, showing device positions inside two cabinets
- A wiring schematic, showing the terminated cable runs inside
- A physical network diagram, showing cabinets with cable runs
- A logical network diagram, showing subnets with their routes
Correct answer: A logical network diagram, showing subnets with their routes
A logical network diagram represents addressing, VLANs, and the routing relationships between segments without committing to where anything physically sits, which is exactly the abstraction the team asked for. A rack diagram places equipment in cabinet units, a wiring schematic records terminations and cable paths, and a physical network diagram ties devices to rooms, racks, and ports, so all three describe the layer being ignored.
- After expanding wireless coverage, a network admin produces a color-coded map overlaid on the floor plan showing signal strength in every area. What is this deliverable called?
- A rack elevation, a drawing of the cabinets on that floor
- A hardware inventory, a list of the network gear per area
- A wireless heat map, a shaded layer over the local levels
- A cable map, a diagram of the cables between four closets
Correct answer: A wireless heat map, a shaded layer over the local levels
A wireless heat map presents measured signal levels as color bands laid over a scaled drawing of the space, so weak coverage, overlap, and dead zones can be seen at a glance after a survey. A rack elevation records equipment placement in cabinets, an inventory lists what the organization owns, and a cable map records where cabling runs, so none of them expresses radio strength across an area.
- An auditor asks for a single source of truth tracking which IP addresses and subnets are assigned, reserved, or free across the enterprise. Which system or practice provides this?
- The DHCP scope list, showing leases granted to each machine
- The NAT translation table, mapping inside hosts to one pool
- The DNS zone file, containing address records for each host
- The IPAM database, tracking the status of each host address
Correct answer: The IPAM database, tracking the status of each host address
IP address management is the discipline, and the tooling, that holds one authoritative record of every subnet and address in the estate together with its status, whether allocated, held back, or available, and reconciles that record against what the network is really using. A DHCP scope only knows the dynamic ranges it serves, a NAT table maps live sessions, and a DNS zone maps names, so none of them is a complete register.
- Before deploying a new VoIP system, an administrator records several days of current traffic levels, latency, and utilization to define what normal looks like. What is this reference measurement called?
- A baseline, a recorded sample of how things run today
- A change request, a written note to alter the network
- A service agreement, a deal fixing the uptime we want
- A heat map, a shaded picture of radio signal strength
Correct answer: A baseline, a recorded sample of how things run today
A baseline is a measured snapshot of a network under ordinary conditions, captured before a change so that later readings have something to be compared against; without it there is no way to say whether the new system caused a shift in latency or utilization. A change request seeks approval for work, a service agreement sets contractual targets, and a heat map shows radio coverage, so none of them records current behavior.
- A monitoring platform exports records summarizing source and destination addresses, ports, and byte counts for conversations traversing a router, so analysts can see which applications consume the most bandwidth. Which technology provides this traffic-flow data?
- Port mirroring, which copies entire frames toward analyzer probes
- NetFlow exporting, which condenses each whole traffic flow record
- SNMP polling, which collects interface counters from the switches
- Syslog forwarding, which delivers severity strings to a collector
Correct answer: NetFlow exporting, which condenses each whole traffic flow record
Flow technologies such as NetFlow, sFlow, and IPFIX build one record per conversation, holding the source and destination addresses, the ports, the protocol, and the byte and packet totals, then export those records to a collector where they can be ranked by talker or by application. Port mirroring copies whole packets rather than summarizing them, SNMP returns per-interface totals, and syslog carries event text.
- An engineer must copy every packet on a busy switch port to a separate analyzer port for deep packet inspection during troubleshooting. Which switch feature accomplishes this?
- Port security, which restricts the MAC addresses on one port
- Port mirroring, which copies one port's traffic to a monitor
- Spanning tree, which blocks one port to stop switching loops
- Power over Ethernet, which powers a handset from that switch
Correct answer: Port mirroring, which copies one port's traffic to a monitor
Port mirroring, called SPAN on many switches, duplicates the traffic seen on a source port or VLAN and sends the copy to a destination port where a protocol analyser is attached, so every frame can be captured without interrupting the production path. Port security restricts which MAC addresses may appear on a port, spanning tree blocks looping paths, and Power over Ethernet supplies electrical power.
- A change request to upgrade core switch firmware includes a documented set of steps to revert to the prior version if the upgrade causes problems. What is this part of the change plan called?
- A rollback plan, the recorded route back to the previous build
- A baseline record, the state that was approved before the work
- A risk acceptance, one written decision to live with a problem
- A maintenance window, the hours that were saved for noisy work
Correct answer: A rollback plan, the recorded route back to the previous build
A rollback plan is the written procedure for returning a device to its previous working state, naming the image to reload, the configuration to restore, and the checks that confirm the reversal succeeded, and it is normally required before a change board will approve the work. A baseline record is the reference build itself, a risk acceptance records a decision not to act, and a maintenance window sets the timing.
- A vendor announces that a switch model will no longer receive security patches or technical assistance after a certain date, although it can still function. Which life-cycle term describes that date?
- End-of-life, when the model departs the vendor's price lists
- Decommissioning, when the gear is pulled from active service
- Deprecation, when a function is flagged for eventual removal
- End-of-support, when the last security fix is finally issued
Correct answer: End-of-support, when the last security fix is finally issued
End-of-support is the milestone after which the manufacturer no longer issues fixes, security updates, or technical assistance for a product, even though installed units keep running, which is what turns continued use into a security and compliance risk. End-of-life marks the end of sales, decommissioning is the act of removing equipment from service, and deprecation flags a feature that is being phased out.
- A network device's reliability data lists an average operational time of 80,000 hours before a repairable hardware failure occurs. Which metric does this figure represent?
- Mean time to repair, the expected duration of each correction
- Recovery point objective, the tolerable gap in the saved data
- Mean time between failures, the expected span before a defect
- Recovery time objective, the target for getting back to speed
Correct answer: Mean time between failures, the expected span before a defect
Mean time between failures expresses how long a repairable item is expected to operate before the next hardware fault, so a figure such as 80,000 hours is a reliability estimate for the device rather than a statement about how quickly it can be fixed or restored. Mean time to repair covers the repair itself, and the two recovery objectives are planning targets for downtime and data loss after an incident.
- An organization keeps a known-good reference configuration for each switch model, sometimes called a golden configuration, so that any device can be quickly restored or audited against the standard. Which discipline does this practice belong to?
- Incident response, the procedures for any unplanned device outage
- Quality of service, the precedence apportioned to network classes
- Capacity planning, the projections of future switch growth trends
- Configuration management, the control of each core device setting
Correct answer: Configuration management, the control of each core device setting
Configuration management is the practice of defining an approved configuration for each class of device, storing it, deploying it, and comparing running devices against it so drift is found and corrected; a golden configuration is precisely that stored reference. Incident response handles live events, quality of service prioritizes traffic, and capacity planning forecasts growth, so none of them owns the reference build.
- A backup design replicates data to a recovery facility continuously and keeps duplicate, ready-to-run equipment powered on, enabling near-immediate failover after a disaster. Which site type and trade-off does this describe?
- A mobile site, a trailer hauled in when the offices flood
- A cold site, the cheapest option but the slowest to start
- A hot site, the costliest option but the fastest to start
- A warm site, a middling option whose data must be fetched
Correct answer: A hot site, the costliest option but the fastest to start
A hot site keeps a full duplicate of the production environment powered on with data replicated continuously, so the business can cut over almost at once; that readiness is bought with the highest running cost of any recovery option. A warm site holds equipment but needs data restored, a cold site is empty space that must be fitted out, and a mobile site is a transportable facility brought to the location.
- A monitoring server is configured so devices send unsolicited alerts the moment an interface goes down, rather than waiting for the next scheduled poll. Which SNMP mechanism delivers these immediate, device-initiated notifications?
- A GET request, which the manager sends when sampling counters
- A trap message, which an agent transmits when interfaces fail
- A walk sequence, which the manager repeats to gather subtrees
- A community string, which an agent must check before replying
Correct answer: A trap message, which an agent transmits when interfaces fail
A trap is the unsolicited, agent-initiated SNMP message: the managed device raises it the instant an event such as a failed interface occurs, so the manager learns of the fault without waiting for the next poll. A GET travels the other way, from manager to agent, and returns data only when the manager asks for it. A walk is the same manager-driven polling repeated across a subtree of objects, so it also depends on the manager acting first. A community string is the shared credential SNMPv1 and v2c use to authorise a request; it is a password, not a message type, and it delivers no notification at all.
- A network administrator wants to block all inbound traffic from a specific subnet while permitting everything else, and applies an ordered list of permit and deny rules to a router interface. What security control is being described?
- A demilitarized zone, which advertises these external web or mail services
- An intrusion detection sensor, which watches over one isolated server host
- A network address translation pool, which hides the private host addresses
- An access control list, which permits or discards these individual packets
Correct answer: An access control list, which permits or discards these individual packets
An access control list is the described control: an ordered set of permit and deny statements applied to an interface and read from the top down, matching on source and destination address, port and protocol, with the first match acted on and an implicit deny at the end. A demilitarized zone is a network segment, so it places servers rather than filtering traffic. An intrusion detection sensor reports on the traffic it observes and drops nothing. A translation pool supplies public addresses for outbound sessions and makes no permit or deny decision.
- An organization places its public-facing web and email servers on a separate network segment positioned between the internet-facing firewall and the internal LAN, so that external users can reach those servers without being granted any path into the internal network. What is this segment called?
