CSLB General Building (B) — All Questions

Which layer of the OSI model is responsible for logical addressing and determining the best path for packets across an internetwork?

• a.Layer 2 (Data Link)
• b.Layer 1 (Physical)
• c.Layer 3 (Network)✓
• d.Layer 4 (Transport)

Layer 3, the Network layer, handles logical addressing such as IP and makes routing decisions to move packets between networks. The Data Link layer uses physical MAC addresses for local delivery, while the Transport layer manages end-to-end segmentation. Routers operate primarily at Layer 3.

A network administrator needs to identify the protocol data unit (PDU) used at the Transport layer of the OSI model. Which term applies?

• a.Frame
• b.Segment✓
• c.Packet
• d.Bit

At the Transport layer the PDU is called a segment (or datagram for UDP). Packets exist at the Network layer, frames at the Data Link layer, and bits at the Physical layer. Knowing PDU names per layer helps when interpreting protocol behavior.

Which protocol and port number are used by HTTPS for secure web traffic by default?

• a.TCP 443✓
• b.TCP 80
• c.UDP 53
• d.TCP 22

HTTPS uses TCP port 443 and secures web traffic with TLS. Port 80 is plain HTTP, port 53 is DNS, and port 22 is SSH. Memorizing well-known ports is essential for firewall and troubleshooting work.

What is the default port used by the Domain Name System (DNS) for standard name resolution queries?

• a.TCP 25
• b.TCP 110
• c.UDP 67
• d.UDP 53✓

DNS uses UDP port 53 for most standard queries because they are small and benefit from low overhead. TCP 53 is used for zone transfers and larger responses. Ports 25, 110, and 67 belong to SMTP, POP3, and DHCP respectively.

An engineer must choose an address class for a private network that supports up to 500 hosts on a single subnet. Which private range is most appropriate to draw from?

• a.169.254.0.0/16
• b.10.0.0.0/8✓
• c.224.0.0.0/4
• d.127.0.0.0/8

The 10.0.0.0/8 range is an RFC 1918 private block that easily provides subnets large enough for 500 hosts. 169.254.0.0/16 is APIPA link-local, 224.0.0.0/4 is multicast, and 127.0.0.0/8 is loopback. Private ranges avoid public IP consumption.

How many usable host addresses are available in a subnet with a /29 prefix?

• a.2
• b.4
• c.6✓
• d.8

A /29 leaves 3 host bits, giving 2^3 = 8 total addresses, minus the network and broadcast addresses, for 6 usable hosts. Subnetting math requires subtracting two reserved addresses from the total. /29 subnets are common for small point-to-point or device segments.

Which IPv6 address type begins with the prefix FE80::/10 and is used only for communication on the local link?

• a.Link-local✓
• b.Global unicast
• c.Anycast
• d.Multicast

Link-local IPv6 addresses use the FE80::/10 prefix and are auto-configured on every interface for local-link communication. Global unicast addresses are routable on the internet, while multicast uses FF00::/8. Link-local addresses are never routed beyond the local segment.

A star topology relies on which central device to interconnect all end nodes?

• a.A repeater between each pair of nodes
• b.A central switch or hub✓
• c.A shared coaxial bus
• d.A ring of daisy-chained cables

In a star topology every node connects to a central switch or hub, which forwards traffic between them. A failure of one cable affects only that node, improving fault isolation. Bus and ring topologies use shared media that create single points of failure.

Which cabling standard defines the maximum supported distance of 100 meters for a twisted-pair Ethernet run?

• a.1000BASE-LX
• b.10GBASE-ER
• c.100BASE-FX
• d.1000BASE-T✓

1000BASE-T runs over twisted-pair copper and is limited to 100 meters per segment. The other options are fiber standards that support much longer distances. The 100-meter copper limit includes patch cords and horizontal cabling.

What is the primary purpose of a VLAN in a switched network?

• a.To logically segment a physical switch into separate broadcast domains✓
• b.To increase the speed of individual switch ports
• c.To convert Layer 2 frames into Layer 3 packets
• d.To provide power to connected devices

A VLAN logically segments a switch so that ports belong to separate broadcast domains without needing additional physical switches. This improves security and reduces broadcast traffic. Routing between VLANs still requires a Layer 3 device.

Which protocol resolves an IPv4 address to a MAC address on a local Ethernet segment?

• a.DNS
• b.ICMP
• c.ARP✓
• d.NTP

ARP (Address Resolution Protocol) maps a known IPv4 address to the MAC address needed for Layer 2 delivery. DNS resolves names to IPs, ICMP handles diagnostics, and NTP synchronizes time. ARP operates only within a local broadcast domain.

A company wants clients to obtain IP configuration automatically. Which protocol assigns addresses, subnet masks, gateways, and DNS servers dynamically?

• a.DNS
• b.DHCP✓
• c.SNMP
• d.LDAP

DHCP dynamically leases IP addresses along with subnet mask, default gateway, and DNS server information to clients. This eliminates manual configuration and reduces addressing errors. DHCP uses UDP ports 67 and 68 for server and client communication.

In the TCP three-way handshake, which sequence of flags correctly establishes a connection?

