CompTIA Network+ — All Questions

According to the structured troubleshooting methodology, what is the first step when addressing a network problem?

• a.Escalate to the vendor
• b.Identify the problem and gather information✓
• c.Document findings and outcomes
• d.Implement the solution immediately

The methodology begins with identifying the problem by gathering information, questioning users, and determining the scope. Jumping straight to solutions risks fixing the wrong thing. Later steps include establishing a theory, testing it, and documenting.

After establishing a theory of probable cause, what is the next step in the troubleshooting process?

• a.Test the theory to determine the cause✓
• b.Document the solution
• c.Verify full system functionality
• d.Establish a plan of action

Once a theory of probable cause is formed, the next step is to test that theory to confirm or refute it. If confirmed, a plan of action follows; if not, a new theory is formed. This disciplined loop prevents wasted effort.

A user cannot reach any website by name but can ping external IP addresses directly. Which service is most likely misconfigured?

• a.DNS✓
• b.DHCP
• c.NTP
• d.STP

Being able to ping IPs but not resolve names points to a DNS problem, since name resolution is failing while basic IP connectivity works. Checking the client's DNS server settings is the logical next step. This isolates the layer where the fault lies.

A client receives an address in the 169.254.x.x range. What does this most likely indicate?

• a.A correctly assigned public IP
• b.Failure to reach a DHCP server✓
• c.Successful DNS resolution
• d.A static IP misconfiguration

A 169.254.x.x APIPA address indicates the client could not obtain an address from a DHCP server and self-assigned a link-local address. This points to a DHCP or connectivity problem. Such a host can only communicate on the local link.

Which command-line tool traces the path packets take to a destination, revealing each hop along the way?

• a.ping
• b.traceroute✓
• c.nslookup
• d.arp

Traceroute (or tracert on Windows) maps each router hop between source and destination, helping locate where connectivity breaks or slows. It works by incrementing the TTL to elicit responses from intermediate routers. It complements ping for path analysis.

Two devices on the same subnet cannot communicate, and one shows a duplicate IP address error. What is the likely cause?

• a.An IP address conflict✓
• b.An expired SSL certificate
• c.A DNS misconfiguration
• d.A routing loop

A duplicate IP address error indicates two devices have been assigned the same IP, causing an address conflict that disrupts communication. Resolving it means reassigning one device, often via DHCP reservation or corrected static settings. ARP entries may need clearing afterward.

A fiber link shows very high signal loss and intermittent connectivity. Which physical issue is a likely cause?

• a.A DHCP scope exhaustion
• b.A missing default gateway
• c.An incorrect VLAN assignment
• d.A dirty or damaged fiber connector✓

Dirty, scratched, or damaged fiber connectors cause high signal attenuation and intermittent link problems. Cleaning connectors and inspecting for damage is a standard first check. Optical power meters help quantify the loss.

Users on one switch experience slow performance, and the interface shows a rising count of CRC errors. What does this most likely indicate?

• a.A cabling or physical layer fault✓
• b.A misconfigured default route
• c.A DNS resolution delay
• d.An exhausted DHCP scope

Rising CRC errors point to a physical layer problem such as a damaged cable, bad connector, or electromagnetic interference corrupting frames. Replacing the cable and checking for interference sources is warranted. CRC errors indicate frames arriving corrupted.

Which tool would a technician use to verify that a newly terminated Ethernet cable has correct pinouts and no opens or shorts?

• a.Cable tester✓
• b.Spectrum analyzer
• c.Loopback plug
• d.Tone generator

A cable tester checks continuity, correct pin mapping, and faults such as opens, shorts, or miswires on a terminated cable. It confirms the termination follows the intended standard. A tone generator, by contrast, helps trace and locate cables.

A wireless client experiences a weak signal and frequent disconnects far from the access point. Which term describes this coverage limitation?

• a.Channel overlap
• b.Broadcast storm
• c.Low signal-to-noise ratio / attenuation✓
• d.Jitter

A weak signal at distance reflects attenuation and a low signal-to-noise ratio, degrading throughput and causing disconnects. Solutions include repositioning the AP, adding access points, or adjusting antennas. A site survey helps map coverage gaps.

Which command displays a host's current IP configuration, including address, subnet mask, and default gateway, on Windows?

• a.ipconfig✓
• b.ping
• c.route add
• d.telnet

The ipconfig command on Windows displays the host's IP address, subnet mask, and default gateway, with /all showing DNS and DHCP details. The equivalent on Linux is ifconfig or ip addr. It is a first step in verifying local configuration.

A network experiences a sudden broadcast storm after a technician added a second cable between two switches. What is the most likely cause?

• a.A DNS misconfiguration
• b.An expired DHCP lease
• c.A switching loop from a redundant link without STP✓
• d.An incorrect subnet mask

Adding a redundant link between switches without a working Spanning Tree Protocol creates a Layer 2 loop, producing a broadcast storm. Enabling or verifying STP resolves it. Broadcast storms rapidly saturate switch bandwidth and CPU.

Which utility resolves a hostname to its IP address and can query specific DNS record types?

• a.ipconfig
• b.netstat
• c.nslookup✓
• d.ping

The nslookup utility queries DNS servers to resolve hostnames and can request specific record types such as MX or CNAME. It is invaluable for diagnosing name-resolution issues. The dig command offers similar functionality on Unix-like systems.

A user reports they can access internal resources but not the internet. Other users are unaffected. What should the technician check first on that host?

• a.The host's default gateway and DNS settings✓
• b.The core router's routing table
• c.The ISP's SLA compliance
• d.The entire building's fiber uplink

Because only one user is affected, the problem is likely local to that host, so checking its default gateway and DNS settings comes first. A missing or wrong gateway would block internet access while local resources on the same subnet remain reachable. Isolating scope narrows the fault quickly.

Which command tests basic reachability to a remote host by sending ICMP echo requests?