- A screened subnet, a guarded zone holding the public web servers
- A default gateway, the router address the host uses when leaving
- A broadcast domain, the span of ports an internal broadcast hits
- A trunk port, one cable carrying several tagged networks at once
Correct answer: A screened subnet, a guarded zone holding the public web servers
The segment is a screened subnet, still widely called a demilitarized zone or DMZ. It sits between the internet-facing firewall and the internal LAN and holds the servers outsiders must reach, so compromising a public server gives an attacker no path into the trusted network. A default gateway is a single router address a host sends off-network traffic to, not a place servers can live. A broadcast domain describes how far a broadcast travels, which says nothing about where a firewall puts public hosts. A trunk carries tagged traffic for many VLANs over one link and is not a security zone.
- A security analyst notices that the perimeter firewall permits inbound TCP packets with the ACK flag set even when no internal host initiated the session, allowing attackers to probe internal hosts. The analyst wants a firewall that tracks each connection in a state table and only allows return traffic that matches an existing session. Which firewall type meets this requirement?
- A packet-filter firewall, which tests each packet against rules
- A web application firewall, which examines HTTP session payload
- A stateful inspection firewall, which records each live session
- A host-based software firewall, which tracks one computer alone
Correct answer: A stateful inspection firewall, which records each live session
A stateful inspection firewall keeps a state table of active connections, holding source and destination address, ports and protocol, and admits an inbound packet only when it matches a session an internal host started, so a bare ACK from outside has no entry to match and is dropped. A packet-filter firewall judges every packet on its own against static rules and keeps no memory of earlier packets, which is exactly the weakness described. A web application firewall reads HTTP payloads for application attacks and maintains no transport state table. A host-based firewall protects one machine and changes nothing about how the perimeter treats unsolicited flags.
- A hospital encrypts patient records so that only clinicians with the proper key can read them, and unauthorized staff who access the database see only ciphertext. Which element of the CIA triad does this control most directly support?
- Availability of the hosted clinical service to remote users
- Integrity of the archived database records retained on disk
- Confidentiality of the patient data stored on those servers
- Accountability for the audit trail entries the system keeps
Correct answer: Confidentiality of the patient data stored on those servers
Encrypting the records supports confidentiality, the principle that information is disclosed only to parties holding authorisation, enforced here by the key: without it the data reads as ciphertext. Availability is about keeping the service reachable, and encryption does nothing to keep a database online. Integrity is about proving data has not been altered, which encryption on its own does not demonstrate. Accountability ties an action to the person who performed it and depends on logging, not on making data unreadable.
- A backup system computes a hash of each archived file and re-checks it on restore so administrators can prove the file was not modified while in storage. Which element of the CIA triad does this hashing practice primarily protect?
- Integrity of the preserved disk images stored inside the vault
- Availability of the backup restore service for the night staff
- Confidentiality of the archived file names on the tape volumes
- Non-repudiation of the admin actions taken at the main console
Correct answer: Integrity of the preserved disk images stored inside the vault
Recomputing a hash and comparing it on restore protects integrity: a matching digest shows the bytes are exactly what was written, and any alteration in storage changes the value. Availability concerns whether the restore can be performed at all, which a digest does not influence. Confidentiality concerns secrecy, and a hash leaves the file just as readable as before. Non-repudiation binds an act to an identity and needs a signature or a private key, not a plain checksum that anyone can recompute.
- A company deploys redundant power supplies, clustered servers, and a failover internet link specifically so that critical applications stay reachable during a component failure. Which element of the CIA triad are these measures designed to uphold?
- Integrity of the transaction log entries preserved on backup
- Confidentiality of the replicated node keys cached in memory
- Non-repudiation of the operator commands issued at a console
- Availability of the critical application to its remote users
Correct answer: Availability of the critical application to its remote users
Redundant supplies, clustered servers and a failover circuit all exist to keep the service reachable through a component failure, which is availability. Integrity concerns whether data is unaltered, and a second power supply neither detects nor prevents corruption. Confidentiality concerns who is able to read the data, which duplicated hardware does not restrict. Non-repudiation proves who performed an action and rests on cryptographic evidence rather than on spare capacity.
- After a security review, an organization configures every employee account to grant only the specific permissions required for that person's job and nothing more. Which security principle is being applied?
- Defense in depth, layering many independent controls on assets
- Least privilege, granting the minimum rights one duty requires
- Separation of duties, splitting each task between two staffers
- Implicit deny, blocking the traffic no explicit rule permitted
Correct answer: Least privilege, granting the minimum rights one duty requires
Scoping each account to exactly the permissions its holder needs is least privilege, and it limits the damage when any single account is compromised. Defense in depth is about stacking several different controls and says nothing about how wide one account's rights should be. Separation of duties divides a sensitive task so that no one person completes it alone, and it can leave each participant heavily privileged. Implicit deny is the default action at the end of a rule list; it governs traffic rather than user accounts.
- A network designer protects a data center with a perimeter firewall, internal segmentation, host antivirus, intrusion detection, and access controls, so that bypassing any single safeguard still leaves an attacker facing others. Which design strategy does this layering represent?
- Defense in depth, stacking several independent security layers
- Least privilege, granting each account the minimum permissions
- Network segmentation, dividing the traffic into separate zones
- Role-based access, mapping user permissions onto job functions
Correct answer: Defense in depth, stacking several independent security layers
Stacking a perimeter firewall, internal segmentation, host antivirus, intrusion detection and access control is defense in depth: the layers are independent, so defeating one still leaves an attacker facing the rest. Least privilege narrows what one identity may do and is a single layer inside this design rather than the design itself. Network segmentation is likewise one of the listed layers, not the strategy that combines them. Role-based access assigns rights by job function and again describes only one of the controls in the stack.
- A network running WPA3-Personal replaces the older pre-shared-key handshake with a method that performs a mutual authentication and key exchange resistant to offline dictionary attacks, even when users choose weak passwords. What is the name of this handshake?
- The WPA2 four-way handshake, an earlier pre-shared-key exchange
- Temporal Key Integrity Protocol, the deprecated WPA2 encryption
- Simultaneous Authentication of Equals, a dragonfly key exchange
- Protected EAP within 802.1X, one enterprise credential exchange
Correct answer: Simultaneous Authentication of Equals, a dragonfly key exchange
WPA3-Personal authenticates with Simultaneous Authentication of Equals, a dragonfly-based exchange in which both sides prove knowledge of the password and derive a fresh key, and which resists offline guessing even when the password is weak. The four-way handshake is precisely the WPA2 mechanism that SAE replaces, so it cannot be the new one. Temporal Key Integrity Protocol is a legacy encryption wrapper around RC4 and performs no authentication of either party. Protected EAP inside 802.1X belongs to the enterprise mode, where a RADIUS server validates individual credentials instead of one shared password.
- Compared with WPA2-Personal, what specific advantage does WPA3-Personal's SAE handshake provide if an attacker captures the wireless association exchange?
- A captured deauthentication frame cannot be used to spoof a disconnect
- A captured exchange yields nothing an attacker can crack offline later
- A captured frame still discloses the wireless network name and channel
- A captured packet remains encrypted using its own per-session pair key
Correct answer: A captured exchange yields nothing an attacker can crack offline later
SAE's advantage is that a recorded association exchange contains no value an attacker can grind against a wordlist offline, because neither side ever transmits material derived directly from the password; the WPA2 four-way handshake did expose exactly such a value. Protection of management frames is a separate WPA3 requirement that blocks forged disconnects and has no bearing on password recovery. The network name and channel are broadcast in the clear by every access point, so reading them from a capture is no gain over WPA2. Per-session keys were already used by WPA2, so that property is not what changed.
- An attacker on an access port crafts an Ethernet frame with two stacked 802.1Q tags. The first switch strips the outer tag matching its native VLAN and forwards the frame, which now carries the inner tag, onto a trunk so it lands in a VLAN the attacker should not reach. Which attack is this, and what is the primary mitigation?
- MAC flooding, blocked by port security limiting the number of learned MACs
- ARP poisoning, blocked by inspecting those ARP replies on each switch port
- Rogue DHCP replies, blocked by DHCP snooping on the untrusted access ports
- Double tagging, blocked by tagging each native VLAN across the trunk ports
Correct answer: Double tagging, blocked by tagging each native VLAN across the trunk ports
Stacking two 802.1Q tags is a double-tagging VLAN hopping attack: the first switch removes only the outer tag, because that tag matches its native VLAN, then forwards the frame onto a trunk still carrying the inner tag, which delivers it into a VLAN the attacker was never permitted to enter. Tagging the native VLAN on trunks, and keeping user ports off it, removes the untagged step the attack depends on. MAC flooding exhausts the address table to force flooding and involves no tags. ARP poisoning rewrites address-to-MAC mappings inside one VLAN. A rogue DHCP server issues bad configuration and never manipulates 802.1Q headers.
- A penetration tester connects a laptop to an unused wall jack and sends DTP negotiation frames, causing the switch port to form a trunk so the tester's device receives traffic for many VLANs. Which form of VLAN hopping is this, and what hardening step prevents it?
- Double tagging, prevented by tagging those native VLANs across the uplinks
- ARP poisoning, prevented by inspecting ARP traffic across each switch port
- MAC flooding, prevented by restricting the MAC addresses each port records
- Switch spoofing, prevented by disabling trunk negotiation at any edge port
Correct answer: Switch spoofing, prevented by disabling trunk negotiation at any edge port
Sending DTP frames so the port negotiates a trunk is switch spoofing: the attacker's host pretends to be a switch, and once the link trunks it receives traffic for every VLAN that trunk carries. Turning DTP off and hard-setting user ports to access mode leaves nothing to negotiate. Double tagging needs no negotiation at all and instead abuses the untagged native VLAN, so it is a different technique. ARP poisoning forges address mappings within one VLAN and gains no extra VLANs. MAC flooding fills the address table so frames are flooded, which never turns an access port into a trunk.
- On a shared LAN segment, an attacker continuously sends forged ARP replies that map the default gateway's IP address to the attacker's own MAC address, so victims' traffic flows through the attacker before reaching the gateway. What is this attack called and what role does the attacker now hold?
