CompTIA Network+ — All Questions

Which layer of the OSI model is responsible for logical addressing and determining the best path for packets across an internetwork?

• a.Layer 1 (Physical)
• b.Layer 4 (Transport)
• c.Layer 3 (Network)✓
• d.Layer 2 (Data Link)

Layer 3, the Network layer, handles logical addressing such as IP and makes routing decisions to move packets between networks. The Data Link layer uses physical MAC addresses for local delivery, while the Transport layer manages end-to-end segmentation. Routers operate primarily at Layer 3.

A network administrator needs to identify the protocol data unit (PDU) used at the Transport layer of the OSI model. Which term applies?

• a.Packet
• b.Bit
• c.Frame
• d.Segment✓

At the Transport layer the PDU is called a segment (or datagram for UDP). Packets exist at the Network layer, frames at the Data Link layer, and bits at the Physical layer. Knowing PDU names per layer helps when interpreting protocol behavior.

Which protocol and port number are used by HTTPS for secure web traffic by default?

• a.TCP 443✓
• b.UDP 53
• c.TCP 80
• d.TCP 22

HTTPS uses TCP port 443 and secures web traffic with TLS. Port 80 is plain HTTP, port 53 is DNS, and port 22 is SSH. Memorizing well-known ports is essential for firewall and troubleshooting work.

What is the default port used by the Domain Name System (DNS) for standard name resolution queries?

• a.TCP 110
• b.UDP 53✓
• c.TCP 25
• d.UDP 67

DNS uses UDP port 53 for most standard queries because they are small and benefit from low overhead. TCP 53 is used for zone transfers and larger responses. Ports 25, 110, and 67 belong to SMTP, POP3, and DHCP respectively.

An engineer must choose an address class for a private network that supports up to 500 hosts on a single subnet. Which private range is most appropriate to draw from?

• a.10.0.0.0/8✓
• b.224.0.0.0/4
• c.127.0.0.0/8
• d.169.254.0.0/16

The 10.0.0.0/8 range is an RFC 1918 private block that easily provides subnets large enough for 500 hosts. 169.254.0.0/16 is APIPA link-local, 224.0.0.0/4 is multicast, and 127.0.0.0/8 is loopback. Private ranges avoid public IP consumption.

How many usable host addresses are available in a subnet with a /29 prefix?

• a.4
• b.8
• c.2
• d.6✓

A /29 leaves 3 host bits, giving 2^3 = 8 total addresses, minus the network and broadcast addresses, for 6 usable hosts. Subnetting math requires subtracting two reserved addresses from the total. /29 subnets are common for small point-to-point or device segments.

Which IPv6 address type begins with the prefix FE80::/10 and is used only for communication on the local link?

• a.Link-local✓
• b.Global unicast
• c.Anycast
• d.Multicast

Link-local IPv6 addresses use the FE80::/10 prefix and are auto-configured on every interface for local-link communication. Global unicast addresses are routable on the internet, while multicast uses FF00::/8. Link-local addresses are never routed beyond the local segment.

A star topology relies on which central device to interconnect all end nodes?

• a.A central switch or hub✓
• b.A ring of daisy-chained cables
• c.A repeater between each pair of nodes
• d.A shared coaxial bus

In a star topology every node connects to a central switch or hub, which forwards traffic between them. A failure of one cable affects only that node, improving fault isolation. Bus and ring topologies use shared media that create single points of failure.

Which cabling standard defines the maximum supported distance of 100 meters for a twisted-pair Ethernet run?

• a.1000BASE-LX
• b.10GBASE-ER
• c.1000BASE-T✓
• d.100BASE-FX

1000BASE-T runs over twisted-pair copper and is limited to 100 meters per segment. The other options are fiber standards that support much longer distances. The 100-meter copper limit includes patch cords and horizontal cabling.

What is the primary purpose of a VLAN in a switched network?

• a.To convert Layer 2 frames into Layer 3 packets
• b.To provide power to connected devices
• c.To increase the speed of individual switch ports
• d.To logically segment a physical switch into separate broadcast domains✓

A VLAN logically segments a switch so that ports belong to separate broadcast domains without needing additional physical switches. This improves security and reduces broadcast traffic. Routing between VLANs still requires a Layer 3 device.

Which protocol resolves an IPv4 address to a MAC address on a local Ethernet segment?

• a.ARP✓
• b.ICMP
• c.DNS
• d.NTP

ARP (Address Resolution Protocol) maps a known IPv4 address to the MAC address needed for Layer 2 delivery. DNS resolves names to IPs, ICMP handles diagnostics, and NTP synchronizes time. ARP operates only within a local broadcast domain.

A company wants clients to obtain IP configuration automatically. Which protocol assigns addresses, subnet masks, gateways, and DNS servers dynamically?

• a.LDAP
• b.DHCP✓
• c.SNMP
• d.DNS

DHCP dynamically leases IP addresses along with subnet mask, default gateway, and DNS server information to clients. This eliminates manual configuration and reduces addressing errors. DHCP uses UDP ports 67 and 68 for server and client communication.

In the TCP three-way handshake, which sequence of flags correctly establishes a connection?

• a.ACK, SYN-ACK, SYN
• b.SYN, SYN-ACK, ACK✓
• c.PSH, URG, ACK
• d.FIN, ACK, RST

The TCP three-way handshake proceeds as SYN, then SYN-ACK, then ACK to establish a reliable session. FIN and RST relate to closing or resetting connections. Understanding the handshake helps diagnose connection setup failures.

Which cloud service model provides virtual machines, storage, and networking that customers manage themselves?

• a.PaaS
• b.IaaS✓
• c.DaaS
• d.SaaS

Infrastructure as a Service (IaaS) delivers fundamental compute, storage, and network resources that the customer configures and manages. SaaS delivers finished applications, and PaaS provides a development platform. IaaS offers the most customer control among cloud models.

What distinguishes UDP from TCP at the Transport layer?

• a.UDP guarantees ordered delivery through sequencing
• b.UDP always encrypts application data
• c.UDP performs a three-way handshake before sending data
• d.UDP is connectionless and does not guarantee delivery✓

UDP is connectionless, has low overhead, and does not guarantee delivery, ordering, or retransmission. This makes it ideal for latency-sensitive traffic such as VoIP and streaming. TCP, by contrast, is connection-oriented and reliable.

A /24 network needs to be divided into four equal subnets. Which new prefix length should be used?

• a./27
• b./28
• c./26✓
• d./25

Borrowing two host bits from a /24 creates four subnets, resulting in a /26 prefix. Each /26 subnet provides 62 usable hosts. The formula 2^n subnets requires n borrowed bits, so 2^2 equals four subnets.

Which network device forwards frames based on MAC address tables and operates primarily at Layer 2?

• a.Firewall
• b.Router
• c.Switch✓
• d.Load balancer

A switch builds a MAC address table and forwards frames only to the port associated with the destination MAC, operating at Layer 2. Routers work at Layer 3 using IP addresses. Switching reduces collisions by creating dedicated collision domains per port.

Which IEEE standard defines VLAN tagging on Ethernet trunk links?

• a.802.1Q✓
• b.802.11ac
• c.802.1X
• d.802.3af

IEEE 802.1Q defines the frame tagging method used to carry multiple VLANs across a trunk link. 802.3af covers PoE, 802.11ac is Wi-Fi, and 802.1X is port-based access control. The 802.1Q tag adds a 4-byte field to the Ethernet frame.

What is the purpose of a default gateway on a host's IP configuration?

• a.To resolve domain names into IP addresses
• b.To encrypt outbound traffic automatically
• c.To assign IP addresses to other hosts
• d.To forward traffic destined for remote networks✓

The default gateway is the router interface a host uses to reach destinations outside its local subnet. Without it, a host can only communicate on its own network. Traffic for remote networks is sent to the gateway for further routing.

Which frequency band and standard pairing offers wider channels and higher throughput but shorter range?

• a.2.4 GHz with 802.11g
• b.2.4 GHz with 802.11b
• c.900 MHz with 802.11ah
• d.5 GHz with 802.11ac✓

802.11ac operates in the 5 GHz band, offering wider channels and higher throughput at the cost of shorter range and less obstacle penetration. The 2.4 GHz band travels farther but is more congested and slower. Band selection balances speed against coverage.

Which protocol uses TCP port 22 to provide encrypted remote command-line access?

• a.SSH✓
• b.FTP
• c.RDP
• d.Telnet

SSH uses TCP port 22 to provide an encrypted remote shell, replacing insecure protocols like Telnet. Telnet on port 23 sends data in clear text. SSH is the standard for secure device management.

In a client-server architecture, what best describes the role of the server?

• a.It exclusively resolves MAC addresses to IPs
• b.It provides resources or services in response to client requests✓
• c.It only forwards broadcast traffic between subnets
• d.It generates spanning-tree topology changes

A server centrally provides resources or services such as files, web pages, or databases in response to client requests. Clients initiate requests and consume those services. This model contrasts with peer-to-peer where nodes act as both.

Which address is reserved as the IPv4 loopback used to test the local TCP/IP stack?

• a.10.0.0.1
• b.127.0.0.1✓
• c.255.255.255.255
• d.192.168.0.1

127.0.0.1 is the loopback address that lets a host test its own TCP/IP stack without touching the physical network. The entire 127.0.0.0/8 block is reserved for loopback. Pinging it confirms the local protocol stack is functioning.

An administrator is terminating a straight-through Ethernet cable using the T568B standard on both ends. Which pin arrangement starts the sequence?

• a.Orange, white-orange, green, white-green
• b.White-green, green, white-orange, blue
• c.White-brown, brown, white-blue, green
• d.White-orange, orange, white-green, blue✓

The T568B wiring order begins with white-orange, orange, white-green, blue on pins one through four. Using the same standard on both ends creates a straight-through cable. Mixing T568A and T568B on opposite ends creates a crossover.

Which technology allows a switch to supply electrical power to devices such as IP phones and access points over the data cable?

• a.STP
• b.PoE✓
• c.NAT
• d.QoS

Power over Ethernet (PoE) delivers electrical power and data over the same twisted-pair cable, powering devices like IP phones, cameras, and access points. This removes the need for separate power adapters. Standards include 802.3af, 802.3at, and 802.3bt.

When implementing inter-VLAN routing on a single router interface, what configuration is required?

• a.Router-on-a-stick using subinterfaces with 802.1Q tagging✓
• b.A separate physical router for each VLAN
• c.Assigning every VLAN the same subnet
• d.Disabling all trunk links to the switch

Router-on-a-stick uses a single physical interface divided into subinterfaces, each tagged for a VLAN with 802.1Q, to route between VLANs. This avoids needing one physical interface per VLAN. A Layer 3 switch is an alternative that uses SVIs.

A wireless network must support the highest client density in a crowded office. Which deployment choice best reduces co-channel interference on 2.4 GHz?

• a.Use overlapping channels 1, 2, and 3
• b.Increase transmit power to maximum on all APs
• c.Use non-overlapping channels 1, 6, and 11✓
• d.Set every access point to channel 6

In the 2.4 GHz band, channels 1, 6, and 11 are the only non-overlapping options, so alternating them between adjacent APs minimizes co-channel and adjacent-channel interference. Maxing transmit power actually worsens interference. Proper channel planning is key to dense deployments.

Which routing protocol is a link-state interior gateway protocol that uses cost based on bandwidth as its metric?

• a.BGP
• b.EIGRP
• c.OSPF✓
• d.RIP

OSPF is a link-state interior gateway protocol that calculates the shortest path using a cost metric derived from link bandwidth. RIP uses hop count and BGP is a path-vector exterior protocol. OSPF converges faster than distance-vector protocols in large networks.

An engineer configures a static route of last resort. Which destination and mask represent the default route?

• a.127.0.0.0/8
• b.255.255.255.255/32
• c.169.254.0.0/16
• d.0.0.0.0/0✓

The default route is written as 0.0.0.0/0, matching any destination not covered by a more specific route. It directs otherwise-unmatched traffic to a next hop, often the internet gateway. This is commonly called the gateway of last resort.

Which protocol prevents Layer 2 switching loops by placing redundant links into a blocking state?

• a.Hot Standby Router Protocol
• b.Network Time Protocol
• c.Spanning Tree Protocol✓
• d.Border Gateway Protocol

Spanning Tree Protocol (STP) detects redundant Layer 2 paths and blocks them to prevent broadcast storms and switching loops. If an active link fails, a blocked link can transition to forwarding. STP is essential in networks with redundant switch links.

A technician needs to connect two buildings 800 meters apart with high bandwidth and immunity to electromagnetic interference. Which medium is best?

• a.Coaxial cable
• b.Single-mode fiber✓
• c.Cat 6 UTP
• d.Cat 5e UTP

Single-mode fiber supports long distances well beyond copper's 100-meter limit and is immune to electromagnetic interference. Twisted-pair copper cannot reach 800 meters. Fiber is the standard choice for building-to-building backbone links.

Which addressing technique allows many internal private hosts to share a single public IP address for internet access?

• a.ARP
• b.PAT✓
• c.DHCP
• d.VLSM

Port Address Translation (PAT), a form of NAT overload, lets multiple private hosts share one public IP by tracking unique source port numbers. This conserves scarce public IPv4 addresses. Each session is distinguished by its translated port.

When configuring a trunk between two switches, which VLAN carries untagged traffic by default?

• a.The management VLAN only
• b.VLAN 4094
• c.The native VLAN✓
• d.The voice VLAN

The native VLAN carries untagged traffic across an 802.1Q trunk. By default it is VLAN 1, but it should be changed and matched on both ends for security. Mismatched native VLANs can cause connectivity and security problems.

Which wireless security standard introduces Simultaneous Authentication of Equals (SAE) to replace the pre-shared key handshake?

• a.WPA
• b.WEP
• c.WPA2
• d.WPA3✓

WPA3 replaces the WPA2 four-way handshake with SAE, providing stronger protection against offline dictionary attacks. WEP and the original WPA are outdated and insecure. WPA3 is the current recommended standard for wireless security.

A network requires automatic failover of the default gateway between two routers. Which category of protocol provides this?

• a.Address resolution protocol
• b.Spanning tree protocol
• c.First hop redundancy protocol✓
• d.Link aggregation protocol

First hop redundancy protocols such as HSRP, VRRP, and GLBP provide a virtual gateway IP shared by multiple routers for automatic failover. If the active router fails, a standby takes over transparently to hosts. This eliminates the gateway as a single point of failure.

Which technology bundles multiple physical links into one logical link to increase bandwidth and provide redundancy between switches?

• a.Spanning tree
• b.VLAN trunking
• c.Link aggregation (LACP)✓
• d.Port mirroring

Link aggregation, often using LACP (802.3ad), combines several physical ports into a single logical link for greater bandwidth and redundancy. If one member link fails, traffic continues over the others. It is commonly used on switch uplinks and server connections.

An administrator assigns 192.168.1.0/24 but needs subnets of varying host sizes. Which technique allows different subnet mask lengths within the same address block?

• a.VLSM✓
• b.APIPA
• c.Classful addressing
• d.CIDR summarization

Variable Length Subnet Masking (VLSM) lets an administrator apply different mask lengths to subnets within the same network, matching each subnet's host requirement. This conserves address space compared with fixed-size subnets. VLSM requires classless routing protocols.

Which DHCP component defines the range of IP addresses a server can lease to clients?

• a.Scope✓
• b.Exclusion
• c.Reservation
• d.Relay

A DHCP scope defines the pool of addresses available for lease on a given subnet. Reservations assign fixed addresses to specific MACs, and exclusions remove addresses from the pool. Relays forward DHCP requests across subnets.

A technician must extend a wired network into an area where running new cable is impractical. Which device bridges two network segments over the existing electrical wiring?

• a.A powerline (Ethernet-over-power) adapter✓
• b.A loopback plug
• c.A KVM switch
• d.A media converter

Powerline adapters, also called Ethernet-over-power, transmit network data over a building's existing electrical wiring to bridge segments. This avoids running new Ethernet cable. Performance varies with wiring quality and distance.

Which SDN plane is responsible for making forwarding decisions and building the network's logical topology?

• a.Data plane
• b.Management plane
• c.Physical plane
• d.Control plane✓

In software-defined networking, the control plane makes forwarding decisions and maintains the logical topology, then programs the data plane. Separating these planes centralizes intelligence in an SDN controller. The data plane simply forwards packets based on control-plane instructions.

An engineer configures a switch port that should immediately transition to forwarding for a single end host. Which STP feature is appropriate?

• a.Root guard
• b.Trunk negotiation
• c.BPDU flooding
• d.PortFast✓

PortFast lets an access port skip the listening and learning states and move directly to forwarding, which is safe for ports connected to a single end device. It should not be enabled on ports connected to other switches. BPDU guard is often paired with it for protection.

Which type of NAT maps one private IP address to one dedicated public IP address permanently?

• a.Overloaded NAT
• b.Static NAT✓
• c.Port Address Translation
• d.Dynamic NAT

Static NAT creates a permanent one-to-one mapping between a private and a public address, often used to expose an internal server. Dynamic NAT pulls from a pool, and PAT overloads a single public IP. Static NAT provides consistent inbound reachability.

Which protocol allows network devices to be monitored and managed by collecting metrics such as interface counters and CPU usage?

• a.TFTP
• b.NTP
• c.SNMP✓
• d.SMTP

SNMP (Simple Network Management Protocol) polls and collects metrics like interface statistics and CPU usage from managed devices. SNMPv3 adds authentication and encryption over earlier versions. It is a foundational tool for network monitoring systems.

An organization wants a centralized record of events from all network devices for correlation and alerting. Which system aggregates these logs?

• a.RADIUS server
• b.DHCP server
• c.DNS resolver
• d.Syslog server✓

A syslog server centralizes log messages from many devices, enabling correlation, retention, and alerting. Consistent timestamps from NTP make correlation reliable. SIEM platforms often ingest syslog data for security analysis.

Why is accurate time synchronization across network devices important for operations?

• a.It replaces the need for DNS resolution
• b.It increases available interface bandwidth
• c.It eliminates the need for routing protocols
• d.It ensures log timestamps align for accurate event correlation✓

Accurate time via NTP ensures that log entries from different devices share a consistent timeline, which is critical for correlating events during troubleshooting or security investigations. Without synchronized clocks, reconstructing an incident becomes difficult. NTP typically uses UDP port 123.

Which metric describes the variation in packet delay that can degrade real-time voice and video quality?

• a.Jitter✓
• b.Attenuation
• c.Bandwidth
• d.Throughput

Jitter is the variation in delay between received packets and is especially harmful to real-time applications like VoIP and video. Buffers can absorb small amounts of jitter, but excessive jitter causes choppy audio. QoS policies help minimize it.

An administrator wants to prioritize voice traffic over bulk file transfers on a congested link. Which mechanism should be configured?

• a.Port mirroring
• b.Quality of Service (QoS)✓
• c.Jumbo frames
• d.Spanning tree

Quality of Service (QoS) classifies and prioritizes traffic so latency-sensitive flows like voice receive preferential treatment during congestion. Marking and queuing ensure critical traffic is served first. Without QoS, all traffic competes equally.

Which document records the physical and logical layout of network cabling, ports, and connections for reference during maintenance?

• a.Network topology diagram✓
• b.Incident response plan
• c.Acceptable use policy
• d.Service level agreement

A network topology diagram documents devices, cabling, and connections, serving as a reference during maintenance and troubleshooting. Keeping it current speeds fault isolation. Physical and logical diagrams may be maintained separately.

What is the primary purpose of establishing a performance baseline for a network?

• a.To replace the need for monitoring tools
• b.To permanently cap the maximum throughput of links
• c.To assign static IP addresses to servers
• d.To define normal behavior so anomalies can be detected✓

A baseline captures normal metrics such as utilization, latency, and error rates so that deviations signaling problems can be identified. Comparing current data against the baseline speeds anomaly detection. Baselines should be updated as the network evolves.

Which agreement defines the guaranteed uptime and response times a service provider commits to deliver?

• a.MOU
• b.SLA✓
• c.AUP
• d.NDA

A Service Level Agreement (SLA) specifies measurable commitments such as guaranteed uptime and response times between a provider and customer. Failing to meet an SLA may trigger penalties or credits. SLAs guide operational priorities and escalation.

An operations team uses a port on a switch to capture all traffic passing through other ports for analysis. What is this feature called?

• a.Trunking
• b.Port mirroring (SPAN)✓
• c.Link aggregation
• d.Port security

Port mirroring, also called SPAN, copies traffic from one or more ports to a monitoring port where a packet analyzer or IDS can inspect it. This provides visibility without inline placement. It is a common tool for troubleshooting and security monitoring.

Which change management step should occur before implementing a major network change?

• a.Disable all monitoring during the change
• b.Obtain approval and prepare a rollback plan✓
• c.Skip documentation to save time
• d.Immediately push the change during peak hours

Sound change management requires securing approval and preparing a rollback plan so the change can be reversed if problems arise. Documentation and scheduling during maintenance windows reduce risk. Skipping these steps increases the chance of prolonged outages.

Which type of backup site is fully equipped and running, allowing near-immediate failover during a disaster?

• a.Warm site
• b.Cold site
• c.Mirror archive
• d.Hot site✓

A hot site is fully operational with hardware, data, and connectivity ready for near-immediate failover, minimizing downtime. Cold sites provide only space and power, and warm sites fall in between. Hot sites cost the most to maintain.

In monitoring terminology, what does SNMP use to send an unsolicited alert from a device to the management station?

• a.Get
• b.Trap✓
• c.Walk
• d.Poll

An SNMP trap is an unsolicited notification a device sends to the management station when an event occurs, such as an interface going down. This is more efficient than waiting for the next poll. Traps enable near-real-time alerting.

Which metric expresses the actual rate of successful data delivery over a link, as opposed to its rated capacity?

• a.Latency
• b.Throughput✓
• c.Frequency
• d.Bandwidth

Throughput is the measured rate of successful data delivery, which is often lower than the link's rated bandwidth due to overhead, congestion, or errors. Bandwidth is the theoretical maximum capacity. Comparing the two reveals efficiency losses.