• a.ACK, SYN-ACK, SYN
• b.FIN, ACK, RST
• c.PSH, URG, ACK
• d.SYN, SYN-ACK, ACK✓

The TCP three-way handshake proceeds as SYN, then SYN-ACK, then ACK to establish a reliable session. FIN and RST relate to closing or resetting connections. Understanding the handshake helps diagnose connection setup failures.

Which cloud service model provides virtual machines, storage, and networking that customers manage themselves?

• a.IaaS✓
• b.SaaS
• c.PaaS
• d.DaaS

Infrastructure as a Service (IaaS) delivers fundamental compute, storage, and network resources that the customer configures and manages. SaaS delivers finished applications, and PaaS provides a development platform. IaaS offers the most customer control among cloud models.

What distinguishes UDP from TCP at the Transport layer?

• a.UDP guarantees ordered delivery through sequencing
• b.UDP performs a three-way handshake before sending data
• c.UDP is connectionless and does not guarantee delivery✓
• d.UDP always encrypts application data

UDP is connectionless, has low overhead, and does not guarantee delivery, ordering, or retransmission. This makes it ideal for latency-sensitive traffic such as VoIP and streaming. TCP, by contrast, is connection-oriented and reliable.

A /24 network needs to be divided into four equal subnets. Which new prefix length should be used?

• a./25
• b./26✓
• c./27
• d./28

Borrowing two host bits from a /24 creates four subnets, resulting in a /26 prefix. Each /26 subnet provides 62 usable hosts. The formula 2^n subnets requires n borrowed bits, so 2^2 equals four subnets.

Which network device forwards frames based on MAC address tables and operates primarily at Layer 2?

• a.Router
• b.Firewall
• c.Load balancer
• d.Switch✓

A switch builds a MAC address table and forwards frames only to the port associated with the destination MAC, operating at Layer 2. Routers work at Layer 3 using IP addresses. Switching reduces collisions by creating dedicated collision domains per port.

Which IEEE standard defines VLAN tagging on Ethernet trunk links?

• a.802.1Q✓
• b.802.3af
• c.802.11ac
• d.802.1X

IEEE 802.1Q defines the frame tagging method used to carry multiple VLANs across a trunk link. 802.3af covers PoE, 802.11ac is Wi-Fi, and 802.1X is port-based access control. The 802.1Q tag adds a 4-byte field to the Ethernet frame.

What is the purpose of a default gateway on a host's IP configuration?

• a.To resolve domain names into IP addresses
• b.To assign IP addresses to other hosts
• c.To forward traffic destined for remote networks✓
• d.To encrypt outbound traffic automatically

The default gateway is the router interface a host uses to reach destinations outside its local subnet. Without it, a host can only communicate on its own network. Traffic for remote networks is sent to the gateway for further routing.

Which frequency band and standard pairing offers wider channels and higher throughput but shorter range?

• a.2.4 GHz with 802.11b
• b.5 GHz with 802.11ac✓
• c.2.4 GHz with 802.11g
• d.900 MHz with 802.11ah

802.11ac operates in the 5 GHz band, offering wider channels and higher throughput at the cost of shorter range and less obstacle penetration. The 2.4 GHz band travels farther but is more congested and slower. Band selection balances speed against coverage.

Which protocol uses TCP port 22 to provide encrypted remote command-line access?

• a.Telnet
• b.FTP
• c.RDP
• d.SSH✓

SSH uses TCP port 22 to provide an encrypted remote shell, replacing insecure protocols like Telnet. Telnet on port 23 sends data in clear text. SSH is the standard for secure device management.

In a client-server architecture, what best describes the role of the server?

• a.It provides resources or services in response to client requests✓
• b.It only forwards broadcast traffic between subnets
• c.It exclusively resolves MAC addresses to IPs
• d.It generates spanning-tree topology changes

A server centrally provides resources or services such as files, web pages, or databases in response to client requests. Clients initiate requests and consume those services. This model contrasts with peer-to-peer where nodes act as both.

Which address is reserved as the IPv4 loopback used to test the local TCP/IP stack?

• a.192.168.0.1
• b.10.0.0.1
• c.127.0.0.1✓
• d.255.255.255.255

127.0.0.1 is the loopback address that lets a host test its own TCP/IP stack without touching the physical network. The entire 127.0.0.0/8 block is reserved for loopback. Pinging it confirms the local protocol stack is functioning.

An administrator is terminating a straight-through Ethernet cable using the T568B standard on both ends. Which pin arrangement starts the sequence?

• a.White-green, green, white-orange, blue
• b.White-orange, orange, white-green, blue✓
• c.White-brown, brown, white-blue, green
• d.Orange, white-orange, green, white-green

The T568B wiring order begins with white-orange, orange, white-green, blue on pins one through four. Using the same standard on both ends creates a straight-through cable. Mixing T568A and T568B on opposite ends creates a crossover.

Which technology allows a switch to supply electrical power to devices such as IP phones and access points over the data cable?

• a.QoS
• b.STP
• c.PoE✓
• d.NAT

Power over Ethernet (PoE) delivers electrical power and data over the same twisted-pair cable, powering devices like IP phones, cameras, and access points. This removes the need for separate power adapters. Standards include 802.3af, 802.3at, and 802.3bt.