- MAC flooding, filling the address table so the switch floods traffic
- ARP poisoning, putting the attacker onto the path toward the gateway
- DNS poisoning, sending each victim to a server the attacker controls
- DHCP starvation, draining the free pool so clients receive no leases
Correct answer: ARP poisoning, putting the attacker onto the path toward the gateway
Forged ARP replies that bind the gateway's address to the attacker's MAC are ARP poisoning, and because victims now hand off-network traffic to the attacker first, the attacker holds an on-path position and can read or alter what passes. MAC flooding overwhelms the address table so the switch floods frames everywhere; it never rewrites a host's gateway mapping. DNS poisoning corrupts name resolution rather than the address-to-MAC binding used on the local segment. DHCP starvation consumes the address pool and denies leases, which blocks clients outright instead of quietly relaying their traffic.
- Users on one subnet are being redirected to a fraudulent banking site even though they typed the correct domain name. Investigation shows forged responses inserted into the resolver's cache so the legitimate hostname resolves to an attacker-controlled IP address. Which attack is occurring?
- A rogue DHCP server, leasing the clients a fraudulent gateway address
- ARP spoofing, binding the gateway address onto the attacker's own MAC
- DNS cache poisoning, binding a genuine hostname onto a hostile server
- An on-path TLS proxy, presenting its own certificate to these clients
Correct answer: DNS cache poisoning, binding a genuine hostname onto a hostile server
Forged records inserted into a resolver's cache, so that a legitimate hostname answers with an attacker's address, is DNS cache poisoning; that is why users who typed the correct domain still land on the fraudulent site. A rogue DHCP server hands out incorrect addressing, but the evidence here points at the resolver's stored records rather than at lease settings. ARP spoofing corrupts address-to-MAC bindings on one segment and leaves DNS answers untouched. An on-path TLS proxy would trigger certificate warnings and explains no poisoned cache entry.
- Shortly after a guest plugs an unauthorized device into a conference-room jack, clients across the VLAN begin receiving IP leases pointing to a wrong default gateway and an attacker-controlled DNS server. Which threat best explains this, and which switch feature is designed to stop it?
- A rogue DHCP server, which DHCP snooping blocks at untrusted ports
- An ARP poisoning host, which ARP inspection blocks at access ports
- A MAC flooding attack, which port security stops at switched ports
- A DNS spoofing record, which DNSSEC signing stops at the resolvers
Correct answer: A rogue DHCP server, which DHCP snooping blocks at untrusted ports
An unauthorised device answering lease requests with a false gateway and DNS server is a rogue DHCP server, and DHCP snooping is the switch feature built for it: ports are classified trusted or untrusted, and server-sourced messages arriving on an untrusted port are discarded. ARP poisoning corrupts address-to-MAC mappings and issues no lease, so it cannot explain clients receiving new IP settings. MAC flooding fills the switch address table to force flooding and hands out no configuration either. A spoofed DNS record misdirects name lookups, but the clients here were handed a wrong gateway as well, which only a DHCP answer can do.
- A switch port configured with port security is set so that if an unauthorized MAC address appears, the port immediately shuts down into an error-disabled state and logs the event. Which port-security violation mode is in use?
- Protect mode, which drops unauthorized frames but logs no event
- Shutdown mode, which disables the port then logs each violation
- Restrict mode, which drops frames, logs the event, counts these
- Sticky learning, which writes the learned MAC address to config
Correct answer: Shutdown mode, which disables the port then logs each violation
Shutdown is the port-security violation mode that error-disables the interface and records the event, which is the behaviour described. Protect mode quietly discards traffic from unknown addresses and raises no notification, so it cannot account for the log entry. Restrict mode also discards that traffic and does notify, but it deliberately leaves the port forwarding for permitted addresses instead of taking it down. Sticky learning is not a violation response at all; it is the feature that writes dynamically learned addresses into the configuration.
- A network uses 802.1X to control who may connect to switch ports. In this framework, what are the three roles, and which device functions as the authenticator?
- Supplicant, authenticator, and server; here the switch is the authenticator
- Initiator, authenticator, plus target; here the target is the authenticator
- Requester, authenticator, and relays; here the gateway is the authenticator
- Client, authenticator, and directory; here the browser is the authenticator
Correct answer: Supplicant, authenticator, and server; here the switch is the authenticator
802.1X defines three roles: the supplicant, which is the client asking for access; the authenticator, which is the switch port or access point holding that port closed and relaying credentials; and the authentication server, usually RADIUS, which decides. The switch is therefore the authenticator. Initiator and target are iSCSI storage roles and have no part in port-based access control, so a target authenticates nobody. A requester and a relay belong to DHCP, where the relay only forwards broadcasts. Naming the browser as authenticator inverts the model, since the device being admitted can never be the device that admits it.
- An enterprise issues each VPN gateway and web server a digital certificate signed by an internal certificate authority, and plans how those certificates are generated, distributed, renewed before expiration, and revoked when compromised. What is this overall practice called?
- Identity federation, accepting logins issued by another business
- IP address management, tracking subnets and unassigned addresses
- Certificate lifecycle management, issuing and revoking user keys
- Configuration management, versioning each device setting in turn
Correct answer: Certificate lifecycle management, issuing and revoking user keys
Planning how certificates are generated, distributed, renewed before expiry and revoked once compromised is certificate lifecycle management, the operational half of a public key infrastructure built around a certificate authority. Identity federation lets one organisation accept another's authentication decisions; it neither mints nor revokes the credentials themselves. IP address management tracks subnets, scopes and leases, which is addressing rather than trust material. Configuration management versions device settings and would never revoke a compromised certificate.
- A technician opens a trouble ticket and begins by interviewing the affected user, asking what changed recently and reproducing the reported symptom. Which step of the CompTIA Network+ troubleshooting methodology is the technician performing?
- Establish a theory of probable cause behind the reported failure
- Test the theory by disconnecting one suspected device or service
- Document the findings, the actions taken and their final outcome
- Identify the problem by questioning the users and reproducing it
Correct answer: Identify the problem by questioning the users and reproducing it
Interviewing the user, asking what recently changed and reproducing the symptom all belong to the first step, identify the problem, whose whole purpose is to gather information and establish what is actually happening. Establishing a theory of probable cause comes second and presupposes that the symptoms are already understood. Testing a theory is later still and requires a theory to exist first. Documentation is the closing step and records work that has already been done.
- After confirming a theory that a misconfigured DHCP scope is causing address conflicts, a technician resolves the issue, then re-tests printing, file shares, and internet access for the affected users. Which methodology step does this re-testing represent?
- Establish a plan of action and document the possible side effects
- Retest the theory to determine the causes of the reported failure
- Document the findings, the actions taken and each of the outcomes
- Verify the whole system works and add any preventive steps needed
Correct answer: Verify the whole system works and add any preventive steps needed
Re-testing printing, file shares and internet access after the fix is the verify full system functionality step, which confirms the whole affected environment works before the ticket is closed and is where preventive measures are added. Establishing a plan of action happens before anything is changed. Testing the theory happens earlier still and was already finished when the scope misconfiguration was confirmed. Documenting findings is the final step and follows verification rather than replacing it.
- A technician suspects a single switch is the source of a problem and decides to start checking at the OSI Physical layer, working upward toward the Application layer. Which troubleshooting approach best describes this?
- The top-to-bottom approach, which begins with the application layer
- The divide-and-conquer approach, which begins at some middle layers
- The bottom-to-top approach, which starts from that physical cabling
- The substitution approach, which means swapping in known-good parts
Correct answer: The bottom-to-top approach, which starts from that physical cabling
Starting at the physical layer and working upward is the bottom-to-top OSI approach, a natural choice when one device is suspected, because cabling, power and link status are checked first. The top-to-bottom approach runs the other way, opening at the application layer. Divide and conquer begins in the middle of the stack and moves up or down depending on what the first test shows. Substitution swaps a suspect component for a known-good one and works through no layers in sequence at all.
- During the troubleshooting process, a technician's first theory about the cause is disproven by testing. According to the CompTIA methodology, what are the two acceptable next actions?
- Establish a fresh theory of probable cause, or escalate this entire case
- Verify the full system functionality, or add any of its preventive steps
- Document the findings and the outcomes, then close out this whole ticket
- Implement the proposed fix, or escalate the first of the probable causes
Correct answer: Establish a fresh theory of probable cause, or escalate this entire case
When testing fails to confirm a theory the methodology allows exactly two moves: form a new theory of probable cause, or escalate to someone with deeper access or authority. Verifying full system functionality assumes a fix has already been applied, and none has. Documenting and closing the ticket would end the job with the cause still unknown. Implementing a fix jumps to a step that only follows a theory testing has actually confirmed, so it cannot come next here.
- A user reports choppy audio and brief gaps during VoIP calls, even though file downloads complete at full speed. The variation in delay between consecutive voice packets arriving at the phone is the likely cause. What is this variation called?
- Latency, the total one-way delay a single packet takes before arriving
- Jitter, the fluctuating gaps between packets as they reach a telephone
- Packet loss, the proportion of packets dropped before they ever arrive
- Attenuation, the loss of signal strength along a lengthy cable segment
Correct answer: Jitter, the fluctuating gaps between packets as they reach a telephone
Variation in the arrival spacing of consecutive packets is jitter, and a jitter buffer can only absorb so much of it before voice arrives in irregular clumps and the caller hears clicks and gaps. Latency is the delay itself, and a high but steady delay makes a call feel slow rather than choppy. Packet loss removes packets outright, and downloads completing at full speed argue against it. Attenuation weakens a signal over distance and is a cabling fault, not a timing one.
- A network monitoring tool reports that 4 percent of packets sent across a WAN link never reach their destination, with no corresponding corruption errors. What networking issue is described, and what is its most common cause?