Which document should users acknowledge to define appropriate use of network resources and prohibited activities?

• a.Bill of materials
• b.Wiring schematic
• c.Acceptable Use Policy✓
• d.Change request form

An Acceptable Use Policy (AUP) defines what users may and may not do with organizational network resources. It sets expectations and provides a basis for enforcement. Users typically sign it during onboarding.

A network is configured so that DHCP requests from a remote subnet are forwarded to a central DHCP server. Which feature enables this?

• a.Proxy ARP
• b.DNS forwarding
• c.Port forwarding
• d.DHCP relay (IP helper)✓

A DHCP relay, configured with an IP helper address, forwards broadcast DHCP requests from a client subnet to a DHCP server on another subnet. This allows one central server to serve many subnets. Without it, DHCP broadcasts would not cross the router.

Which recovery metric defines the maximum acceptable amount of data loss measured in time?

• a.MTBF
• b.MTTR
• c.RTO
• d.RPO✓

The Recovery Point Objective (RPO) defines how much data, measured in time, an organization can afford to lose, guiding backup frequency. RTO addresses how quickly systems must be restored. Together they shape disaster recovery planning.

An administrator wants to standardize device configurations and deploy them at scale automatically. Which approach best supports this?

• a.Disabling all remote management
• b.Relying only on factory defaults
• c.Configuration management and automation tools✓
• d.Manually typing commands on each device

Configuration management and automation tools apply standardized, version-controlled configurations across many devices consistently and quickly. This reduces human error and configuration drift. Automation is increasingly central to modern network operations.

Which protocol synchronizes clocks across network devices to a reliable time source?

• a.LDAP
• b.SNMP
• c.NTP✓
• d.SMTP

Network Time Protocol (NTP) synchronizes device clocks to authoritative time sources, keeping logs and certificates consistent. It uses a stratum hierarchy to indicate proximity to the reference clock. Accurate time underpins logging and security functions.

Which access control method assigns permissions to users based on their job function within an organization?

• a.Discretionary access control
• b.Rule-based access control
• c.Role-based access control✓
• d.Mandatory access control

Role-based access control (RBAC) grants permissions according to a user's role or job function, simplifying administration at scale. Users inherit access by being placed into roles rather than being assigned rights individually. This supports least-privilege principles.

A firewall rule set should end with which type of rule to enforce a secure default posture?

• a.An implicit or explicit deny-all✓
• b.A permit-all to any destination
• c.A rule allowing all ICMP
• d.A rule opening all high ports

A secure firewall enforces a default-deny posture, so any traffic not explicitly permitted is blocked by an implicit or explicit deny-all rule. This follows the principle of least privilege for network access. Permit-all rules undermine the firewall's purpose.

Which attack floods a switch's MAC address table to force it to broadcast frames out all ports?

• a.MAC flooding✓
• b.DNS poisoning
• c.ARP spoofing
• d.Smurf attack

MAC flooding overwhelms a switch's MAC address table, causing it to fail open and flood frames out all ports so an attacker can capture traffic. Port security limiting MAC addresses per port mitigates this. It exploits the finite size of the CAM table.

Which technology creates an encrypted tunnel over the public internet to securely connect a remote user to a corporate network?

• a.VLAN
• b.VPN✓
• c.DMZ
• d.NAT

A VPN establishes an encrypted tunnel across untrusted networks, allowing remote users to securely access internal resources. IPsec and SSL/TLS are common VPN technologies. The encryption protects confidentiality and integrity in transit.

Which network segment is designed to host public-facing servers while isolating them from the internal LAN?

• a.Loopback interface
• b.Native VLAN
• c.Broadcast domain
• d.Screened subnet (DMZ)✓

A screened subnet, commonly called a DMZ, hosts public-facing services like web and mail servers in an isolated zone between the internet and the internal network. If a DMZ host is compromised, the internal LAN remains protected. Firewalls control traffic in and out of the DMZ.

Which authentication framework provides port-based network access control, often used with RADIUS for wired and wireless clients?

• a.802.3af
• b.802.1X✓
• c.802.1Q
• d.802.11ac

IEEE 802.1X provides port-based network access control, requiring clients to authenticate, often against a RADIUS server, before gaining network access. It is widely used for both wired ports and wireless networks. This prevents unauthorized devices from connecting.

An attacker sends forged ARP replies to associate their MAC with the default gateway's IP. What is this attack called?

• a.SYN flooding
• b.Session hijacking via cookies
• c.ARP poisoning✓
• d.Port scanning

ARP poisoning sends forged ARP replies so victims map the gateway's IP to the attacker's MAC, enabling on-path interception. Dynamic ARP Inspection and static ARP entries mitigate it. It is a classic on-path (man-in-the-middle) technique.

Which principle dictates that users and processes should receive only the minimum access necessary to perform their tasks?

• a.Zero trust
• b.Separation of duties
• c.Least privilege✓
• d.Defense in depth

The principle of least privilege grants only the minimum access required, limiting the damage from compromised accounts or mistakes. It is a foundational security control. Regular access reviews help maintain it over time.

Which device inspects traffic and can actively block malicious activity inline, rather than only alerting on it?

• a.IDS
• b.IPS✓
• c.Proxy cache
• d.Syslog server

An Intrusion Prevention System (IPS) sits inline and can actively block or drop malicious traffic in real time. An IDS, by contrast, only detects and alerts without stopping the traffic. Inline placement is what enables prevention.

Which switch feature limits the number of MAC addresses learned on a port and can shut the port down if violated?

• a.Dynamic ARP inspection
• b.DHCP snooping
• c.BPDU guard
• d.Port security✓

Port security restricts how many MAC addresses a switch port learns and can take actions like shutting the port down on a violation. This mitigates MAC flooding and unauthorized device connections. Violation modes include protect, restrict, and shutdown.

Which authentication factor category does a hardware token or smartphone authenticator app represent?

• a.Something you have✓
• b.Something you know
• c.Something you are
• d.Somewhere you are

A hardware token or authenticator app is a 'something you have' factor, since it is a physical or possessed item. Passwords are 'something you know' and biometrics are 'something you are.' Combining factor categories creates multifactor authentication.

Which feature validates DHCP messages and blocks rogue DHCP servers on untrusted switch ports?

• a.Port mirroring
• b.MAC filtering
• c.DHCP snooping✓
• d.Link aggregation

DHCP snooping designates trusted and untrusted ports, dropping DHCP server responses on untrusted ports to block rogue DHCP servers. It also builds a binding table used by Dynamic ARP Inspection. This protects clients from receiving malicious configuration.

Which social engineering attack uses fraudulent emails that appear legitimate to trick users into revealing credentials?

• a.Dumpster diving
• b.Tailgating
• c.Phishing✓
• d.Shoulder surfing

Phishing uses deceptive emails impersonating trusted entities to lure users into disclosing credentials or clicking malicious links. Targeted variants include spear phishing and whaling. User awareness training is a primary defense.

Which security model assumes no implicit trust and verifies every request regardless of network location?

• a.Flat network model
• b.Zero trust✓
• c.Perimeter security
• d.Open access model

Zero trust assumes no user or device is inherently trusted, requiring continuous verification of every access request regardless of location. It shifts security away from a trusted internal perimeter. Microsegmentation and strong identity verification support the model.

According to the structured troubleshooting methodology, what is the first step when addressing a network problem?

• a.Escalate to the vendor
• b.Identify the problem and gather information✓
• c.Document findings and outcomes
• d.Implement the solution immediately

The methodology begins with identifying the problem by gathering information, questioning users, and determining the scope. Jumping straight to solutions risks fixing the wrong thing. Later steps include establishing a theory, testing it, and documenting.

After establishing a theory of probable cause, what is the next step in the troubleshooting process?

• a.Test the theory to determine the cause✓
• b.Document the solution
• c.Verify full system functionality
• d.Establish a plan of action

Once a theory of probable cause is formed, the next step is to test that theory to confirm or refute it. If confirmed, a plan of action follows; if not, a new theory is formed. This disciplined loop prevents wasted effort.

A user cannot reach any website by name but can ping external IP addresses directly. Which service is most likely misconfigured?

• a.DNS✓
• b.DHCP
• c.NTP
• d.STP

Being able to ping IPs but not resolve names points to a DNS problem, since name resolution is failing while basic IP connectivity works. Checking the client's DNS server settings is the logical next step. This isolates the layer where the fault lies.

A client receives an address in the 169.254.x.x range. What does this most likely indicate?

• a.A correctly assigned public IP
• b.Failure to reach a DHCP server✓
• c.Successful DNS resolution
• d.A static IP misconfiguration

A 169.254.x.x APIPA address indicates the client could not obtain an address from a DHCP server and self-assigned a link-local address. This points to a DHCP or connectivity problem. Such a host can only communicate on the local link.

Which command-line tool traces the path packets take to a destination, revealing each hop along the way?

• a.ping
• b.traceroute✓
• c.nslookup
• d.arp

Traceroute (or tracert on Windows) maps each router hop between source and destination, helping locate where connectivity breaks or slows. It works by incrementing the TTL to elicit responses from intermediate routers. It complements ping for path analysis.

Two devices on the same subnet cannot communicate, and one shows a duplicate IP address error. What is the likely cause?

• a.An IP address conflict✓
• b.An expired SSL certificate
• c.A DNS misconfiguration
• d.A routing loop

A duplicate IP address error indicates two devices have been assigned the same IP, causing an address conflict that disrupts communication. Resolving it means reassigning one device, often via DHCP reservation or corrected static settings. ARP entries may need clearing afterward.

A fiber link shows very high signal loss and intermittent connectivity. Which physical issue is a likely cause?

• a.A DHCP scope exhaustion
• b.A missing default gateway
• c.An incorrect VLAN assignment
• d.A dirty or damaged fiber connector✓

Dirty, scratched, or damaged fiber connectors cause high signal attenuation and intermittent link problems. Cleaning connectors and inspecting for damage is a standard first check. Optical power meters help quantify the loss.

Users on one switch experience slow performance, and the interface shows a rising count of CRC errors. What does this most likely indicate?

• a.A cabling or physical layer fault✓
• b.A misconfigured default route
• c.A DNS resolution delay
• d.An exhausted DHCP scope

Rising CRC errors point to a physical layer problem such as a damaged cable, bad connector, or electromagnetic interference corrupting frames. Replacing the cable and checking for interference sources is warranted. CRC errors indicate frames arriving corrupted.

Which tool would a technician use to verify that a newly terminated Ethernet cable has correct pinouts and no opens or shorts?

• a.Cable tester✓
• b.Spectrum analyzer
• c.Loopback plug
• d.Tone generator

A cable tester checks continuity, correct pin mapping, and faults such as opens, shorts, or miswires on a terminated cable. It confirms the termination follows the intended standard. A tone generator, by contrast, helps trace and locate cables.

A wireless client experiences a weak signal and frequent disconnects far from the access point. Which term describes this coverage limitation?

• a.Channel overlap
• b.Broadcast storm
• c.Low signal-to-noise ratio / attenuation✓
• d.Jitter

A weak signal at distance reflects attenuation and a low signal-to-noise ratio, degrading throughput and causing disconnects. Solutions include repositioning the AP, adding access points, or adjusting antennas. A site survey helps map coverage gaps.

Which command displays a host's current IP configuration, including address, subnet mask, and default gateway, on Windows?

• a.ipconfig✓
• b.ping
• c.route add
• d.telnet

The ipconfig command on Windows displays the host's IP address, subnet mask, and default gateway, with /all showing DNS and DHCP details. The equivalent on Linux is ifconfig or ip addr. It is a first step in verifying local configuration.

A network experiences a sudden broadcast storm after a technician added a second cable between two switches. What is the most likely cause?

• a.A DNS misconfiguration
• b.An expired DHCP lease
• c.A switching loop from a redundant link without STP✓
• d.An incorrect subnet mask

Adding a redundant link between switches without a working Spanning Tree Protocol creates a Layer 2 loop, producing a broadcast storm. Enabling or verifying STP resolves it. Broadcast storms rapidly saturate switch bandwidth and CPU.

Which utility resolves a hostname to its IP address and can query specific DNS record types?

• a.ipconfig
• b.netstat
• c.nslookup✓
• d.ping

The nslookup utility queries DNS servers to resolve hostnames and can request specific record types such as MX or CNAME. It is invaluable for diagnosing name-resolution issues. The dig command offers similar functionality on Unix-like systems.

A user reports they can access internal resources but not the internet. Other users are unaffected. What should the technician check first on that host?

• a.The host's default gateway and DNS settings✓
• b.The core router's routing table
• c.The ISP's SLA compliance
• d.The entire building's fiber uplink

Because only one user is affected, the problem is likely local to that host, so checking its default gateway and DNS settings comes first. A missing or wrong gateway would block internet access while local resources on the same subnet remain reachable. Isolating scope narrows the fault quickly.

Which command tests basic reachability to a remote host by sending ICMP echo requests?

• a.arp
• b.nbtstat
• c.ping✓
• d.tracert

The ping command sends ICMP echo requests and measures replies to test basic reachability and round-trip time. Successful replies confirm Layer 3 connectivity. Lack of replies may indicate a down host, filtering, or a routing problem.

An access switch port connected to a PC keeps going into an err-disabled state. Which security feature most likely triggered this?

• a.Quality of Service
• b.Link aggregation
• c.Spanning tree root guard
• d.Port security violation✓

A port security violation can place a port into err-disabled state when it detects more MAC addresses than allowed. Reviewing the configured maximum and violation mode reveals the cause. Clearing the condition and correcting the setup restores the port.

Intermittent connectivity affects devices only during business hours, correlating with heavy equipment operation nearby. Which cabling issue is the likely culprit?

• a.Incorrect DNS server
• b.Electromagnetic interference (EMI) on copper cabling✓
• c.A duplicate default gateway
• d.Exhausted DHCP scope

Interference from nearby heavy equipment induces EMI on unshielded copper cabling, causing errors and intermittent connectivity that tracks with equipment use. Rerouting cable away from the source or using shielded cable or fiber resolves it. The time-based correlation is a strong clue.

A pair of switch ports negotiated a duplex mismatch. Which symptom is most characteristic of this condition?

• a.Late collisions and slow throughput✓
• b.Complete loss of link
• c.APIPA addressing
• d.DNS resolution failures

A duplex mismatch, where one side is full and the other half duplex, typically causes late collisions, frame errors, and poor throughput rather than a total link failure. Setting both ends to the same duplex, or both to autonegotiate, resolves it. Late collisions on a full-duplex link are a telltale sign.

After confirming a fix resolves the reported issue, which troubleshooting step should be performed next?

• a.Reboot every device on the network
• b.Escalate the issue to management
• c.Verify full system functionality and implement preventive measures✓
• d.Immediately close the ticket without testing

After implementing a fix, the technician should verify full system functionality and, if applicable, apply preventive measures to keep the issue from recurring. This confirms the solution truly worked end to end. Documentation follows as the final step.

A technician suspects a specific cable among many in a bundle. Which tool pair helps locate and identify that individual cable?

• a.Cable tester and loopback plug
• b.Multimeter and OTDR
• c.Protocol analyzer and syslog
• d.Tone generator and inductive probe✓

A tone generator places a signal on a wire, and the inductive probe detects that tone to locate and identify the specific cable within a bundle. This is standard practice for tracing cables in patch panels or ceilings. It complements continuity testing.

A server's throughput is far below the link's rated speed, and interface counters show many output drops during peak traffic. What is the likely cause?

• a.A DNS misconfiguration
• b.A duplicate IP address
• c.An incorrect default gateway
• d.Congestion causing the interface queue to overflow✓

Output drops during peak traffic indicate the interface queue is overflowing due to congestion, so packets are discarded when buffers fill. QoS, increased capacity, or traffic shaping can relieve it. The correlation with peak load confirms congestion rather than a config error.

Which command shows active TCP/UDP connections and listening ports on a local host?

• a.arp
• b.ping
• c.tracert
• d.netstat✓

The netstat command lists active connections, listening ports, and associated states on the local host. It helps confirm whether a service is listening and which remote endpoints are connected. It is useful for diagnosing application and port issues.

The final step of the troubleshooting methodology is to document the findings, actions, and outcomes. Why is this step important?

• a.It builds a knowledge base that speeds resolution of future similar issues✓
• b.It automatically prevents all future outages
• c.It eliminates the need for change management
• d.It replaces the need for network monitoring

Documenting findings, actions, and outcomes creates a knowledge base that helps resolve similar future problems faster and informs others. It also supports auditing and accountability. Skipping documentation loses valuable troubleshooting insight.

Which Layer 3 switch feature provides a virtual interface used to route traffic for a VLAN without a separate router?

• a.A loopback plug
• b.A switched virtual interface (SVI)✓
• c.A native VLAN
• d.A trunk port

A switched virtual interface (SVI) is a virtual Layer 3 interface on a multilayer switch that routes traffic for an associated VLAN. This enables inter-VLAN routing entirely within the switch, avoiding router-on-a-stick. Each routed VLAN typically has its own SVI acting as the default gateway.

Which cloud connectivity model provides a dedicated private circuit between an organization and its cloud provider instead of traversing the public internet?

• a.A direct/private cloud interconnect✓
• b.A remote-access SSL VPN
• c.A public API gateway
• d.A site-to-site VPN over the internet

A direct or private cloud interconnect provides a dedicated circuit between the organization and the cloud provider, offering predictable performance and better security than the public internet. It avoids exposure to internet congestion and threats. Providers market these as direct-connect or express-route style services.

A newly connected device gets no link light and no connectivity, while other ports on the same switch work. What should the technician verify first?

• a.The corporate DNS zone file
• b.The ISP's routing table
• c.The patch cable and physical port connection✓
• d.The organization's SLA terms

With a dead port while neighbors work, the fault is almost certainly local, so the technician should first verify the patch cable and physical connection, swapping the cable and trying another port. A missing link light points to a Layer 1 problem rather than addressing or routing. Confirming physical connectivity comes before higher-layer checks.

Which OSI layer provides reliable, connection-oriented delivery with segmentation, sequencing, and flow control?

• a.Layer 4 (Transport)✓
• b.Layer 5 (Session)
• c.Layer 3 (Network)
• d.Layer 6 (Presentation)

The Transport layer (Layer 4) handles end-to-end delivery, breaking data into segments, sequencing them, and managing flow control and, in TCP, retransmission. The Network layer routes packets but does not guarantee delivery. TCP is the classic Layer 4 protocol that provides these reliability features.

At which OSI layer are data formatting, character encoding, compression, and encryption or decryption handled?

• a.Layer 7 (Application)
• b.Layer 2 (Data Link control)
• c.Layer 4 (Transport)
• d.Layer 6 (Presentation)✓

The Presentation layer (Layer 6) translates data between the application and the network, handling formatting, character encoding, compression, and encryption. It ensures data from the sender is readable by the receiver. TLS encryption is often associated with this layer's functions.

Which OSI layer establishes, maintains, and terminates dialogues between two communicating hosts?

• a.Layer 4 (Transport)
• b.Layer 5 (Session)✓
• c.Layer 7 (Application)
• d.Layer 6 (Presentation)

The Session layer (Layer 5) sets up, manages, and tears down the sessions or dialogues between applications on different hosts. It can also handle checkpointing and reestablishing dropped connections. It sits above Transport and below Presentation in the stack.

Which OSI layer defines voltage levels, pin assignments, and the encoding of bits into electrical, optical, or radio signals?

• a.Layer 4 (Transport)
• b.Layer 3 (Network)
• c.Layer 2 (Data Link)
• d.Layer 1 (Physical)✓

The Physical layer (Layer 1) defines the physical and electrical characteristics of the medium, including voltage, pinouts, cabling, and how bits become signals. Hubs, cables, and connectors operate here. It is concerned only with transmitting raw bits, not their meaning.

The Data Link layer encapsulates packets into which protocol data unit before placing them on the local medium?

• a.Packet
• b.Frame✓
• c.Datagram
• d.Segment

At the Data Link layer (Layer 2), packets from the Network layer are encapsulated into frames that include source and destination MAC addresses and error-checking. Segments belong to the Transport layer and packets to the Network layer. Framing prepares data for delivery across the local link.

Protocols such as HTTP, SMTP, and FTP that provide services directly to user applications operate at which OSI layer?

• a.Layer 5 (Session)
• b.Layer 6 (Presentation)
• c.Layer 7 (Application)✓
• d.Layer 4 (Transport)

The Application layer (Layer 7) is where protocols that interface directly with user-facing applications, such as HTTP, SMTP, and FTP, operate. It provides network services to applications rather than to end users directly. It is the top layer of the OSI model.

As data moves down the OSI stack from a sending host, in what order is it encapsulated?

• a.Bits, frames, packets, segments, data
• b.Packets, segments, frames, data, bits
• c.Data, segments, packets, frames, bits✓
• d.Frames, packets, segments, data, bits

Encapsulation proceeds top down: application data becomes segments at Transport, packets at Network, frames at Data Link, and finally bits at the Physical layer. Each layer adds its own header (and the Data Link layer a trailer). The receiving host reverses this order during de-encapsulation.

At the Network layer, a segment received from the Transport layer is encapsulated into which protocol data unit?

• a.Segment
• b.Packet✓
• c.Bit
• d.Frame

The Network layer (Layer 3) adds logical addressing to form a packet from the Transport layer's segment. Frames are formed at Layer 2 and bits exist at Layer 1. Routers forward packets based on the destination IP in the Layer 3 header.

In a full-mesh topology of 6 nodes, how many direct point-to-point links are required?

• a.15✓
• b.30
• c.6
• d.12

A full mesh connects every node to every other node, requiring n(n-1)/2 links. For 6 nodes that is 6 times 5 divided by 2, which equals 15. Full mesh offers maximum redundancy but grows expensive quickly as nodes increase.

Which topology connects multiple remote sites back to a single central hub site, minimizing links but creating a single point of failure at the center?