• a.arp
• b.nbtstat
• c.ping✓
• d.tracert

The ping command sends ICMP echo requests and measures replies to test basic reachability and round-trip time. Successful replies confirm Layer 3 connectivity. Lack of replies may indicate a down host, filtering, or a routing problem.

An access switch port connected to a PC keeps going into an err-disabled state. Which security feature most likely triggered this?

• a.Quality of Service
• b.Link aggregation
• c.Spanning tree root guard
• d.Port security violation✓

A port security violation can place a port into err-disabled state when it detects more MAC addresses than allowed. Reviewing the configured maximum and violation mode reveals the cause. Clearing the condition and correcting the setup restores the port.

Intermittent connectivity affects devices only during business hours, correlating with heavy equipment operation nearby. Which cabling issue is the likely culprit?

• a.Incorrect DNS server
• b.Electromagnetic interference (EMI) on copper cabling✓
• c.A duplicate default gateway
• d.Exhausted DHCP scope

Interference from nearby heavy equipment induces EMI on unshielded copper cabling, causing errors and intermittent connectivity that tracks with equipment use. Rerouting cable away from the source or using shielded cable or fiber resolves it. The time-based correlation is a strong clue.

A pair of switch ports negotiated a duplex mismatch. Which symptom is most characteristic of this condition?

• a.Late collisions and slow throughput✓
• b.Complete loss of link
• c.APIPA addressing
• d.DNS resolution failures

A duplex mismatch, where one side is full and the other half duplex, typically causes late collisions, frame errors, and poor throughput rather than a total link failure. Setting both ends to the same duplex, or both to autonegotiate, resolves it. Late collisions on a full-duplex link are a telltale sign.

After confirming a fix resolves the reported issue, which troubleshooting step should be performed next?

• a.Reboot every device on the network
• b.Escalate the issue to management
• c.Verify full system functionality and implement preventive measures✓
• d.Immediately close the ticket without testing

After implementing a fix, the technician should verify full system functionality and, if applicable, apply preventive measures to keep the issue from recurring. This confirms the solution truly worked end to end. Documentation follows as the final step.

A technician suspects a specific cable among many in a bundle. Which tool pair helps locate and identify that individual cable?

• a.Cable tester and loopback plug
• b.Multimeter and OTDR
• c.Protocol analyzer and syslog
• d.Tone generator and inductive probe✓

A tone generator places a signal on a wire, and the inductive probe detects that tone to locate and identify the specific cable within a bundle. This is standard practice for tracing cables in patch panels or ceilings. It complements continuity testing.

A server's throughput is far below the link's rated speed, and interface counters show many output drops during peak traffic. What is the likely cause?

• a.A DNS misconfiguration
• b.A duplicate IP address
• c.An incorrect default gateway
• d.Congestion causing the interface queue to overflow✓

Output drops during peak traffic indicate the interface queue is overflowing due to congestion, so packets are discarded when buffers fill. QoS, increased capacity, or traffic shaping can relieve it. The correlation with peak load confirms congestion rather than a config error.

Which command shows active TCP/UDP connections and listening ports on a local host?

• a.arp
• b.ping
• c.tracert
• d.netstat✓

The netstat command lists active connections, listening ports, and associated states on the local host. It helps confirm whether a service is listening and which remote endpoints are connected. It is useful for diagnosing application and port issues.

The final step of the troubleshooting methodology is to document the findings, actions, and outcomes. Why is this step important?

• a.It builds a knowledge base that speeds resolution of future similar issues✓
• b.It automatically prevents all future outages
• c.It eliminates the need for change management
• d.It replaces the need for network monitoring

Documenting findings, actions, and outcomes creates a knowledge base that helps resolve similar future problems faster and informs others. It also supports auditing and accountability. Skipping documentation loses valuable troubleshooting insight.

A newly connected device gets no link light and no connectivity, while other ports on the same switch work. What should the technician verify first?

• a.The corporate DNS zone file
• b.The ISP's routing table
• c.The patch cable and physical port connection✓
• d.The organization's SLA terms

With a dead port while neighbors work, the fault is almost certainly local, so the technician should first verify the patch cable and physical connection, swapping the cable and trying another port. A missing link light points to a Layer 1 problem rather than addressing or routing. Confirming physical connectivity comes before higher-layer checks.

A help desk ticket reports 'the network is down.' Before doing anything else in the structured troubleshooting method, what should the technician do first?

• a.Implement a fix immediately
• b.Document the outcome
• c.Identify the problem and gather information✓
• d.Escalate the ticket to the equipment vendor's support line

The first step is to identify the problem by gathering information, questioning users, and determining the scope. Acting before understanding risks fixing the wrong thing. Later steps establish and test a theory, then implement and verify.

A technician has tested and confirmed the probable cause of an outage. According to the methodology, what is the next step?

• a.Establish a plan of action✓
• b.Document the findings and close the ticket
• c.Re-form a new theory from scratch
• d.Verify full system functionality across every device

Once a theory is confirmed, the next step is to establish a plan of action to resolve the problem and identify potential effects. This precedes implementing the solution. Planning reduces the chance the fix causes new issues.

A technician's tested theory turns out to be wrong; the suspected cause is not the real one. What does the methodology say to do next?

• a.Establish a new theory or escalate✓
• b.Implement the disproven fix anyway
• c.Verify full functionality of the entire network before continuing
• d.Document the solution and close out

If testing does not confirm the theory, the technician either establishes a new theory or escalates. Repeatedly forcing a disproven theory wastes time. This disciplined loop keeps troubleshooting evidence-based.

While identifying a problem, a technician asks the user what changed recently and tries to reproduce the failure. These actions belong to which phase of the methodology?

• a.Documenting findings and outcomes
• b.Verifying full system functionality
• c.Establishing a plan of action to resolve the issue
• d.Identifying the problem✓

Questioning users, identifying recent changes, and duplicating the problem are all part of the first phase: identifying the problem. This information shapes the theory that follows. Skipping it leads to guesswork.

After forming a theory that a bad cable is the cause, a technician swaps in a known-good cable to see if the symptom disappears. Which methodology step is this?