When implementing inter-VLAN routing on a single router interface, what configuration is required?

• a.Router-on-a-stick using subinterfaces with 802.1Q tagging✓
• b.A separate physical router for each VLAN
• c.Disabling all trunk links to the switch
• d.Assigning every VLAN the same subnet

Router-on-a-stick uses a single physical interface divided into subinterfaces, each tagged for a VLAN with 802.1Q, to route between VLANs. This avoids needing one physical interface per VLAN. A Layer 3 switch is an alternative that uses SVIs.

A wireless network must support the highest client density in a crowded office. Which deployment choice best reduces co-channel interference on 2.4 GHz?

• a.Set every access point to channel 6
• b.Use overlapping channels 1, 2, and 3
• c.Increase transmit power to maximum on all APs
• d.Use non-overlapping channels 1, 6, and 11✓

In the 2.4 GHz band, channels 1, 6, and 11 are the only non-overlapping options, so alternating them between adjacent APs minimizes co-channel and adjacent-channel interference. Maxing transmit power actually worsens interference. Proper channel planning is key to dense deployments.

Which routing protocol is a link-state interior gateway protocol that uses cost based on bandwidth as its metric?

• a.RIP
• b.OSPF✓
• c.BGP
• d.EIGRP

OSPF is a link-state interior gateway protocol that calculates the shortest path using a cost metric derived from link bandwidth. RIP uses hop count and BGP is a path-vector exterior protocol. OSPF converges faster than distance-vector protocols in large networks.

An engineer configures a static route of last resort. Which destination and mask represent the default route?

• a.255.255.255.255/32
• b.127.0.0.0/8
• c.0.0.0.0/0✓
• d.169.254.0.0/16

The default route is written as 0.0.0.0/0, matching any destination not covered by a more specific route. It directs otherwise-unmatched traffic to a next hop, often the internet gateway. This is commonly called the gateway of last resort.

Which protocol prevents Layer 2 switching loops by placing redundant links into a blocking state?

• a.Spanning Tree Protocol✓
• b.Border Gateway Protocol
• c.Hot Standby Router Protocol
• d.Network Time Protocol

Spanning Tree Protocol (STP) detects redundant Layer 2 paths and blocks them to prevent broadcast storms and switching loops. If an active link fails, a blocked link can transition to forwarding. STP is essential in networks with redundant switch links.

A technician needs to connect two buildings 800 meters apart with high bandwidth and immunity to electromagnetic interference. Which medium is best?

• a.Cat 6 UTP
• b.Coaxial cable
• c.Cat 5e UTP
• d.Single-mode fiber✓

Single-mode fiber supports long distances well beyond copper's 100-meter limit and is immune to electromagnetic interference. Twisted-pair copper cannot reach 800 meters. Fiber is the standard choice for building-to-building backbone links.

Which addressing technique allows many internal private hosts to share a single public IP address for internet access?

• a.DHCP
• b.PAT✓
• c.VLSM
• d.ARP

Port Address Translation (PAT), a form of NAT overload, lets multiple private hosts share one public IP by tracking unique source port numbers. This conserves scarce public IPv4 addresses. Each session is distinguished by its translated port.

When configuring a trunk between two switches, which VLAN carries untagged traffic by default?

• a.The management VLAN only
• b.VLAN 4094
• c.The native VLAN✓
• d.The voice VLAN

The native VLAN carries untagged traffic across an 802.1Q trunk. By default it is VLAN 1, but it should be changed and matched on both ends for security. Mismatched native VLANs can cause connectivity and security problems.

Which wireless security standard introduces Simultaneous Authentication of Equals (SAE) to replace the pre-shared key handshake?

• a.WPA3✓
• b.WPA2
• c.WEP
• d.WPA

WPA3 replaces the WPA2 four-way handshake with SAE, providing stronger protection against offline dictionary attacks. WEP and the original WPA are outdated and insecure. WPA3 is the current recommended standard for wireless security.

A network requires automatic failover of the default gateway between two routers. Which category of protocol provides this?

• a.Link aggregation protocol
• b.Spanning tree protocol
• c.Address resolution protocol
• d.First hop redundancy protocol✓

First hop redundancy protocols such as HSRP, VRRP, and GLBP provide a virtual gateway IP shared by multiple routers for automatic failover. If the active router fails, a standby takes over transparently to hosts. This eliminates the gateway as a single point of failure.

Which technology bundles multiple physical links into one logical link to increase bandwidth and provide redundancy between switches?

• a.VLAN trunking
• b.Link aggregation (LACP)✓
• c.Port mirroring
• d.Spanning tree

Link aggregation, often using LACP (802.3ad), combines several physical ports into a single logical link for greater bandwidth and redundancy. If one member link fails, traffic continues over the others. It is commonly used on switch uplinks and server connections.

An administrator assigns 192.168.1.0/24 but needs subnets of varying host sizes. Which technique allows different subnet mask lengths within the same address block?