• a.Bus
• b.Ring
• c.Full mesh
• d.Hub-and-spoke✓

In a hub-and-spoke topology, each remote spoke site connects only to a central hub, reducing the number of links compared with a mesh. The trade-off is that the hub becomes a single point of failure and a potential bottleneck. It is common in WAN designs for cost efficiency.

Which data center fabric design connects every leaf switch to every spine switch to provide predictable, low-latency east-west traffic?

• a.Token ring
• b.Three-tier collapsed core
• c.Bus backbone
• d.Spine-and-leaf✓

A spine-and-leaf fabric links each leaf (access) switch to every spine switch, so any server is at most two hops from any other. This yields consistent latency and high bandwidth for east-west traffic in modern data centers. It scales better than traditional three-tier designs for server-to-server flows.

In the classic three-tier hierarchical campus model, which layer aggregates access switches and enforces routing and policy between them?

• a.Distribution layer✓
• b.Physical layer
• c.Core layer
• d.Access layer

The distribution (aggregation) layer sits between access and core, aggregating access-layer uplinks and applying routing, filtering, and policy. The access layer connects end devices, and the core provides high-speed backbone transport. Separating these roles improves scalability and manageability.

Which network type spans a city or metropolitan area, larger than a LAN but smaller than a WAN?

• a.SAN
• b.PAN
• c.MAN✓
• d.WLAN

A Metropolitan Area Network (MAN) covers a city or metro region, bridging the gap between a local LAN and a wide-area WAN. It often interconnects multiple campuses within the same city. Service providers frequently deliver MAN services over fiber.

Which specialized network provides block-level access to consolidated storage, appearing to servers as locally attached disks?

• a.Campus area network (CAN)
• b.Personal area network (PAN)
• c.Wireless LAN (WLAN)
• d.Storage area network (SAN)✓

A Storage Area Network (SAN) delivers block-level storage over a dedicated high-speed network so servers treat remote volumes as if locally attached. Technologies include Fiber Channel and iSCSI. This differs from file-level NAS, which presents shares over the LAN.

A wireless connection between a smartphone and nearby earbuds over Bluetooth is an example of which network type?

• a.Storage area network (SAN)
• b.Personal area network (PAN)✓
• c.Metro area network (MAN)
• d.Wide area network (WAN)

A Personal Area Network (PAN) interconnects devices within a person's immediate range, typically a few meters, often over Bluetooth. Pairing a phone with earbuds or a smartwatch is a common example. PANs are the smallest scope among network types.

Which technology uses centralized, software-based policy to steer traffic across multiple transport links such as MPLS, broadband, and LTE between sites?

• a.VLSM
• b.STP
• c.PoE
• d.SD-WAN✓

Software-Defined WAN (SD-WAN) abstracts the underlying transports and uses centralized policy to route application traffic over the best available link. It can combine MPLS, broadband, and cellular for resilience and cost savings. It improves agility compared with traditional static WAN routing.

Which copper cabling category is required to reliably support 10GBASE-T over the full 100-meter distance?

• a.Cat 3
• b.Cat 6a✓
• c.Cat 5e
• d.Cat 5

Category 6a cabling supports 10GBASE-T at the full 100-meter distance with improved alien crosstalk performance. Cat 6 can carry 10 Gbps but only to about 55 meters. Cat 5e tops out at 1 Gbps for typical runs.

Which small-form-factor fiber connector uses a 1.25 mm ferrule and a latching clip, and is common on SFP transceivers?

• a.LC✓
• b.BNC
• c.F-type
• d.ST

The LC (Lucent Connector) uses a compact 1.25 mm ferrule and a push-pull latch, making it ideal for high-density SFP and SFP+ ports. ST and SC are larger 2.5 mm connectors. BNC and F-type are coaxial, not fiber, connectors.

Which transceiver form factor supports a single 10 Gbps link and is widely used in switch uplinks?

• a.RJ45
• b.SFP+✓
• c.GBIC
• d.QSFP28 (100 Gbps quad channel)

SFP+ is an enhanced small form-factor pluggable transceiver rated for 10 Gbps on a single lane. GBIC is an older, larger 1 Gbps module. QSFP variants bundle four lanes for 40 or 100 Gbps, so they are not single-link 10 Gbps modules.

Which fiber type uses a larger core, typically 50 or 62.5 microns, with LED or VCSEL light sources for shorter, cost-effective runs?

• a.Multimode fiber✓
• b.Single-mode fiber
• c.Twinaxial cable
• d.Coaxial cable

Multimode fiber has a larger core that allows multiple light paths, working well for shorter distances with inexpensive LED or VCSEL sources. Single-mode fiber has a tiny core and laser sources for very long distances. Multimode is common inside data centers and buildings.

Which cable rating is required when cabling runs through air-handling spaces because it produces less toxic smoke when burned?

• a.Riser (CMR)
• b.Shielded (STP)
• c.Direct-burial
• d.Plenum (CMP)✓

Plenum-rated cable (CMP) has a fire-resistant jacket that emits less toxic smoke, so it is required in plenum air spaces above ceilings or under raised floors. Riser cable is for vertical shafts between floors but not plenum spaces. Local fire codes mandate plenum cable in these areas.

Which connector is threaded onto coaxial cable to deliver cable-internet or CATV service to a modem?

• a.LC
• b.RJ11
• c.SC
• d.F-type✓

The F-type connector screws onto coaxial cable and is standard for cable television and cable-modem internet service. LC and SC are fiber connectors, while RJ11 is for telephone lines. Coax with F-connectors is common on the last mile of cable networks.

Which short-reach copper assembly with attached transceivers, known as a DAC, is commonly used for top-of-rack switch-to-server links?

• a.Coaxial RG-6
• b.Twinaxial cable✓
• c.Single-mode fiber
• d.Cat 5e patch cord

A Direct Attach Copper (DAC) cable uses twinaxial copper with transceivers permanently attached to each end, providing a low-cost, low-power option for short 10 to 100 Gbps links inside a rack. It is cheaper than optics for these short distances. It is popular for top-of-rack connectivity.

Which fiber connector bundles 12 or more fibers into one housing and is often used to break out 40G or 100G into multiple lanes?

• a.ST
• b.MPO/MTP✓
• c.SC simplex
• d.LC duplex

The MPO/MTP connector groups many fibers (commonly 12 or 24) into a single rectangular housing, enabling high-density parallel optics for 40G and 100G. It can be broken out into multiple duplex LC links. It is widely used in data-center fiber trunking.

A traditional analog telephone line typically terminates in which small connector with fewer conductors than an Ethernet jack?

• a.LC
• b.RJ45
• c.BNC
• d.RJ11✓

The RJ11 connector, with its two to four conductors, is used for analog telephone and some DSL connections. RJ45 is the eight-conductor connector used for Ethernet. The two look similar but RJ11 is noticeably narrower.

How many usable host addresses does a /26 subnet provide?

• a.126
• b.30
• c.64
• d.62✓

A /26 leaves 6 host bits, giving 2 to the 6th power, or 64 total addresses, minus the network and broadcast addresses, for 62 usable hosts. Always subtract two reserved addresses from the total. A /26 is a common size for medium departmental subnets.

The subnet mask 255.255.255.240 corresponds to which CIDR prefix length?

• a./27
• b./29
• c./28✓
• d./26

The last octet 240 is 11110000 in binary, which is four network bits added to the 24 in the first three octets, totaling 28. So 255.255.255.240 equals /28. Each /28 subnet provides 14 usable hosts.

Host 10.1.5.130 with a /25 mask belongs to which subnet network address?

• a.10.1.5.128✓
• b.10.1.5.0
• c.10.1.5.64
• d.10.1.5.96

A /25 splits the last octet into blocks of 128, producing subnets .0 and .128. The host .130 falls in the second block, so its network address is 10.1.5.128. The broadcast for that subnet would be 10.1.5.255.

A /30 subnet, commonly used for point-to-point router links, provides how many usable host addresses?

• a.6
• b.1
• c.4
• d.2✓

A /30 leaves 2 host bits, giving 4 total addresses minus the network and broadcast, for 2 usable hosts. That is exactly enough for the two ends of a point-to-point link. This efficiency is why /30 is traditional for router interconnections.

How many /27 subnets can be created from a single /24 network?

• a.16
• b.4
• c.32
• d.8✓

Moving from /24 to /27 borrows 3 host bits, and 2 to the 3rd power equals 8 subnets. Each /27 provides 30 usable hosts. The formula 2 to the number of borrowed bits gives the subnet count.

What is the broadcast address of the network 172.16.4.0/22?

• a.172.16.255.255
• b.172.16.7.255✓
• c.172.16.4.255
• d.172.16.4.63

A /22 mask is 255.255.252.0, giving a block size of 4 in the third octet, so 172.16.4.0 spans 172.16.4.0 through 172.16.7.255. The broadcast address is therefore 172.16.7.255. The last usable host is 172.16.7.254.

An IPv6 address is composed of how many bits?

• a.256
• b.128✓
• c.64
• d.32

IPv6 uses 128-bit addresses, written as eight groups of four hexadecimal digits. This vastly expands the address space compared with IPv4's 32 bits. The larger space removes the practical scarcity that drove IPv4 NAT adoption.

Which IPv6 prefix is reserved for unique local addresses, the rough equivalent of IPv4 RFC 1918 private space?

• a.FF00::/8
• b.FC00::/7✓
• c.2000::/3
• d.FE80::/10

Unique local addresses use the FC00::/7 range (in practice FD00::/8) and are routable within an organization but not on the public internet. FE80::/10 is link-local, FF00::/8 is multicast, and 2000::/3 is global unicast. ULAs provide private-style addressing for IPv6.

Which IPv6 address is the loopback used to test the local protocol stack?

• a.FF02::1
• b.FE80::1
• c.::
• d.::1✓

The IPv6 loopback address is ::1, the equivalent of 127.0.0.1 in IPv4, used to test the local TCP/IP stack. The all-zeros :: is the unspecified address. FF02::1 is the all-nodes multicast address on the local link.

Which IPv6 mechanism lets a host automatically generate its own global address from a router-advertised prefix without a DHCP server?

• a.APIPA
• b.SLAAC✓
• c.NAT66
• d.DHCPv6 stateful

Stateless Address Autoconfiguration (SLAAC) lets a host build its own address by combining the prefix from a Router Advertisement with a locally generated interface identifier. No DHCP server is required. APIPA is an IPv4 concept, and stateful DHCPv6 does track assignments centrally.

Which process forms the 64-bit IPv6 interface identifier from a 48-bit MAC address by inserting FFFE and flipping a bit?

• a.Stateful DHCPv6
• b.Anycast assignment
• c.EUI-64✓
• d.SLAAC prefix delegation

EUI-64 expands a 48-bit MAC into a 64-bit interface identifier by inserting FFFE in the middle and flipping the seventh bit of the first byte. SLAAC often uses EUI-64 to build the host portion of an address. Privacy extensions can replace it with randomized identifiers.

Which address range does a Windows host self-assign when it cannot reach a DHCP server?

• a.172.16.0.0/12
• b.192.168.0.0/16
• c.169.254.0.0/16✓
• d.10.0.0.0/8

APIPA self-assigns an address from 169.254.0.0/16 when no DHCP server responds, allowing local-link communication only. The other ranges are RFC 1918 private blocks that are normally assigned deliberately. Seeing a 169.254 address is a strong sign of a DHCP problem.

Which transition approach runs IPv4 and IPv6 simultaneously on the same interfaces so hosts can use either protocol?

• a.6to4 only
• b.Dual stack✓
• c.Tunneling
• d.NAT64

Dual stack configures both IPv4 and IPv6 on the same interfaces so a host can communicate over whichever protocol a destination supports. It is the most straightforward migration method. Tunneling and NAT64 address cases where only one protocol is available end to end.

Under legacy classful addressing, what is the default subnet mask for a Class B network?

• a.255.255.0.0✓
• b.255.255.255.0
• c.255.255.255.128
• d.255.0.0.0

Class B networks span 128.0.0.0 through 191.255.255.255 and use a default mask of 255.255.0.0, or /16. Class A defaults to 255.0.0.0 and Class C to 255.255.255.0. Modern networks use CIDR rather than rigid classful boundaries.

Which IPv4 address range is reserved for multicast group traffic?

• a.10.0.0.0/8
• b.127.0.0.0/8
• c.224.0.0.0/4✓
• d.169.254.0.0/16

The 224.0.0.0/4 range (224.0.0.0 through 239.255.255.255), historically Class D, is reserved for multicast. Multicast delivers a single stream to many subscribed receivers efficiently. The other ranges are loopback, APIPA, and private unicast respectively.

Which TCP port does FTP use for its control connection carrying commands and responses?

• a.21✓
• b.22
• c.69
• d.20

FTP uses TCP port 21 for the control channel that carries commands and server responses, while port 20 handles active-mode data transfer. Port 22 is SSH and port 69 is TFTP. Separating control and data is a defining trait of FTP.

Which well-known TCP port is used by SMTP to relay email between mail servers?

• a.993
• b.110
• c.143
• d.25✓

SMTP uses TCP port 25 to transfer email between servers. Ports 110 and 143 are POP3 and IMAP for retrieval, and 993 is secure IMAP. Submission from clients often uses port 587 with authentication.

Which TCP port does IMAP use by default to retrieve and synchronize email from a server?

• a.25
• b.110
• c.389
• d.143✓

IMAP uses TCP port 143 and, unlike POP3, keeps messages on the server and synchronizes folder state across devices. POP3 on port 110 typically downloads and deletes mail. Secure IMAP over TLS uses port 993.

On which UDP port does an SNMP agent listen for polling requests from a management station?

• a.514
• b.161✓
• c.123
• d.162

SNMP agents listen on UDP port 161 for get and set requests, while traps are sent to the manager on UDP 162. Port 514 is syslog and 123 is NTP. Knowing this pair is key to allowing monitoring through firewalls.

Which TCP port is used by Microsoft's Remote Desktop Protocol for graphical remote sessions?

• a.5900
• b.22
• c.23
• d.3389✓

RDP uses TCP port 3389 to provide graphical remote access to Windows systems. Port 5900 is VNC, port 22 is SSH, and 23 is Telnet. Exposing 3389 directly to the internet is a common security risk.

Which TCP or UDP port does LDAP use for unencrypted directory queries?

• a.636
• b.445
• c.389✓
• d.88

LDAP uses port 389 for standard, unencrypted directory lookups. The secure variant LDAPS uses port 636. Port 88 is Kerberos and 445 is SMB, both common in the same directory environments.

Which TCP port does modern SMB use for Windows file and printer sharing over TCP/IP?

• a.139
• b.137
• c.3389
• d.445✓

Modern SMB (CIFS) runs directly over TCP port 445 for file and printer sharing. Legacy NetBIOS used ports 137 through 139. Port 445 is frequently targeted by worms, so it should be filtered at the perimeter.

Which UDP port do network devices commonly use to send syslog messages to a logging server?

• a.514✓
• b.123
• c.161
• d.69

Syslog traditionally uses UDP port 514 to forward event messages to a central log server. SNMP uses 161, NTP uses 123, and TFTP uses 69. Reliable variants can carry syslog over TCP, sometimes with TLS.

Which TCP port does the insecure, clear-text Telnet remote-terminal protocol use?

• a.23✓
• b.25
• c.22
• d.21

Telnet uses TCP port 23 and transmits everything, including credentials, in clear text. SSH on port 22 is the secure replacement. Telnet should be disabled on production devices for security reasons.

Which UDP port does TFTP use, often for network device firmware and configuration transfers?

• a.161
• b.69✓
• c.20
• d.21

TFTP uses UDP port 69 and is a lightweight, unauthenticated file-transfer protocol often used to load firmware or configs onto network devices. It lacks the reliability and security of FTP. Its simplicity makes it convenient on the LAN but unsafe across untrusted links.

Which TCP port carries LDAP directory traffic secured with SSL or TLS as LDAPS?

• a.989
• b.636✓
• c.389
• d.443

LDAPS encrypts directory traffic and uses TCP port 636. Standard LDAP on 389 is unencrypted. Port 443 is HTTPS and 989 is FTPS data, so neither applies to secure directory queries.

Which port is used by unencrypted SIP for setting up and tearing down VoIP calls?

• a.5060✓
• b.5061
• c.1720
• d.554

SIP signaling for VoIP call setup and teardown uses port 5060 without encryption, while 5061 is used for SIP over TLS. Port 1720 is H.323 and 554 is RTSP for streaming. SIP handles signaling while RTP carries the actual media.

Which TCP port does POP3 use to download email, typically removing it from the server?

• a.143
• b.110✓
• c.465
• d.25

POP3 uses TCP port 110 and generally downloads messages to a single device, removing them from the server. IMAP on 143 keeps mail synchronized on the server. Secure POP3 over TLS uses port 995.

Which port does Kerberos use for authentication in Windows Active Directory environments?

• a.636
• b.88✓
• c.445
• d.389

Kerberos authentication uses port 88 to issue and validate tickets in Active Directory. LDAP uses 389, LDAPS 636, and SMB 445 in the same environments. Kerberos provides single sign-on through its ticket-granting mechanism.

Which TCP port carries unencrypted HTTP web traffic by default?

• a.21
• b.80✓
• c.8080
• d.443

HTTP uses TCP port 80 for unencrypted web traffic. Port 443 carries HTTPS with TLS encryption, and 8080 is a common alternate proxy or web port. Modern sites redirect port 80 to 443 for security.

Which default TCP port does Microsoft SQL Server listen on for database client connections?

• a.3306
• b.1521
• c.1433✓
• d.5432

Microsoft SQL Server listens on TCP port 1433 by default. MySQL uses 3306, Oracle 1521, and PostgreSQL 5432. Database ports should be restricted to application servers rather than exposed broadly.

Which sequence correctly lists the four DHCP messages a client and server exchange to obtain a lease?

• a.Offer, Discover, Acknowledge, Request
• b.Discover, Request, Offer, Acknowledge
• c.Discover, Offer, Request, Acknowledge✓
• d.Request, Offer, Discover, Acknowledge

The DHCP process follows the DORA sequence: the client broadcasts a Discover, the server sends an Offer, the client sends a Request for the offered address, and the server confirms with an Acknowledge. Remembering DORA keeps the order straight. Only after the ACK does the client use the leased address.

Which DNS record type maps a hostname to an IPv4 address?

• a.CNAME
• b.MX
• c.AAAA
• d.A✓

The A record maps a hostname to a 32-bit IPv4 address. The AAAA record does the same for IPv6, MX points to mail servers, and CNAME creates an alias. A records are the most common forward-lookup entries.

Which DNS record type resolves a hostname to an IPv6 address?

• a.PTR (reverse pointer)
• b.TXT
• c.A
• d.AAAA✓

The AAAA (quad-A) record maps a hostname to a 128-bit IPv6 address. The A record handles IPv4, PTR handles reverse lookups, and TXT holds arbitrary text. Dual-stack hosts commonly have both A and AAAA records.

Which DNS record identifies the mail server responsible for accepting email for a domain?

• a.CNAME
• b.MX✓
• c.SRV
• d.NS

The MX (Mail Exchange) record specifies the mail servers that accept email for a domain, along with a priority value. Lower priority numbers are preferred. SRV records locate other services, while NS records delegate the zone.

Which DNS record creates an alias that points one hostname to another canonical name?

• a.CNAME✓
• b.PTR
• c.SOA
• d.A

A CNAME (Canonical Name) record aliases one hostname to another, so www can point to a canonical host that itself has an A record. It avoids duplicating address records. A CNAME should not coexist with other record types for the same name.

Which DNS record maps an IP address back to a hostname for reverse lookups?

• a.TXT
• b.A
• c.PTR✓
• d.MX

The PTR (pointer) record provides reverse DNS, mapping an IP address to a hostname within the in-addr.arpa or ip6.arpa zones. Mail servers often check PTR records to help verify sender legitimacy. It is the inverse of an A or AAAA record.

Which DNS record type holds free-form text and is used for SPF, DKIM, and domain-verification data?

• a.SRV
• b.CNAME
• c.TXT✓
• d.NS

The TXT record stores arbitrary text and is widely used for email authentication such as SPF and DKIM, plus domain ownership verification. It carries policy data rather than addressing. Its flexibility makes it central to modern email security.

In a DNS record, what does the TTL value control?

• a.How long a resolver may cache the record✓
• b.The priority of a mail server
• c.The UDP port the query is sent to
• d.The maximum size of the DNS response packet

The DNS TTL tells resolvers how many seconds they may cache a record before querying again for a fresh copy. Lower TTLs speed propagation of changes but increase query load. Administrators lower TTLs before planned changes to reduce stale answers.

Which term describes a DNS resolver that takes full responsibility for querying other servers and returning a final answer to the client?

• a.Root hint server
• b.Authoritative-only server
• c.Iterative forwarder
• d.Recursive resolver✓

A recursive resolver accepts a client's query and does the work of contacting root, TLD, and authoritative servers until it has the final answer. The client makes one request and gets one answer. Authoritative servers, by contrast, only answer for the zones they host.

In NTP, what does the stratum number indicate?

• a.The distance in hops from a reference clock✓
• b.The encryption strength of the time source
• c.The UDP port used for synchronization
• d.The number of clients a server can serve

The NTP stratum indicates how many steps a time source is from an authoritative reference clock, with stratum 0 being the reference itself and stratum 1 directly attached. Higher stratum numbers are further away and slightly less accurate. Clients typically sync to low-stratum servers.

Which DHCP feature guarantees that a specific device always receives the same IP address based on its MAC address?

• a.Exclusion range
• b.Lease time
• c.Scope option
• d.Reservation✓

A DHCP reservation ties a specific MAC address to a fixed IP so the device always gets the same address while still using DHCP. Exclusions merely remove addresses from the pool, and scope options set parameters like DNS. Reservations suit printers and servers that need consistent addressing.

On which UDP port does NTP exchange time-synchronization messages?