• a.Documenting the outcome
• b.Establishing a plan of action for the change
• c.Testing the theory✓
• d.Identifying the problem and its scope

Swapping in a known-good component to see whether the symptom clears is testing the theory to determine the cause. If it confirms the theory, a plan of action follows. If not, a new theory is needed.

A technician has applied a fix and confirmed the reported issue is resolved. Which step comes next before documenting?

• a.Escalate the resolved issue to management for review
• b.Reboot every device on the network as a precaution
• c.Immediately close the ticket without further testing
• d.Verify full functionality and apply preventive measures✓

After implementing the fix, the technician verifies full system functionality and, where applicable, implements preventive measures. This confirms the solution truly worked end to end. Documentation is the final step that follows.

The very last step of the structured troubleshooting methodology is what?

• a.Establish a theory of probable cause
• b.Verify full functionality of the affected systems
• c.Document findings, actions, and outcomes✓
• d.Test the theory to determine the cause

The final step is to document findings, actions, and outcomes, building a knowledge base for future issues and supporting accountability. It captures lessons others can reuse. Skipping it loses valuable insight.

Facing a complex fault, a technician methodically checks from the physical layer upward, confirming each OSI layer before moving to the next. Which troubleshooting approach is this?

• a.Randomly rebooting devices until it works
• b.Immediately replacing all hardware in the affected path
• c.A bottom-up OSI approach✓
• d.Guessing based on the last similar ticket

Working layer by layer up the OSI model (a bottom-up approach) systematically isolates the fault to a specific layer. Top-down and divide-and-conquer are alternative structured approaches. Choosing one prevents random, unfocused checking.

A cable tester on a newly run link shows no continuity on one conductor, indicating the wire is broken somewhere along the run. Which fault is this?

• a.A duplex mismatch negotiated between the two switch ports
• b.Crosstalk between adjacent pairs
• c.A short between two conductors
• d.An open✓

An open is a broken conductor with no continuity end to end, so a signal cannot pass on that wire. A short instead connects two conductors that should be separate. Re-terminating or replacing the cable resolves an open.

A long copper run near other cabling shows signal from one pair bleeding into an adjacent pair, corrupting data at higher speeds. Which impairment is this?

• a.An open circuit
• b.Crosstalk✓
• c.Attenuation over distance
• d.Electromagnetic interference from a nearby motor on the cable path

Crosstalk is the coupling of a signal from one pair into an adjacent pair, degrading data especially at higher frequencies. Proper twist rates and untwisting as little as possible at terminations reduce it. Testers report near-end and far-end crosstalk.

A technician connects two switches with a cable but gets no link, and finds the transmit and receive pairs are not properly crossed for that connection. Which issue is this?

• a.DHCP scope exhaustion
• b.A TX/RX reversal✓
• c.An incorrect default gateway configured on the host
• d.A duplex mismatch

A transmit/receive (TX/RX) reversal means the send and receive pairs are not correctly aligned for the devices, so no link forms. Auto-MDIX often fixes this automatically, but its absence or a miswired cable exposes it. Correcting the pinout or using the right cable type resolves it.

A copper Ethernet run of about 130 meters shows a weak, error-prone signal, while shorter runs are fine. Which cabling limitation explains this?

• a.Crosstalk between pairs
• b.A short circuit in the connector
• c.Attenuation from exceeding the distance limit✓
• d.An IP address conflict between two hosts on the segment

Attenuation is the loss of signal strength over distance, and exceeding the 100-meter copper limit degrades the signal and causes errors. Shorter runs stay within spec and work fine. Fiber or an intermediate switch is needed for longer distances.

A link works intermittently, and inspection reveals a poorly crimped RJ45 plug with loose conductors. Which fault category is this?

• a.A bad connector✓
• b.An oversubscribed uplink dropping packets during peak load
• c.A DNS misconfiguration
• d.A routing loop

A bad connector or failing termination causes intermittent connectivity as loose or misaligned conductors make unreliable contact. Re-terminating with a proper crimp restores a solid connection. Physical inspection and a cable tester confirm it.

A cable passes a basic continuity test but suffers high error rates at gigabit speeds, and testing reveals wires from different pairs were combined. Which wiring fault is this?

• a.Excessive attenuation caused by exceeding the maximum run length
• b.An open circuit
• c.Split pairs✓
• d.A short circuit

Split pairs occur when wires from two different pairs are used together, passing continuity but destroying the twist protection and causing crosstalk at speed. A wire-map test that checks pairing, not just continuity, detects it. Re-terminating to the correct standard fixes it.

A fiber transceiver will not establish a link, and a technician finds the small pluggable optic has a bent pin and a dirty connector end. Which is the most appropriate first action?

• a.Reconfigure the DHCP scope
• b.Clean and reseat or replace the transceiver✓
• c.Change the VLAN assignment on the port
• d.Increase the interface MTU to allow larger frames

Inspecting and cleaning the connector and reseating or replacing a damaged transceiver addresses physical optic faults like bent pins or contamination. Dirty or damaged optics are a common cause of no-link on fiber. Optical inspection tools confirm the condition.

On a fiber patch, no link forms until the technician swaps the two strands at one end. What was the original problem?

• a.The fiber was too short for the optic
• b.The DHCP server had run out of addresses to lease
• c.The switch port was in the wrong VLAN
• d.The fiber transmit and receive strands were reversed✓

On duplex fiber, the transmit strand of one device must reach the receive of the other; if the strands are reversed, no link forms until they are swapped. This TX/RX crossover requirement is easy to overlook. Swapping the strands at one connector resolves it.

A technician plugs a multimode patch cable into a transceiver designed for single-mode fiber and gets high loss or no link. What is the root cause?

• a.An APIPA address assigned to the host
• b.A spanning-tree loop between two switches
• c.A duplex mismatch between the switch ports
• d.A single-mode/multimode fiber mismatch✓

A fiber type mismatch, such as multimode cable with a single-mode optic (or vice versa), causes high loss or link failure. The core sizes and light sources are incompatible. Matching the cable, connector, and optic types resolves it.