- Packet loss, most often from congestion filling up a queue buffer
- Latency, most often from a lengthy path crossing many router hops
- Jitter, most often from queues that drain at widely varying rates
- Attenuation, most often from a copper run beyond its length limit
Correct answer: Packet loss, most often from congestion filling up a queue buffer
Frames that never arrive, with no corruption counted anywhere, describe packet loss, and its usual source is congestion: once a router or switch buffer fills, further arrivals are simply discarded, with an outage along the path the other common cause. Latency delays traffic but still delivers it. Jitter is about uneven spacing among packets that do arrive. Attenuation weakens the signal and shows up as errored or corrupted frames, which the monitoring tool explicitly did not see.
- A technician runs a cable a distance well beyond the 100-meter limit for a Category 6 copper Ethernet link, and devices at the far end experience errors and reduced throughput. The gradual weakening of the electrical signal as it travels the length of the cable is responsible. What is this phenomenon called?
- Crosstalk, the coupling of one signal from one pair into another
- Jitter, the irregular spacing of packets as they reach a handset
- Latency, the delay each frame takes crossing a rather long route
- Attenuation, the fading of a signal's strength along a cable run
Correct answer: Attenuation, the fading of a signal's strength along a cable run
The gradual weakening of a signal as it travels down a conductor is attenuation, and because copper attenuates far faster than fibre it is the reason a Category 6 Ethernet run is limited to 100 metres. Crosstalk is energy coupling between neighbouring pairs, which corrupts a signal rather than weakening it. Jitter describes uneven packet timing and has no relation to cable length. Latency is how long delivery takes and would not by itself raise the error counters seen here.
- While certifying a UTP cable run, a technician measures unwanted signal bleeding from one wire pair into an adjacent pair within the same cable. What is this interference called?
- Attenuation, the gradual loss of one signal along a copper segment
- Crosstalk, the bleeding of signals from one pair into its neighbor
- Latency, the time each frame spends travelling to its far endpoint
- Jitter, the uneven arrival spacing of packets within a data stream
Correct answer: Crosstalk, the bleeding of signals from one pair into its neighbor
Signal energy coupling out of one pair and into an adjacent pair inside the same sheath is crosstalk, and it is the reason the conductors are twisted at differing rates in the first place. Attenuation is loss of strength along the run, not interference between neighbouring conductors. Latency measures how long delivery takes and is not a cabling certification result. Jitter describes uneven packet timing and is measured on live traffic, never on a pair being certified.
- A wireless client's utility reports an RSSI of -45 dBm. What does this value indicate about the received signal, and roughly how good is it?
- A marginal reading, since it barely exceeds the local radio noise floor here
- A failing reading, since a client roams away from such weak signal strengths
- A strong reading, since RSSI nears zero as the received power keeps climbing
- A throughput figure, since RSSI follows the data rate a radio has negotiated
Correct answer: A strong reading, since RSSI nears zero as the received power keeps climbing
RSSI is reported in dBm on a negative scale, so a value close to zero means more received power and a more negative value means less; at -45 dBm the client sits close to the access point and the signal is excellent. Calling it marginal reverses the scale, because the noise floor lies far lower, nearer -90 dBm. Nothing at this level would drive a client to roam, since roaming thresholds are set well below it. RSSI reports received power, not the data rate a radio has negotiated.
- A help-desk technician needs to test basic reachability to a remote server and measure round-trip time, but does not need to see the path taken. Which command-line utility is the most appropriate first choice?
- traceroute, which lists each router hop between you and the target
- nslookup, which queries one name server for the records it returns
- ping, which sends echo requests and then times each reply received
- netstat, which lists the sockets and listening ports for a machine
Correct answer: ping, which sends echo requests and then times each reply received
ping is the right first tool: it sends ICMP echo requests, reports whether replies come back and prints the round-trip time for each, which is precisely reachability plus timing. traceroute would also prove reachability but spends extra probes exposing the hop-by-hop path the technician explicitly does not need. nslookup resolves names and never tests whether the host answers. netstat reports connections on the local machine and sends nothing at all to the remote server.
- What is the key functional difference between ping and traceroute?
- ping enumerates each router hop and its delays; traceroute validates that endpoint
- ping reports reachability and the round-trip time; traceroute lists each hop taken
- ping translates names into addresses; traceroute resolves them into the MAC values
- ping estimates the link bandwidth; traceroute estimates the losses plus the delays
Correct answer: ping reports reachability and the round-trip time; traceroute lists each hop taken
ping asks a single destination whether it is reachable and how long a round trip takes, while traceroute enumerates the routers between source and destination by raising the TTL on successive probes and collecting the time-exceeded replies. Swapping the two, so that ping walks the path, gives each tool the other's job. Neither utility performs address-to-MAC resolution, which is what ARP does on the local segment. Neither measures link bandwidth either; that needs a throughput tool such as iperf.
- A technician wants to identify where along a path traffic to a remote host is being delayed or dropped, listing each intermediate router. How does traceroute accomplish this?
- It reads the local routing tables and prints that next hop recorded there
- It probes each router by SNMP and then reads the interface counters found
- It sends an echo request to that broadcast address and lists the repliers
- It raises the TTL by one per probe and collects each time-exceeded answer
Correct answer: It raises the TTL by one per probe and collects each time-exceeded answer
traceroute sends probes whose Time To Live starts at one and increases by one each round. Every router decrements the TTL, and the router at which it reaches zero discards the probe and returns an ICMP time-exceeded message, revealing that router's address and the round-trip time to it; repeating the process walks the path outward hop by hop. Reading the local routing table shows only the first hop this host would use. SNMP polling needs credentials on routers that are usually outside the technician's control and is not how the tool works. A broadcast echo request reaches only the local segment and reveals no ordered path.
- A Windows technician needs to view a workstation's current IPv4 address, subnet mask, and default gateway during troubleshooting. Which command should be used?
- ipconfig, which prints the whole IP configuration of a Windows workstation
- getmac, which lists the hardware address of each installed network adapter
- netstat, which enumerates the address and ports for each active connection
- route print, which displays each default gateway and its interface metrics
Correct answer: ipconfig, which prints the whole IP configuration of a Windows workstation
ipconfig prints the interface configuration on Windows, including the IPv4 address, the subnet mask and the default gateway, which is exactly the set of values wanted here. getmac returns layer-two hardware addresses and shows no IP settings at all. netstat enumerates connections and listening ports rather than the interface's own addressing. route print does show the gateway, but it displays the routing table instead of the address and mask assigned to the adapter.
- A technician resolved a DNS misconfiguration but discovers the workstation still resolves the old, incorrect IP address from its local cache. Which command most directly addresses this on a Windows host?
- arp -d, which discards the remembered IP-to-MAC mappings on this workstation
- ipconfig /flushdns, which discards the recorded name answers on this machine
- netsh winsock reset, which rebuilds the layered socket catalogs it maintains
- ipconfig /registerdns, which refreshes this host's own records at the server
Correct answer: ipconfig /flushdns, which discards the recorded name answers on this machine
ipconfig /flushdns empties the local DNS resolver cache, so the next lookup is answered by the now-corrected server instead of from the stale entry the workstation kept. arp -d clears an entirely different cache: it holds address-to-MAC mappings and stores no name records. netsh winsock reset rebuilds the Winsock catalog, which affects layered service providers and leaves cached names exactly where they were. ipconfig /registerdns pushes this host's own record up to the server and discards nothing the resolver has already stored.
- A technician needs to confirm which IP address a hostname resolves to and verify that the DNS server is answering queries correctly. Which tool is purpose-built for this?
- netstat or ss, which enumerate the connections a machine currently has open
- tcpdump or Wireshark, which record the raw frames crossing a live interface
- nslookup or dig, which interrogate a chosen name server and display records
- arp or ip neigh, which enumerate those neighbors one machine has discovered
Correct answer: nslookup or dig, which interrogate a chosen name server and display records
nslookup and its Unix counterpart dig are built to interrogate DNS directly: they send a query to a chosen server and print the records returned, which both confirms the address a hostname resolves to and shows whether that server answers correctly. netstat and ss enumerate local sockets and issue no DNS query. tcpdump and Wireshark can capture DNS traffic, but only if some other process happens to send it, and they ask the server nothing themselves. arp and ip neigh report layer-two neighbours on the local segment.
- After a workstation cannot reach a host on its own subnet, a technician suspects a stale or incorrect IP-to-MAC mapping. Which command displays the local table of IP-to-MAC address mappings?
- route print, which displays the routes and the gateways this host uses
- nslookup, which displays the records a name server stores for one host
- ping -a, which displays the hostname that answers for a chosen address
- arp -a, which shows the IP-to-MAC entries this host has already cached
Correct answer: arp -a, which shows the IP-to-MAC entries this host has already cached
arp -a prints the ARP cache, the table of address-to-MAC mappings the host has learned on its own segment, so a stale or wrong entry there explains why a local host is unreachable despite correct addressing. route print shows where traffic is sent for each destination network, which is a routing question rather than a mapping one. nslookup queries DNS and returns name records, never hardware addresses. ping -a performs a reverse name lookup on an address and still reports no MAC.
- A technician needs to see all active TCP connections and listening ports on a server suspected of running an unauthorized service. Which utility provides this information?
- netstat, which lists the opened sockets and listening ports on this server
- arp, which lists the IP-to-MAC mappings one server has noticed and learned
- traceroute, which lists the routers one packet passes in reaching a target
- ping, which collects the replies each active server sends back in sequence
Correct answer: netstat, which lists the opened sockets and listening ports on this server
netstat enumerates the connections a host has open and the ports on which it is listening, so an unexpected listener belonging to an unauthorised service shows up immediately. arp reports address-to-MAC mappings for the local segment and says nothing about which processes hold ports. traceroute maps the path toward some other destination and inspects no local sockets. ping only confirms that a target answers and reports timing, neither of which reveals an open port.