• a.53
• b.67
• c.514
• d.123✓

NTP uses UDP port 123 to synchronize clocks between devices and time sources. Port 53 is DNS, 67 is DHCP, and 514 is syslog. Accurate time from NTP underpins logging, certificates, and authentication.

Which UDP port pair does DHCP use for server and client communication?

• a.80 and 8080
• b.53 and 54
• c.67 and 68✓
• d.137 and 138

DHCP servers listen on UDP port 67 and clients receive on UDP port 68. These ports are essential to allow through firewalls or configure in DHCP relays. Knowing them helps diagnose why clients fail to obtain addresses.

Which DNS record identifies the authoritative name servers for a zone?

• a.MX
• b.PTR
• c.NS✓
• d.A

NS (Name Server) records list the authoritative name servers for a zone and are used to delegate subdomains. MX points to mail servers, PTR handles reverse lookups, and A maps names to IPv4 addresses. Correct NS records are essential for delegation to work.

A company uses a web-based email and CRM suite that the provider fully manages, with no OS or application maintenance by the customer. Which cloud model is this?

• a.PaaS
• b.DaaS
• c.IaaS
• d.SaaS✓

Software as a Service (SaaS) delivers complete, provider-managed applications accessed over the web, with the customer managing only data and users. IaaS and PaaS require the customer to manage more of the stack. Email and CRM suites are classic SaaS examples.

Which cloud service model gives developers a managed platform of runtime, OS, and middleware to deploy their own applications without managing servers?

• a.On-premises
• b.PaaS✓
• c.IaaS
• d.SaaS

Platform as a Service (PaaS) provides a managed environment, including the operating system, runtime, and middleware, so developers deploy code without maintaining the underlying infrastructure. IaaS gives raw compute the customer must manage, and SaaS gives finished apps. PaaS accelerates development.

An organization keeps sensitive workloads in its private data center but bursts to a public provider during peak demand. Which cloud deployment model is this?

• a.Private cloud
• b.Public cloud
• c.Community cloud
• d.Hybrid cloud✓

A hybrid cloud combines private infrastructure with public cloud resources, allowing sensitive workloads to stay private while bursting to public capacity when needed. This balances control with scalability. Cloud bursting is a common hybrid use case.

Which cloud characteristic allows resources to automatically expand and contract in response to changing demand?

• a.Elasticity✓
• b.Multitenancy
• c.Metered billing
• d.Broad network access

Elasticity lets cloud resources scale up during spikes and scale down when demand falls, often automatically. This ensures performance during peaks while avoiding paying for idle capacity. It is a defining advantage of cloud over fixed on-premises hardware.

Which cloud construct provides a logically isolated, customer-defined virtual network with its own subnets and routing inside a public provider?

• a.Network function virtualization (NFV)
• b.Availability zone
• c.Virtual private cloud (VPC)✓
• d.Content delivery network (CDN)

A Virtual Private Cloud (VPC) is a logically isolated section of a public cloud where a customer defines subnets, route tables, and gateways. It gives control similar to an on-premises network within the provider. CDNs cache content, and availability zones describe physical data-center groupings.

RIP considers a route unreachable once its hop count reaches which value?

• a.255
• b.15
• c.16✓
• d.255 milliseconds

RIP treats a hop count of 16 as infinity, meaning the destination is unreachable, so 15 is the maximum number of usable hops. This limit prevents routing loops but also restricts RIP to small networks. Larger networks use OSPF or EIGRP instead.

When a router learns the same destination from two routing protocols, which value determines the preferred source?

• a.MTU size
• b.Hop count
• c.Bandwidth delay product
• d.Administrative distance✓

Administrative distance ranks the trustworthiness of routing sources, so the route from the protocol with the lower administrative distance is installed. For example, OSPF (110) is preferred over RIP (120). Metrics only compare routes within the same protocol.

A router has routes to 10.1.0.0/16 and 10.1.5.0/24 for a packet destined to 10.1.5.10. Which rule decides which route is used?

• a.Longest prefix match✓
• b.Lowest administrative distance
• c.Round-robin load sharing
• d.First route in the table

Routers select the most specific matching route, known as the longest prefix match, so 10.1.5.0/24 wins over 10.1.0.0/16 for that destination. Administrative distance and metrics only break ties among equally specific routes. Longest match always takes precedence first.

Which Cisco-developed routing protocol uses a composite metric and the DUAL algorithm for fast convergence?

• a.OSPF
• b.RIPv2
• c.BGP
• d.EIGRP✓

EIGRP is an advanced distance-vector protocol that uses a composite metric (bandwidth and delay by default) and the DUAL algorithm to precompute backup routes for rapid convergence. OSPF is link-state and BGP is path-vector. EIGRP was historically Cisco-proprietary before being partially opened.

Which routing protocol exchanges reachability between autonomous systems and is the routing protocol of the internet?

• a.BGP✓
• b.EIGRP
• c.OSPF
• d.RIP

Border Gateway Protocol (BGP) is a path-vector protocol that exchanges routing information between autonomous systems and holds the internet's global routing together. OSPF, EIGRP, and RIP are interior gateway protocols used within a single organization. BGP decisions rely on path attributes rather than simple metrics.

Which routing method requires an administrator to manually enter each destination network and next hop, with no automatic reconvergence?

• a.Static routing✓
• b.OSPF routing
• c.Distance-vector routing
• d.Link-state routing

Static routing relies on manually configured entries and does not adapt automatically when a link fails. It is simple and predictable for small or stub networks but does not scale or self-heal. Dynamic protocols like OSPF reconverge automatically after topology changes.

Which category of routing protocol periodically shares its entire routing table with directly connected neighbors and typically uses hop count?

• a.Path-vector
• b.Link-state
• c.Distance-vector✓
• d.Static

Distance-vector protocols like RIP periodically advertise their whole routing table to neighbors and choose paths using simple metrics such as hop count. Link-state protocols instead flood link information and build a full topology map. Distance-vector is simpler but converges more slowly.

A switch port configured to carry traffic for exactly one VLAN to an end device is known as what?

• a.Access port✓
• b.Trunk port
• c.Native port
• d.Mirror port

An access port belongs to a single VLAN and connects to an end device such as a PC or printer, sending untagged frames. A trunk port carries multiple VLANs between switches. Assigning the wrong VLAN to an access port is a common connectivity fault.

Which switch port type carries traffic for multiple VLANs between switches using 802.1Q tagging?

• a.Trunk port✓
• b.Console port
• c.Access port
• d.Loopback port

A trunk port carries frames for many VLANs across a single link, tagging them with 802.1Q so the far end can separate them. Access ports carry only one VLAN. Trunks are essential for extending VLANs between switches and to routers.

How do switches running Spanning Tree Protocol elect the root bridge?

• a.The first switch powered on always wins
• b.The switch with the lowest bridge ID wins✓
• c.The switch with the most ports wins
• d.The switch with the highest IP address wins

STP elects the root bridge as the switch with the lowest bridge ID, which combines a configurable priority value with the MAC address. Lowering a switch's priority makes it the root. The root bridge becomes the reference point for building the loop-free tree.

Which standard improves on classic STP by converging in seconds rather than up to 50 seconds after a topology change?

• a.802.1X
• b.802.1Q
• c.802.3ad
• d.RSTP (802.1w)✓

Rapid Spanning Tree Protocol (RSTP), defined in 802.1w, converges in seconds using proposal and agreement handshakes and new port roles. Classic STP could take up to 50 seconds. RSTP is backward compatible with legacy STP switches.

Which feature lets a single access port carry both a PC's data VLAN and an IP phone's traffic on a separate tagged VLAN?

• a.Management VLAN
• b.Voice VLAN✓
• c.Native VLAN
• d.Private VLAN

A voice VLAN lets a switch port place phone traffic on a dedicated tagged VLAN while the attached PC uses the untagged data VLAN. This separates voice for QoS and security without a second cable. The IP phone typically has a small built-in switch for the PC.

Two hosts are in different VLANs on the same switch and cannot reach each other. What is required to enable their communication?

• a.Placing both ports in the native VLAN
• b.Disabling Spanning Tree Protocol
• c.A Layer 3 device to route between the VLANs✓
• d.A crossover cable between them

VLANs are separate broadcast domains, so traffic between them must be routed by a Layer 3 device such as a router or Layer 3 switch. Simply being on the same physical switch does not allow inter-VLAN communication. A router-on-a-stick or SVI provides this routing.

Which wireless standard is marketed as Wi-Fi 6 and introduces OFDMA to improve efficiency in dense environments?

• a.802.11ax✓
• b.802.11n
• c.802.11ac
• d.802.11g

802.11ax, branded Wi-Fi 6, adds OFDMA and improved MU-MIMO to serve many clients efficiently in congested areas. It operates in both 2.4 and 5 GHz, with Wi-Fi 6E extending into 6 GHz. It boosts real-world throughput in high-density deployments.

Wi-Fi 6E extends Wi-Fi 6 into which additional, less congested frequency band?

• a.2.4 GHz
• b.6 GHz✓
• c.60 GHz
• d.900 MHz

Wi-Fi 6E adds the 6 GHz band, providing many new non-overlapping channels free of legacy device congestion. This reduces interference and supports wide channels for high throughput. Only 6E-capable clients can use the 6 GHz spectrum.

Which wireless standard, branded Wi-Fi 4, first introduced MIMO and can operate in both the 2.4 GHz and 5 GHz bands?

• a.802.11ac
• b.802.11a
• c.802.11n✓
• d.802.11b

802.11n, marketed as Wi-Fi 4, introduced MIMO with multiple antennas and channel bonding, and it works in both 2.4 and 5 GHz. 802.11ac (Wi-Fi 5) operates only in 5 GHz. The dual-band flexibility of 802.11n made it widely adopted.

In an enterprise wireless deployment, which device centrally manages configuration, RF, and roaming for many lightweight access points?

• a.A wireless LAN controller✓
• b.A router-on-a-stick
• c.A layer 2 switch
• d.A DHCP server

A wireless LAN controller (WLC) centrally manages lightweight access points, handling configuration, channel and power tuning, and seamless roaming. This scales far better than configuring each autonomous AP individually. The controller also enforces consistent security policy across all APs.

Which antenna type focuses radio energy in one direction to extend range on a point-to-point link between two buildings?

• a.Isotropic antenna
• b.Omnidirectional dipole
• c.Rubber duck antenna
• d.Directional (Yagi) antenna✓

A directional antenna such as a Yagi concentrates energy into a narrow beam, increasing range and gain along one axis for point-to-point links. Omnidirectional antennas radiate in all horizontal directions for general coverage. Directional antennas require careful aiming between the two endpoints.

Which technique combines adjacent channels into a wider channel, such as 40 or 80 MHz, to increase wireless throughput?

• a.Frequency hopping
• b.Band steering
• c.Channel bonding✓
• d.MAC filtering

Channel bonding merges adjacent channels into a wider one to carry more data, boosting throughput. It works best in the 5 GHz and 6 GHz bands where spectrum is plentiful. In the crowded 2.4 GHz band, wide channels cause interference and are discouraged.

Which access point feature encourages dual-band capable clients to connect on 5 GHz instead of the more crowded 2.4 GHz band?

• a.Power over Ethernet
• b.Band steering✓
• c.Beamforming
• d.Roaming

Band steering nudges capable clients onto the less congested 5 GHz band to improve performance and free up 2.4 GHz for legacy devices. It works by influencing how the AP responds to client probes. This balances load across bands automatically.

Wireless clients that all connect through a central access point rather than directly to each other are operating in which mode?

• a.Infrastructure mode✓
• b.Monitor mode
• c.Mesh backhaul mode
• d.Ad hoc mode

In infrastructure mode, clients associate with a central access point that coordinates all communication, which is the standard enterprise and home setup. Ad hoc mode connects devices peer-to-peer without an AP. Infrastructure mode scales and secures far better than ad hoc.

Which device sits between clients and the internet, forwarding requests on their behalf and often caching content and filtering URLs?

• a.A media converter
• b.A proxy server✓
• c.A DHCP relay
• d.A layer 2 switch

A proxy server forwards client requests to the internet, can cache frequently requested content, and can filter or log web activity. It centralizes control over outbound traffic. Forward proxies serve internal clients, while reverse proxies front internal servers.

Which device distributes incoming client requests across a pool of backend servers to improve capacity and availability?

• a.Hub
• b.Patch panel
• c.Repeater
• d.Load balancer✓

A load balancer spreads incoming requests across multiple backend servers using algorithms like round robin or least connections, improving scalability and resilience. If one server fails, traffic shifts to the others. It also enables maintenance without downtime.

Which device connects a copper Ethernet segment to a fiber segment by converting between electrical and optical signaling?

• a.KVM switch
• b.Punchdown block
• c.Media converter✓
• d.Loopback plug

A media converter translates between copper and fiber media, extending a link across the boundary between the two. It operates at the physical layer, converting electrical signals to light and back. It is common where fiber is needed to reach beyond copper's distance limit.

Which firewall type tracks the state of active connections and permits return traffic only for sessions it has already seen?

• a.Packet-filtering (stateless) firewall
• b.Proxy-only gateway
• c.Layer 2 transparent bridge
• d.Stateful firewall✓

A stateful firewall maintains a connection table and allows return traffic only for sessions it recognizes as established, providing stronger control than stateless filtering. Stateless firewalls evaluate each packet in isolation against static rules. Statefulness is standard in modern firewalls.

In IPv6, which protocol replaces ARP for discovering the link-layer address of a neighbor?

• a.DHCPv6
• b.ARP for IPv6
• c.Neighbor Discovery Protocol (NDP)✓
• d.ICMPv4

IPv6 uses the Neighbor Discovery Protocol (NDP), part of ICMPv6, to resolve link-layer addresses and discover routers, replacing IPv4's ARP. NDP uses neighbor solicitation and advertisement messages. There is no ARP in IPv6.

Which service assigns IPv6 addresses and options centrally, tracking which client received which address?

• a.Stateful DHCPv6✓
• b.SLAAC
• c.APIPA
• d.NAT64

Stateful DHCPv6 centrally assigns IPv6 addresses and configuration and keeps a record of leases, similar to IPv4 DHCP. SLAAC, by contrast, is stateless and lets hosts self-configure. Stateful DHCPv6 is chosen when central tracking and control are required.

Which IPv6 message does a router periodically send so that hosts learn the on-link prefix and default gateway?

• a.Echo request
• b.Neighbor solicitation
• c.Router advertisement✓
• d.DHCP offer

Routers send Router Advertisement (RA) messages announcing the prefix, default gateway, and configuration flags that hosts use for SLAAC. Hosts can also solicit these with a Router Solicitation. RAs are central to IPv6 autoconfiguration.

Which technology allows IPv6-only clients to reach IPv4-only servers by translating between the two address families?

• a.SLAAC
• b.Dual stack
• c.EUI-64
• d.NAT64✓

NAT64 translates between IPv6 and IPv4 so IPv6-only clients can communicate with IPv4-only resources, usually paired with DNS64. Dual stack instead runs both protocols natively. NAT64 is useful during transition when full dual stack is not possible.

When manually assigning a static IPv4 configuration to a server, which set of parameters is minimally required for it to reach remote networks?

• a.VLAN ID and switch port number
• b.IP address and MAC address only
• c.IP address, subnet mask, and default gateway✓
• d.Hostname and DNS suffix only

To reach remote networks a host needs an IP address, a subnet mask to define its local network, and a default gateway to forward off-subnet traffic. A DNS server is also needed to resolve names but not for basic IP reachability. Without a gateway, the host can only talk locally.

Which PoE standard delivers the most power, up to about 90 W at the source, for devices like PTZ cameras and displays?

• a.802.3u Fast Ethernet
• b.802.3bt (PoE++)✓
• c.802.3af (PoE)
• d.802.3at (PoE+)

802.3bt, known as PoE++, supplies up to roughly 90 W at the source across all four pairs, powering high-draw devices. 802.3af provides about 15 W and 802.3at about 30 W. 802.3u is a Fast Ethernet standard, unrelated to power delivery.

Which switch configuration forces a port to operate as a trunk regardless of the neighbor's negotiation settings?

• a.switchport nonegotiate off
• b.switchport mode trunk✓
• c.no switchport
• d.switchport mode access

The command switchport mode trunk statically sets the port to trunk, carrying tagged VLAN traffic without relying on dynamic negotiation. switchport mode access fixes it as an access port. Hard-setting trunk mode avoids issues from mismatched auto-negotiation.

Enabling jumbo frames on a storage network changes which interface setting to roughly 9000 bytes?

• a.The VLAN ID
• b.The maximum transmission unit (MTU)✓
• c.The spanning-tree cost
• d.The administrative distance

Jumbo frames raise the interface MTU to about 9000 bytes so large payloads move with less per-packet overhead, benefiting iSCSI and backup traffic. Every device in the path must support the same larger MTU. A mismatch causes fragmentation or dropped frames.

Disabling SSID broadcast on an access point has which practical effect?

• a.It hides the network name from casual scans but not from determined attackers✓
• b.It encrypts all wireless traffic automatically
• c.It doubles the available bandwidth
• d.It prevents all deauthentication attacks

Hiding the SSID stops the name from appearing in ordinary device scans but does not provide real security, since the SSID still travels in other frames and tools can reveal it. It offers no encryption and does not stop skilled attackers. Strong encryption like WPA3 is the actual protection.

Which feature presents a web page requiring acceptance of terms or login before granting guests wireless internet access?

• a.MAC randomization
• b.Band steering
• c.WPA3-Enterprise
• d.Captive portal✓

A captive portal intercepts a new client's web traffic and forces it to a page for authentication or acceptance of terms before allowing access. It is common on guest and public Wi-Fi. It controls access without distributing a shared passphrase.

For seamless roaming as a user walks between two access points, how should the APs be configured?

• a.Hidden SSIDs with static client IPs
• b.Different SSIDs and the same channel
• c.The same SSID on non-overlapping channels✓
• d.The same SSID and the same channel

Seamless roaming needs the same SSID across APs so clients see one network, with each AP on a non-overlapping channel to avoid co-channel interference. Matching channels would cause interference in overlapping coverage. Consistent security settings are also required for smooth handoff.

In a router's table, which route source has the most trustworthy administrative distance of 0?

• a.Static routes
• b.RIP-learned routes
• c.Directly connected interfaces✓
• d.OSPF-learned routes

Directly connected networks have an administrative distance of 0, the most trusted, because the router has a live interface on that network. Static routes default to 1, OSPF to 110, and RIP to 120. Lower administrative distance always wins when routes overlap.

When configuring router-on-a-stick, what must be applied to each subinterface for it to service a specific VLAN?

• a.An 802.1Q encapsulation tag matching the VLAN ID✓
• b.A separate physical NIC per VLAN
• c.An access-list that permits any
• d.A crossover cable to the switch

Each router subinterface must be configured with 802.1Q encapsulation for the specific VLAN ID so it can send and receive tagged frames on the trunk. The switch port to the router is configured as a trunk. This lets one physical link route among many VLANs.

Which device combines high-speed hardware switching with the ability to route between VLANs using ASICs?

• a.A media converter
• b.A wireless controller
• c.A Layer 3 (multilayer) switch✓
• d.An unmanaged hub

A Layer 3 or multilayer switch performs both switching and routing in hardware, routing between VLANs at wire speed via switched virtual interfaces. This outperforms router-on-a-stick for high inter-VLAN traffic. It is the standard core and distribution device in campus networks.

Which feature shuts down a PortFast-enabled access port if it unexpectedly receives a BPDU, protecting the spanning-tree topology?

• a.Storm control
• b.BPDU guard✓
• c.Root guard
• d.DHCP snooping

BPDU guard disables a PortFast access port the moment it receives a BPDU, since that indicates an unauthorized switch was connected. This protects the topology from accidental loops or rogue switches. It is commonly paired with PortFast on edge ports.

Which open-standard first-hop redundancy protocol lets multiple routers share a virtual IP so hosts keep a single default gateway?

• a.OSPF
• b.STP
• c.VRRP✓
• d.LACP

Virtual Router Redundancy Protocol (VRRP) is an open standard that lets multiple routers present one virtual gateway IP, with a backup taking over if the master fails. HSRP is a Cisco equivalent. This removes the default gateway as a single point of failure.

Before deploying wireless in a warehouse, which activity maps signal strength and identifies interference and coverage gaps?

• a.A port scan
• b.A cable certification test
• c.A packet capture
• d.A wireless site survey✓

A wireless site survey measures signal strength, interference, and coverage across the space, guiding AP placement, channel plans, and power levels. It produces heat maps that reveal dead zones before deployment. Skipping it often leads to coverage and roaming problems.

An administrator wants the DHCP scope to skip .1 through .10 because those are statically assigned to servers. Which setting accomplishes this?

• a.A reservation
• b.An exclusion range✓
• c.A shorter lease time
• d.A relay agent

An exclusion range removes specific addresses from the DHCP pool so they are never leased, protecting statically assigned server addresses. A reservation, by contrast, hands a fixed address to a particular device via DHCP. Exclusions prevent address conflicts with manual assignments.

How does a switch build its MAC address table?

• a.By recording the source MAC and ingress port of frames it receives✓
• b.By copying the routing table from the gateway
• c.By querying DNS for each destination host
• d.By broadcasting ARP on every port at boot

A switch learns by examining the source MAC address of incoming frames and associating it with the port they arrived on. It then forwards frames only to the known port for a destination, flooding only when the destination is unknown. Entries age out after a period of inactivity.

In the static route 'ip route 192.168.50.0 255.255.255.0 10.0.0.2', what does 10.0.0.2 represent?

• a.The subnet mask
• b.The administrative distance
• c.The next-hop address✓
• d.The destination network

In that command, 192.168.50.0 is the destination network, 255.255.255.0 is its mask, and 10.0.0.2 is the next-hop IP to which matching traffic is forwarded. The router sends packets for that network toward 10.0.0.2. An optional trailing number would set the administrative distance.

In OSPF, which area must all other areas connect to, acting as the backbone?