• a.CIDR summarization
• b.Classful addressing
• c.VLSM✓
• d.APIPA

Variable Length Subnet Masking (VLSM) lets an administrator apply different mask lengths to subnets within the same network, matching each subnet's host requirement. This conserves address space compared with fixed-size subnets. VLSM requires classless routing protocols.

Which DHCP component defines the range of IP addresses a server can lease to clients?

• a.Scope✓
• b.Reservation
• c.Exclusion
• d.Relay

A DHCP scope defines the pool of addresses available for lease on a given subnet. Reservations assign fixed addresses to specific MACs, and exclusions remove addresses from the pool. Relays forward DHCP requests across subnets.

A technician must extend a wired network into an area where running new cable is impractical. Which device bridges two network segments over the existing electrical wiring?

• a.A media converter
• b.A powerline (Ethernet-over-power) adapter✓
• c.A KVM switch
• d.A loopback plug

Powerline adapters, also called Ethernet-over-power, transmit network data over a building's existing electrical wiring to bridge segments. This avoids running new Ethernet cable. Performance varies with wiring quality and distance.

Which SDN plane is responsible for making forwarding decisions and building the network's logical topology?

• a.Data plane
• b.Management plane
• c.Physical plane
• d.Control plane✓

In software-defined networking, the control plane makes forwarding decisions and maintains the logical topology, then programs the data plane. Separating these planes centralizes intelligence in an SDN controller. The data plane simply forwards packets based on control-plane instructions.

An engineer configures a switch port that should immediately transition to forwarding for a single end host. Which STP feature is appropriate?

• a.Root guard
• b.BPDU flooding
• c.PortFast✓
• d.Trunk negotiation

PortFast lets an access port skip the listening and learning states and move directly to forwarding, which is safe for ports connected to a single end device. It should not be enabled on ports connected to other switches. BPDU guard is often paired with it for protection.

Which type of NAT maps one private IP address to one dedicated public IP address permanently?

• a.Static NAT✓
• b.Dynamic NAT
• c.Port Address Translation
• d.Overloaded NAT

Static NAT creates a permanent one-to-one mapping between a private and a public address, often used to expose an internal server. Dynamic NAT pulls from a pool, and PAT overloads a single public IP. Static NAT provides consistent inbound reachability.

Which protocol allows network devices to be monitored and managed by collecting metrics such as interface counters and CPU usage?

• a.NTP
• b.SNMP✓
• c.TFTP
• d.SMTP

SNMP (Simple Network Management Protocol) polls and collects metrics like interface statistics and CPU usage from managed devices. SNMPv3 adds authentication and encryption over earlier versions. It is a foundational tool for network monitoring systems.

An organization wants a centralized record of events from all network devices for correlation and alerting. Which system aggregates these logs?

• a.DHCP server
• b.DNS resolver
• c.RADIUS server
• d.Syslog server✓

A syslog server centralizes log messages from many devices, enabling correlation, retention, and alerting. Consistent timestamps from NTP make correlation reliable. SIEM platforms often ingest syslog data for security analysis.

Why is accurate time synchronization across network devices important for operations?

• a.It ensures log timestamps align for accurate event correlation✓
• b.It increases available interface bandwidth
• c.It eliminates the need for routing protocols
• d.It replaces the need for DNS resolution

Accurate time via NTP ensures that log entries from different devices share a consistent timeline, which is critical for correlating events during troubleshooting or security investigations. Without synchronized clocks, reconstructing an incident becomes difficult. NTP typically uses UDP port 123.

Which metric describes the variation in packet delay that can degrade real-time voice and video quality?

• a.Throughput
• b.Bandwidth
• c.Jitter✓
• d.Attenuation

Jitter is the variation in delay between received packets and is especially harmful to real-time applications like VoIP and video. Buffers can absorb small amounts of jitter, but excessive jitter causes choppy audio. QoS policies help minimize it.

An administrator wants to prioritize voice traffic over bulk file transfers on a congested link. Which mechanism should be configured?

• a.Port mirroring
• b.Quality of Service (QoS)✓
• c.Spanning tree
• d.Jumbo frames

Quality of Service (QoS) classifies and prioritizes traffic so latency-sensitive flows like voice receive preferential treatment during congestion. Marking and queuing ensure critical traffic is served first. Without QoS, all traffic competes equally.

Which document records the physical and logical layout of network cabling, ports, and connections for reference during maintenance?

• a.Acceptable use policy
• b.Incident response plan
• c.Service level agreement
• d.Network topology diagram✓

A network topology diagram documents devices, cabling, and connections, serving as a reference during maintenance and troubleshooting. Keeping it current speeds fault isolation. Physical and logical diagrams may be maintained separately.

What is the primary purpose of establishing a performance baseline for a network?

• a.To define normal behavior so anomalies can be detected✓
• b.To permanently cap the maximum throughput of links
• c.To replace the need for monitoring tools
• d.To assign static IP addresses to servers

A baseline captures normal metrics such as utilization, latency, and error rates so that deviations signaling problems can be identified. Comparing current data against the baseline speeds anomaly detection. Baselines should be updated as the network evolves.

Which agreement defines the guaranteed uptime and response times a service provider commits to deliver?

