420 questions
In IPv6, which protocol replaces ARP for discovering the link-layer address of a neighbor?
- a.DHCPv6
- b.ARP for IPv6
- c.Neighbor Discovery Protocol (NDP)✓
- d.ICMPv4
IPv6 uses the Neighbor Discovery Protocol (NDP), part of ICMPv6, to resolve link-layer addresses and discover routers, replacing IPv4's ARP. NDP uses neighbor solicitation and advertisement messages. There is no ARP in IPv6.
Which service assigns IPv6 addresses and options centrally, tracking which client received which address?
- a.Stateful DHCPv6✓
- b.SLAAC
- c.APIPA
- d.NAT64
Stateful DHCPv6 centrally assigns IPv6 addresses and configuration and keeps a record of leases, similar to IPv4 DHCP. SLAAC, by contrast, is stateless and lets hosts self-configure. Stateful DHCPv6 is chosen when central tracking and control are required.
Which IPv6 message does a router periodically send so that hosts learn the on-link prefix and default gateway?
- a.Echo request
- b.Neighbor solicitation
- c.Router advertisement✓
- d.DHCP offer
Routers send Router Advertisement (RA) messages announcing the prefix, default gateway, and configuration flags that hosts use for SLAAC. Hosts can also solicit these with a Router Solicitation. RAs are central to IPv6 autoconfiguration.
Which technology allows IPv6-only clients to reach IPv4-only servers by translating between the two address families?
- a.SLAAC
- b.Dual stack
- c.EUI-64
- d.NAT64✓
NAT64 translates between IPv6 and IPv4 so IPv6-only clients can communicate with IPv4-only resources, usually paired with DNS64. Dual stack instead runs both protocols natively. NAT64 is useful during transition when full dual stack is not possible.
When manually assigning a static IPv4 configuration to a server, which set of parameters is minimally required for it to reach remote networks?
- a.VLAN ID and switch port number
- b.IP address and MAC address only
- c.IP address, subnet mask, and default gateway✓
- d.Hostname and DNS suffix only
To reach remote networks a host needs an IP address, a subnet mask to define its local network, and a default gateway to forward off-subnet traffic. A DNS server is also needed to resolve names but not for basic IP reachability. Without a gateway, the host can only talk locally.
Which PoE standard delivers the most power, up to about 90 W at the source, for devices like PTZ cameras and displays?
- a.802.3u Fast Ethernet
- b.802.3bt (PoE++)✓
- c.802.3af (PoE)
- d.802.3at (PoE+)
802.3bt, known as PoE++, supplies up to roughly 90 W at the source across all four pairs, powering high-draw devices. 802.3af provides about 15 W and 802.3at about 30 W. 802.3u is a Fast Ethernet standard, unrelated to power delivery.
Which switch configuration forces a port to operate as a trunk regardless of the neighbor's negotiation settings?
- a.switchport nonegotiate off
- b.switchport mode trunk✓
- c.no switchport
- d.switchport mode access
The command switchport mode trunk statically sets the port to trunk, carrying tagged VLAN traffic without relying on dynamic negotiation. switchport mode access fixes it as an access port. Hard-setting trunk mode avoids issues from mismatched auto-negotiation.
Enabling jumbo frames on a storage network changes which interface setting to roughly 9000 bytes?
- a.The VLAN ID
- b.The maximum transmission unit (MTU)✓
- c.The spanning-tree cost
- d.The administrative distance
Jumbo frames raise the interface MTU to about 9000 bytes so large payloads move with less per-packet overhead, benefiting iSCSI and backup traffic. Every device in the path must support the same larger MTU. A mismatch causes fragmentation or dropped frames.
Disabling SSID broadcast on an access point has which practical effect?
- a.It hides the network name from casual scans but not from determined attackers✓
- b.It encrypts all wireless traffic automatically
- c.It doubles the available bandwidth
- d.It prevents all deauthentication attacks
Hiding the SSID stops the name from appearing in ordinary device scans but does not provide real security, since the SSID still travels in other frames and tools can reveal it. It offers no encryption and does not stop skilled attackers. Strong encryption like WPA3 is the actual protection.
Which feature presents a web page requiring acceptance of terms or login before granting guests wireless internet access?