• a.The not-so-stubby area
• b.Area 1
• c.The stub area
• d.Area 0✓

OSPF designates Area 0 as the backbone, and all other areas must connect to it, directly or via virtual links, so inter-area routing passes through the backbone. This hierarchy keeps the topology scalable and loop-free. Stub and NSSA areas are special non-backbone area types.

A 370 W PoE switch cannot power the 30th camera even though ports are free. What has most likely been exceeded?

• a.The DHCP scope
• b.The MAC address table size
• c.The spanning-tree diameter
• d.The switch's total PoE power budget✓

Each PoE switch has a finite power budget shared across all ports, and adding devices can exhaust it even when physical ports remain. The switch then stops powering additional devices. The fix is a higher-wattage power supply or a switch with a larger PoE budget.

Traffic for VLAN 40 is not crossing a trunk, though VLAN 40 exists on both switches. Which trunk setting should be checked first?

• a.The port speed and duplex
• b.The list of VLANs allowed on the trunk✓
• c.The PoE class of the port
• d.The DNS server address

Trunks can be configured to allow only specific VLANs, so VLAN 40 may simply be missing from the allowed list on the trunk. Verifying and adding it to the allowed VLANs restores the traffic. Native VLAN mismatches are another common trunking issue to check.

Which wireless security mode authenticates each user against a central RADIUS server rather than a shared passphrase?

• a.WPA3-Personal
• b.WEP
• c.WPA3-Enterprise✓
• d.Open with MAC filtering

WPA3-Enterprise uses 802.1X with a RADIUS server so each user authenticates with unique credentials rather than one shared key. This enables per-user access control and easy revocation. Personal modes rely on a single pre-shared key for everyone.

Which is the correctly compressed form of 2001:0db8:0000:0000:0000:0000:0000:0001?

• a.2001:db8::1✓
• b.2001:db8:0:1
• c.2001:0db8::0001::
• d.2001:db8:::1

Leading zeros in each group are dropped and one run of all-zero groups is replaced by a single double colon, giving 2001:db8::1. The double colon may appear only once in an address. Two double colons or an incomplete result would be invalid.

Which trio of goals forms the foundational model for information security?

• a.Confidentiality, integrity, and availability✓
• b.People, process, and technology
• c.Authentication, authorization, and accounting
• d.Prevention, detection, and response

The CIA triad of confidentiality, integrity, and availability is the foundational model that security controls aim to uphold. Confidentiality protects secrecy, integrity protects accuracy, and availability keeps resources accessible. Most controls map to one or more of these goals.

A file's SHA-256 hash is compared before and after transfer to confirm it was not altered. Which security goal does this protect?

• a.Availability
• b.Non-repudiation
• c.Integrity✓
• d.Confidentiality

Comparing hashes verifies integrity, confirming that data has not been changed in transit. Confidentiality would involve encryption, and availability concerns uptime. A matching hash proves the file is identical to the original.

A successful DDoS attack that makes a website unreachable primarily violates which security goal?

• a.Availability✓
• b.Integrity
• c.Authentication
• d.Confidentiality

A DDoS attack targets availability by overwhelming a service so legitimate users cannot reach it. It does not necessarily expose or alter data. Availability is the CIA goal most directly harmed by denial-of-service attacks.

Which framework encompasses verifying identity, granting permissions, and logging user actions?

• a.Public key infrastructure
• b.AAA (authentication, authorization, and accounting)✓
• c.Spanning Tree Protocol
• d.The CIA triad

AAA stands for authentication (proving identity), authorization (granting appropriate access), and accounting (logging activity). Protocols like RADIUS and TACACS+ implement AAA. It provides a complete model for controlling and auditing access.

Layering firewalls, segmentation, endpoint protection, and access controls so no single failure is catastrophic describes which strategy?

• a.Security through obscurity
• b.Flat networking
• c.Single sign-on
• d.Defense in depth✓

Defense in depth layers multiple independent controls so that if one fails, others still protect the asset. It assumes no single safeguard is perfect. This layered approach is a core principle of resilient security architecture.

What distinguishes a distributed denial-of-service attack from a simple denial-of-service attack?

• a.It always uses encryption to hide
• b.It only targets DNS servers
• c.It floods the target from many compromised sources at once✓
• d.It exploits a single software bug

A DDoS attack uses many compromised systems, often a botnet, to flood the target simultaneously, making it far harder to block than a single-source DoS. The distributed nature overwhelms defenses and disguises the true origin. Mitigation typically requires upstream scrubbing or filtering services.

An attacker secretly relays and can alter traffic between two parties who believe they communicate directly. What is this called?

• a.A port scan
• b.A ransomware attack
• c.A brute-force attack
• d.An on-path (man-in-the-middle) attack✓

An on-path attack, historically called man-in-the-middle, positions the attacker between two parties to intercept and possibly modify traffic. Techniques include ARP poisoning and rogue access points. Strong encryption and mutual authentication defend against it.

Which attack abuses the native VLAN by adding two 802.1Q tags so a frame reaches a VLAN the attacker should not access?

• a.VLAN hopping via double tagging✓
• b.DHCP starvation
• c.ARP poisoning
• d.MAC flooding

Double-tagging VLAN hopping inserts two 802.1Q tags so the first is stripped by the native VLAN and the inner tag delivers the frame to a target VLAN. Setting the native VLAN to an unused ID and not using VLAN 1 mitigates it. Explicitly tagging the native VLAN also helps.

An attacker sets up an access point advertising the corporate SSID to lure clients into connecting. What is this called?

• a.A captive portal
• b.A jump box
• c.A honeypot
• d.An evil twin✓

An evil twin is a rogue access point impersonating a legitimate SSID to trick users into connecting so the attacker can intercept traffic or harvest credentials. It is a form of on-path attack. Client certificate validation and WPA3-Enterprise reduce the risk.

Which wireless attack sends spoofed management frames to force clients to disconnect from a legitimate access point?

• a.War driving
• b.Smurf attack
• c.Bluesnarfing
• d.Deauthentication attack✓

A deauthentication attack forges 802.11 management frames to kick clients off an AP, causing denial of service or pushing them toward an evil twin. Protected Management Frames (802.11w) defend against it. WPA3 mandates management frame protection.

An attacker inserts a forged record into a resolver's cache so users are sent to a malicious IP for a legitimate domain. What is this?

• a.Session hijacking
• b.ARP spoofing
• c.DNS cache poisoning✓
• d.SYN flood

DNS cache poisoning plants false records in a resolver so users of a legitimate domain are redirected to attacker-controlled addresses. DNSSEC, which cryptographically signs records, is the primary defense. It undermines trust in name resolution.

An unauthorized person follows an employee through a badge-controlled door without presenting credentials. Which technique is this?

• a.Dumpster diving
• b.Phishing
• c.Tailgating✓
• d.Shoulder surfing

Tailgating (or piggybacking) is when an unauthorized person slips through a secured door behind an authorized one. Access control vestibules and security awareness reduce it. It is a physical social-engineering technique.

Watching a user type their password over their shoulder to steal it is an example of which technique?

• a.Shoulder surfing✓
• b.Whaling
• c.Pretexting
• d.Vishing

Shoulder surfing is directly observing someone entering credentials or sensitive data. Privacy screens, positioning, and awareness counter it. It requires no technical tools, only proximity.

Which attack sends many TCP SYN packets without completing the handshake, exhausting a server's connection table?

• a.Ping of death
• b.ARP poisoning
• c.SYN flood✓
• d.Cross-site scripting

A SYN flood sends numerous SYN requests but never completes the three-way handshake, filling the server's half-open connection table until it can accept no new sessions. SYN cookies and rate limiting mitigate it. It is a classic denial-of-service technique.

An attacker changes their NIC's hardware address to bypass a MAC-based allow list. What is this technique called?

• a.Port mirroring
• b.DNS tunneling
• c.IP spoofing
• d.MAC spoofing✓

MAC spoofing alters a device's hardware address to impersonate an allowed device and defeat MAC filtering. Because MAC filtering is easily bypassed this way, it is considered weak on its own. Strong authentication such as 802.1X is far more reliable.

Which attack sends small spoofed queries to open DNS or NTP servers so large responses flood a victim?

• a.Tailgating
• b.MAC flooding
• c.Evil twin
• d.Reflection and amplification attack✓

A reflection and amplification attack spoofs the victim's source address in small queries to open servers, which reply with much larger responses aimed at the victim. DNS and NTP are common amplifiers. Disabling open recursion and rate limiting reduce exposure.

Which switch-hardening practice prevents an intruder from simply plugging into an unused wall jack and reaching the network?

• a.Using the default VLAN 1 on all ports
• b.Enabling all ports by default
• c.Administratively shutting down unused ports✓
• d.Broadcasting the SSID everywhere

Disabling or shutting down unused switch ports stops someone from gaining access by plugging into a live but unmonitored jack. Ports can also be placed in an unused, isolated VLAN. This is a basic but effective network-hardening step.

What is the most important first hardening step after installing a new network appliance?

• a.Disable logging to save disk space
• b.Enable Telnet for easy access
• c.Change the default administrative credentials✓
• d.Open all firewall ports temporarily

Default credentials are widely published, so changing the default administrator username and password is the essential first hardening step on any new device. Leaving defaults invites trivial compromise. Disabling insecure services like Telnet should follow.

Which feature uses the DHCP snooping binding table to drop forged ARP replies and stop ARP poisoning?

• a.PortFast
• b.Dynamic ARP Inspection✓
• c.Split tunneling
• d.Band steering

Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP snooping binding table and drops those with spoofed IP-to-MAC mappings. This defeats ARP poisoning and on-path attacks. It depends on DHCP snooping being enabled first.

Which solution checks a device's identity and health, such as patch level and antivirus, before allowing it onto the network?

• a.Network access control (NAC)✓
• b.A load balancer
• c.A syslog server
• d.A content delivery network

Network access control (NAC) enforces posture assessment, checking a device's identity and health before granting access, and can quarantine non-compliant devices. It integrates with 802.1X and can remediate before admission. NAC keeps risky endpoints off the production network.

Which decoy system is deliberately exposed to attract and study attackers away from production assets?

• a.A proxy server
• b.A jump box
• c.A honeypot✓
• d.A screened subnet

A honeypot is a decoy system made attractive to attackers so their activity can be observed and diverted from real assets. It provides early warning and threat intelligence. A network of honeypots is called a honeynet.

Placing IoT devices on their own isolated VLAN so a compromise cannot easily reach servers is an example of what?

• a.Network segmentation✓
• b.Link aggregation
• c.Port mirroring
• d.Load balancing

Network segmentation divides the network into isolated zones so a breach in one, such as vulnerable IoT devices, cannot easily spread to critical systems. It limits lateral movement and shrinks the attack surface. VLANs and firewalls commonly enforce segmentation.

Which physical control uses two interlocking doors so only one person is admitted at a time, preventing tailgating?

• a.Faraday cage
• b.Asset tag
• c.Access control vestibule (mantrap)✓
• d.Bollard

An access control vestibule, formerly called a mantrap, uses two interlocking doors so only one authenticated person passes at a time, blocking tailgating. Bollards stop vehicles, and Faraday cages block electromagnetic signals. The vestibule specifically controls pedestrian entry.

Which physical security measure best prevents unauthorized removal of switches from a wiring closet?

• a.Enabling WPA3 encryption
• b.Disabling SSID broadcast
• c.Locking equipment racks and the closet door✓
• d.Shortening the DHCP lease time

Physically locking racks and the wiring-closet door prevents theft or tampering with network hardware. Logical controls like encryption or DHCP settings do nothing against physical removal. Physical and logical security must work together.

Within IPsec, which protocol provides confidentiality by encrypting the payload rather than only authenticating it?

• a.GRE
• b.ESP (Encapsulating Security Payload)✓
• c.IKE only
• d.AH (Authentication Header)

ESP encrypts the payload to provide confidentiality, and can also offer integrity and authentication. AH provides integrity and authentication but no encryption. IKE negotiates the keys, and GRE is an unencrypted tunneling protocol.

Which VPN type permanently connects two office networks over the internet so hosts communicate as if on one network, without client software on each device?

• a.Site-to-site VPN✓
• b.Host-to-host VPN
• c.Full-tunnel client VPN
• d.Clientless SSL VPN

A site-to-site VPN links two networks through gateways, encrypting traffic between locations so hosts communicate transparently without individual client software. It is typically always on between offices. Remote-access VPNs, by contrast, connect individual users.

A remote user's VPN sends only corporate-bound traffic through the tunnel while internet browsing goes directly out. Which configuration is this?

• a.Full tunnel
• b.Clientless VPN
• c.Split tunnel✓
• d.Site-to-site tunnel

Split tunneling routes only traffic destined for the corporate network through the VPN while other traffic goes directly to the internet. It saves bandwidth but reduces visibility and control over general browsing. Full tunnel sends all traffic through the VPN for tighter security.

Which remote-access method lets a user reach internal web applications through an HTTPS portal without installing a dedicated VPN client?

• a.Clientless SSL/TLS VPN✓
• b.GRE tunnel
• c.IPsec site-to-site VPN
• d.L2TP tunnel

A clientless SSL/TLS VPN provides access to internal web applications through a standard browser over HTTPS, with no dedicated client software. It is convenient for occasional access from untrusted devices. Full VPN clients are still preferred for broad, native network access.

Administrators connect to a single hardened, monitored host and from there manage sensitive servers. What is this host called?

• a.A honeypot
• b.A proxy cache
• c.A load balancer
• d.A jump box (bastion host)✓

A jump box, or bastion host, is a hardened, closely monitored system through which administrators access sensitive segments. Funneling admin access through it centralizes logging and control. It reduces direct exposure of critical systems to the broader network.

A login that requires a password plus a one-time code from an authenticator app satisfies which security concept?

• a.Single sign-on
• b.Multifactor authentication✓
• c.Federation
• d.Role-based access control (RBAC)

Multifactor authentication combines factors from different categories, here something you know (the password) and something you have (the authenticator app). This makes a stolen password alone insufficient. Requiring distinct factor types is what makes it multifactor.

Which AAA protocol separates authentication, authorization, and accounting and encrypts the entire packet body, making it popular for device administration?

• a.TACACS+✓
• b.Kerberos
• c.LDAP
• d.RADIUS

TACACS+ separates the three AAA functions and encrypts the full payload, giving granular command authorization prized for network device administration. RADIUS combines authentication and authorization and encrypts only the password. TACACS+ also runs over TCP for reliability.

Which AAA protocol is commonly paired with 802.1X to authenticate wired and wireless clients and encrypts only the password field?

• a.TACACS+
• b.SNMPv3
• c.RADIUS✓
• d.SAML

RADIUS is widely used with 802.1X to authenticate network clients and encrypts only the password within its packets. It combines authentication and authorization and runs over UDP. It is the standard back end for enterprise Wi-Fi and NAC.

Which 802.1X authentication method requires a digital certificate on both the client and the server, avoiding passwords entirely?

• a.Open authentication
• b.PSK
• c.EAP-TLS✓
• d.PAP

EAP-TLS uses mutual certificate authentication, requiring valid certificates on both client and server, so no password is transmitted. This makes it one of the strongest 802.1X methods. It requires a PKI to issue and manage the certificates.

Which capability lets a user authenticate once and then access multiple applications without logging in again?

• a.Least privilege
• b.Multifactor authentication
• c.Single sign-on (SSO)✓
• d.Separation of duties

Single sign-on lets a user authenticate once and gain access to many applications without repeated logins, improving convenience and reducing password fatigue. It is often paired with MFA for strong assurance. Federation extends SSO across organizational boundaries.

Requiring two different administrators to each perform part of a sensitive task so no one person controls it end to end describes which principle?

• a.Least privilege
• b.Separation of duties✓
• c.Zero trust
• d.Defense in depth

Separation of duties splits a sensitive task among multiple people so no single individual can complete it alone, reducing fraud and error. Least privilege limits each person's access, a related but distinct idea. Together they strengthen internal control.

A monitoring team must poll router statistics across a segment where credentials could be captured, so they need both authentication and encryption for the management traffic. Which SNMP version should they deploy?

• a.SNMPv2c
• b.SNMPv3✓
• c.SNMPv1
• d.the community-string model used by the earlier SNMP versions

SNMPv3 adds authentication and encryption (authPriv), unlike v1 and v2c which rely on clear-text community strings. It is the only version that protects management data in transit. Choose v3 whenever confidentiality or integrity of monitoring matters.

Within SNMP, which component is the hierarchical database that defines the managed objects a device exposes, each identified by a numeric object identifier?

• a.The MIB✓
• b.An unsolicited SNMP trap
• c.The read-only community string configured on the agent
• d.A single OID value

The MIB (Management Information Base) is the structured catalog of managed objects, each addressed by an OID. Agents return MIB values when the manager polls them. Understanding the MIB/OID relationship is key to building useful monitoring.

On a syslog server, an engineer wants to alert only on the most critical device messages. Which numeric severity level represents the highest urgency?

• a.0 (emergency)✓
• b.5 (notice)
• c.the highest number in the range, because a larger value signals more urgency
• d.7 (debugging)

Syslog severities run 0 to 7, where 0 (emergency) is the most severe and 7 (debugging) the least. Lower numbers mean higher urgency, which is counterintuitive at first. Filtering on 0-2 captures messages that usually demand immediate attention.

A capacity-planning report needs a summary of which hosts and applications consume the most bandwidth, grouped by conversation rather than by full packet contents. Which data source best provides this?

• a.Flow data such as NetFlow✓
• b.Basic SNMP interface polling
• c.A packet sniffer capturing every full frame on the link
• d.Syslog messages from the router

Flow technologies like NetFlow, sFlow, and IPFIX summarize traffic into conversation records (source, destination, ports, bytes). This gives top-talker and application visibility without storing full packets. It is lighter than a capture yet richer than raw interface counters.

A team finds some SNMP notifications are lost in transit and wants the manager to acknowledge receipt so the agent can retransmit if needed. Which notification type provides this confirmation?

• a.An SNMP GET request
• b.An SNMP trap
• c.A one-way syslog message delivered over UDP without acknowledgment
• d.An SNMP inform✓

An SNMP inform is an acknowledged notification; the manager confirms receipt so the agent can resend if the message is lost. A trap is fire-and-forget with no acknowledgment. Informs trade extra overhead for reliability.

Security operations wants logs from firewalls, servers, and switches gathered in one place, normalized, and correlated to surface multi-device attack patterns. Which platform is designed for this?

• a.A SIEM✓
• b.A DHCP server
• c.An NTP time source
• d.A TFTP server used for config backups

A SIEM (Security Information and Event Management) aggregates and correlates logs from many sources to detect patterns a single device would miss. It adds alerting, retention, and search on top of raw syslog. Synchronized time via NTP makes its correlation trustworthy.

To decide when interface utilization is abnormal, an operations team compares live metrics against previously recorded normal values. What are they comparing against?

• a.The current routing table
• b.The maximum rated link speed
• c.The switch's original factory-default configuration settings
• d.A performance baseline✓

A performance baseline records normal utilization, latency, and error rates so deviations can trigger alerts. Thresholds are usually set relative to the baseline rather than to a device's rated maximum. Baselines must be refreshed as the network grows.

Which per-port data does a monitoring system read to calculate link utilization, error rates, and discards on a switch?

• a.The ARP cache
• b.The spanning-tree topology table maintained by the switch
• c.Interface counters✓
• d.DNS query logs

Interface counters track bytes, packets, errors, and discards per port, and tools poll them (often via SNMP) to compute utilization. Rising error or discard counters flag physical or congestion problems. They are the foundation of throughput dashboards.

A data-center team wants automated alerts if a wiring closet gets too hot or humid before equipment is damaged. Which monitoring input provides this?

• a.A NetFlow exporter
• b.A syslog facility code
• c.Environmental sensors✓
• d.An SNMP trap threshold set on router CPU load

Environmental sensors report temperature, humidity, water, and airflow, feeding alerts that prevent heat- or moisture-related failures. They are often integrated into the same NMS that tracks network metrics. Early warning here avoids costly hardware damage.

A modern platform needs sub-second, push-based metrics from devices instead of waiting for the next polling interval. Which approach delivers this?

• a.Manual CLI checks by an on-call engineer
• b.SNMP polling on a fixed five-minute interval
• c.Periodic ICMP pings
• d.Streaming telemetry✓

Streaming telemetry has devices continuously push metrics to a collector, giving near-real-time granularity that periodic SNMP polling cannot match. It scales better for large, fast-changing environments. Polling still suits simpler or legacy gear.

An operations lead wants to monitor network devices without installing extra software on each one, relying on protocols already built into the gear. Which monitoring model fits?

• a.Agentless polling✓
• b.Mirroring all ports to a dedicated packet sniffer
• c.Installing a proprietary monitoring agent on every managed device
• d.Exporting device logs by hand each week

Agentless monitoring uses protocols already on the device, such as SNMP, ICMP, or SSH, avoiding software installs. It is quick to deploy across mixed hardware. Agent-based monitoring can offer deeper data but adds installation and upkeep.

To diagnose a subtle application handshake failure, an analyst needs the actual bytes of each packet, not just summary statistics. Which tool output is required?

• a.A NetFlow conversation record
• b.An interface utilization graph
• c.A full packet capture✓
• d.An SNMP walk of the device MIB

A full packet capture (via Wireshark, tcpdump, or a SPAN port) records complete frame contents for deep protocol analysis. Flow and SNMP data only summarize traffic and cannot show payload detail. Captures are powerful but storage-intensive, so they are used selectively.

Auditors ask how long the organization keeps device and security logs before they are purged. Which document defines this?

• a.A log retention policy✓
• b.A memorandum of understanding between two parties
• c.An acceptable use policy
• d.The spanning-tree configuration

A log retention policy specifies how long logs are stored and when they are deleted, balancing investigative and compliance needs against storage cost. It often reflects regulatory requirements. Consistent retention ensures evidence exists when incidents surface late.

In SNMPv2c, which credential lets a manager poll device values but not change the configuration?