- A security analyst needs to capture and inspect the actual packet contents crossing a Linux server's interface to diagnose a protocol-level problem. Which command-line tool is most appropriate?
- tcpdump, which duplicates those frames on this interface into a capture file
- netstat, which displays the sockets one Linux server currently has left open
- iperf3, which reports the throughput a single link sustains while under load
- ss, which summarizes the socket table and its currently reported states here
Correct answer: tcpdump, which duplicates those frames on this interface into a capture file
tcpdump captures packets from an interface and decodes them, so the analyst can read the actual protocol exchange rather than infer it, which is what a protocol-level fault requires. netstat lists sockets and their states but never shows the bytes on the wire. iperf3 generates its own traffic to measure throughput and captures nothing that was already flowing. ss reports socket information faster than netstat and is still a socket lister, not a capture tool.
- A technician needs to map which switch port a server is connected to and what device sits on the other end of a link, using information advertised by the directly connected switch. Which protocols provide this neighbor-discovery information?
- SNMP or syslog, which deliver device counters and events to one collector
- LLDP or CDP, which carry the neighbor details between two linked switches
- NTP or PTP, which distribute one shared clock across each attached device
- SMTP or IMAP, which transport messages between one client and its servers
Correct answer: LLDP or CDP, which carry the neighbor details between two linked switches
LLDP, and the Cisco-proprietary CDP, are neighbour discovery protocols: directly connected devices advertise their identity, port and capabilities to each other, which is how a technician learns which switch port a server occupies and what sits at the far end of a link. SNMP and syslog move counters and log messages to a management station and describe no adjacency. NTP and PTP distribute time. SMTP and IMAP move mail and reveal nothing about physical topology.
- Wireless users in one corner of an office report intermittent disconnects. A technician wants to view channel utilization, overlapping access points, and signal strength on each band. Which tool is the best fit?
- A spectrum analyzer, which registers RF energy and noise across bands
- A protocol analyzer, which decodes those frames captured on a segment
- A Wi-Fi analyzer, which reports the channel load, overlap and signals
- A cable tester, which confirms each wire mapping throughout one cable
Correct answer: A Wi-Fi analyzer, which reports the channel load, overlap and signals
A Wi-Fi analyzer surveys the 802.11 environment and reports channel utilisation, which access points compete on overlapping channels, and the received strength of each, which is exactly what intermittent wireless disconnects call for. A spectrum analyzer sees raw RF energy, including non-802.11 sources, but identifies no access points and no channels in use. A protocol analyzer decodes frames once they are captured and reports nothing about coverage. A cable tester works on copper runs and cannot assess radio conditions.
- After terminating several new Ethernet drops, a technician needs to confirm each pair is connected to the correct pin and that there are no opens, shorts, or miswires. Which tool verifies this?
- A toner probe, which follows each pair back to the wall terminations
- A loopback plug, which returns a port's own transmitted signal to it
- A multimeter, which finds the opens and shorts on a single conductor
- A cable tester, which checks each pin and identifies opens or shorts
Correct answer: A cable tester, which checks each pin and identifies opens or shorts
A cable tester checks the finished run end to end: it verifies continuity on all eight conductors, confirms that each one lands on the correct pin, and reports opens, shorts, reversals and split pairs. A toner probe only locates where a cable goes and says nothing about pinout. A loopback plug exercises one interface by folding its transmit path back on itself and tests no cable. A multimeter can find a break on one conductor at a time but produces no pin-to-pin wire map.
- Two newly created twisted-pair patch cables fail an end-to-end test: the technician finds that pairs are landed in different pin orders on each end, even though continuity exists on all eight conductors. What is the most likely fault?
- A split pair, where two conductors from separate pairs carry one signal
- Attenuation, where the run goes past the 100-meter limit set for copper
- A duplex mismatch, where one interface runs half and another runs fully
- A standard mismatch, where one connector uses T568A and the other T568B
Correct answer: A standard mismatch, where one connector uses T568A and the other T568B
Continuity on all eight conductors combined with a different pin order at each end means the two ends were terminated to different wiring standards, one to T568A and one to T568B, so the cable behaves as an unintended crossover. A split pair keeps the same pin numbers at both ends while pairing the wrong conductors together, so it fails a wire map differently. Attenuation depends on length and cannot reorder pins. A duplex mismatch is an interface setting and changes nothing about how a connector was punched down.
- Users on a gigabit link complain of slow transfers and high error counts. The interface shows a large number of late collisions and CRC errors. What configuration problem most commonly produces this symptom?
- An MTU mismatch, which requires a gateway to fragment each of those datagrams
- Electrical noise on an unshielded link, which disrupts many of the CRC checks
- A duplex mismatch, which leaves one side of the cable sensing late collisions
- A copper run past its length limits, which weakens each signal arriving there
Correct answer: A duplex mismatch, which leaves one side of the cable sensing late collisions
Late collisions together with CRC errors on a gigabit link point to a duplex mismatch: the half-duplex end applies carrier sense and registers a collision whenever the full-duplex end transmits at will, so frames are aborted late and arrive damaged. An MTU mismatch causes fragmentation or dropped oversized frames, never collisions. Electrical noise can raise CRC counts but produces no late collisions, because nothing is contending for the medium. An over-length run likewise corrupts frames without creating any collision event.
- A fiber-optic run between two buildings shows very low light levels at the receiving transceiver and an unstable link. The cables and connectors are intact. Which physical-layer issue is the most likely cause specific to fiber?
- A single-mode strand spliced to multimode
- A chromatic dispersion penalty over spans
- A modal bandwidth limitation across cores
- A duplex negotiation failure at receivers
Correct answer: A single-mode strand spliced to multimode
Joining single-mode fiber to multimode fiber discards most of the launched light at the junction, because the core diameters and modal fields do not match. That produces exactly this picture: hardware that inspects as intact, very low received optical power, and a link that flaps as the receiver hovers near its sensitivity threshold. Chromatic dispersion spreads pulses in time and raises the bit error rate, but it does not lower received power. A modal bandwidth ceiling caps how fast a multimode run can be driven over a given distance and again does not attenuate the signal. Duplex negotiation happens above the physical layer and cannot change how much light reaches the detector.
- A technician troubleshooting interference on copper cabling near an industrial motor recalls that this type of interference affects copper but not fiber. What is this interference called, and why is fiber immune?
- Pair-to-pair crosstalk; fiber resists it because no two strands share a channel for it to jump
- Electromagnetic interference; fiber resists it because it holds no metal for a field to act on
- Distance attenuation; fiber resists it because a glass core loses far less power in each metre
- Timing jitter; fiber resists it because a light pulse simply travels at one steady known speed
Correct answer: Electromagnetic interference; fiber resists it because it holds no metal for a field to act on
A motor, a ballast or a power conduit radiates an electromagnetic field, and that field induces unwanted voltage in any nearby conductor, which is why copper suffers electromagnetic interference. An optical fiber signals with light in a glass core and offers the field no conductor to act on, so the field passes through with no effect. Crosstalk is coupling between two copper pairs in the same sheath, not radiation from a motor, so it names the wrong impairment. Attenuation is loss of strength with distance and it affects glass as well as copper, so fiber is not immune to it. Jitter is variation in arrival timing produced by queuing and processing, and fiber carries jittered traffic exactly as copper does.
- A user reports that web pages load but feel sluggish, and a ping to the server shows consistently high round-trip times of around 350 ms with no dropped replies. Which performance issue is most directly indicated?
- Packet loss on the return path alone
- Jitter between each of the ping runs
- High latency on the whole round trip
- Attenuation on the cable to the wall
Correct answer: High latency on the whole round trip
A round-trip time that sits steadily near 350 milliseconds with every reply returning is the definition of high latency: the packets all arrive, they simply take a long time to do it, which is why pages render but feel slow. Packet loss is ruled out because no replies were dropped. Jitter is variation between successive measurements, and these times are described as consistent rather than swinging. Attenuation weakens a signal on a cable run and shows up as errors or a dead link, not as a uniform delay that every reply shares.
- A new VoIP deployment suffers from both dropped audio and inconsistent call quality. A technician confirms the link is congested during peak hours, with full buffers on the WAN router. Which two performance symptoms is this congestion most likely to produce together?
- Crosstalk and attenuation on the copper runs
- Fragmentation and MTU mismatch on the tunnel
- Channel overlap and weak signals on antennas
- Packet loss and jitter under buffer overflow
Correct answer: Packet loss and jitter under buffer overflow
When a WAN interface stays busy its queues fill, so newly arriving packets are discarded once the buffer is full and the packets that do get through wait a different amount of time depending on how deep the queue was, which is loss plus jitter. Voice is sensitive to both, so calls break up and quality wanders. Crosstalk and attenuation are copper cabling faults that congestion does not create. Fragmentation and an MTU mismatch come from packet sizing on a tunnel, not from a full buffer. Channel overlap and weak signal are wireless radio conditions and have nothing to do with a congested wired WAN link.
- A web client establishes an unencrypted connection to a web server to retrieve a standard HTML page. Which well-known TCP port does plaintext HTTP traffic use by default?
- TCP port 22
- TCP port 25
- TCP port 80
- TCP port 53
Correct answer: TCP port 80
Plaintext HTTP is registered on TCP port 80, so an unencrypted request for a web page is sent there by default. TCP port 22 carries SSH and SFTP sessions. TCP port 25 carries server-to-server SMTP mail relay. Port 53 is the DNS service, used to resolve the web server's name before the page request is ever sent. None of those three deliver web content.
- A network administrator configures separate broadcast domains on a single physical switch so that the accounting and engineering departments cannot see each other's broadcast traffic, without adding more hardware. Which technology accomplishes this logical segmentation?