• a.MOU
• b.NDA
• c.SLA✓
• d.AUP

A Service Level Agreement (SLA) specifies measurable commitments such as guaranteed uptime and response times between a provider and customer. Failing to meet an SLA may trigger penalties or credits. SLAs guide operational priorities and escalation.

An operations team uses a port on a switch to capture all traffic passing through other ports for analysis. What is this feature called?

• a.Link aggregation
• b.Port mirroring (SPAN)✓
• c.Port security
• d.Trunking

Port mirroring, also called SPAN, copies traffic from one or more ports to a monitoring port where a packet analyzer or IDS can inspect it. This provides visibility without inline placement. It is a common tool for troubleshooting and security monitoring.

Which change management step should occur before implementing a major network change?

• a.Immediately push the change during peak hours
• b.Skip documentation to save time
• c.Disable all monitoring during the change
• d.Obtain approval and prepare a rollback plan✓

Sound change management requires securing approval and preparing a rollback plan so the change can be reversed if problems arise. Documentation and scheduling during maintenance windows reduce risk. Skipping these steps increases the chance of prolonged outages.

Which type of backup site is fully equipped and running, allowing near-immediate failover during a disaster?

• a.Hot site✓
• b.Cold site
• c.Warm site
• d.Mirror archive

A hot site is fully operational with hardware, data, and connectivity ready for near-immediate failover, minimizing downtime. Cold sites provide only space and power, and warm sites fall in between. Hot sites cost the most to maintain.

In monitoring terminology, what does SNMP use to send an unsolicited alert from a device to the management station?

• a.Poll
• b.Walk
• c.Trap✓
• d.Get

An SNMP trap is an unsolicited notification a device sends to the management station when an event occurs, such as an interface going down. This is more efficient than waiting for the next poll. Traps enable near-real-time alerting.

Which metric expresses the actual rate of successful data delivery over a link, as opposed to its rated capacity?

• a.Bandwidth
• b.Throughput✓
• c.Latency
• d.Frequency

Throughput is the measured rate of successful data delivery, which is often lower than the link's rated bandwidth due to overhead, congestion, or errors. Bandwidth is the theoretical maximum capacity. Comparing the two reveals efficiency losses.

Which document should users acknowledge to define appropriate use of network resources and prohibited activities?

• a.Acceptable Use Policy✓
• b.Bill of materials
• c.Wiring schematic
• d.Change request form

An Acceptable Use Policy (AUP) defines what users may and may not do with organizational network resources. It sets expectations and provides a basis for enforcement. Users typically sign it during onboarding.

A network is configured so that DHCP requests from a remote subnet are forwarded to a central DHCP server. Which feature enables this?

• a.DNS forwarding
• b.Proxy ARP
• c.Port forwarding
• d.DHCP relay (IP helper)✓

A DHCP relay, configured with an IP helper address, forwards broadcast DHCP requests from a client subnet to a DHCP server on another subnet. This allows one central server to serve many subnets. Without it, DHCP broadcasts would not cross the router.

Which recovery metric defines the maximum acceptable amount of data loss measured in time?

• a.MTBF
• b.MTTR
• c.RPO✓
• d.RTO

The Recovery Point Objective (RPO) defines how much data, measured in time, an organization can afford to lose, guiding backup frequency. RTO addresses how quickly systems must be restored. Together they shape disaster recovery planning.

An administrator wants to standardize device configurations and deploy them at scale automatically. Which approach best supports this?

• a.Manually typing commands on each device
• b.Configuration management and automation tools✓
• c.Disabling all remote management
• d.Relying only on factory defaults

Configuration management and automation tools apply standardized, version-controlled configurations across many devices consistently and quickly. This reduces human error and configuration drift. Automation is increasingly central to modern network operations.

Which protocol synchronizes clocks across network devices to a reliable time source?

• a.NTP✓
• b.SNMP
• c.LDAP
• d.SMTP

Network Time Protocol (NTP) synchronizes device clocks to authoritative time sources, keeping logs and certificates consistent. It uses a stratum hierarchy to indicate proximity to the reference clock. Accurate time underpins logging and security functions.

Which access control method assigns permissions to users based on their job function within an organization?

• a.Discretionary access control
• b.Mandatory access control
• c.Role-based access control✓
• d.Rule-based access control

Role-based access control (RBAC) grants permissions according to a user's role or job function, simplifying administration at scale. Users inherit access by being placed into roles rather than being assigned rights individually. This supports least-privilege principles.

A firewall rule set should end with which type of rule to enforce a secure default posture?

• a.An implicit or explicit deny-all✓
• b.A permit-all to any destination
• c.A rule allowing all ICMP
• d.A rule opening all high ports

A secure firewall enforces a default-deny posture, so any traffic not explicitly permitted is blocked by an implicit or explicit deny-all rule. This follows the principle of least privilege for network access. Permit-all rules undermine the firewall's purpose.

Which attack floods a switch's MAC address table to force it to broadcast frames out all ports?

• a.ARP spoofing
• b.DNS poisoning
• c.Smurf attack
• d.MAC flooding✓

MAC flooding overwhelms a switch's MAC address table, causing it to fail open and flood frames out all ports so an attacker can capture traffic. Port security limiting MAC addresses per port mitigates this. It exploits the finite size of the CAM table.