An IP camera on a PoE switch loses power under load even though the switch supports PoE, and the switch reports its power budget is fully consumed. What is the likely cause?

• a.The PoE power budget is exhausted✓
• b.An incorrect subnet mask on the switch
• c.A DNS misconfiguration on the camera
• d.A spanning-tree blocking state on the camera's uplink port

Exceeding the switch's total PoE power budget starves later devices of power, causing them to drop even though PoE is supported. Adding a higher-wattage supply, a PoE injector, or fewer powered devices resolves it. Checking the per-port and total budget confirms it.

Copper cabling routed alongside fluorescent lighting and motors shows errors that worsen when the equipment runs. Which remedy directly addresses the cause?

• a.Use shielded cabling or reroute away from the interference✓
• b.Shorten the DHCP lease time
• c.Change the host's DNS server
• d.Increase the switch's MAC address table size

Interference induced on unshielded copper is best addressed with shielded cabling (or rerouting away from the source, or using fiber). Shielding drains the induced noise to ground. The correlation with nearby equipment operation points to EMI.

A user's jack is dead, but testing shows the patch panel port is cross-connected to the wrong switch port than the labeling claims. Which documentation-related fault is this?

• a.A patch panel cross-connect/mapping error✓
• b.Electromagnetic interference on the horizontal cable run
• c.A duplex mismatch
• d.An expired DHCP lease

A patch panel mapping error connects a jack to a different switch port than documented, so the intended configuration never reaches the user. Correcting the cross-connect or updating records resolves it. Accurate labeling prevents this class of mistake.

In a 2.4 GHz deployment, three nearby access points on channels 4, 7, and 9 suffer poor performance from overlapping signals. Which channel plan resolves this?

• a.Set all APs to channel 6
• b.Use channels 1, 6, and 11✓
• c.Raise every AP to maximum transmit power
• d.Bond the channels together into one wide 40 MHz channel

In 2.4 GHz, only channels 1, 6, and 11 are non-overlapping, so assigning adjacent APs to those channels eliminates the overlap. Channels like 4, 7, and 9 partially overlap and interfere. Proper channel reuse is essential in dense deployments.

Wi-Fi in a break room drops out whenever the microwave oven runs, and the interference is not from another access point. Which cause is most likely?

• a.Non-Wi-Fi RF interference✓
• b.An incorrect default gateway on the clients
• c.A DHCP scope that is exhausted
• d.Co-channel interference from another access point on the same channel

Non-Wi-Fi interference from devices like microwave ovens, cordless phones, and Bluetooth radios disrupts the 2.4 GHz band. Its correlation with the microwave running is a strong clue. A spectrum analyzer identifies such non-802.11 sources.

Users in a far corner of the warehouse get very weak Wi-Fi or none at all, while the rest of the floor is fine. Which fix best addresses this coverage gap?

• a.Replace the wired uplink with a higher-category copper cable
• b.Change the SSID name broadcast by the AP
• c.Add an access point to cover the dead zone✓
• d.Shorten the DHCP lease timer

A dead zone from insufficient coverage is resolved by adding an access point (or repositioning/adjusting antennas) to extend signal into the gap. Simply raising power on a distant AP often worsens interference elsewhere. A site survey confirms placement.

A laptop stays connected to a distant access point with a weak signal even after the user walks near a closer AP, hurting performance. What is this behavior called?

• a.A DNS resolution failure
• b.A duplex mismatch between the AP and its wired switch port
• c.A sticky client roaming problem✓
• d.An IP address conflict on the subnet

A sticky client clings to its original AP despite a stronger nearby one, degrading throughput as signal weakens. Tuning roaming thresholds or enabling 802.11k/v/r assistance encourages timely handoff. The client, not the network, decides when to roam.

Several users cannot join the secured Wi-Fi and are repeatedly prompted for the network key, though the signal is strong. Which cause is most likely?

• a.A spanning-tree loop between the AP and the switch
• b.A missing default gateway on the AP
• c.Weak signal at the client location
• d.An incorrect pre-shared key✓

Repeated authentication prompts with a strong signal typically indicate an incorrect pre-shared key (wrong passphrase). Correcting the entered key restores access. Signal strength being fine rules out coverage as the cause.

Older devices cannot connect after an AP is reconfigured, and the AP is set to require a security mode the clients do not support. Which issue is this?

• a.Attenuation from distance to the AP
• b.A security mode mismatch✓
• c.An exhausted DHCP scope
• d.A duplex mismatch on the AP's wired uplink port

A wireless security mode mismatch (for example, requiring WPA3-only while a client supports only WPA2) prevents association. A transitional/mixed mode or matching settings restores compatibility. Verifying supported modes on both ends resolves it.

During a busy all-hands meeting, a single access point serving hundreds of attendees becomes sluggish for everyone, though signal is strong. What is the likely cause?

• a.An incorrect subnet mask on the AP
• b.A dirty fiber connector on the AP's uplink
• c.Too many clients on one access point (overcapacity)✓
• d.A weak signal at every client

AP overcapacity occurs when too many clients share one radio, so airtime contention degrades performance despite good signal. Adding APs or enabling band steering spreads the load. High client counts, not weak signal, are the tell.

A client sees a strong 5 GHz signal near the access point but loses it much sooner than 2.4 GHz as they walk away. Which characteristic explains this?

• a.The client's DHCP lease expired
• b.5 GHz has shorter range than 2.4 GHz✓
• c.The switch port feeding the AP had a duplex mismatch
• d.A default gateway was missing on the client

The 5 GHz band offers higher throughput and less congestion but has shorter range and weaker obstacle penetration than 2.4 GHz. So coverage falls off faster with distance and walls. Band selection trades speed against reach.

To cover a long, narrow corridor from one end, an engineer needs to focus the AP's signal down the hallway rather than spread it in all directions. Which change helps?