- a.MAC randomization
- b.Band steering
- c.WPA3-Enterprise
- d.Captive portal✓
A captive portal intercepts a new client's web traffic and forces it to a page for authentication or acceptance of terms before allowing access. It is common on guest and public Wi-Fi. It controls access without distributing a shared passphrase.
For seamless roaming as a user walks between two access points, how should the APs be configured?
- a.Hidden SSIDs with static client IPs
- b.Different SSIDs and the same channel
- c.The same SSID on non-overlapping channels✓
- d.The same SSID and the same channel
Seamless roaming needs the same SSID across APs so clients see one network, with each AP on a non-overlapping channel to avoid co-channel interference. Matching channels would cause interference in overlapping coverage. Consistent security settings are also required for smooth handoff.
In a router's table, which route source has the most trustworthy administrative distance of 0?
- a.Static routes
- b.RIP-learned routes
- c.Directly connected interfaces✓
- d.OSPF-learned routes
Directly connected networks have an administrative distance of 0, the most trusted, because the router has a live interface on that network. Static routes default to 1, OSPF to 110, and RIP to 120. Lower administrative distance always wins when routes overlap.
When configuring router-on-a-stick, what must be applied to each subinterface for it to service a specific VLAN?
- a.An 802.1Q encapsulation tag matching the VLAN ID✓
- b.A separate physical NIC per VLAN
- c.An access-list that permits any
- d.A crossover cable to the switch
Each router subinterface must be configured with 802.1Q encapsulation for the specific VLAN ID so it can send and receive tagged frames on the trunk. The switch port to the router is configured as a trunk. This lets one physical link route among many VLANs.
Which device combines high-speed hardware switching with the ability to route between VLANs using ASICs?
- a.A media converter
- b.A wireless controller
- c.A Layer 3 (multilayer) switch✓
- d.An unmanaged hub
A Layer 3 or multilayer switch performs both switching and routing in hardware, routing between VLANs at wire speed via switched virtual interfaces. This outperforms router-on-a-stick for high inter-VLAN traffic. It is the standard core and distribution device in campus networks.
Which feature shuts down a PortFast-enabled access port if it unexpectedly receives a BPDU, protecting the spanning-tree topology?
- a.Storm control
- b.BPDU guard✓
- c.Root guard
- d.DHCP snooping
BPDU guard disables a PortFast access port the moment it receives a BPDU, since that indicates an unauthorized switch was connected. This protects the topology from accidental loops or rogue switches. It is commonly paired with PortFast on edge ports.
Which open-standard first-hop redundancy protocol lets multiple routers share a virtual IP so hosts keep a single default gateway?
- a.OSPF
- b.STP
- c.VRRP✓
- d.LACP
Virtual Router Redundancy Protocol (VRRP) is an open standard that lets multiple routers present one virtual gateway IP, with a backup taking over if the master fails. HSRP is a Cisco equivalent. This removes the default gateway as a single point of failure.
Before deploying wireless in a warehouse, which activity maps signal strength and identifies interference and coverage gaps?
- a.A port scan
- b.A cable certification test
- c.A packet capture
- d.A wireless site survey✓
A wireless site survey measures signal strength, interference, and coverage across the space, guiding AP placement, channel plans, and power levels. It produces heat maps that reveal dead zones before deployment. Skipping it often leads to coverage and roaming problems.
An administrator wants the DHCP scope to skip .1 through .10 because those are statically assigned to servers. Which setting accomplishes this?
- a.A reservation
- b.An exclusion range✓
- c.A shorter lease time
- d.A relay agent
An exclusion range removes specific addresses from the DHCP pool so they are never leased, protecting statically assigned server addresses. A reservation, by contrast, hands a fixed address to a particular device via DHCP. Exclusions prevent address conflicts with manual assignments.
How does a switch build its MAC address table?
- a.By recording the source MAC and ingress port of frames it receives✓
- b.By copying the routing table from the gateway
- c.By querying DNS for each destination host
- d.By broadcasting ARP on every port at boot
A switch learns by examining the source MAC address of incoming frames and associating it with the port they arrived on. It then forwards frames only to the known port for a destination, flooding only when the destination is unknown. Entries age out after a period of inactivity.
In the static route 'ip route 192.168.50.0 255.255.255.0 10.0.0.2', what does 10.0.0.2 represent?