- Spanning tree blocking inside the switch
- Link aggregation pairs inside the switch
- Port mirroring streams inside the switch
- Virtual LAN separation inside the switch
Correct answer: Virtual LAN separation inside the switch
A virtual LAN divides one physical switch into several logical broadcast domains, so accounting frames and engineering frames never reach each other even though both departments plug into the same box, and no extra hardware is needed. Spanning tree blocks redundant links to stop loops; it does not separate departments. Link aggregation bundles several physical links into one logical link for bandwidth and redundancy. Port mirroring copies frames to an analyzer port for capture. None of the other three creates a second broadcast domain.
- An organization adopts a network architecture that decouples the control plane from the data plane, allowing a centralized controller to program forwarding behavior across many devices programmatically. Which concept describes this approach?
- The network address translation approach
- The software defined networking approach
- The virtualized private network approach
- The network traffic engineering approach
Correct answer: The software defined networking approach
Software-defined networking is the architecture that lifts the control plane out of each individual device and gives it to a central controller, which then programs the forwarding tables of the data plane through an API. Network address translation rewrites addresses and ports at a boundary so private hosts can share public addressing; it changes packets, not the location of the control plane. A virtualized private network builds an encrypted tunnel across an untrusted path. Traffic engineering steers flows onto chosen paths to use capacity better, and it can be done with the control plane still living on every device. Only the first separates the two planes.
- A student maps the four layers of the TCP/IP model. Which layer of the TCP/IP model contains both TCP and UDP?
- Transport layer (segments and datagrams)
- Application layer (requests and replies)
- Internet layer (prefixes and addressing)
- Link layer (switching and interconnects)
Correct answer: Transport layer (segments and datagrams)
TCP and UDP are the two host-to-host protocols of the TCP/IP model, and both live at the Transport layer, where TCP produces reliable ordered segments and UDP produces connectionless datagrams. The Application layer holds the protocols that generate user traffic, such as HTTP and DNS. The Internet layer holds IP itself along with ICMP and routing, and it moves packets between networks using their prefixes. The Link layer covers framing and media access on the local segment. None of those three defines the port-based end-to-end protocols the question asks about.
- An IPv6 host generates its own global unicast address by combining a router-advertised prefix with an interface identifier, without using a DHCP server. Which IPv6 mechanism is being used?
- Link-local address self-assignment by this host
- Stateless address autoconfiguration of the host
- Neighbour solicitation probing across this link
- Router advertisement toward the default gateway
Correct answer: Stateless address autoconfiguration of the host
Stateless address autoconfiguration is the mechanism where a host listens for a router advertisement, takes the announced prefix, appends an interface identifier it derives for itself, and ends up with a routable global unicast address without ever contacting a server. Link-local self-assignment also needs no server, but it only ever yields an fe80:: address that cannot leave the segment. Neighbour solicitation probing is how a host proves a candidate address is unused before it commits to it, so it validates an address rather than building one. A router advertisement travels from the router to the hosts and carries the prefix; sending one toward the gateway is the wrong direction and is not how a host forms its address.
- A content delivery provider advertises the same IP address from multiple geographic locations so that client requests are routed to the nearest available server. Which IP addressing/traffic delivery method describes sending to the nearest member of a group sharing one address?
- Anycast address delivery
- Multicast group delivery
- Broadcast flood delivery
- Unicast session delivery
Correct answer: Anycast address delivery
Anycast gives the same address to several servers in different places and lets routing decide which one is closest, so a request is delivered to exactly one member of the group, the topologically nearest. Multicast delivers one copy of a stream to every subscriber that has joined a group address. Broadcast floods a frame to every host on the local segment. Unicast is a one-to-one exchange with a single uniquely addressed host. Only anycast shares one address across many locations while still delivering to a single destination.
- A technician must allow a secure, encrypted remote desktop session to a Windows server. Which port does the Remote Desktop Protocol (RDP) use by default?
- TCP port 3306
- TCP port 5060
- TCP port 5900
- TCP port 3389
Correct answer: TCP port 3389
The Remote Desktop Protocol listens on TCP port 3389, so a graphical remote session to a Windows server is opened there by default. TCP port 3306 is the MySQL database service. TCP port 5060 carries SIP call signalling for voice deployments. TCP port 5900 belongs to VNC, which is a different remote-control product entirely. Only 3389 answers the question asked.
- A network designer connects every workstation to a single central switch so that each device has its own dedicated cable run to that switch. Which physical network topology is described?
- A backbone bus topology
- A looping ring topology
- A central star topology
- A partial mesh topology
Correct answer: A central star topology
A star runs one dedicated cable from every endpoint to a single central device, which is exactly the wiring described, and it is the standard pattern in modern switched Ethernet. A bus shares one common cable that every station taps, so there is no dedicated run per device. A ring passes traffic from neighbour to neighbour around a closed loop. A mesh gives devices direct links to one another rather than to one shared centre. Only the star matches one dedicated run per workstation into one central switch.
- A team uses version-controlled configuration files and automation tools to provision and manage network device configurations consistently and repeatably, rather than configuring each device by hand. Which practice does this describe?
- The zero touch provisioning routine
- The software defined network design
- The virtual network function scheme
- The infrastructure as code practice
Correct answer: The infrastructure as code practice
Infrastructure as code keeps device configuration in version-controlled files and applies it with automation, so the same definition can be reviewed, rolled back, and reapplied to produce identical results every time. Zero-touch provisioning only covers the first boot of a new device, which then pulls an image and a starting configuration. Network functions virtualization runs appliance roles as software on general-purpose servers. Software-defined networking centralizes the control plane behind a controller. None of those three is the practice of storing configuration as reviewed, repeatable source files.
- A technician compares how many collision domains and broadcast domains exist on an Ethernet switch that has no VLANs configured. For such a switch, which statement is correct?
- Each port is its own broadcast domain but every port shares one collision domain
- Each port sits in one shared collision domain and in one shared broadcast domain
- Each port is its own collision domain but every port shares one broadcast domain
- Each port forms its own collision domain and forms its own broadcast domain also
Correct answer: Each port is its own collision domain but every port shares one broadcast domain
A switch forwards rather than repeats, so it terminates contention at each interface: one port, one collision domain, which is why a full-duplex switched port never sees a collision at all. Broadcast frames are a different matter, because a switch floods them out of every other port, and with no VLANs configured the whole switch is a single broadcast domain. Reversing the two is wrong because broadcasts are flooded and contention is not. Treating the whole switch as one collision domain describes a hub, not a switch. Giving every port its own broadcast domain describes a router, or a switch on which each port has been placed in a separate VLAN.
- DHCP clients sit on VLAN 30, while the DHCP server is on a different subnet reachable through a router. Broadcast DHCP DISCOVER messages cannot cross the router. What should the administrator configure on the router's VLAN 30 interface so clients can obtain addresses from the remote server?
- A DHCP relay agent aimed toward one server
- A static route added toward the far server
- An inbound filter permitting UDP 67 and 68
- A second DHCP scope defined on this router
Correct answer: A DHCP relay agent aimed toward one server
A relay agent, configured on the interface facing the clients, catches the local broadcast, rewrites it as a unicast toward the address of the remote server, and stamps in the subnet the request arrived on so the correct scope is chosen. A static route only tells the router how to reach a network; it does nothing about a broadcast that never leaves the segment in the first place. A filter can permit or deny traffic that is already being forwarded, but a router does not forward a link-local broadcast, so permitting the ports changes nothing. Defining a scope on the router turns the router itself into the server, which is a different design and does not let clients use the existing remote server.
- A monitoring system queries each network device at fixed 60-second intervals to retrieve interface counters and CPU statistics. Which SNMP operation describes this regularly scheduled request-and-response data collection?
- Trap alerting sent from managed devices
- Periodic polling of the managed devices
- Inform messaging to the network manager
- Message queueing inside the local agent
Correct answer: Periodic polling of the managed devices
Polling is the manager-initiated half of SNMP: the management station sends a get request to each agent on a timer and the agent answers with the current value, which is precisely the interval-driven request-and-response cycle described. A trap is the reverse direction and is unsolicited, sent by the agent only when something happens. An inform is a trap the manager acknowledges, so it is still agent-initiated and event-driven. Queueing notifications on the agent describes how pending messages are held, not how a manager gathers counters on a schedule.
- An engineer needs to look up the specific numeric identifier that represents the 'interface inbound errors' counter inside a device's SNMP management information base. Which term describes that numeric identifier?
- The object identifier (OID) value
- The community string (SNMP) value
- The enterprise number (PEN) value
- The management branch (MIB) value
Correct answer: The object identifier (OID) value
Every managed object in a management information base is named by an object identifier, a dotted numeric path, and it is that path a manager quotes when it asks for the inbound error counter on a particular interface. A community string is the shared secret that authorizes an SNMP request rather than a name for any counter. A private enterprise number identifies the vendor that owns a branch of the tree, so it names a manufacturer, not a value. A management branch is a whole subtree of related objects; it groups counters instead of pinpointing the single one being read.
- A network team reviews a captured device log and sees that every event message carries a numeric severity level, where lower numbers indicate more urgent conditions. According to standard logging severity ordering, which level represents the most severe condition?
- The Critical condition keyword
- The Alert notification keyword
- The Error announcement keyword
- The Emergency severity keyword
Correct answer: The Emergency severity keyword
Standard syslog severities run from zero through seven, and the keyword sitting at zero, the most severe end of the scale, is Emergency, which is reserved for a system that has become unusable. Alert sits one step down at level one and means a condition needing immediate attention. Critical sits at level two for a hard failure that has not yet taken the system down. Error sits at level three and simply records a failed operation. All three of those are less severe than Emergency, so none of them represents the most urgent condition a device can log.