• a.Disable SSID broadcast on the AP
• b.Assign the AP a static route to the corridor subnet
• c.Use a shorter DHCP lease
• d.Use a directional antenna✓

A directional antenna focuses RF energy in a specific direction, ideal for long corridors or point-to-point links, versus an omnidirectional antenna that radiates evenly. Matching antenna type and placement to the space improves coverage. Antenna choice is part of RF design.

Wi-Fi is strong in an office but drops sharply behind a room with thick concrete and metal walls. Which factor best explains the loss?

• a.An IP address conflict
• b.A DNS server outage
• c.Signal attenuation from building materials✓
• d.Co-channel interference from a distant access point on channel 11

Dense building materials like concrete and metal cause RF attenuation and reflection, sharply reducing signal behind them. Repositioning or adding an AP on the far side restores coverage. Materials are a key input to any site survey.

Guests connect to the open Wi-Fi and get an IP address, but the sign-in web page that should grant internet access never appears. Which component is likely failing?

• a.The captive portal is not loading✓
• b.The switch uplink is running at half duplex
• c.The antenna is directional instead of omnidirectional
• d.The client is too close to the access point

A captive portal is the web page that authenticates or accepts terms before granting internet access; if it fails to load, users associate but cannot browse. DNS redirection or portal server issues commonly cause this. Verifying the portal and its DNS handling resolves it.

An access point using a 5 GHz channel occasionally goes quiet and moves channels after detecting radar, briefly disrupting clients. Which mechanism causes this?

• a.A sticky client refusing to roam
• b.Crosstalk on the copper cable feeding the access point
• c.An exhausted DHCP scope on the guest VLAN
• d.Dynamic Frequency Selection (DFS) radar avoidance✓

Dynamic Frequency Selection (DFS) requires APs on certain 5 GHz channels to vacate when radar is detected, causing brief channel changes and disruption. Choosing non-DFS channels avoids it where radar is present. It is a regulatory requirement, not a fault.

A technician wants to quickly confirm whether a remote server is reachable at the IP layer and see the round-trip time. Which command is the simplest choice?

• a.ping✓
• b.netstat
• c.nslookup
• d.traceroute, which maps every router hop along the path

Ping sends ICMP echo requests and reports replies and round-trip time, confirming basic Layer 3 reachability. Success shows the path and host are responding. No reply may mean a down host, filtering, or a routing problem.

Users report a site is slow to reach, and a technician wants to see at which router hop along the path latency spikes. Which tool shows per-hop delay?

• a.arp
• b.traceroute✓
• c.ipconfig
• d.netstat, which lists active connections and listening ports

Traceroute (tracert on Windows) lists each router hop and the delay to it, revealing where latency spikes or the path breaks. It increments the TTL to elicit responses from intermediate routers. It complements ping for locating path problems.

A technician suspects a specific DNS record is wrong and wants to query the DNS server directly for that record type. Which tool is appropriate?

• a.ipconfig, which displays the local interface addressing
• b.nslookup✓
• c.ping
• d.netstat

nslookup (or dig) queries DNS servers directly and can request specific record types such as MX, A, or CNAME. It isolates name-resolution problems from other issues. Comparing results across resolvers reveals inconsistencies.

A Windows client is stuck with a bad DHCP lease, and a technician wants to force it to drop the current address and request a fresh one. Which commands accomplish this?

• a.nslookup and arp
• b.ping and traceroute
• c.ipconfig /release and /renew✓
• d.netstat combined with the route print command

Running ipconfig /release then ipconfig /renew forces the client to give up its lease and request a new one from the DHCP server. This resolves stale or incorrect leases. It is a quick fix for many client addressing problems.

A technician wants to see which TCP ports a server is currently listening on and what connections are established. Which command shows this?

• a.ping
• b.netstat✓
• c.tracert
• d.nslookup, which resolves hostnames to addresses

netstat lists active connections, listening ports, and their states on the local host. It confirms whether a service is listening and which endpoints are connected. It is a first check when an application will not accept connections.

A host cannot reach a device on its own subnet, and a technician wants to view the cached IP-to-MAC mappings the host has learned. Which command displays this table?

• a.ping -t
• b.arp -a✓
• c.ipconfig /all
• d.netstat -r, which prints the local routing table

The arp -a command displays the ARP cache, mapping recently contacted IP addresses to their MAC addresses. A wrong or missing entry can explain local delivery failures. Clearing a stale entry can restore connectivity.

A technician wants a single tool that both traces the path to a destination and, over time, measures packet loss at each hop. Which utility combines these?

• a.arp
• b.pathping/mtr✓
• c.ipconfig
• d.nslookup, used to query DNS record types

Pathping (Windows) and mtr (Unix) combine traceroute with continuous statistics, reporting per-hop latency and packet loss over time. This pinpoints the hop where loss originates. It is more diagnostic than a single traceroute pass.

A technician suspects a host is missing a route and wants to view the local routing table to confirm the default gateway and any static routes. Which command shows this?

• a.nslookup for the destination hostname
• b.route print✓
• c.ping -t
• d.arp -a

The route print command (or ip route on Linux) displays the host's local routing table, including the default gateway and any static routes. A missing or wrong default route explains failures reaching remote networks. It is key when local traffic works but remote does not.

To analyze the exact contents of packets during a subtle protocol failure, a technician needs to capture and decode frames on the wire. Which tool fits?

• a.ipconfig
• b.arp, which only shows the local address cache
• c.ping
• d.Wireshark/tcpdump✓

A protocol analyzer like Wireshark or tcpdump captures and decodes packets, exposing headers and payloads for deep analysis. It reveals malformed exchanges that summaries hide. A SPAN/mirror port often feeds it the traffic.

An engineer wants to measure the actual throughput achievable between two hosts by generating test traffic in a controlled way. Which tool is designed for this?

• a.arp -a
• b.tracert to the far-end host's address
• c.nslookup
• d.iperf✓

iperf generates controlled TCP or UDP traffic between a client and server to measure achievable throughput, jitter, and loss. It isolates network capacity from application behavior. Results guide capacity and QoS decisions.