- a.The subnet mask
- b.The administrative distance
- c.The next-hop address✓
- d.The destination network
In that command, 192.168.50.0 is the destination network, 255.255.255.0 is its mask, and 10.0.0.2 is the next-hop IP to which matching traffic is forwarded. The router sends packets for that network toward 10.0.0.2. An optional trailing number would set the administrative distance.
In OSPF, which area must all other areas connect to, acting as the backbone?
- a.The not-so-stubby area
- b.Area 1
- c.The stub area
- d.Area 0✓
OSPF designates Area 0 as the backbone, and all other areas must connect to it, directly or via virtual links, so inter-area routing passes through the backbone. This hierarchy keeps the topology scalable and loop-free. Stub and NSSA areas are special non-backbone area types.
A 370 W PoE switch cannot power the 30th camera even though ports are free. What has most likely been exceeded?
- a.The DHCP scope
- b.The MAC address table size
- c.The spanning-tree diameter
- d.The switch's total PoE power budget✓
Each PoE switch has a finite power budget shared across all ports, and adding devices can exhaust it even when physical ports remain. The switch then stops powering additional devices. The fix is a higher-wattage power supply or a switch with a larger PoE budget.
Traffic for VLAN 40 is not crossing a trunk, though VLAN 40 exists on both switches. Which trunk setting should be checked first?
- a.The port speed and duplex
- b.The list of VLANs allowed on the trunk✓
- c.The PoE class of the port
- d.The DNS server address
Trunks can be configured to allow only specific VLANs, so VLAN 40 may simply be missing from the allowed list on the trunk. Verifying and adding it to the allowed VLANs restores the traffic. Native VLAN mismatches are another common trunking issue to check.
Which wireless security mode authenticates each user against a central RADIUS server rather than a shared passphrase?
- a.WPA3-Personal
- b.WEP
- c.WPA3-Enterprise✓
- d.Open with MAC filtering
WPA3-Enterprise uses 802.1X with a RADIUS server so each user authenticates with unique credentials rather than one shared key. This enables per-user access control and easy revocation. Personal modes rely on a single pre-shared key for everyone.
Which is the correctly compressed form of 2001:0db8:0000:0000:0000:0000:0000:0001?
- a.2001:db8::1✓
- b.2001:db8:0:1
- c.2001:0db8::0001::
- d.2001:db8:::1
Leading zeros in each group are dropped and one run of all-zero groups is replaced by a single double colon, giving 2001:db8::1. The double colon may appear only once in an address. Two double colons or an incomplete result would be invalid.
Which trio of goals forms the foundational model for information security?
- a.Confidentiality, integrity, and availability✓
- b.People, process, and technology
- c.Authentication, authorization, and accounting
- d.Prevention, detection, and response
The CIA triad of confidentiality, integrity, and availability is the foundational model that security controls aim to uphold. Confidentiality protects secrecy, integrity protects accuracy, and availability keeps resources accessible. Most controls map to one or more of these goals.
A file's SHA-256 hash is compared before and after transfer to confirm it was not altered. Which security goal does this protect?
- a.Availability
- b.Non-repudiation
- c.Integrity✓
- d.Confidentiality
Comparing hashes verifies integrity, confirming that data has not been changed in transit. Confidentiality would involve encryption, and availability concerns uptime. A matching hash proves the file is identical to the original.
A successful DDoS attack that makes a website unreachable primarily violates which security goal?
- a.Availability✓
- b.Integrity
- c.Authentication
- d.Confidentiality
A DDoS attack targets availability by overwhelming a service so legitimate users cannot reach it. It does not necessarily expose or alter data. Availability is the CIA goal most directly harmed by denial-of-service attacks.
Which framework encompasses verifying identity, granting permissions, and logging user actions?
- a.Public key infrastructure
- b.AAA (authentication, authorization, and accounting)✓
- c.Spanning Tree Protocol
- d.The CIA triad
AAA stands for authentication (proving identity), authorization (granting appropriate access), and accounting (logging activity). Protocols like RADIUS and TACACS+ implement AAA. It provides a complete model for controlling and auditing access.
Layering firewalls, segmentation, endpoint protection, and access controls so no single failure is catastrophic describes which strategy?