Which technology creates an encrypted tunnel over the public internet to securely connect a remote user to a corporate network?

• a.VLAN
• b.VPN✓
• c.NAT
• d.DMZ

A VPN establishes an encrypted tunnel across untrusted networks, allowing remote users to securely access internal resources. IPsec and SSL/TLS are common VPN technologies. The encryption protects confidentiality and integrity in transit.

Which network segment is designed to host public-facing servers while isolating them from the internal LAN?

• a.Screened subnet (DMZ)✓
• b.Native VLAN
• c.Loopback interface
• d.Broadcast domain

A screened subnet, commonly called a DMZ, hosts public-facing services like web and mail servers in an isolated zone between the internet and the internal network. If a DMZ host is compromised, the internal LAN remains protected. Firewalls control traffic in and out of the DMZ.

Which authentication framework provides port-based network access control, often used with RADIUS for wired and wireless clients?

• a.802.11ac
• b.802.3af
• c.802.1X✓
• d.802.1Q

IEEE 802.1X provides port-based network access control, requiring clients to authenticate, often against a RADIUS server, before gaining network access. It is widely used for both wired ports and wireless networks. This prevents unauthorized devices from connecting.

An attacker sends forged ARP replies to associate their MAC with the default gateway's IP. What is this attack called?

• a.Port scanning
• b.Session hijacking via cookies
• c.SYN flooding
• d.ARP poisoning✓

ARP poisoning sends forged ARP replies so victims map the gateway's IP to the attacker's MAC, enabling on-path interception. Dynamic ARP Inspection and static ARP entries mitigate it. It is a classic on-path (man-in-the-middle) technique.

Which principle dictates that users and processes should receive only the minimum access necessary to perform their tasks?

• a.Defense in depth
• b.Least privilege✓
• c.Separation of duties
• d.Zero trust

The principle of least privilege grants only the minimum access required, limiting the damage from compromised accounts or mistakes. It is a foundational security control. Regular access reviews help maintain it over time.

Which device inspects traffic and can actively block malicious activity inline, rather than only alerting on it?

• a.IPS✓
• b.IDS
• c.Proxy cache
• d.Syslog server

An Intrusion Prevention System (IPS) sits inline and can actively block or drop malicious traffic in real time. An IDS, by contrast, only detects and alerts without stopping the traffic. Inline placement is what enables prevention.

Which switch feature limits the number of MAC addresses learned on a port and can shut the port down if violated?

• a.DHCP snooping
• b.Dynamic ARP inspection
• c.Port security✓
• d.BPDU guard

Port security restricts how many MAC addresses a switch port learns and can take actions like shutting the port down on a violation. This mitigates MAC flooding and unauthorized device connections. Violation modes include protect, restrict, and shutdown.

Which authentication factor category does a hardware token or smartphone authenticator app represent?

• a.Something you are
• b.Something you know
• c.Somewhere you are
• d.Something you have✓

A hardware token or authenticator app is a 'something you have' factor, since it is a physical or possessed item. Passwords are 'something you know' and biometrics are 'something you are.' Combining factor categories creates multifactor authentication.

Which feature validates DHCP messages and blocks rogue DHCP servers on untrusted switch ports?

• a.Port mirroring
• b.DHCP snooping✓
• c.Link aggregation
• d.MAC filtering

DHCP snooping designates trusted and untrusted ports, dropping DHCP server responses on untrusted ports to block rogue DHCP servers. It also builds a binding table used by Dynamic ARP Inspection. This protects clients from receiving malicious configuration.

Which social engineering attack uses fraudulent emails that appear legitimate to trick users into revealing credentials?

• a.Phishing✓
• b.Tailgating
• c.Shoulder surfing
• d.Dumpster diving

Phishing uses deceptive emails impersonating trusted entities to lure users into disclosing credentials or clicking malicious links. Targeted variants include spear phishing and whaling. User awareness training is a primary defense.

Which security model assumes no implicit trust and verifies every request regardless of network location?

• a.Perimeter security
• b.Open access model
• c.Zero trust✓
• d.Flat network model

Zero trust assumes no user or device is inherently trusted, requiring continuous verification of every access request regardless of location. It shifts security away from a trusted internal perimeter. Microsegmentation and strong identity verification support the model.

According to the structured troubleshooting methodology, what is the first step when addressing a network problem?

• a.Implement the solution immediately
• b.Identify the problem and gather information✓
• c.Document findings and outcomes
• d.Escalate to the vendor

The methodology begins with identifying the problem by gathering information, questioning users, and determining the scope. Jumping straight to solutions risks fixing the wrong thing. Later steps include establishing a theory, testing it, and documenting.

After establishing a theory of probable cause, what is the next step in the troubleshooting process?

• a.Document the solution
• b.Establish a plan of action
• c.Test the theory to determine the cause✓
• d.Verify full system functionality

Once a theory of probable cause is formed, the next step is to test that theory to confirm or refute it. If confirmed, a plan of action follows; if not, a new theory is formed. This disciplined loop prevents wasted effort.