A security technician wants to discover which hosts are alive on a subnet and which TCP ports they have open. Which tool provides this scan?

• a.ipconfig
• b.ping -t
• c.nmap✓
• d.netstat run on each individual host

nmap scans a range of hosts to discover live systems and their open ports and services. It is a standard reconnaissance and audit tool. Results reveal exposure and help verify firewall rules.

After a DNS record was corrected, a Windows client still resolves the old address because of local caching. Which command clears the client's DNS cache?

• a.netstat -a to list all connections and ports
• b.arp -d
• c.ipconfig /flushdns✓
• d.route add

ipconfig /flushdns clears the Windows DNS resolver cache so the client queries fresh records instead of stale cached ones. It resolves cases where a record changed but the client still returns the old value. Restarting the resolver service does the same.

Traffic to a cloud service routes over a very long path across several continents, adding significant delay even though no link is congested. Which factor is responsible?

• a.Path length / propagation delay✓
• b.Insufficient link bandwidth
• c.Packet loss from bad cabling
• d.A duplex mismatch between two switches in the path

Propagation and path length add latency independent of congestion; a longer route simply takes more time end to end. Choosing a closer endpoint or better-peered path reduces it. High RTT with low utilization points here rather than to congestion.

During peak hours a WAN link is saturated and applications slow down, and monitoring shows the interface at 100 percent with rising output drops. What is the cause?

• a.A DNS misconfiguration
• b.A missing default gateway on the affected hosts
• c.Bandwidth saturation (congestion)✓
• d.An IP address conflict

Bandwidth saturation occurs when demand exceeds link capacity, filling queues and dropping packets during peaks. Adding capacity, shaping, or QoS relieves it. The correlation with peak load and full utilization confirms congestion.

A link shows intermittent packet loss and rising interface error counters, and replacing a marginal cable clears both. Which was the underlying cause?

• a.A DNS server outage
• b.Physical-layer errors from a faulty cable✓
• c.An access control list blocking the traffic at the router
• d.An exhausted DHCP scope

Physical errors from a marginal cable or connector corrupt frames, showing up as CRC/input errors and causing intermittent loss. Replacing the faulty cable removes the errors. Error counters are the diagnostic that points to Layer 1.

A saturated link makes interactive traffic laggy because oversized buffers hold packets far too long before forwarding them. What is this phenomenon called?

• a.Co-channel interference on the wireless segment
• b.Attenuation
• c.Bufferbloat✓
• d.A routing loop

Bufferbloat is excessive latency caused by overly large buffers that queue packets instead of dropping them promptly, hurting interactive traffic. Active queue management (such as CoDel) mitigates it. It appears as high latency under load without heavy loss.

Traffic reaches a server fine but return traffic takes a different path, and a stateful firewall drops the flow because it never saw the outbound side. Which condition is this?

• a.An exhausted DHCP address pool on the subnet
• b.Asymmetric routing✓
• c.A duplex mismatch
• d.A DNS misconfiguration

Asymmetric routing sends forward and return traffic over different paths, which can break stateful devices that must see both directions of a flow. Aligning the paths or making the device state-aware of both resolves it. It often appears after redundancy or route changes.

A VPN tunnel drops large packets while small ones pass, and the problem clears when the interface's maximum frame size is lowered. Which issue caused it?

• a.A spanning-tree loop between the tunnel endpoints
• b.A DNS resolution failure
• c.An MTU mismatch✓
• d.A duplicate IP address on the tunnel

An MTU mismatch or fragmentation problem drops or mishandles packets larger than a link allows, especially where encapsulation shrinks the usable size. Lowering the MTU or enabling proper path MTU discovery resolves it. Small packets passing while large ones fail is the classic symptom.

Two switch ports show late collisions and poor throughput because one end is set to full duplex and the other to half. What is the recommended fix?

• a.Set both ends to autonegotiate or matching duplex✓
• b.Assign the ports to different VLANs
• c.Replace the switch with a router
• d.Increase the interface MTU to reduce collisions on the link

Setting both ends to autonegotiate (or both to the same fixed duplex) resolves a duplex mismatch that causes late collisions and slow throughput. Mismatched fixed settings are a common misconfiguration. Matching the configuration on both ends is essential.

After a redundant switch link was added without loop prevention, switch CPUs spike to 100 percent and the whole segment slows to a crawl. Which problem does this indicate?

• a.An expired DHCP lease on the clients
• b.A DNS misconfiguration
• c.An access control list dropping legitimate traffic at the edge
• d.A broadcast storm from a switching loop✓

A broadcast storm from a Layer 2 loop floods frames endlessly, spiking switch CPU and saturating the segment. Enabling or verifying spanning tree stops it. The sudden onset after adding a redundant link is the giveaway.

Web pages take several seconds to begin loading, but once resolved they download quickly, and the assigned DNS server is geographically distant. Which fix most directly helps?

• a.Enable jumbo frames on the client's network adapter
• b.Increase the link bandwidth
• c.Configure a faster, closer DNS resolver✓
• d.Replace the copper cabling with fiber

Slow initial page loads with fast downloads point to slow DNS resolution; using a closer or faster resolver cuts the lookup delay. The quick transfer once resolved rules out bandwidth. Testing with nslookup timing confirms the cause.

A traceroute shows the same set of routers repeating and packets eventually dying with TTL-exceeded messages, and users cannot reach the destination. Which problem is this?

• a.A duplex mismatch
• b.A routing loop✓
• c.Electromagnetic interference on the copper uplink
• d.A DHCP scope exhaustion

A routing loop sends packets circling between routers until the TTL expires, producing TTL-exceeded messages and unreachable destinations. Correcting the conflicting routes breaks the loop. The repeating hops in traceroute are the telltale sign.

After a QoS change, backup traffic monopolizes the link and voice suffers because the policy failed to reserve capacity for voice. Which is the underlying issue?