- a.Security through obscurity
- b.Flat networking
- c.Single sign-on
- d.Defense in depth✓
Defense in depth layers multiple independent controls so that if one fails, others still protect the asset. It assumes no single safeguard is perfect. This layered approach is a core principle of resilient security architecture.
What distinguishes a distributed denial-of-service attack from a simple denial-of-service attack?
- a.It always uses encryption to hide
- b.It only targets DNS servers
- c.It floods the target from many compromised sources at once✓
- d.It exploits a single software bug
A DDoS attack uses many compromised systems, often a botnet, to flood the target simultaneously, making it far harder to block than a single-source DoS. The distributed nature overwhelms defenses and disguises the true origin. Mitigation typically requires upstream scrubbing or filtering services.
An attacker secretly relays and can alter traffic between two parties who believe they communicate directly. What is this called?
- a.A port scan
- b.A ransomware attack
- c.A brute-force attack
- d.An on-path (man-in-the-middle) attack✓
An on-path attack, historically called man-in-the-middle, positions the attacker between two parties to intercept and possibly modify traffic. Techniques include ARP poisoning and rogue access points. Strong encryption and mutual authentication defend against it.
Which attack abuses the native VLAN by adding two 802.1Q tags so a frame reaches a VLAN the attacker should not access?
- a.VLAN hopping via double tagging✓
- b.DHCP starvation
- c.ARP poisoning
- d.MAC flooding
Double-tagging VLAN hopping inserts two 802.1Q tags so the first is stripped by the native VLAN and the inner tag delivers the frame to a target VLAN. Setting the native VLAN to an unused ID and not using VLAN 1 mitigates it. Explicitly tagging the native VLAN also helps.
An attacker sets up an access point advertising the corporate SSID to lure clients into connecting. What is this called?
- a.A captive portal
- b.A jump box
- c.A honeypot
- d.An evil twin✓
An evil twin is a rogue access point impersonating a legitimate SSID to trick users into connecting so the attacker can intercept traffic or harvest credentials. It is a form of on-path attack. Client certificate validation and WPA3-Enterprise reduce the risk.
Which wireless attack sends spoofed management frames to force clients to disconnect from a legitimate access point?
- a.War driving
- b.Smurf attack
- c.Bluesnarfing
- d.Deauthentication attack✓
A deauthentication attack forges 802.11 management frames to kick clients off an AP, causing denial of service or pushing them toward an evil twin. Protected Management Frames (802.11w) defend against it. WPA3 mandates management frame protection.
An attacker inserts a forged record into a resolver's cache so users are sent to a malicious IP for a legitimate domain. What is this?
- a.Session hijacking
- b.ARP spoofing
- c.DNS cache poisoning✓
- d.SYN flood
DNS cache poisoning plants false records in a resolver so users of a legitimate domain are redirected to attacker-controlled addresses. DNSSEC, which cryptographically signs records, is the primary defense. It undermines trust in name resolution.
An unauthorized person follows an employee through a badge-controlled door without presenting credentials. Which technique is this?
- a.Dumpster diving
- b.Phishing
- c.Tailgating✓
- d.Shoulder surfing
Tailgating (or piggybacking) is when an unauthorized person slips through a secured door behind an authorized one. Access control vestibules and security awareness reduce it. It is a physical social-engineering technique.
Watching a user type their password over their shoulder to steal it is an example of which technique?
- a.Shoulder surfing✓
- b.Whaling
- c.Pretexting
- d.Vishing
Shoulder surfing is directly observing someone entering credentials or sensitive data. Privacy screens, positioning, and awareness counter it. It requires no technical tools, only proximity.
Which attack sends many TCP SYN packets without completing the handshake, exhausting a server's connection table?
- a.Ping of death
- b.ARP poisoning
- c.SYN flood✓
- d.Cross-site scripting
A SYN flood sends numerous SYN requests but never completes the three-way handshake, filling the server's half-open connection table until it can accept no new sessions. SYN cookies and rate limiting mitigate it. It is a classic denial-of-service technique.
An attacker changes their NIC's hardware address to bypass a MAC-based allow list. What is this technique called?