A user cannot reach any website by name but can ping external IP addresses directly. Which service is most likely misconfigured?

• a.DNS✓
• b.DHCP
• c.STP
• d.NTP

Being able to ping IPs but not resolve names points to a DNS problem, since name resolution is failing while basic IP connectivity works. Checking the client's DNS server settings is the logical next step. This isolates the layer where the fault lies.

A client receives an address in the 169.254.x.x range. What does this most likely indicate?

• a.A correctly assigned public IP
• b.A static IP misconfiguration
• c.Successful DNS resolution
• d.Failure to reach a DHCP server✓

A 169.254.x.x APIPA address indicates the client could not obtain an address from a DHCP server and self-assigned a link-local address. This points to a DHCP or connectivity problem. Such a host can only communicate on the local link.

Which command-line tool traces the path packets take to a destination, revealing each hop along the way?

• a.ping
• b.traceroute✓
• c.nslookup
• d.arp

Traceroute (or tracert on Windows) maps each router hop between source and destination, helping locate where connectivity breaks or slows. It works by incrementing the TTL to elicit responses from intermediate routers. It complements ping for path analysis.

Two devices on the same subnet cannot communicate, and one shows a duplicate IP address error. What is the likely cause?

• a.A routing loop
• b.A DNS misconfiguration
• c.An IP address conflict✓
• d.An expired SSL certificate

A duplicate IP address error indicates two devices have been assigned the same IP, causing an address conflict that disrupts communication. Resolving it means reassigning one device, often via DHCP reservation or corrected static settings. ARP entries may need clearing afterward.

A fiber link shows very high signal loss and intermittent connectivity. Which physical issue is a likely cause?

• a.A dirty or damaged fiber connector✓
• b.An incorrect VLAN assignment
• c.A missing default gateway
• d.A DHCP scope exhaustion

Dirty, scratched, or damaged fiber connectors cause high signal attenuation and intermittent link problems. Cleaning connectors and inspecting for damage is a standard first check. Optical power meters help quantify the loss.

Users on one switch experience slow performance, and the interface shows a rising count of CRC errors. What does this most likely indicate?

• a.A DNS resolution delay
• b.An exhausted DHCP scope
• c.A misconfigured default route
• d.A cabling or physical layer fault✓

Rising CRC errors point to a physical layer problem such as a damaged cable, bad connector, or electromagnetic interference corrupting frames. Replacing the cable and checking for interference sources is warranted. CRC errors indicate frames arriving corrupted.

Which tool would a technician use to verify that a newly terminated Ethernet cable has correct pinouts and no opens or shorts?

• a.Tone generator
• b.Cable tester✓
• c.Loopback plug
• d.Spectrum analyzer

A cable tester checks continuity, correct pin mapping, and faults such as opens, shorts, or miswires on a terminated cable. It confirms the termination follows the intended standard. A tone generator, by contrast, helps trace and locate cables.

A wireless client experiences a weak signal and frequent disconnects far from the access point. Which term describes this coverage limitation?

• a.Channel overlap
• b.Jitter
• c.Low signal-to-noise ratio / attenuation✓
• d.Broadcast storm

A weak signal at distance reflects attenuation and a low signal-to-noise ratio, degrading throughput and causing disconnects. Solutions include repositioning the AP, adding access points, or adjusting antennas. A site survey helps map coverage gaps.

Which command displays a host's current IP configuration, including address, subnet mask, and default gateway, on Windows?

• a.ipconfig✓
• b.ping
• c.route add
• d.telnet

The ipconfig command on Windows displays the host's IP address, subnet mask, and default gateway, with /all showing DNS and DHCP details. The equivalent on Linux is ifconfig or ip addr. It is a first step in verifying local configuration.

A network experiences a sudden broadcast storm after a technician added a second cable between two switches. What is the most likely cause?

• a.A DNS misconfiguration
• b.An expired DHCP lease
• c.An incorrect subnet mask
• d.A switching loop from a redundant link without STP✓

Adding a redundant link between switches without a working Spanning Tree Protocol creates a Layer 2 loop, producing a broadcast storm. Enabling or verifying STP resolves it. Broadcast storms rapidly saturate switch bandwidth and CPU.

Which utility resolves a hostname to its IP address and can query specific DNS record types?

• a.ping
• b.nslookup✓
• c.ipconfig
• d.netstat

The nslookup utility queries DNS servers to resolve hostnames and can request specific record types such as MX or CNAME. It is invaluable for diagnosing name-resolution issues. The dig command offers similar functionality on Unix-like systems.

A user reports they can access internal resources but not the internet. Other users are unaffected. What should the technician check first on that host?

• a.The entire building's fiber uplink
• b.The core router's routing table
• c.The host's default gateway and DNS settings✓
• d.The ISP's SLA compliance

Because only one user is affected, the problem is likely local to that host, so checking its default gateway and DNS settings comes first. A missing or wrong gateway would block internet access while local resources on the same subnet remain reachable. Isolating scope narrows the fault quickly.

Which command tests basic reachability to a remote host by sending ICMP echo requests?