- An administrator notices that several switches have drifted from the approved standard build, with extra VLANs and inconsistent settings that no one documented. Which network-operations practice is designed to prevent this kind of unapproved deviation from the baseline build?
- Performance benchmarking for the device builds
- Inventory reconciliation for the device builds
- Configuration management for the device builds
- Requirements forecasting for the device builds
Correct answer: Configuration management for the device builds
Configuration management is the discipline that defines an approved baseline build, records what each device is actually running, and detects and corrects drift away from that baseline, which is precisely what the undocumented extra VLANs represent. Performance benchmarking measures how fast a device or link is performing and never compares settings against a standard. Inventory reconciliation confirms that the hardware on record is the hardware in the rack, which is an asset question rather than a configuration one. Requirements forecasting estimates what capacity will be needed later. None of those three would notice a setting that no one approved.
- Before a major firmware upgrade, a change-management board reviews the proposed work, the risk assessment, the implementation steps, and the rollback procedure, then formally approves the change for a scheduled maintenance window. What is the primary purpose of this formal review and approval process?
- To keep an accurate record of all the deployed gear
- To reduce the danger a change poses to live service
- To forecast the growth of traffic on the WAN trunks
- To push new firmware images out to the remote sites
Correct answer: To reduce the danger a change poses to live service
Formal change management exists to force someone other than the implementer to weigh what could go wrong, confirm the work is scoped and scheduled, and require a tested way back before the change is allowed near production, which is how unplanned outages are kept rare. Keeping an accurate hardware inventory is the job of asset management. Forecasting bandwidth growth belongs to capacity planning. Pushing firmware images to remote sites is a deployment task that a change record may cover but does not exist to perform. Only risk reduction explains why a board reviews and approves the work.
- A capacity-planning team wants to know which applications consume the most bandwidth on a WAN link without capturing full packet payloads. They enable a flow-export feature that summarizes conversations by source, destination, ports, and byte counts. Which technology are they using?
- Interface counter sampling off the router
- Conversation record export off the router
- Syslog message aggregation off the router
- Active latency probing through the router
Correct answer: Conversation record export off the router
Flow-based monitoring has the router summarize each conversation it forwards into a record holding the addresses, the ports, the protocol and the byte and packet totals, then export those records to a collector, which answers who used the bandwidth without ever storing a payload. Polling interface counters yields only a total in and out per interface, so it cannot attribute traffic to an application. Syslog aggregation gathers event messages, not traffic volumes. Active probing measures the delay of test packets the tool itself generates and says nothing about which applications the real users are running.
- A data-center operations team installs sensors that report rack temperature and relative humidity to the monitoring platform so they can react before equipment overheats. These devices are best categorized as which type of monitoring?
- Application response monitoring
- Traffic conversation monitoring
- Environmental sensor monitoring
- Bandwidth saturation monitoring
Correct answer: Environmental sensor monitoring
Temperature and humidity probes in a rack report the physical conditions the equipment lives in, so alerting on them is environmental monitoring, and it gives the team time to act before hardware overheats and fails. Application monitoring watches whether a service responds and how quickly. Flow monitoring summarizes conversations to show who is talking to whom. Bandwidth monitoring tracks how full a link is. None of those three sees a hot aisle or a failing cooling unit.
- An operations engineer wants to confirm a device clock is synchronized and notes that its NTP source is described as stratum 1, while the device itself is stratum 2. What does the device's stratum 2 designation indicate?
- It sits one hop below a stratum 1 source
- It sits at the top of the stratum ladder
- It cannot be used as a source by clients
- It has lost sync and is running free now
Correct answer: It sits one hop below a stratum 1 source
Stratum counts distance from the reference clock, and each step away adds one, so a device synchronized to a stratum 1 server becomes stratum 2 and is one network hop further from the authoritative time source. It is not the top of the tree, because the stratum 1 server it follows is closer to the reference clock than it is. It can certainly serve time onward, and any client that takes time from it simply becomes stratum 3. It is also not unsynchronized: a device that has lost its source stops advertising a usable stratum rather than reporting stratum 2.
- A network engineer must enable forensic analysis by directing an external IP address to resolve back to its registered hostname for log enrichment. Which DNS record type performs this address-to-name resolution?
- The TXT record type
- The SRV record type
- The SOA record type
- The PTR record type
Correct answer: The PTR record type
Reverse lookups are answered by PTR records, which live in the in-addr.arpa and ip6.arpa zones and map an address back to the hostname registered for it, so log enrichment that turns an address into a name queries a PTR. A TXT record carries arbitrary text and is used for things such as SPF and domain ownership proofs. An SRV record advertises the host and port of a named service. An SOA record holds the zone's authority data, serial number and timers. None of those three resolves an address to a name.
- An operations group wants to track every network asset from purchase, through deployment and maintenance, to eventual decommissioning and disposal, so that aging hardware is replaced before it becomes a reliability or security liability. Which network-operations discipline does this describe?
- Change and approval management
- Capacity and demand management
- Incident and outage management
- Asset and lifecycle management
Correct answer: Asset and lifecycle management
Tracking hardware from purchase through deployment, maintenance, refresh and secure disposal is asset and lifecycle management, and it is what flags equipment nearing end of support before its age turns into a reliability or security problem. Change and approval management governs how modifications are authorized and released. Capacity and demand management forecasts how much resource future load will require. Incident and outage management restores service after a failure and finds the underlying cause. None of those three follows a single device from purchase order to disposal.
- A monitoring dashboard shows that a single 1 Gbps uplink has averaged 92 percent utilization during business hours for the past month, with frequent peaks at 100 percent. Based on this trend data, which network-operations action is most appropriate?
- Plan to add more capacity on the saturated uplink
- Cut the interface MTU on the saturated uplink now
- Extend the DHCP lease time on the attached subnet
- Raise the SNMP poll timer on the connected switch
Correct answer: Plan to add more capacity on the saturated uplink
A link averaging ninety-two percent through the business day and touching one hundred percent regularly has no headroom left, so the trend data supports adding bandwidth or a second link before users feel it, which is what capacity planning is for. Lowering the MTU makes the problem worse, since smaller frames carry more header overhead for the same payload. Extending the DHCP lease time changes how long addresses are held and has no effect on throughput. Raising the polling interval only reduces how often the graph updates, which hides the trend instead of relieving it.
- A SOC analyst correlates a sudden interface-down syslog message, an SNMP trap, and a NetFlow drop to confirm a fiber cut on a core link. Combining multiple monitoring data sources to validate and contextualize a single event is best described as what?
- Threshold alerting against a single event counter
- Event correlation across the several data sources
- NetFlow baselining over a long observation window
- Packet capture recorded at the affected interface
Correct answer: Event correlation across the several data sources
Bringing a syslog message, a trap and a flow record together and reading them as one story is correlation, and it is what turns three separate alarms into a single confirmed fibre cut with a known time and location. Alerting on one counter crossing a limit fires on a single metric and by itself gives no context. Baselining records what normal looks like over time so that deviations stand out later. A packet capture records the traffic on one interface in detail but joins no evidence from other systems. Only correlation combines several sources to validate one event.
- A technician finds and fixes a faulty switch uplink, then writes a description of the symptom, the verified cause, and the corrective steps into the ticketing system before closing the case. Which final step of the CompTIA Network+ troubleshooting methodology is being performed?
- Establish a probable, recurring cause theory
- Verify full system functionality, once again
- Document findings, actions and full outcomes
- Implement this repair, or escalate elsewhere
Correct answer: Document findings, actions and full outcomes
The final step of the CompTIA troubleshooting methodology is to write up what was wrong, what was done and what the result was, so the next technician meets a record rather than a mystery, and that is exactly what the ticket note describes. Establishing a theory of probable cause is the second step and happens long before the repair. Verifying full system functionality is the step immediately before documentation and involves testing, not writing. Implementing the solution is the repair itself, which in this scenario has already been completed.
- A technician suspects a connectivity problem lies somewhere between a client and a remote server. Rather than checking layer by layer, the technician tests at the middle of the path first and then narrows toward either the client or the server based on the result. Which troubleshooting approach is this?
- The top-to-bottom sequential troubleshooting approach
- The bottom-to-top sequential troubleshooting approach
- The divide-and-conquer split troubleshooting approach
- The known-good swap-and-test troubleshooting approach
Correct answer: The divide-and-conquer split troubleshooting approach
Testing in the middle of the path and then moving toward whichever side failed is divide and conquer: each test removes about half of the remaining suspects, so the fault is bracketed in a few steps rather than walked through one layer at a time. Working top to bottom starts at the application and descends through every layer in order. Working bottom to top starts at the cabling and climbs. Known-good substitution swaps in a component known to work to see whether the symptom follows the part. Only the first begins in the middle and narrows outward from there.
- Several VoIP phones and PCs across a building suddenly fail to obtain IP addresses, while devices configured with static addresses continue to work normally. Logs show legitimate clients receiving addresses from an unexpected server. What is the most likely cause?
- An allocation range which has been completely drained
- An unauthorized DHCP server is answering the requests
- The relay agent points toward one unreachable address
- The connected access ports have DHCP snooping enabled
Correct answer: An unauthorized DHCP server is answering the requests
Clients that receive addresses from a server nobody recognizes are being served by an unauthorized DHCP server, which answers faster than the real one and hands out a wrong gateway or wrong DNS, while statically addressed machines never ask and so never notice. A drained address range would leave clients with no address at all rather than an address from an unexpected source. A relay pointing at an unreachable address would send requests nowhere and produce silence, not a competing reply. DHCP snooping is the countermeasure for this problem: enabling it on access ports blocks the offending replies rather than causing them.
- A user can reach hosts on the local subnet but cannot reach any device on other subnets or the internet. The workstation's IP address and subnet mask are valid for its VLAN. Which misconfiguration most directly explains this behavior?