• a.A trap receiver address
• b.A read-write credential that also permits pushing configuration changes
• c.An OID
• d.A read-only community string✓

A read-only community string permits GET operations but denies SET, so monitoring cannot alter the device. Because v2c community strings are clear-text, SNMPv3 is preferred where security matters. Read-write strings are far more sensitive and should be tightly controlled.

Management wants an at-a-glance visual view of uptime, utilization, and open alert counts across key links. Which operations artifact provides this?

• a.A one-time ARP table export
• b.A single syslog severity filter
• c.A paper change-request form
• d.A monitoring dashboard✓

A monitoring dashboard visualizes KPIs like uptime, utilization, latency, and open alerts for quick situational awareness. It aggregates data from SNMP, flow, and log sources. Well-designed dashboards speed detection and reporting.

A technician needs to know exactly which patch-panel port and cable run connect a specific wall jack to the switch. Which document shows this?

• a.A logical diagram showing subnets and VLANs
• b.A rack power-load schedule
• c.A physical network diagram✓
• d.An IP address allocation plan

A physical network diagram maps actual cabling, ports, panels, and device locations. A logical diagram instead shows IP subnets, VLANs, and routing relationships. The two are maintained together because each answers different questions.

As subnets multiply, a team wants a single authoritative record of which IP addresses are assigned, reserved, or free. Which tool manages this?

• a.A change advisory board that reviews proposed changes
• b.An IPAM system✓
• c.A syslog server
• d.A rack elevation diagram

IPAM (IP Address Management) tracks address allocation, reservations, and availability, often integrating DNS and DHCP. It prevents conflicts and address exhaustion. Spreadsheets do not scale to large or dynamic networks.

Before installing a new 2U server, an engineer checks a drawing that shows which rack units are occupied and where free space and power exist. What is this document?

• a.A logical topology map of the whole campus
• b.An IP address plan
• c.A rack diagram✓
• d.A cable test report

A rack diagram (rack elevation) depicts the front and rear layout of equipment by rack unit, aiding installation and airflow planning. It shows occupancy, weight, and power distribution. Keeping it current prevents installation surprises.

To speed future troubleshooting, a cabling contractor marks each cable end and patch-panel port with a consistent identifier. Which documentation practice is this?

• a.Publishing a service level agreement
• b.Cable and port labeling✓
• c.Drawing a full mesh topology
• d.Maintaining a spanning-tree convergence diagram

Standardized cable and port labeling lets technicians trace connections quickly and reduces errors during moves and changes. Labels should follow a documented naming convention. Good labeling pays off most during outages.

An organization stores a known-good, standard device configuration that all similar switches should match. What is this reference called?

• a.A memorandum of understanding
• b.A configuration baseline✓
• c.A disaster recovery plan
• d.An after-action incident report

A configuration baseline is the documented standard build that devices should conform to, making drift easy to spot. Comparing a running config against it reveals unauthorized changes. It also speeds provisioning of replacement hardware.

Finance and security both need an authoritative list of every network device, its model, serial number, and warranty status. Which record provides this?

• a.An asset inventory✓
• b.A logical topology diagram
• c.A quality-of-service marking policy
• d.The firewall rule set

An asset inventory catalogs hardware and software with details like model, serial, location, and lifecycle status. It supports warranty, licensing, and end-of-life planning. Accurate inventory underpins both security and budgeting.

After a Wi-Fi deployment, an engineer documents measured signal strength across the floor as a color-coded coverage map. What is this artifact?

• a.A site survey heat map✓
• b.A rack elevation showing every device mounted in the cabinet
• c.An SLA compliance report
• d.A logical VLAN diagram

A wireless site survey heat map visualizes signal strength and coverage, revealing dead zones and overlap. It guides AP placement and channel planning. Surveys are done before deployment (predictive) and after (validation).

In a multi-floor building, cabling from each floor's wiring closet runs back to a central equipment room. What is the per-floor closet called?

• a.The default gateway for the floor
• b.An IDF✓
• c.The native VLAN on the trunk
• d.A separate broadcast domain

An IDF (intermediate distribution frame) is a floor or zone wiring closet that connects back to the MDF (main distribution frame). Documenting IDF/MDF locations and links is essential for structured cabling. This hierarchy keeps runs within distance limits.

After a project is complete, a team updates the diagrams to reflect exactly how the network was actually built, including last-minute field changes. What is this documentation called?

• a.As-built documentation✓
• b.A predictive site survey
• c.A request-for-change ticket
• d.The original pre-construction design proposal

As-built documentation records the real, final state of an installation, including deviations from the original design. It is more accurate than the planning drawings because it captures field changes. Keeping it current prevents surprises during later work.

A regulator requires proof that network controls are periodically checked against policy and standards by an independent review. Which activity satisfies this?

• a.A network audit✓
• b.A firmware upgrade
• c.A change freeze
• d.A predictive wireless coverage survey

A network audit is an independent review that verifies configurations, access, and controls against policy and standards. It produces findings and remediation items. Regular audits demonstrate compliance and surface drift or gaps.

A new technician needs a documented, repeatable set of steps for safely rebooting a core switch during a maintenance window. Which document provides this?

• a.A vendor master service agreement
• b.An acceptable use policy
• c.A standard operating procedure✓
• d.A network topology diagram

A standard operating procedure (SOP) documents the exact, repeatable steps for a routine task, reducing errors and inconsistency. It captures institutional knowledge so any qualified staff member can perform the work. SOPs support both safety and compliance.

An operations team keeps a record of each vendor, the equipment covered, support entitlements, and renewal dates so contracts do not lapse. Which document is this?

• a.A spanning-tree diagram
• b.A vendor support contract record✓
• c.A one-time packet capture from the core switch
• d.A wireless heat map

A vendor support contract record tracks coverage levels, entitlements, and renewal dates so critical support does not lapse unnoticed. It links assets to their applicable service agreements. This avoids scrambling for support during an outage on out-of-contract gear.

Two routers should share a single virtual gateway IP so that if the active router fails, the standby takes over transparently to hosts. Which category of protocol provides this?

• a.The Address Resolution Protocol used for local delivery
• b.A first hop redundancy protocol✓
• c.Spanning Tree Protocol
• d.Network Time Protocol

A first hop redundancy protocol such as VRRP or HSRP presents one virtual gateway IP backed by multiple routers, enabling automatic failover. Hosts keep the same gateway address regardless of which router is active. This removes the gateway as a single point of failure.

A design distributes live traffic across two data centers simultaneously so both handle load and either can absorb the other's share. Which model is this?

• a.Active-active✓
• b.A single node with no redundancy
• c.Cold standby only
• d.Active-passive with an idle standby node held in reserve

An active-active design runs both nodes or sites simultaneously, sharing load and providing redundancy. If one fails, the other absorbs its traffic, though capacity planning must allow for it. Active-passive instead keeps a standby idle until needed.

A load balancer must send each new client connection to the next server in a repeating list, distributing sessions evenly. Which distribution method is this?

• a.Least connections
• b.Weighted response time
• c.Source-IP hashing that pins a client to one server
• d.Round robin✓

Round robin sends each successive request to the next server in rotation, distributing connections evenly without regard to load. Least-connections and weighted methods account for server capacity or current load. The right method depends on how uniform the servers and sessions are.

A server should keep network connectivity even if one of its two network cards or switch uplinks fails. Which server-side technique provides this?

• a.Static ARP entries
• b.Enabling jumbo frames on the interface
• c.Port mirroring
• d.NIC teaming✓

NIC teaming (bonding) groups multiple physical adapters so the server tolerates a NIC, cable, or switch-port failure, and can add throughput. Modes include active-backup and load-balancing. It protects the host's connection independently of the network core.

A core switch should keep running if a single power source fails, without any interruption. Which hardware feature provides this?

• a.A larger cooling fan
• b.A single higher-wattage power supply
• c.Power over Ethernet on the uplink
• d.Redundant power supplies✓

Dual (redundant) power supplies let a device keep running if one supply or feed fails, ideally each on a separate circuit. This removes the power supply as a single point of failure. Pairing them with independent PDUs and UPS units maximizes resilience.

Several servers act as one system so that if a node fails, the remaining nodes continue the service with minimal disruption. What is this arrangement called?

• a.A demilitarized zone
• b.Clustering✓
• c.A single-server deployment with nightly backups only
• d.Port aggregation

Clustering groups multiple servers so they function as a single, resilient service, with surviving nodes taking over on failure. It supports high availability and sometimes load sharing. Shared or replicated storage often backs the cluster.

An organization wants its internet access to survive the total failure of one provider by contracting a second, independent carrier. Which approach is this?

• a.Multiple ISPs (multihoming)✓
• b.A larger DHCP scope
• c.Enabling QoS on the WAN edge
• d.A faster single circuit from one provider

Using multiple ISPs (multihoming) provides path and provider redundancy so a single carrier outage does not sever internet access. Ideally the links enter through diverse physical paths. BGP or policy routing steers traffic across the providers.

A facility must keep critical network gear running through a multi-hour utility power outage. Beyond battery backup, which resource provides sustained power?

• a.A backup generator✓
• b.A redundant cooling unit
• c.A second internet circuit
• d.A single uninterruptible power supply on its own

A backup generator supplies sustained power during extended utility outages, well beyond the minutes a UPS battery provides. The UPS bridges the gap while the generator starts. Together they form a layered power-resilience strategy.

After a link failure, a Layer 2 network must recover forwarding paths in a second or two rather than the tens of seconds classic STP takes. Which protocol provides this faster convergence?

• a.RSTP✓
• b.Border Gateway Protocol
• c.Classic STP (802.1D)
• d.The first hop redundancy protocol used for gateways

Rapid Spanning Tree Protocol (RSTP, 802.1w) converges in a few seconds versus the roughly 30-50 seconds of classic STP. It uses proposal/agreement and additional port roles to speed recovery. It is backward compatible with legacy STP.

During a brief utility power sag, network gear must stay up on battery for the few minutes needed to switch to generator or shut down cleanly. Which device provides this immediate bridge?

• a.A second default gateway
• b.A backup generator with a startup delay
• c.A redundant switch fabric
• d.An uninterruptible power supply✓

An uninterruptible power supply (UPS) provides immediate battery power to ride through sags and short outages and to bridge to a generator. It also conditions power against spikes. Sizing it correctly determines how long equipment stays up.

A shelf holds a preconfigured, powered-off replacement switch that can be swapped in quickly, but it is not already running. What is this spare called?

• a.A load-balanced active-active pair already carrying traffic
• b.A hot spare
• c.A cold spare✓
• d.A warm site

A cold spare is a spare device kept powered off and ready to be installed when the primary fails, trading faster-than-procurement recovery for some downtime. A hot spare is already running and can take over immediately. The choice balances cost against recovery speed.

To survive the loss of an entire building or region, an organization replicates services to a second location far from the primary. Which resilience strategy is this?

• a.A larger single data center with more racks
• b.Geographic redundancy✓
• c.NIC teaming on each server
• d.Dual power supplies in one chassis

Geographic (site) redundancy places services in a separate location so a regional disaster does not take down everything at once. Data is replicated between sites to keep them in sync. It is the broadest tier of high-availability design.

A disaster recovery plan states that a critical system must be fully restored and usable within four hours of an outage. Which metric expresses this target?

• a.RPO
• b.MTBF
• c.RTO✓
• d.MTTR, which measures average repair time after a failure

The Recovery Time Objective (RTO) is the maximum tolerable time to restore a system after an outage. It drives investment in failover and recovery capability. RTO differs from RPO, which addresses acceptable data loss rather than downtime.

Management wants to know, on average, how long it takes staff to repair a failed device and restore service once work begins. Which metric captures this?

• a.RPO
• b.The recovery time objective set in the DR plan
• c.MTTR✓
• d.MTBF

Mean Time To Repair (MTTR) is the average time to restore a failed component to service, reflecting maintainability and process efficiency. Lowering MTTR shrinks outage duration. It complements MTBF, which measures how often failures occur.

A vendor advertises how long, on average, a device operates before it fails, helping predict reliability and replacement planning. Which metric is this?

• a.RTO
• b.MTTR
• c.The recovery point objective for acceptable data loss
• d.MTBF✓

Mean Time Between Failures (MTBF) estimates the average operating time between failures of a repairable device, indicating reliability. Higher MTBF suggests longer expected service life. It informs redundancy and spare-parts planning.

A budget-limited backup facility provides floor space, power, and cooling but no installed equipment or current data; hardware must be brought in after a disaster. Which site type is this?

• a.An active-active cloud region
• b.A cold site✓
• c.A warm site with servers preinstalled and data partially synchronized
• d.A hot site

A cold site provides only the physical space, power, and cooling; equipment and data must be delivered and configured after a disaster, so recovery is slow but cheap. A hot site is fully ready and costly. A warm site sits between the two.

A backup job copies only the data that changed since the previous backup of any type, minimizing each night's backup size but requiring the full chain to restore. Which backup type is this?

• a.A differential backup that copies everything changed since the last full backup
• b.An incremental backup✓
• c.A full backup
• d.A snapshot of the live volume

An incremental backup copies only data changed since the last backup of any kind, making each job small and fast. Restoration requires the last full backup plus every incremental in order. This trades quick backups for a longer restore chain.

A team gathers stakeholders in a room to walk through the disaster recovery plan step by step and discuss responses, without touching production systems. Which exercise is this?

• a.A tabletop exercise✓
• b.A live failover cutover of production traffic
• c.A full restore of every backup to new hardware
• d.A penetration test against the perimeter

A tabletop exercise is a discussion-based walkthrough of the DR or incident plan that validates roles and steps without disrupting production. It surfaces gaps cheaply before a real event. More disruptive tests, like full failover, come later.

Beyond restoring IT systems, an organization documents how the whole business will keep operating essential functions during a major disruption. Which plan covers this broader scope?

• a.A disaster recovery plan focused only on IT systems
• b.A change management record
• c.A business continuity plan✓
• d.An acceptable use policy

A business continuity plan (BCP) addresses keeping essential business functions running during a disruption, of which IT disaster recovery is one part. It covers people, facilities, and processes, not just technology. DR plans nest inside the broader BCP.

A best-practice backup strategy calls for three copies of data on two different media types with one copy kept offsite. What is this guideline commonly called?

• a.The default gateway of last resort
• b.The single-copy nightly backup approach
• c.Continuous active-active replication between two data centers
• d.The 3-2-1 backup rule✓

The 3-2-1 rule keeps three copies of data on two media types with one copy offsite, protecting against device, site, and media failures. The offsite copy guards against local disasters. Many teams add an offline copy to resist ransomware.

When a primary system fails, operations automatically shifts to a standby system so service continues. What is this transition called?

• a.Load balancing
• b.Failover✓
• c.Failback to the original primary once it is repaired
• d.A backup restore from tape

Failover is the automatic (or manual) switch of operations from a failed primary to a standby system to preserve service. Returning to the primary once repaired is called failback. Well-tested failover minimizes downtime during incidents.

A storage system keeps a continuously updated copy of data on a second array so that a copy is always current if the primary array fails. Which technique is this?

• a.An archived copy stored offline for compliance
• b.A weekly full tape backup
• c.Replication✓
• d.A point-in-time snapshot taken once per day

Replication maintains a continuously updated copy of data on another system or site, keeping a near-current copy available for recovery. Synchronous replication keeps copies identical; asynchronous lags slightly to reduce latency. It underpins low-RPO recovery.

Users on a satellite WAN link report that interactive applications feel sluggish even though the link is not congested and no packets are lost. Which metric best explains this?

• a.Excessive jitter between packets
• b.Low bandwidth
• c.Insufficient throughput on the local LAN segment
• d.High latency✓

Latency is the time a packet takes to travel end to end, and high latency (as on satellite links) makes interactive apps feel sluggish even without loss or congestion. It is distinct from bandwidth, which is capacity. Propagation distance is a major latency contributor.

A VoIP call breaks up and words drop out, and monitoring shows some packets never arrive at the far end. Which metric describes this?

• a.Bandwidth
• b.The signal-to-noise ratio measured on the wireless link
• c.Jitter
• d.Packet loss✓

Packet loss is the percentage of packets that never reach the destination, and even small amounts badly degrade real-time voice. Causes include congestion, errors, and faulty links. QoS and capacity fixes reduce it.

VoIP audio is uneven because packets arrive with inconsistent spacing, so an engineer configures a mechanism to hold and release them at a steady rate. What is this mechanism?

• a.An access control list that filters unwanted traffic
• b.A jitter buffer✓
• c.A spanning-tree recalculation
• d.A larger DHCP scope

A jitter buffer temporarily holds arriving packets and releases them at a steady interval, smoothing out variation in delay. Too small a buffer fails to absorb jitter; too large adds latency. It is a standard mitigation for real-time media.

A voice platform reports a numeric score from 1 to 5 that summarizes perceived call quality for stakeholders. Which metric is this?

• a.RTT
• b.The link utilization percentage during the busy hour
• c.DSCP
• d.MOS✓

Mean Opinion Score (MOS) rates perceived voice quality on a 1-to-5 scale, condensing latency, jitter, and loss into one figure. Scores above about 4 are considered good. It gives non-technical stakeholders an intuitive quality measure.

A technician pings a server and reads the time reported for an echo request to be sent and its reply received. Which metric is this measuring?

• a.The number of hops between the source and destination
• b.Round-trip time✓
• c.Total available bandwidth
• d.One-way delay in a single direction only

Round-trip time (RTT) is the time for a packet to reach a destination and its reply to return, which ping reports directly. It reflects two-way latency along the path. Rising RTT often signals congestion or a longer route.

For acceptable interactive voice, engineers target keeping delay in a single direction under roughly a specific threshold. What is the commonly cited one-way delay budget for VoIP?

• a.About 5 ms
• b.About 2 seconds
• c.About 500 ms, which is the point at which callers stop noticing delay
• d.About 150 ms✓

A common design target keeps one-way delay under about 150 ms for good interactive voice quality. Beyond that, callers begin talking over each other. Jitter and loss budgets accompany this latency target.

To ensure voice packets receive top priority through the network, an engineer marks them with a specific Layer 3 code point that routers honor. Which marking is standard for voice?

• a.The 802.1Q VLAN tag value
• b.DSCP default (0)
• c.A best-effort class with no special priority applied at all
• d.DSCP EF (46)✓

Expedited Forwarding (EF, DSCP 46) is the standard DiffServ marking for voice, giving it low-latency, priority handling. Routers map EF to a priority queue. Consistent marking end to end is what makes QoS effective.

On a trunk, an engineer wants switches to prioritize frames at Layer 2 using a 3-bit priority field in the VLAN tag. Which mechanism provides this?

• a.A spanning-tree priority value
• b.DSCP marking at Layer 3
• c.The differentiated services field carried in the IP header
• d.802.1p CoS✓

The 802.1p Class of Service (CoS) uses a 3-bit priority field in the 802.1Q tag for Layer 2 prioritization. It is the Layer 2 counterpart to Layer 3 DSCP marking. Switches map CoS values to egress queues.

During congestion, a policy should buffer and delay excess traffic to smooth bursts rather than immediately discarding it. Which QoS technique does this?

• a.Spanning-tree blocking
• b.Port mirroring
• c.Traffic shaping✓
• d.Traffic policing that drops packets exceeding the rate

Traffic shaping buffers and delays excess traffic to smooth bursts to a target rate, whereas policing simply drops or remarks traffic above the rate. Shaping adds latency but avoids drops. The choice depends on whether smoothing or hard limiting is desired.

An engineer wants to measure the actual achievable transfer rate between two endpoints by pushing test traffic across the link. Which type of tool provides this?

• a.A physical cable continuity tester that checks pin mapping
• b.A bandwidth speed test tool✓
• c.A DNS lookup utility
• d.An ARP cache viewer

A throughput/bandwidth test tool (such as iperf) generates traffic between endpoints to measure achievable transfer rates. It reveals real performance versus the link's rated speed. Results depend on latency, loss, and TCP tuning.

A monitoring system reports that a WAN link averaged 85 percent of its capacity during business hours. Which metric is being reported?

• a.Link utilization✓
• b.Latency
• c.The mean time between failures of the WAN router
• d.Jitter

Link utilization expresses used capacity as a percentage of the link's total, here 85 percent, and sustained high values warn of congestion risk. It is derived from interface byte counters over time. Trending it guides capacity upgrades.

A server room's equipment keeps overheating, and staff must guarantee stable temperature and airflow year-round. Which facility system addresses this?

• a.HVAC✓
• b.A UPS
• c.A power distribution unit feeding the racks
• d.A fire suppression system

HVAC (heating, ventilation, and air conditioning) maintains stable temperature and airflow so equipment stays within safe operating ranges. Hot- and cold-aisle layouts improve its efficiency. Inadequate cooling causes thermal shutdowns and shortened hardware life.

A data center needs to extinguish fires without soaking and destroying electronic equipment with water. Which protection approach fits?

• a.An HVAC economizer that brings in outside air
• b.A UPS
• c.Standard water sprinklers over the racks
• d.Clean-agent fire suppression✓

A clean-agent (gaseous) fire suppression system extinguishes fires without water, protecting electronics from damage. Water-based sprinklers would ruin equipment. Such systems are standard in equipment rooms and data centers.

Technicians handling circuit boards in a dry equipment room keep damaging components with static discharge. Controlling which environmental factor most reduces this risk?

• a.Humidity✓
• b.Air pressure
• c.Ambient light level
• d.The temperature set point of the cooling system

Maintaining adequate humidity reduces static buildup and the electrostatic discharge (ESD) that damages components. Air that is too dry raises ESD risk, while too humid promotes condensation. ESD wrist straps and mats add further protection.

An engineer must ensure that if utility power fails, several racks receive conditioned, distributed power from a single managed unit that also reports per-outlet load. Which device is this?

• a.A managed PDU✓
• b.A single power strip
• c.A network interface card teamed for redundancy
• d.A KVM switch

A managed PDU (power distribution unit) distributes and monitors power to multiple devices in a rack, often reporting per-outlet load and enabling remote switching. Fed by a UPS or generator, it supports resilient power design. Monitoring helps avoid overloading circuits.