• a.ping✓
• b.tracert
• c.arp
• d.nbtstat

The ping command sends ICMP echo requests and measures replies to test basic reachability and round-trip time. Successful replies confirm Layer 3 connectivity. Lack of replies may indicate a down host, filtering, or a routing problem.

An access switch port connected to a PC keeps going into an err-disabled state. Which security feature most likely triggered this?

• a.Quality of Service
• b.Link aggregation
• c.Spanning tree root guard
• d.Port security violation✓

A port security violation can place a port into err-disabled state when it detects more MAC addresses than allowed. Reviewing the configured maximum and violation mode reveals the cause. Clearing the condition and correcting the setup restores the port.

Intermittent connectivity affects devices only during business hours, correlating with heavy equipment operation nearby. Which cabling issue is the likely culprit?

• a.Incorrect DNS server
• b.Electromagnetic interference (EMI) on copper cabling✓
• c.Exhausted DHCP scope
• d.A duplicate default gateway

Interference from nearby heavy equipment induces EMI on unshielded copper cabling, causing errors and intermittent connectivity that tracks with equipment use. Rerouting cable away from the source or using shielded cable or fiber resolves it. The time-based correlation is a strong clue.

A pair of switch ports negotiated a duplex mismatch. Which symptom is most characteristic of this condition?

• a.Complete loss of link
• b.APIPA addressing
• c.Late collisions and slow throughput✓
• d.DNS resolution failures

A duplex mismatch, where one side is full and the other half duplex, typically causes late collisions, frame errors, and poor throughput rather than a total link failure. Setting both ends to the same duplex, or both to autonegotiate, resolves it. Late collisions on a full-duplex link are a telltale sign.

After confirming a fix resolves the reported issue, which troubleshooting step should be performed next?

• a.Verify full system functionality and implement preventive measures✓
• b.Immediately close the ticket without testing
• c.Reboot every device on the network
• d.Escalate the issue to management

After implementing a fix, the technician should verify full system functionality and, if applicable, apply preventive measures to keep the issue from recurring. This confirms the solution truly worked end to end. Documentation follows as the final step.

A technician suspects a specific cable among many in a bundle. Which tool pair helps locate and identify that individual cable?

• a.Multimeter and OTDR
• b.Tone generator and inductive probe✓
• c.Cable tester and loopback plug
• d.Protocol analyzer and syslog

A tone generator places a signal on a wire, and the inductive probe detects that tone to locate and identify the specific cable within a bundle. This is standard practice for tracing cables in patch panels or ceilings. It complements continuity testing.

A server's throughput is far below the link's rated speed, and interface counters show many output drops during peak traffic. What is the likely cause?

• a.A DNS misconfiguration
• b.An incorrect default gateway
• c.A duplicate IP address
• d.Congestion causing the interface queue to overflow✓

Output drops during peak traffic indicate the interface queue is overflowing due to congestion, so packets are discarded when buffers fill. QoS, increased capacity, or traffic shaping can relieve it. The correlation with peak load confirms congestion rather than a config error.

Which command shows active TCP/UDP connections and listening ports on a local host?

• a.ping
• b.tracert
• c.netstat✓
• d.arp

The netstat command lists active connections, listening ports, and associated states on the local host. It helps confirm whether a service is listening and which remote endpoints are connected. It is useful for diagnosing application and port issues.

The final step of the troubleshooting methodology is to document the findings, actions, and outcomes. Why is this step important?

• a.It builds a knowledge base that speeds resolution of future similar issues✓
• b.It automatically prevents all future outages
• c.It replaces the need for network monitoring
• d.It eliminates the need for change management

Documenting findings, actions, and outcomes creates a knowledge base that helps resolve similar future problems faster and informs others. It also supports auditing and accountability. Skipping documentation loses valuable troubleshooting insight.

Which Layer 3 switch feature provides a virtual interface used to route traffic for a VLAN without a separate router?

• a.A trunk port
• b.A native VLAN
• c.A loopback plug
• d.A switched virtual interface (SVI)✓

A switched virtual interface (SVI) is a virtual Layer 3 interface on a multilayer switch that routes traffic for an associated VLAN. This enables inter-VLAN routing entirely within the switch, avoiding router-on-a-stick. Each routed VLAN typically has its own SVI acting as the default gateway.

Which cloud connectivity model provides a dedicated private circuit between an organization and its cloud provider instead of traversing the public internet?

• a.A site-to-site VPN over the internet
• b.A remote-access SSL VPN
• c.A public API gateway
• d.A direct/private cloud interconnect✓

A direct or private cloud interconnect provides a dedicated circuit between the organization and the cloud provider, offering predictable performance and better security than the public internet. It avoids exposure to internet congestion and threats. Providers market these as direct-connect or express-route style services.

A newly connected device gets no link light and no connectivity, while other ports on the same switch work. What should the technician verify first?

• a.The ISP's routing table
• b.The corporate DNS zone file
• c.The organization's SLA terms
• d.The patch cable and physical port connection✓

With a dead port while neighbors work, the fault is almost certainly local, so the technician should first verify the patch cable and physical connection, swapping the cable and trying another port. A missing link light points to a Layer 1 problem rather than addressing or routing. Confirming physical connectivity comes before higher-layer checks.