• a.A QoS misconfiguration✓
• b.A dirty fiber connector on the WAN uplink
• c.A DNS outage
• d.A duplicate IP address

A QoS misconfiguration that fails to classify or reserve priority for voice lets bulk traffic starve it during congestion. Correcting the classification and queuing restores voice quality. The change coinciding with the problem points to the policy.

An old segment built around a hub shows many collisions and poor performance as more devices are added. Which characteristic of the hub explains this?

• a.The hub blocks redundant links using spanning tree
• b.The hub is one shared, half-duplex collision domain✓
• c.The hub exhausts the DHCP scope
• d.The hub routes between VLANs at Layer 3

A hub creates a single shared collision domain running half duplex, so collisions rise as devices and traffic increase. Replacing it with a switch gives each port its own collision domain and full duplex. This is why hubs are obsolete for modern LANs.

A high-latency, high-bandwidth WAN link achieves far less throughput than its capacity for a single TCP transfer, and the small TCP window cannot keep the long pipe full. Which fix helps?

• a.Disable QoS on the link
• b.Lower the interface MTU
• c.Enable TCP window scaling✓
• d.Shorten the DHCP lease duration for the clients

On a long fat network, a small TCP window limits throughput because the sender cannot keep enough data in flight for the high latency. Enabling window scaling (larger windows) lets a single flow fill the pipe. This explains low single-stream throughput despite ample bandwidth.

VoIP calls sound choppy with syllables clipped, and monitoring shows packets arriving at uneven intervals though few are lost. Which mitigation best addresses the cause?

• a.Replace the DNS server with a local one
• b.Assign the phones static IP addresses
• c.Add a jitter buffer and prioritize voice with QoS✓
• d.Increase the DHCP scope size on the voice VLAN

Choppy audio from uneven packet arrival is caused by jitter, and a properly sized jitter buffer plus QoS prioritization smooths it. The low loss rules out congestion drops as the main issue. Marking and queuing voice traffic reduces the jitter itself.

After terminating a cable, a technician needs to confirm each pin connects to the correct pin at the far end with no miswires. Which tool verifies the wire map?

• a.A cable tester✓
• b.A loopback plug
• c.A tone generator paired with an inductive probe
• d.A spectrum analyzer

A cable tester with a wire-map function confirms pin-to-pin correctness and flags opens, shorts, reversed, or split pairs. It validates that the termination follows the intended standard. It is the standard check after terminating a run.

A technician needs to find which wall jack corresponds to an unlabeled cable end in a crowded telecom closet. Which tool pair helps locate it?

• a.A protocol analyzer capturing frames on the link
• b.A multimeter
• c.An OTDR
• d.A tone generator and inductive probe✓

A tone generator places an audible signal on a wire, and an inductive probe detects that tone to trace and identify the specific cable or jack. It is standard for locating cables in bundles or panels. It complements, rather than replaces, continuity testing.

To test whether a switch port or NIC is functioning by looping its transmit back to its receive, which simple tool does a technician use?

• a.An optical time-domain reflectometer for fiber
• b.A loopback plug✓
• c.A tone generator
• d.A cable certifier

A loopback plug (or adapter) connects a port's transmit to its receive so the interface can test itself without another device. It confirms the port electrically works. It is a quick way to isolate a suspected bad port.

A long fiber run has a break somewhere, and the team needs to know the distance to the fault without digging up the whole path. Which instrument provides this?

• a.A tone generator with an inductive probe
• b.An OTDR✓
• c.A cable tester
• d.A loopback plug

An OTDR (optical time-domain reflectometer) sends light pulses and measures reflections to locate breaks, bends, and their distance along a fiber. It maps loss events across the run. This pinpoints where to dig or repair.

A technician needs to measure the actual optical signal strength arriving at a receiver to confirm it is within the transceiver's specified range. Which tool measures this?

• a.An optical power meter✓
• b.A multimeter
• c.A tone generator used to trace copper pairs
• d.A punchdown tool

An optical power meter (light meter) measures received optical power in dBm to verify a fiber link is within the transceiver's budget. Readings that are too low indicate excess loss. It quantifies problems a visual check cannot.

To check continuity and measure voltage on a copper conductor or a PoE circuit, which general-purpose electrical tool does a technician use?

• a.A multimeter✓
• b.An OTDR
• c.A Wi-Fi analyzer
• d.A protocol analyzer that decodes captured packets

A multimeter measures continuity, voltage, and resistance, useful for checking copper conductors and PoE voltage. It is a general electrical diagnostic, not a network-specific tester. It helps confirm power delivery and basic wire integrity.

A technician must seat individual conductors into an insulation-displacement block on a patch panel, cutting and securing each wire. Which tool is required?

• a.An optical time-domain reflectometer
• b.A crimper
• c.A loopback plug
• d.A punchdown tool✓

A punchdown tool seats conductors into insulation-displacement contacts on 66- or 110-blocks and patch panels, trimming the excess in one motion. It ensures solid, standardized terminations. Using it correctly avoids intermittent connections.

To attach an RJ45 plug onto a freshly stripped patch cable, securing the pins and strain relief, which tool does a technician use?

• a.A tone generator
• b.A crimper✓
• c.A cable certifier that validates performance to a standard
• d.A punchdown tool

A crimper attaches RJ45 (or RJ11) connectors to a cable, seating the pins onto the conductors and locking the strain relief. Proper crimping prevents loose, intermittent contacts. It pairs with a stripper and a tester for reliable field terminations.

A contractor must prove a finished cabling run meets the full performance requirements of a category standard for the customer's records. Which tool produces this compliance report?

• a.A basic continuity cable tester
• b.A loopback plug
• c.A tone generator with a probe
• d.A cable certifier✓

A cable certifier tests a run against a category's full performance parameters (such as insertion loss, NEXT, and return loss) and produces a pass/fail compliance report. A basic tester only checks wiring continuity and mapping. Certification is required for many warranties.

An engineer wants to see which Wi-Fi channels nearby access points occupy and their signal strengths to plan channel assignments. Which tool provides this view?