Operations wants an automatic alert if a wiring closet exceeds a safe temperature threshold so staff can intervene before a shutdown. Which control provides this?

• a.A smoke detector
• b.A humidity-only sensor
• c.A power distribution unit that reports outlet current
• d.A temperature monitor with alert thresholds✓

A temperature monitor with an alerting threshold notifies staff when a closet exceeds safe limits, allowing intervention before thermal shutdown. It integrates with the NMS or environmental system. Early alerts prevent heat-related outages and hardware damage.

An organization wants to enforce minimum length, complexity, and periodic change of user credentials across all systems. Which document defines these rules?

• a.A network topology diagram
• b.A memorandum of understanding
• c.An acceptable use policy governing general resource use
• d.A password policy✓

A password policy defines requirements such as length, complexity, history, and rotation for credentials. It standardizes account security across systems. Enforcement is typically automated through directory settings.

When an employee leaves, IT must reliably disable accounts, reclaim equipment, and revoke access on their last day. Which documented process ensures this happens consistently?

• a.A password complexity requirement in the account policy
• b.An offboarding process✓
• c.A disaster recovery tabletop exercise
• d.A change advisory board review

An offboarding process defines the steps to disable accounts, revoke access, and recover assets when someone leaves, closing security gaps. It mirrors the onboarding process that grants access. Consistent execution prevents lingering access by former staff.

A company lets staff use personal phones and laptops for work and needs rules covering security requirements and acceptable use of those devices. Which policy governs this?

• a.A BYOD policy✓
• b.A quality-of-service policy
• c.A service level agreement with an external provider
• d.A rack elevation diagram

A BYOD (bring your own device) policy sets the security and usage rules for employee-owned devices accessing company resources. It typically requires controls like passcodes, encryption, and remote wipe. It balances flexibility against data protection.

An organization must define how staff may connect from outside the office, including required VPN use and authentication for remote sessions. Which policy covers this?

• a.A memorandum of understanding between two organizations
• b.A remote access policy✓
• c.A rack diagram
• d.A wiring standard

A remote access policy defines the approved methods, security requirements, and authentication for connecting from outside the network, such as mandatory VPN and multifactor authentication. It reduces risk from remote connections. It complements broader acceptable use rules.

Before a risky configuration change reaches production, a group formally reviews and approves it, weighing risk and scheduling. What is this body called?

• a.A penetration testing crew
• b.A change advisory board✓
• c.An incident response team
• d.A disaster recovery site coordinator

A change advisory board (CAB) reviews, prioritizes, and approves proposed changes, weighing risk, impact, and timing. Its sign-off is part of formal change management. This governance reduces the chance of unplanned outages from unvetted changes.

When a security breach is detected, staff follow a predefined set of stages to detect, contain, eradicate, and recover from the event. Which document guides these stages?

• a.A rack elevation diagram
• b.An incident response plan✓
• c.An acceptable use policy
• d.A service level agreement with the cloud provider

An incident response plan defines the phases (such as preparation, detection, containment, eradication, recovery, and lessons learned) for handling security events. It assigns roles and communication paths. Practicing it improves real-world response speed.

A contractor and client sign a document that spells out exactly the deliverables, tasks, timeline, and price for a specific network project. Which document is this?

• a.A statement of work (SOW)✓
• b.A non-disclosure agreement protecting shared information
• c.A memorandum of understanding
• d.An acceptable use policy

A statement of work (SOW) details the specific deliverables, tasks, timeline, and cost for a defined project. It sits under a broader master agreement and prevents scope disputes. Clear SOWs align expectations between client and vendor.

Two organizations sign a non-binding document expressing their intent to cooperate and outlining broad roles before any formal contract. Which document is this?

• a.A service level agreement
• b.A statement of work
• c.A memorandum of understanding✓
• d.A master service agreement setting overall contract terms

A memorandum of understanding (MOU) expresses a mutual, generally non-binding intent to cooperate and outlines broad responsibilities. It precedes more formal, binding contracts. It signals commitment while details are still negotiated.

A company and a vendor sign one overarching contract that sets the general legal and commercial terms governing all future projects between them. Which document is this?

• a.A master service agreement✓
• b.A memorandum of understanding
• c.A statement of work
• d.A non-disclosure agreement covering confidential data only

A master service agreement (MSA) establishes the overarching terms that govern all future engagements between two parties, so each new project needs only a short statement of work. It streamlines repeated work. Individual SOWs reference the MSA for legal terms.

A vendor announces a date after which a switch model will receive no further updates, patches, or support. Which term describes this milestone?

• a.A recovery point objective
• b.End of life / end of support✓
• c.A service level agreement renewal date
• d.A maintenance window

End of life / end of support (EOL/EOS) marks when a product no longer receives updates, patches, or vendor support, making continued use a security and reliability risk. Tracking these dates drives replacement planning. Running EOL gear can also break compliance.

An operations team schedules disruptive upgrades for 2 a.m. Sunday when usage is lowest to limit impact on users. What is this pre-approved timeframe called?

• a.A change freeze
• b.A recovery time objective
• c.An acceptable use policy signed at onboarding
• d.A maintenance window✓

A maintenance window is a pre-approved, scheduled period, usually during low-usage hours, for performing disruptive changes with minimal user impact. It is coordinated through change management. Communicating it in advance sets user expectations.

A team wants every device configuration stored in version control so changes are tracked and any prior known-good version can be restored. Which practice provides this?

• a.Disabling remote management to prevent changes
• b.Configuration management with version control✓
• c.Manually retyping commands on each device
• d.Relying on each device's factory defaults

Configuration management with version control tracks every change to device configs and lets teams roll back to a known-good version. It reveals who changed what and when, and detects drift from the baseline. Automation tools often enforce it at scale.

Before sharing sensitive network diagrams with a consultant, the company requires them to sign an agreement not to disclose the information. Which document is this?

• a.A non-disclosure agreement✓
• b.A memorandum of understanding outlining cooperative intent
• c.A service level agreement
• d.A statement of work

A non-disclosure agreement (NDA) legally binds a party to keep shared confidential information private. It protects sensitive designs and data disclosed during an engagement. Signing it precedes sharing proprietary details.

A provider's contract promises 99.9 percent uptime and specifies credits to the customer if that level is not met. Which document defines these commitments and penalties?

• a.A service level agreement✓
• b.A memorandum of understanding between the parties
• c.A statement of work
• d.A non-disclosure agreement

A service level agreement (SLA) defines measurable commitments such as uptime and response time, plus remedies like credits when they are missed. It sets accountability between provider and customer. SLA terms guide escalation and prioritization.

When provisioning a new switch, technicians must apply a standard set of steps to disable defaults, set strong credentials, and enable logging before it goes live. Which process ensures this?

• a.A disaster recovery tabletop test
• b.A predictive wireless site survey
• c.A change advisory board approval for the purchase
• d.A device hardening baseline✓

A device hardening (secure onboarding) baseline is the standard set of steps applied to new gear, disabling insecure defaults, setting strong credentials, and enabling logging before deployment. It ensures every device starts from a consistent secure state. Automation keeps it repeatable.

A help desk ticket reports 'the network is down.' Before doing anything else in the structured troubleshooting method, what should the technician do first?

• a.Implement a fix immediately
• b.Document the outcome
• c.Identify the problem and gather information✓
• d.Escalate the ticket to the equipment vendor's support line

The first step is to identify the problem by gathering information, questioning users, and determining the scope. Acting before understanding risks fixing the wrong thing. Later steps establish and test a theory, then implement and verify.

A technician has tested and confirmed the probable cause of an outage. According to the methodology, what is the next step?

• a.Establish a plan of action✓
• b.Document the findings and close the ticket
• c.Re-form a new theory from scratch
• d.Verify full system functionality across every device

Once a theory is confirmed, the next step is to establish a plan of action to resolve the problem and identify potential effects. This precedes implementing the solution. Planning reduces the chance the fix causes new issues.

A technician's tested theory turns out to be wrong; the suspected cause is not the real one. What does the methodology say to do next?

• a.Establish a new theory or escalate✓
• b.Implement the disproven fix anyway
• c.Verify full functionality of the entire network before continuing
• d.Document the solution and close out

If testing does not confirm the theory, the technician either establishes a new theory or escalates. Repeatedly forcing a disproven theory wastes time. This disciplined loop keeps troubleshooting evidence-based.

While identifying a problem, a technician asks the user what changed recently and tries to reproduce the failure. These actions belong to which phase of the methodology?

• a.Documenting findings and outcomes
• b.Verifying full system functionality
• c.Establishing a plan of action to resolve the issue
• d.Identifying the problem✓

Questioning users, identifying recent changes, and duplicating the problem are all part of the first phase: identifying the problem. This information shapes the theory that follows. Skipping it leads to guesswork.

After forming a theory that a bad cable is the cause, a technician swaps in a known-good cable to see if the symptom disappears. Which methodology step is this?

• a.Documenting the outcome
• b.Establishing a plan of action for the change
• c.Testing the theory✓
• d.Identifying the problem and its scope

Swapping in a known-good component to see whether the symptom clears is testing the theory to determine the cause. If it confirms the theory, a plan of action follows. If not, a new theory is needed.

A technician has applied a fix and confirmed the reported issue is resolved. Which step comes next before documenting?

• a.Escalate the resolved issue to management for review
• b.Reboot every device on the network as a precaution
• c.Immediately close the ticket without further testing
• d.Verify full functionality and apply preventive measures✓

After implementing the fix, the technician verifies full system functionality and, where applicable, implements preventive measures. This confirms the solution truly worked end to end. Documentation is the final step that follows.

The very last step of the structured troubleshooting methodology is what?

• a.Establish a theory of probable cause
• b.Verify full functionality of the affected systems
• c.Document findings, actions, and outcomes✓
• d.Test the theory to determine the cause

The final step is to document findings, actions, and outcomes, building a knowledge base for future issues and supporting accountability. It captures lessons others can reuse. Skipping it loses valuable insight.

Facing a complex fault, a technician methodically checks from the physical layer upward, confirming each OSI layer before moving to the next. Which troubleshooting approach is this?

• a.Randomly rebooting devices until it works
• b.Immediately replacing all hardware in the affected path
• c.A bottom-up OSI approach✓
• d.Guessing based on the last similar ticket

Working layer by layer up the OSI model (a bottom-up approach) systematically isolates the fault to a specific layer. Top-down and divide-and-conquer are alternative structured approaches. Choosing one prevents random, unfocused checking.

A cable tester on a newly run link shows no continuity on one conductor, indicating the wire is broken somewhere along the run. Which fault is this?

• a.A duplex mismatch negotiated between the two switch ports
• b.Crosstalk between adjacent pairs
• c.A short between two conductors
• d.An open✓

An open is a broken conductor with no continuity end to end, so a signal cannot pass on that wire. A short instead connects two conductors that should be separate. Re-terminating or replacing the cable resolves an open.

A long copper run near other cabling shows signal from one pair bleeding into an adjacent pair, corrupting data at higher speeds. Which impairment is this?

• a.An open circuit
• b.Crosstalk✓
• c.Attenuation over distance
• d.Electromagnetic interference from a nearby motor on the cable path

Crosstalk is the coupling of a signal from one pair into an adjacent pair, degrading data especially at higher frequencies. Proper twist rates and untwisting as little as possible at terminations reduce it. Testers report near-end and far-end crosstalk.

A technician connects two switches with a cable but gets no link, and finds the transmit and receive pairs are not properly crossed for that connection. Which issue is this?

• a.DHCP scope exhaustion
• b.A TX/RX reversal✓
• c.An incorrect default gateway configured on the host
• d.A duplex mismatch

A transmit/receive (TX/RX) reversal means the send and receive pairs are not correctly aligned for the devices, so no link forms. Auto-MDIX often fixes this automatically, but its absence or a miswired cable exposes it. Correcting the pinout or using the right cable type resolves it.

A copper Ethernet run of about 130 meters shows a weak, error-prone signal, while shorter runs are fine. Which cabling limitation explains this?

• a.Crosstalk between pairs
• b.A short circuit in the connector
• c.Attenuation from exceeding the distance limit✓
• d.An IP address conflict between two hosts on the segment

Attenuation is the loss of signal strength over distance, and exceeding the 100-meter copper limit degrades the signal and causes errors. Shorter runs stay within spec and work fine. Fiber or an intermediate switch is needed for longer distances.

A link works intermittently, and inspection reveals a poorly crimped RJ45 plug with loose conductors. Which fault category is this?

• a.A bad connector✓
• b.An oversubscribed uplink dropping packets during peak load
• c.A DNS misconfiguration
• d.A routing loop

A bad connector or failing termination causes intermittent connectivity as loose or misaligned conductors make unreliable contact. Re-terminating with a proper crimp restores a solid connection. Physical inspection and a cable tester confirm it.

A cable passes a basic continuity test but suffers high error rates at gigabit speeds, and testing reveals wires from different pairs were combined. Which wiring fault is this?

• a.Excessive attenuation caused by exceeding the maximum run length
• b.An open circuit
• c.Split pairs✓
• d.A short circuit

Split pairs occur when wires from two different pairs are used together, passing continuity but destroying the twist protection and causing crosstalk at speed. A wire-map test that checks pairing, not just continuity, detects it. Re-terminating to the correct standard fixes it.

A fiber transceiver will not establish a link, and a technician finds the small pluggable optic has a bent pin and a dirty connector end. Which is the most appropriate first action?

• a.Reconfigure the DHCP scope
• b.Clean and reseat or replace the transceiver✓
• c.Change the VLAN assignment on the port
• d.Increase the interface MTU to allow larger frames

Inspecting and cleaning the connector and reseating or replacing a damaged transceiver addresses physical optic faults like bent pins or contamination. Dirty or damaged optics are a common cause of no-link on fiber. Optical inspection tools confirm the condition.

On a fiber patch, no link forms until the technician swaps the two strands at one end. What was the original problem?

• a.The fiber was too short for the optic
• b.The DHCP server had run out of addresses to lease
• c.The switch port was in the wrong VLAN
• d.The fiber transmit and receive strands were reversed✓

On duplex fiber, the transmit strand of one device must reach the receive of the other; if the strands are reversed, no link forms until they are swapped. This TX/RX crossover requirement is easy to overlook. Swapping the strands at one connector resolves it.

A technician plugs a multimode patch cable into a transceiver designed for single-mode fiber and gets high loss or no link. What is the root cause?

• a.An APIPA address assigned to the host
• b.A spanning-tree loop between two switches
• c.A duplex mismatch between the switch ports
• d.A single-mode/multimode fiber mismatch✓

A fiber type mismatch, such as multimode cable with a single-mode optic (or vice versa), causes high loss or link failure. The core sizes and light sources are incompatible. Matching the cable, connector, and optic types resolves it.

An IP camera on a PoE switch loses power under load even though the switch supports PoE, and the switch reports its power budget is fully consumed. What is the likely cause?

• a.The PoE power budget is exhausted✓
• b.An incorrect subnet mask on the switch
• c.A DNS misconfiguration on the camera
• d.A spanning-tree blocking state on the camera's uplink port

Exceeding the switch's total PoE power budget starves later devices of power, causing them to drop even though PoE is supported. Adding a higher-wattage supply, a PoE injector, or fewer powered devices resolves it. Checking the per-port and total budget confirms it.

Copper cabling routed alongside fluorescent lighting and motors shows errors that worsen when the equipment runs. Which remedy directly addresses the cause?

• a.Use shielded cabling or reroute away from the interference✓
• b.Shorten the DHCP lease time
• c.Change the host's DNS server
• d.Increase the switch's MAC address table size

Interference induced on unshielded copper is best addressed with shielded cabling (or rerouting away from the source, or using fiber). Shielding drains the induced noise to ground. The correlation with nearby equipment operation points to EMI.

A user's jack is dead, but testing shows the patch panel port is cross-connected to the wrong switch port than the labeling claims. Which documentation-related fault is this?

• a.A patch panel cross-connect/mapping error✓
• b.Electromagnetic interference on the horizontal cable run
• c.A duplex mismatch
• d.An expired DHCP lease

A patch panel mapping error connects a jack to a different switch port than documented, so the intended configuration never reaches the user. Correcting the cross-connect or updating records resolves it. Accurate labeling prevents this class of mistake.

In a 2.4 GHz deployment, three nearby access points on channels 4, 7, and 9 suffer poor performance from overlapping signals. Which channel plan resolves this?

• a.Set all APs to channel 6
• b.Use channels 1, 6, and 11✓
• c.Raise every AP to maximum transmit power
• d.Bond the channels together into one wide 40 MHz channel

In 2.4 GHz, only channels 1, 6, and 11 are non-overlapping, so assigning adjacent APs to those channels eliminates the overlap. Channels like 4, 7, and 9 partially overlap and interfere. Proper channel reuse is essential in dense deployments.

Wi-Fi in a break room drops out whenever the microwave oven runs, and the interference is not from another access point. Which cause is most likely?

• a.Non-Wi-Fi RF interference✓
• b.An incorrect default gateway on the clients
• c.A DHCP scope that is exhausted
• d.Co-channel interference from another access point on the same channel

Non-Wi-Fi interference from devices like microwave ovens, cordless phones, and Bluetooth radios disrupts the 2.4 GHz band. Its correlation with the microwave running is a strong clue. A spectrum analyzer identifies such non-802.11 sources.

Users in a far corner of the warehouse get very weak Wi-Fi or none at all, while the rest of the floor is fine. Which fix best addresses this coverage gap?

• a.Replace the wired uplink with a higher-category copper cable
• b.Change the SSID name broadcast by the AP
• c.Add an access point to cover the dead zone✓
• d.Shorten the DHCP lease timer

A dead zone from insufficient coverage is resolved by adding an access point (or repositioning/adjusting antennas) to extend signal into the gap. Simply raising power on a distant AP often worsens interference elsewhere. A site survey confirms placement.

A laptop stays connected to a distant access point with a weak signal even after the user walks near a closer AP, hurting performance. What is this behavior called?

• a.A DNS resolution failure
• b.A duplex mismatch between the AP and its wired switch port
• c.A sticky client roaming problem✓
• d.An IP address conflict on the subnet

A sticky client clings to its original AP despite a stronger nearby one, degrading throughput as signal weakens. Tuning roaming thresholds or enabling 802.11k/v/r assistance encourages timely handoff. The client, not the network, decides when to roam.

Several users cannot join the secured Wi-Fi and are repeatedly prompted for the network key, though the signal is strong. Which cause is most likely?

• a.A spanning-tree loop between the AP and the switch
• b.A missing default gateway on the AP
• c.Weak signal at the client location
• d.An incorrect pre-shared key✓

Repeated authentication prompts with a strong signal typically indicate an incorrect pre-shared key (wrong passphrase). Correcting the entered key restores access. Signal strength being fine rules out coverage as the cause.

Older devices cannot connect after an AP is reconfigured, and the AP is set to require a security mode the clients do not support. Which issue is this?

• a.Attenuation from distance to the AP
• b.A security mode mismatch✓
• c.An exhausted DHCP scope
• d.A duplex mismatch on the AP's wired uplink port

A wireless security mode mismatch (for example, requiring WPA3-only while a client supports only WPA2) prevents association. A transitional/mixed mode or matching settings restores compatibility. Verifying supported modes on both ends resolves it.

During a busy all-hands meeting, a single access point serving hundreds of attendees becomes sluggish for everyone, though signal is strong. What is the likely cause?

• a.An incorrect subnet mask on the AP
• b.A dirty fiber connector on the AP's uplink
• c.Too many clients on one access point (overcapacity)✓
• d.A weak signal at every client

AP overcapacity occurs when too many clients share one radio, so airtime contention degrades performance despite good signal. Adding APs or enabling band steering spreads the load. High client counts, not weak signal, are the tell.

A client sees a strong 5 GHz signal near the access point but loses it much sooner than 2.4 GHz as they walk away. Which characteristic explains this?

• a.The client's DHCP lease expired
• b.5 GHz has shorter range than 2.4 GHz✓
• c.The switch port feeding the AP had a duplex mismatch
• d.A default gateway was missing on the client

The 5 GHz band offers higher throughput and less congestion but has shorter range and weaker obstacle penetration than 2.4 GHz. So coverage falls off faster with distance and walls. Band selection trades speed against reach.

To cover a long, narrow corridor from one end, an engineer needs to focus the AP's signal down the hallway rather than spread it in all directions. Which change helps?

• a.Disable SSID broadcast on the AP
• b.Assign the AP a static route to the corridor subnet
• c.Use a shorter DHCP lease
• d.Use a directional antenna✓

A directional antenna focuses RF energy in a specific direction, ideal for long corridors or point-to-point links, versus an omnidirectional antenna that radiates evenly. Matching antenna type and placement to the space improves coverage. Antenna choice is part of RF design.

Wi-Fi is strong in an office but drops sharply behind a room with thick concrete and metal walls. Which factor best explains the loss?

• a.An IP address conflict
• b.A DNS server outage
• c.Signal attenuation from building materials✓
• d.Co-channel interference from a distant access point on channel 11

Dense building materials like concrete and metal cause RF attenuation and reflection, sharply reducing signal behind them. Repositioning or adding an AP on the far side restores coverage. Materials are a key input to any site survey.

Guests connect to the open Wi-Fi and get an IP address, but the sign-in web page that should grant internet access never appears. Which component is likely failing?

• a.The captive portal is not loading✓
• b.The switch uplink is running at half duplex
• c.The antenna is directional instead of omnidirectional
• d.The client is too close to the access point

A captive portal is the web page that authenticates or accepts terms before granting internet access; if it fails to load, users associate but cannot browse. DNS redirection or portal server issues commonly cause this. Verifying the portal and its DNS handling resolves it.

An access point using a 5 GHz channel occasionally goes quiet and moves channels after detecting radar, briefly disrupting clients. Which mechanism causes this?