- a.Port mirroring
- b.DNS tunneling
- c.IP spoofing
- d.MAC spoofing✓
MAC spoofing alters a device's hardware address to impersonate an allowed device and defeat MAC filtering. Because MAC filtering is easily bypassed this way, it is considered weak on its own. Strong authentication such as 802.1X is far more reliable.
Which attack sends small spoofed queries to open DNS or NTP servers so large responses flood a victim?
- a.Tailgating
- b.MAC flooding
- c.Evil twin
- d.Reflection and amplification attack✓
A reflection and amplification attack spoofs the victim's source address in small queries to open servers, which reply with much larger responses aimed at the victim. DNS and NTP are common amplifiers. Disabling open recursion and rate limiting reduce exposure.
Which switch-hardening practice prevents an intruder from simply plugging into an unused wall jack and reaching the network?
- a.Using the default VLAN 1 on all ports
- b.Enabling all ports by default
- c.Administratively shutting down unused ports✓
- d.Broadcasting the SSID everywhere
Disabling or shutting down unused switch ports stops someone from gaining access by plugging into a live but unmonitored jack. Ports can also be placed in an unused, isolated VLAN. This is a basic but effective network-hardening step.
What is the most important first hardening step after installing a new network appliance?
- a.Disable logging to save disk space
- b.Enable Telnet for easy access
- c.Change the default administrative credentials✓
- d.Open all firewall ports temporarily
Default credentials are widely published, so changing the default administrator username and password is the essential first hardening step on any new device. Leaving defaults invites trivial compromise. Disabling insecure services like Telnet should follow.
Which feature uses the DHCP snooping binding table to drop forged ARP replies and stop ARP poisoning?
- a.PortFast
- b.Dynamic ARP Inspection✓
- c.Split tunneling
- d.Band steering
Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP snooping binding table and drops those with spoofed IP-to-MAC mappings. This defeats ARP poisoning and on-path attacks. It depends on DHCP snooping being enabled first.
Which solution checks a device's identity and health, such as patch level and antivirus, before allowing it onto the network?
- a.Network access control (NAC)✓
- b.A load balancer
- c.A syslog server
- d.A content delivery network
Network access control (NAC) enforces posture assessment, checking a device's identity and health before granting access, and can quarantine non-compliant devices. It integrates with 802.1X and can remediate before admission. NAC keeps risky endpoints off the production network.
Which decoy system is deliberately exposed to attract and study attackers away from production assets?
- a.A proxy server
- b.A jump box
- c.A honeypot✓
- d.A screened subnet
A honeypot is a decoy system made attractive to attackers so their activity can be observed and diverted from real assets. It provides early warning and threat intelligence. A network of honeypots is called a honeynet.
Placing IoT devices on their own isolated VLAN so a compromise cannot easily reach servers is an example of what?
- a.Network segmentation✓
- b.Link aggregation
- c.Port mirroring
- d.Load balancing
Network segmentation divides the network into isolated zones so a breach in one, such as vulnerable IoT devices, cannot easily spread to critical systems. It limits lateral movement and shrinks the attack surface. VLANs and firewalls commonly enforce segmentation.
Which physical control uses two interlocking doors so only one person is admitted at a time, preventing tailgating?
- a.Faraday cage
- b.Asset tag
- c.Access control vestibule (mantrap)✓
- d.Bollard
An access control vestibule, formerly called a mantrap, uses two interlocking doors so only one authenticated person passes at a time, blocking tailgating. Bollards stop vehicles, and Faraday cages block electromagnetic signals. The vestibule specifically controls pedestrian entry.
Which physical security measure best prevents unauthorized removal of switches from a wiring closet?
- a.Enabling WPA3 encryption
- b.Disabling SSID broadcast
- c.Locking equipment racks and the closet door✓
- d.Shortening the DHCP lease time
Physically locking racks and the wiring-closet door prevents theft or tampering with network hardware. Logical controls like encryption or DHCP settings do nothing against physical removal. Physical and logical security must work together.
Within IPsec, which protocol provides confidentiality by encrypting the payload rather than only authenticating it?
- a.GRE
- b.ESP (Encapsulating Security Payload)✓
- c.IKE only
- d.AH (Authentication Header)
ESP encrypts the payload to provide confidentiality, and can also offer integrity and authentication. AH provides integrity and authentication but no encryption. IKE negotiates the keys, and GRE is an unencrypted tunneling protocol.