- The configured DNS forwarder address is unreachable
- The workstation ARP cache contains outdated entries
- The client firewall is discarding outbound sessions
- The configured default gateway address is incorrect
Correct answer: The configured default gateway address is incorrect
A host with a valid address and mask always reaches its own subnet directly, because that traffic never needs a router, so a gateway entry that is absent or points at the wrong address explains reachability that stops exactly at the subnet boundary. A wrong or unreachable DNS server would break name resolution while addresses still worked. Stale ARP entries affect neighbours on the local segment, which is the part that is working here. A host firewall discarding everything outbound would cut local traffic too, and local traffic is fine.
- Two workstations on the same subnet intermittently lose connectivity, and Windows displays an address-conflict warning on one of them. Both machines were manually assigned the same IPv4 address. What is this condition called?
- A duplicate address claimed by these hosts
- A broadcast storm crossing the same subnet
- An asymmetric path back toward the gateway
- A speed and duplex clash between endpoints
Correct answer: A duplicate address claimed by these hosts
Two machines manually given the same address will each answer for it, so the switch and the other hosts keep changing their minds about where that address lives and connectivity flickers, and Windows raises a conflict warning when it sees its own address claimed by a different MAC. A broadcast storm would disrupt every host on the segment rather than one pair. An asymmetric return path concerns routing between subnets and cannot arise inside a single subnet. A speed or duplex clash produces errors and slow throughput on one link but never raises an address conflict warning.
- A DHCP server stops issuing new leases and recently connected devices fail to get addresses, even though the scope and server are healthy. Investigation shows every address in the configured range is already leased. What problem is occurring?
- This allocation pool has run completely out of leases
- The helper address on this gateway router was removed
- A second server is issuing the wrong client addresses
- A perimeter filter is discarding every UDP 67 request
Correct answer: This allocation pool has run completely out of leases
A scope holds a finite range of addresses, and once the last one is handed out the server has nothing left to give, so machines that already hold a lease keep working while every newly connected device is refused. Removing the helper address would stop requests reaching the server at all, yet the server is receiving them and reporting an empty pool. A second server issuing the wrong addresses would still leave clients with an address, just an unusable one. A filter discarding the DHCP port would block the traffic before the server ever saw it, which again contradicts a healthy server whose range is fully committed.
- A technician needs to copy all traffic passing through several switch ports to a single monitoring port so a protocol analyzer can capture it without inline taps. Which switch feature provides this?
- Port security with sticky MAC learning
- Port channeling across two uplink legs
- Port mirroring toward one monitor port
- Port isolation among the protected set
Correct answer: Port mirroring toward one monitor port
Mirroring copies the frames seen on chosen source ports to a single destination port, where an analyzer can capture them without breaking the link or inserting a physical tap, which is exactly what is being asked for. Port security limits which MAC addresses may appear on a port and shuts the port down when the limit is broken. Port channeling bundles several links into one logical connection for capacity and resilience. Port isolation stops protected ports from talking to each other while still allowing them to reach an uplink. None of those three delivers a copy of the traffic to an analyzer.
- In a wiring closet, a technician needs to identify which unlabeled cable in a large bundle terminates at a specific wall jack. Which tool pair is purpose-built to trace and locate that individual cable?
- A cable certifier paired with one loopback plug
- A tone generator paired with an inductive probe
- An optical meter paired with one visual locator
- A spectrum analyzer paired with a radio scanner
Correct answer: A tone generator paired with an inductive probe
A toner injects an audio signal onto the pair at the jack, and the probe picks that signal up inductively as it passes over the bundle, so the one cable that hums is the one that lands on that jack. A certifier and loopback plug prove that a finished run meets a performance standard, but neither singles a cable out of a bundle. An optical meter and visual locator are fibre instruments for measuring loss and finding breaks, and the wiring here is copper. A spectrum analyzer and radio scanner survey how the airwaves are being used and never touch a cable at all.
- A technician certifying a fiber link must confirm that the total optical loss across connectors, splices, and cable length stays within the manufacturer's acceptable limit. Which measurement, expressed in decibels, must be compared against that limit?
- The optical return loss of those connectors in decibels
- The chromatic dispersion penalty of the run in decibels
- The polarization mode delay across the span in decibels
- The measured insertion loss across the link in decibels
Correct answer: The measured insertion loss across the link in decibels
Certifying a fibre run means measuring how much light is lost between the two ends, adding up connector, splice and cable loss, and comparing that total against the loss budget the equipment and standard allow. Optical return loss measures the power reflected back toward the transmitter rather than the power that fails to arrive, so it is a different quantity with a different limit. A chromatic dispersion penalty describes pulse spreading over long high-rate spans. Polarization mode delay is a timing effect on very long single-mode routes. Only total insertion loss is what a certification compares to the allowed budget.
- A fiber connection that previously worked now shows degraded signal and errors after a patch panel was serviced. The cable tests fine end to end, but inspection reveals contamination on the connector end face. What is the most likely cause of the degraded signal?
- A tight macrobend within this serviced panel
- A contaminated end face inside the connector
- An angled connector meeting a flat connector
- A transceiver locked to the wrong wavelength
Correct answer: A contaminated end face inside the connector
Dust, oil or a fingerprint on the ferrule end face scatters and blocks light exactly where two fibres meet, which is why a run that certifies fine along its length still shows loss and errors after someone has handled the patch panel. A macrobend would have shown up as loss during the end-to-end test rather than passing it. Mating an angled polish against a flat polish causes permanent loss and reflection, but that would have been present from the day the panel was built rather than appearing after service. A transceiver on the wrong wavelength would not have worked before the maintenance either.
- After a technician swaps a workstation's straight-through cable but the link still will not come up to a switch, the technician recalls modern switches negotiate the correct transmit and receive pin assignments automatically. Which feature performs this automatic crossover?
- Automatic speed and duplex parameter renegotiation
- Automatic neighbour discovery through link adverts
- Automatic pause frame generation during congestion
- Automatic medium dependent interface pin crossover
Correct answer: Automatic medium dependent interface pin crossover
Auto-MDI-X lets an interface detect that its transmit pins face another transmitter and swap its own pin assignments internally, which is why modern switches link up over either a straight-through or a crossover cable. Speed and duplex autonegotiation settles how fast the link runs and whether both ends may send at once, but it does not move transmit and receive pairs. Link layer neighbour discovery advertises device identity and capabilities to a neighbour for documentation and troubleshooting. Pause frame generation asks a sender to slow down when a buffer fills. None of those three rearranges the pinout.
- On a wireless network, clients near a busy access point experience slow throughput even though signal strength is strong. Analysis shows nearby access points and a microwave operating on the same frequency. Which metric best captures how usable the signal is relative to background interference?
- The signal-to-noise ratio in decibels
- The received-signal power in decibels
- The antenna-radiated gain in decibels
- The ambient-noise reading in decibels
Correct answer: The signal-to-noise ratio in decibels
Signal-to-noise ratio compares the wanted signal against the interference and noise underneath it, so it is the metric that explains poor throughput while the signal itself still reads strong: the competing access points and the microwave have lifted the noise, and the usable margin has collapsed even though received power has not. Received-signal power reports the wanted signal alone and therefore misses the interference entirely. Antenna-radiated gain describes how a transmitter concentrates energy, not what a client experiences. An ambient-noise reading is only half of the comparison, since a noisy band matters only relative to how strong the signal is.
- A wireless survey of a 2.4 GHz deployment shows three access points in range using channels 3, 6, and 9, and users report degraded performance. Which configuration practice resolves the overlapping-channel interference?
- Adopt a single shared channel across every radio
- Adopt 40 MHz widened channels across every radio
- Adopt the 1/6/11 channel plan across every radio
- Adopt a higher transmit power across every radio
Correct answer: Adopt the 1/6/11 channel plan across every radio
In the 2.4 GHz band a channel is wider than the spacing between channel numbers, so only 1, 6 and 11 sit far enough apart to avoid overlapping one another, and moving the three access points onto that plan removes the adjacent-channel interference that channels 3, 6 and 9 create. Putting every radio on one channel replaces overlap with co-channel contention, so the airtime is still shared. Widening to 40 MHz consumes most of the band on one access point and makes overlap worse. Raising transmit power increases the area over which the access points interfere with each other.
- A technician needs to view and modify the local IP routing table on a Windows workstation to confirm which gateway is being used for a specific destination network during troubleshooting. Which command displays the host's routing table entries?
- arp -a, submitted at the console
- ipconfig /all, run at the prompt
- netstat -an, used at the console
- route print, typed at the prompt
Correct answer: route print, typed at the prompt
The routing table on a Windows host is displayed with route print, which lists the destination networks, masks, gateways, interfaces and metrics the host will use, so the gateway chosen for a particular destination can be read straight off it. The arp command prints the mapping of local addresses to MAC addresses, which only covers the local segment. Ipconfig with the all switch reports adapter settings including the configured gateway, but it does not show per-destination routes or metrics. Netstat with those switches lists sockets and connections rather than routes.
- Reachability to a remote server fails intermittently, and a traceroute shows the path changing between attempts, with replies sometimes never returning even though the forward path succeeds. The forward and return traffic appear to follow different routes. What condition is most likely described?
- A routing loop that sits between the two routers
- A return leg following a path the request missed
- A black hole dropping packets above the path MTU
- A time to live expiring before the probes arrive
Correct answer: A return leg following a path the request missed
When traffic leaves along one route and comes back along another, stateful devices on either path may see only half of a session and drop the replies, which is why the forward direction succeeds while answers arrive erratically and the traceroute output shifts from run to run. A routing loop would stop the forward direction as well, since packets never reach the destination at all. An MTU black hole silently discards only the packets that exceed the limit, so small probes would still return normally. An expiring time to live is how traceroute works by design and does not by itself break reachability.