• a.A sticky client refusing to roam
• b.Crosstalk on the copper cable feeding the access point
• c.An exhausted DHCP scope on the guest VLAN
• d.Dynamic Frequency Selection (DFS) radar avoidance✓

Dynamic Frequency Selection (DFS) requires APs on certain 5 GHz channels to vacate when radar is detected, causing brief channel changes and disruption. Choosing non-DFS channels avoids it where radar is present. It is a regulatory requirement, not a fault.

A technician wants to quickly confirm whether a remote server is reachable at the IP layer and see the round-trip time. Which command is the simplest choice?

• a.ping✓
• b.netstat
• c.nslookup
• d.traceroute, which maps every router hop along the path

Ping sends ICMP echo requests and reports replies and round-trip time, confirming basic Layer 3 reachability. Success shows the path and host are responding. No reply may mean a down host, filtering, or a routing problem.

Users report a site is slow to reach, and a technician wants to see at which router hop along the path latency spikes. Which tool shows per-hop delay?

• a.arp
• b.traceroute✓
• c.ipconfig
• d.netstat, which lists active connections and listening ports

Traceroute (tracert on Windows) lists each router hop and the delay to it, revealing where latency spikes or the path breaks. It increments the TTL to elicit responses from intermediate routers. It complements ping for locating path problems.

A technician suspects a specific DNS record is wrong and wants to query the DNS server directly for that record type. Which tool is appropriate?

• a.ipconfig, which displays the local interface addressing
• b.nslookup✓
• c.ping
• d.netstat

nslookup (or dig) queries DNS servers directly and can request specific record types such as MX, A, or CNAME. It isolates name-resolution problems from other issues. Comparing results across resolvers reveals inconsistencies.

A Windows client is stuck with a bad DHCP lease, and a technician wants to force it to drop the current address and request a fresh one. Which commands accomplish this?

• a.nslookup and arp
• b.ping and traceroute
• c.ipconfig /release and /renew✓
• d.netstat combined with the route print command

Running ipconfig /release then ipconfig /renew forces the client to give up its lease and request a new one from the DHCP server. This resolves stale or incorrect leases. It is a quick fix for many client addressing problems.

A technician wants to see which TCP ports a server is currently listening on and what connections are established. Which command shows this?

• a.ping
• b.netstat✓
• c.tracert
• d.nslookup, which resolves hostnames to addresses

netstat lists active connections, listening ports, and their states on the local host. It confirms whether a service is listening and which endpoints are connected. It is a first check when an application will not accept connections.

A host cannot reach a device on its own subnet, and a technician wants to view the cached IP-to-MAC mappings the host has learned. Which command displays this table?

• a.ping -t
• b.arp -a✓
• c.ipconfig /all
• d.netstat -r, which prints the local routing table

The arp -a command displays the ARP cache, mapping recently contacted IP addresses to their MAC addresses. A wrong or missing entry can explain local delivery failures. Clearing a stale entry can restore connectivity.

A technician wants a single tool that both traces the path to a destination and, over time, measures packet loss at each hop. Which utility combines these?

• a.arp
• b.pathping/mtr✓
• c.ipconfig
• d.nslookup, used to query DNS record types

Pathping (Windows) and mtr (Unix) combine traceroute with continuous statistics, reporting per-hop latency and packet loss over time. This pinpoints the hop where loss originates. It is more diagnostic than a single traceroute pass.

A technician suspects a host is missing a route and wants to view the local routing table to confirm the default gateway and any static routes. Which command shows this?

• a.nslookup for the destination hostname
• b.route print✓
• c.ping -t
• d.arp -a

The route print command (or ip route on Linux) displays the host's local routing table, including the default gateway and any static routes. A missing or wrong default route explains failures reaching remote networks. It is key when local traffic works but remote does not.

To analyze the exact contents of packets during a subtle protocol failure, a technician needs to capture and decode frames on the wire. Which tool fits?

• a.ipconfig
• b.arp, which only shows the local address cache
• c.ping
• d.Wireshark/tcpdump✓

A protocol analyzer like Wireshark or tcpdump captures and decodes packets, exposing headers and payloads for deep analysis. It reveals malformed exchanges that summaries hide. A SPAN/mirror port often feeds it the traffic.

An engineer wants to measure the actual throughput achievable between two hosts by generating test traffic in a controlled way. Which tool is designed for this?

• a.arp -a
• b.tracert to the far-end host's address
• c.nslookup
• d.iperf✓

iperf generates controlled TCP or UDP traffic between a client and server to measure achievable throughput, jitter, and loss. It isolates network capacity from application behavior. Results guide capacity and QoS decisions.

A security technician wants to discover which hosts are alive on a subnet and which TCP ports they have open. Which tool provides this scan?

• a.ipconfig
• b.ping -t
• c.nmap✓
• d.netstat run on each individual host

nmap scans a range of hosts to discover live systems and their open ports and services. It is a standard reconnaissance and audit tool. Results reveal exposure and help verify firewall rules.

After a DNS record was corrected, a Windows client still resolves the old address because of local caching. Which command clears the client's DNS cache?

• a.netstat -a to list all connections and ports
• b.arp -d
• c.ipconfig /flushdns✓
• d.route add

ipconfig /flushdns clears the Windows DNS resolver cache so the client queries fresh records instead of stale cached ones. It resolves cases where a record changed but the client still returns the old value. Restarting the resolver service does the same.

Traffic to a cloud service routes over a very long path across several continents, adding significant delay even though no link is congested. Which factor is responsible?

• a.Path length / propagation delay✓
• b.Insufficient link bandwidth
• c.Packet loss from bad cabling
• d.A duplex mismatch between two switches in the path

Propagation and path length add latency independent of congestion; a longer route simply takes more time end to end. Choosing a closer endpoint or better-peered path reduces it. High RTT with low utilization points here rather than to congestion.

During peak hours a WAN link is saturated and applications slow down, and monitoring shows the interface at 100 percent with rising output drops. What is the cause?

• a.A DNS misconfiguration
• b.A missing default gateway on the affected hosts
• c.Bandwidth saturation (congestion)✓
• d.An IP address conflict

Bandwidth saturation occurs when demand exceeds link capacity, filling queues and dropping packets during peaks. Adding capacity, shaping, or QoS relieves it. The correlation with peak load and full utilization confirms congestion.

A link shows intermittent packet loss and rising interface error counters, and replacing a marginal cable clears both. Which was the underlying cause?

• a.A DNS server outage
• b.Physical-layer errors from a faulty cable✓
• c.An access control list blocking the traffic at the router
• d.An exhausted DHCP scope

Physical errors from a marginal cable or connector corrupt frames, showing up as CRC/input errors and causing intermittent loss. Replacing the faulty cable removes the errors. Error counters are the diagnostic that points to Layer 1.

A saturated link makes interactive traffic laggy because oversized buffers hold packets far too long before forwarding them. What is this phenomenon called?

• a.Co-channel interference on the wireless segment
• b.Attenuation
• c.Bufferbloat✓
• d.A routing loop

Bufferbloat is excessive latency caused by overly large buffers that queue packets instead of dropping them promptly, hurting interactive traffic. Active queue management (such as CoDel) mitigates it. It appears as high latency under load without heavy loss.

Traffic reaches a server fine but return traffic takes a different path, and a stateful firewall drops the flow because it never saw the outbound side. Which condition is this?

• a.An exhausted DHCP address pool on the subnet
• b.Asymmetric routing✓
• c.A duplex mismatch
• d.A DNS misconfiguration

Asymmetric routing sends forward and return traffic over different paths, which can break stateful devices that must see both directions of a flow. Aligning the paths or making the device state-aware of both resolves it. It often appears after redundancy or route changes.

A VPN tunnel drops large packets while small ones pass, and the problem clears when the interface's maximum frame size is lowered. Which issue caused it?

• a.A spanning-tree loop between the tunnel endpoints
• b.A DNS resolution failure
• c.An MTU mismatch✓
• d.A duplicate IP address on the tunnel

An MTU mismatch or fragmentation problem drops or mishandles packets larger than a link allows, especially where encapsulation shrinks the usable size. Lowering the MTU or enabling proper path MTU discovery resolves it. Small packets passing while large ones fail is the classic symptom.

Two switch ports show late collisions and poor throughput because one end is set to full duplex and the other to half. What is the recommended fix?

• a.Set both ends to autonegotiate or matching duplex✓
• b.Assign the ports to different VLANs
• c.Replace the switch with a router
• d.Increase the interface MTU to reduce collisions on the link

Setting both ends to autonegotiate (or both to the same fixed duplex) resolves a duplex mismatch that causes late collisions and slow throughput. Mismatched fixed settings are a common misconfiguration. Matching the configuration on both ends is essential.

After a redundant switch link was added without loop prevention, switch CPUs spike to 100 percent and the whole segment slows to a crawl. Which problem does this indicate?

• a.An expired DHCP lease on the clients
• b.A DNS misconfiguration
• c.An access control list dropping legitimate traffic at the edge
• d.A broadcast storm from a switching loop✓

A broadcast storm from a Layer 2 loop floods frames endlessly, spiking switch CPU and saturating the segment. Enabling or verifying spanning tree stops it. The sudden onset after adding a redundant link is the giveaway.

Web pages take several seconds to begin loading, but once resolved they download quickly, and the assigned DNS server is geographically distant. Which fix most directly helps?

• a.Enable jumbo frames on the client's network adapter
• b.Increase the link bandwidth
• c.Configure a faster, closer DNS resolver✓
• d.Replace the copper cabling with fiber

Slow initial page loads with fast downloads point to slow DNS resolution; using a closer or faster resolver cuts the lookup delay. The quick transfer once resolved rules out bandwidth. Testing with nslookup timing confirms the cause.

A traceroute shows the same set of routers repeating and packets eventually dying with TTL-exceeded messages, and users cannot reach the destination. Which problem is this?

• a.A duplex mismatch
• b.A routing loop✓
• c.Electromagnetic interference on the copper uplink
• d.A DHCP scope exhaustion

A routing loop sends packets circling between routers until the TTL expires, producing TTL-exceeded messages and unreachable destinations. Correcting the conflicting routes breaks the loop. The repeating hops in traceroute are the telltale sign.

After a QoS change, backup traffic monopolizes the link and voice suffers because the policy failed to reserve capacity for voice. Which is the underlying issue?

• a.A QoS misconfiguration✓
• b.A dirty fiber connector on the WAN uplink
• c.A DNS outage
• d.A duplicate IP address

A QoS misconfiguration that fails to classify or reserve priority for voice lets bulk traffic starve it during congestion. Correcting the classification and queuing restores voice quality. The change coinciding with the problem points to the policy.

An old segment built around a hub shows many collisions and poor performance as more devices are added. Which characteristic of the hub explains this?

• a.The hub blocks redundant links using spanning tree
• b.The hub is one shared, half-duplex collision domain✓
• c.The hub exhausts the DHCP scope
• d.The hub routes between VLANs at Layer 3

A hub creates a single shared collision domain running half duplex, so collisions rise as devices and traffic increase. Replacing it with a switch gives each port its own collision domain and full duplex. This is why hubs are obsolete for modern LANs.

A high-latency, high-bandwidth WAN link achieves far less throughput than its capacity for a single TCP transfer, and the small TCP window cannot keep the long pipe full. Which fix helps?

• a.Disable QoS on the link
• b.Lower the interface MTU
• c.Enable TCP window scaling✓
• d.Shorten the DHCP lease duration for the clients

On a long fat network, a small TCP window limits throughput because the sender cannot keep enough data in flight for the high latency. Enabling window scaling (larger windows) lets a single flow fill the pipe. This explains low single-stream throughput despite ample bandwidth.

VoIP calls sound choppy with syllables clipped, and monitoring shows packets arriving at uneven intervals though few are lost. Which mitigation best addresses the cause?

• a.Replace the DNS server with a local one
• b.Assign the phones static IP addresses
• c.Add a jitter buffer and prioritize voice with QoS✓
• d.Increase the DHCP scope size on the voice VLAN

Choppy audio from uneven packet arrival is caused by jitter, and a properly sized jitter buffer plus QoS prioritization smooths it. The low loss rules out congestion drops as the main issue. Marking and queuing voice traffic reduces the jitter itself.

After terminating a cable, a technician needs to confirm each pin connects to the correct pin at the far end with no miswires. Which tool verifies the wire map?

• a.A cable tester✓
• b.A loopback plug
• c.A tone generator paired with an inductive probe
• d.A spectrum analyzer

A cable tester with a wire-map function confirms pin-to-pin correctness and flags opens, shorts, reversed, or split pairs. It validates that the termination follows the intended standard. It is the standard check after terminating a run.

A technician needs to find which wall jack corresponds to an unlabeled cable end in a crowded telecom closet. Which tool pair helps locate it?

• a.A protocol analyzer capturing frames on the link
• b.A multimeter
• c.An OTDR
• d.A tone generator and inductive probe✓

A tone generator places an audible signal on a wire, and an inductive probe detects that tone to trace and identify the specific cable or jack. It is standard for locating cables in bundles or panels. It complements, rather than replaces, continuity testing.

To test whether a switch port or NIC is functioning by looping its transmit back to its receive, which simple tool does a technician use?

• a.An optical time-domain reflectometer for fiber
• b.A loopback plug✓
• c.A tone generator
• d.A cable certifier

A loopback plug (or adapter) connects a port's transmit to its receive so the interface can test itself without another device. It confirms the port electrically works. It is a quick way to isolate a suspected bad port.

A long fiber run has a break somewhere, and the team needs to know the distance to the fault without digging up the whole path. Which instrument provides this?

• a.A tone generator with an inductive probe
• b.An OTDR✓
• c.A cable tester
• d.A loopback plug

An OTDR (optical time-domain reflectometer) sends light pulses and measures reflections to locate breaks, bends, and their distance along a fiber. It maps loss events across the run. This pinpoints where to dig or repair.

A technician needs to measure the actual optical signal strength arriving at a receiver to confirm it is within the transceiver's specified range. Which tool measures this?

• a.An optical power meter✓
• b.A multimeter
• c.A tone generator used to trace copper pairs
• d.A punchdown tool

An optical power meter (light meter) measures received optical power in dBm to verify a fiber link is within the transceiver's budget. Readings that are too low indicate excess loss. It quantifies problems a visual check cannot.

To check continuity and measure voltage on a copper conductor or a PoE circuit, which general-purpose electrical tool does a technician use?

• a.A multimeter✓
• b.An OTDR
• c.A Wi-Fi analyzer
• d.A protocol analyzer that decodes captured packets

A multimeter measures continuity, voltage, and resistance, useful for checking copper conductors and PoE voltage. It is a general electrical diagnostic, not a network-specific tester. It helps confirm power delivery and basic wire integrity.

A technician must seat individual conductors into an insulation-displacement block on a patch panel, cutting and securing each wire. Which tool is required?

• a.An optical time-domain reflectometer
• b.A crimper
• c.A loopback plug
• d.A punchdown tool✓

A punchdown tool seats conductors into insulation-displacement contacts on 66- or 110-blocks and patch panels, trimming the excess in one motion. It ensures solid, standardized terminations. Using it correctly avoids intermittent connections.

To attach an RJ45 plug onto a freshly stripped patch cable, securing the pins and strain relief, which tool does a technician use?

• a.A tone generator
• b.A crimper✓
• c.A cable certifier that validates performance to a standard
• d.A punchdown tool

A crimper attaches RJ45 (or RJ11) connectors to a cable, seating the pins onto the conductors and locking the strain relief. Proper crimping prevents loose, intermittent contacts. It pairs with a stripper and a tester for reliable field terminations.

A contractor must prove a finished cabling run meets the full performance requirements of a category standard for the customer's records. Which tool produces this compliance report?

• a.A basic continuity cable tester
• b.A loopback plug
• c.A tone generator with a probe
• d.A cable certifier✓

A cable certifier tests a run against a category's full performance parameters (such as insertion loss, NEXT, and return loss) and produces a pass/fail compliance report. A basic tester only checks wiring continuity and mapping. Certification is required for many warranties.

An engineer wants to see which Wi-Fi channels nearby access points occupy and their signal strengths to plan channel assignments. Which tool provides this view?

• a.A punchdown tool
• b.A Wi-Fi analyzer✓
• c.A multimeter measuring the AP's supply voltage
• d.An OTDR

A Wi-Fi analyzer scans the bands to show nearby SSIDs, their channels, and signal strengths, guiding channel planning to avoid overlap. It reveals congestion from other 802.11 networks. It is a first step in wireless troubleshooting and design.

Wi-Fi in an area suffers interference that a Wi-Fi analyzer cannot explain, suggesting a non-802.11 source. Which instrument identifies such RF energy?

• a.A spectrum analyzer✓
• b.A loopback plug
• c.A tone generator and inductive probe
• d.A cable certifier

A spectrum analyzer visualizes all RF energy in a band, revealing non-Wi-Fi sources like microwaves, cordless phones, or jammers that a Wi-Fi analyzer misses. It shows interference the 802.11 view cannot. This pinpoints physical-layer RF problems.

A field team must permanently join two fiber strands with minimal loss for a long-haul splice. Which specialized tool set performs this?

• a.A punchdown tool
• b.A crimper and stripper
• c.A fusion splicer and cleaver✓
• d.A tone generator paired with an inductive probe

A fusion splicer (with a cleaver) permanently joins fiber strands by aligning and melting the cores together, producing a very low-loss splice. A cleaver first prepares clean, square end faces. This is the standard method for durable, high-quality fiber joins.

To decode a suspicious traffic exchange down to individual protocol fields during an investigation, which tool does an analyst rely on?

• a.A protocol analyzer✓
• b.An optical power meter reading the receive level
• c.An OTDR
• d.A punchdown tool

A protocol analyzer captures and decodes traffic field by field, exposing the exact protocol behavior during an investigation. It reveals malformed or malicious exchanges that summaries hide. It is central to deep network and security analysis.

A technician needs a quick way to confirm a short fiber patch has continuity and to see roughly where a break is by looking for escaping red light. Which simple tool helps?

• a.A multimeter
• b.A tone generator used on copper pairs
• c.A crimper
• d.A visual fault locator✓

A visual fault locator injects visible red laser light into a fiber, making breaks, sharp bends, or bad connectors glow where light escapes. It is a fast, low-cost check for continuity and gross faults. It complements the precise distance data of an OTDR.

A team wants a dedicated hardware appliance that generates and measures traffic to certify a circuit's throughput and latency during turn-up. Which tool fits?

• a.A loopback plug
• b.A punchdown tool
• c.A tone generator and inductive probe
• d.A throughput/traffic tester✓

A dedicated throughput/traffic tester generates and measures traffic to certify a circuit's throughput, latency, and loss during turn-up. It provides repeatable, standards-based results a laptop utility may not. Providers often require it to validate an SLA.

To access a switch's command line locally when the network is down, a technician connects a laptop to the device's serial management port. Which cable is required?

• a.A fiber patch cable
• b.A crossover cable
• c.A tone generator with an inductive probe
• d.A console (rollover) cable✓

A console (rollover) cable connects a computer to a device's serial console port for out-of-band CLI access, even when the network is unreachable. It is essential for initial setup and recovery. USB-to-serial adapters often bridge to modern laptops.

A fiber uplink will not come up, and the transceiver, though it fits, is a different vendor code than the switch expects and is rejected. What is the likely cause?

• a.A duplex mismatch on the link
• b.An incompatible/uncoded transceiver✓
• c.A spanning-tree loop between the two switches
• d.An exhausted DHCP scope

Some switches reject transceivers whose vendor coding is not recognized or compatible, so the link never comes up despite a physical fit. Using a supported or properly coded optic resolves it. Checking compatibility lists prevents this surprise.

A technician must trim cable jacket and cut conductors cleanly while terminating copper. Which hand tools are appropriate?

• a.An OTDR
• b.A cable stripper and snips✓
• c.A spectrum analyzer
• d.A protocol analyzer decoding the captured frames

A cable stripper and cutting snips cleanly remove jacket and trim conductors during termination without nicking the wire. Clean preparation is essential for reliable crimps and punchdowns. They are basic parts of a cabling toolkit.

During troubleshooting, a technician glances at a switch port's LEDs to quickly gauge link status and activity before running deeper tests. What do these indicators primarily show?

• a.The spanning-tree root bridge for the VLAN
• b.The DNS server in use
• c.Link status and activity✓
• d.The DHCP lease duration

Port status LEDs quickly indicate link presence, speed, and activity, giving a fast first read before deeper testing. A dark link LED points to a Layer 1 problem. They are the quickest physical-layer sanity check.

A known bug in a device's current software version causes intermittent crashes, and the vendor has published a corrected release. What is the appropriate remediation?

• a.Reassign the device's IP address
• b.Replace all the network cabling
• c.Apply the vendor's firmware update✓
• d.Increase the interface MTU to work around the crashes

Applying the vendor's firmware/software update that fixes a known bug is the correct remediation for a defect-driven failure. Change management and a maintenance window should govern the upgrade. Verifying the release notes confirms the fix applies.

Midway through a tricky fault, a technician reviews the network's baseline and documentation to compare current behavior against the known-good state. Why is this step valuable?

• a.It replaces the need for change management approval entirely
• b.It eliminates the need to test any theory
• c.It reveals deviations from the known-good state✓
• d.It automatically repairs the misconfiguration

Comparing current behavior against baselines and documentation quickly reveals what has deviated from the known-good state, focusing the investigation. It turns vague symptoms into concrete differences. This is why keeping documentation current pays off during outages.

For long-term packet capture on a critical link, a team wants a passive inline device that copies all traffic to a monitoring port without relying on switch resources or dropping frames under load. Which tool fits?

• a.A network tap✓
• b.A tone generator paired with an inductive probe
• c.A punchdown tool
• d.A loopback plug

A network tap is a passive inline device that copies full-duplex traffic to a monitor port without burdening the switch CPU or dropping frames the way an oversubscribed SPAN port can. It gives an unaltered, reliable feed for capture and analysis. It is preferred over port mirroring for high-fidelity, sustained monitoring.