• a.A punchdown tool
• b.A Wi-Fi analyzer✓
• c.A multimeter measuring the AP's supply voltage
• d.An OTDR

A Wi-Fi analyzer scans the bands to show nearby SSIDs, their channels, and signal strengths, guiding channel planning to avoid overlap. It reveals congestion from other 802.11 networks. It is a first step in wireless troubleshooting and design.

Wi-Fi in an area suffers interference that a Wi-Fi analyzer cannot explain, suggesting a non-802.11 source. Which instrument identifies such RF energy?

• a.A spectrum analyzer✓
• b.A loopback plug
• c.A tone generator and inductive probe
• d.A cable certifier

A spectrum analyzer visualizes all RF energy in a band, revealing non-Wi-Fi sources like microwaves, cordless phones, or jammers that a Wi-Fi analyzer misses. It shows interference the 802.11 view cannot. This pinpoints physical-layer RF problems.

A field team must permanently join two fiber strands with minimal loss for a long-haul splice. Which specialized tool set performs this?

• a.A punchdown tool
• b.A crimper and stripper
• c.A fusion splicer and cleaver✓
• d.A tone generator paired with an inductive probe

A fusion splicer (with a cleaver) permanently joins fiber strands by aligning and melting the cores together, producing a very low-loss splice. A cleaver first prepares clean, square end faces. This is the standard method for durable, high-quality fiber joins.

To decode a suspicious traffic exchange down to individual protocol fields during an investigation, which tool does an analyst rely on?

• a.A protocol analyzer✓
• b.An optical power meter reading the receive level
• c.An OTDR
• d.A punchdown tool

A protocol analyzer captures and decodes traffic field by field, exposing the exact protocol behavior during an investigation. It reveals malformed or malicious exchanges that summaries hide. It is central to deep network and security analysis.

A technician needs a quick way to confirm a short fiber patch has continuity and to see roughly where a break is by looking for escaping red light. Which simple tool helps?

• a.A multimeter
• b.A tone generator used on copper pairs
• c.A crimper
• d.A visual fault locator✓

A visual fault locator injects visible red laser light into a fiber, making breaks, sharp bends, or bad connectors glow where light escapes. It is a fast, low-cost check for continuity and gross faults. It complements the precise distance data of an OTDR.

A team wants a dedicated hardware appliance that generates and measures traffic to certify a circuit's throughput and latency during turn-up. Which tool fits?

• a.A loopback plug
• b.A punchdown tool
• c.A tone generator and inductive probe
• d.A throughput/traffic tester✓

A dedicated throughput/traffic tester generates and measures traffic to certify a circuit's throughput, latency, and loss during turn-up. It provides repeatable, standards-based results a laptop utility may not. Providers often require it to validate an SLA.

To access a switch's command line locally when the network is down, a technician connects a laptop to the device's serial management port. Which cable is required?

• a.A fiber patch cable
• b.A crossover cable
• c.A tone generator with an inductive probe
• d.A console (rollover) cable✓

A console (rollover) cable connects a computer to a device's serial console port for out-of-band CLI access, even when the network is unreachable. It is essential for initial setup and recovery. USB-to-serial adapters often bridge to modern laptops.

A fiber uplink will not come up, and the transceiver, though it fits, is a different vendor code than the switch expects and is rejected. What is the likely cause?

• a.A duplex mismatch on the link
• b.An incompatible/uncoded transceiver✓
• c.A spanning-tree loop between the two switches
• d.An exhausted DHCP scope

Some switches reject transceivers whose vendor coding is not recognized or compatible, so the link never comes up despite a physical fit. Using a supported or properly coded optic resolves it. Checking compatibility lists prevents this surprise.

A technician must trim cable jacket and cut conductors cleanly while terminating copper. Which hand tools are appropriate?

• a.An OTDR
• b.A cable stripper and snips✓
• c.A spectrum analyzer
• d.A protocol analyzer decoding the captured frames

A cable stripper and cutting snips cleanly remove jacket and trim conductors during termination without nicking the wire. Clean preparation is essential for reliable crimps and punchdowns. They are basic parts of a cabling toolkit.

During troubleshooting, a technician glances at a switch port's LEDs to quickly gauge link status and activity before running deeper tests. What do these indicators primarily show?

• a.The spanning-tree root bridge for the VLAN
• b.The DNS server in use
• c.Link status and activity✓
• d.The DHCP lease duration

Port status LEDs quickly indicate link presence, speed, and activity, giving a fast first read before deeper testing. A dark link LED points to a Layer 1 problem. They are the quickest physical-layer sanity check.

A known bug in a device's current software version causes intermittent crashes, and the vendor has published a corrected release. What is the appropriate remediation?

• a.Reassign the device's IP address
• b.Replace all the network cabling
• c.Apply the vendor's firmware update✓
• d.Increase the interface MTU to work around the crashes

Applying the vendor's firmware/software update that fixes a known bug is the correct remediation for a defect-driven failure. Change management and a maintenance window should govern the upgrade. Verifying the release notes confirms the fix applies.

Midway through a tricky fault, a technician reviews the network's baseline and documentation to compare current behavior against the known-good state. Why is this step valuable?

• a.It replaces the need for change management approval entirely
• b.It eliminates the need to test any theory
• c.It reveals deviations from the known-good state✓
• d.It automatically repairs the misconfiguration

Comparing current behavior against baselines and documentation quickly reveals what has deviated from the known-good state, focusing the investigation. It turns vague symptoms into concrete differences. This is why keeping documentation current pays off during outages.

For long-term packet capture on a critical link, a team wants a passive inline device that copies all traffic to a monitoring port without relying on switch resources or dropping frames under load. Which tool fits?

• a.A network tap✓
• b.A tone generator paired with an inductive probe
• c.A punchdown tool
• d.A loopback plug

A network tap is a passive inline device that copies full-duplex traffic to a monitor port without burdening the switch CPU or dropping frames the way an oversubscribed SPAN port can. It gives an unaltered, reliable feed for capture and analysis. It is preferred over port mirroring for high-fidelity, sustained monitoring.