CompTIA Network+ — All Questions

An administrator is terminating a straight-through Ethernet cable using the T568B standard on both ends. Which pin arrangement starts the sequence?

• a.Orange, white-orange, green, white-green
• b.White-green, green, white-orange, blue
• c.White-brown, brown, white-blue, green
• d.White-orange, orange, white-green, blue✓

The T568B wiring order begins with white-orange, orange, white-green, blue on pins one through four. Using the same standard on both ends creates a straight-through cable. Mixing T568A and T568B on opposite ends creates a crossover.

Which technology allows a switch to supply electrical power to devices such as IP phones and access points over the data cable?

• a.STP
• b.PoE✓
• c.NAT
• d.QoS

Power over Ethernet (PoE) delivers electrical power and data over the same twisted-pair cable, powering devices like IP phones, cameras, and access points. This removes the need for separate power adapters. Standards include 802.3af, 802.3at, and 802.3bt.

When implementing inter-VLAN routing on a single router interface, what configuration is required?

• a.Router-on-a-stick using subinterfaces with 802.1Q tagging✓
• b.A separate physical router for each VLAN
• c.Assigning every VLAN the same subnet
• d.Disabling all trunk links to the switch

Router-on-a-stick uses a single physical interface divided into subinterfaces, each tagged for a VLAN with 802.1Q, to route between VLANs. This avoids needing one physical interface per VLAN. A Layer 3 switch is an alternative that uses SVIs.

A wireless network must support the highest client density in a crowded office. Which deployment choice best reduces co-channel interference on 2.4 GHz?

• a.Use overlapping channels 1, 2, and 3
• b.Increase transmit power to maximum on all APs
• c.Use non-overlapping channels 1, 6, and 11✓
• d.Set every access point to channel 6

In the 2.4 GHz band, channels 1, 6, and 11 are the only non-overlapping options, so alternating them between adjacent APs minimizes co-channel and adjacent-channel interference. Maxing transmit power actually worsens interference. Proper channel planning is key to dense deployments.

Which routing protocol is a link-state interior gateway protocol that uses cost based on bandwidth as its metric?

• a.BGP
• b.EIGRP
• c.OSPF✓
• d.RIP

OSPF is a link-state interior gateway protocol that calculates the shortest path using a cost metric derived from link bandwidth. RIP uses hop count and BGP is a path-vector exterior protocol. OSPF converges faster than distance-vector protocols in large networks.

An engineer configures a static route of last resort. Which destination and mask represent the default route?

• a.127.0.0.0/8
• b.255.255.255.255/32
• c.169.254.0.0/16
• d.0.0.0.0/0✓

The default route is written as 0.0.0.0/0, matching any destination not covered by a more specific route. It directs otherwise-unmatched traffic to a next hop, often the internet gateway. This is commonly called the gateway of last resort.

Which protocol prevents Layer 2 switching loops by placing redundant links into a blocking state?

• a.Hot Standby Router Protocol
• b.Network Time Protocol
• c.Spanning Tree Protocol✓
• d.Border Gateway Protocol

Spanning Tree Protocol (STP) detects redundant Layer 2 paths and blocks them to prevent broadcast storms and switching loops. If an active link fails, a blocked link can transition to forwarding. STP is essential in networks with redundant switch links.

A technician needs to connect two buildings 800 meters apart with high bandwidth and immunity to electromagnetic interference. Which medium is best?

• a.Coaxial cable
• b.Single-mode fiber✓
• c.Cat 6 UTP
• d.Cat 5e UTP

Single-mode fiber supports long distances well beyond copper's 100-meter limit and is immune to electromagnetic interference. Twisted-pair copper cannot reach 800 meters. Fiber is the standard choice for building-to-building backbone links.

Which addressing technique allows many internal private hosts to share a single public IP address for internet access?

• a.ARP
• b.PAT✓
• c.DHCP
• d.VLSM

Port Address Translation (PAT), a form of NAT overload, lets multiple private hosts share one public IP by tracking unique source port numbers. This conserves scarce public IPv4 addresses. Each session is distinguished by its translated port.

When configuring a trunk between two switches, which VLAN carries untagged traffic by default?

• a.The management VLAN only
• b.VLAN 4094
• c.The native VLAN✓
• d.The voice VLAN

The native VLAN carries untagged traffic across an 802.1Q trunk. By default it is VLAN 1, but it should be changed and matched on both ends for security. Mismatched native VLANs can cause connectivity and security problems.

Which wireless security standard introduces Simultaneous Authentication of Equals (SAE) to replace the pre-shared key handshake?

• a.WPA
• b.WEP
• c.WPA2
• d.WPA3✓

WPA3 replaces the WPA2 four-way handshake with SAE, providing stronger protection against offline dictionary attacks. WEP and the original WPA are outdated and insecure. WPA3 is the current recommended standard for wireless security.

A network requires automatic failover of the default gateway between two routers. Which category of protocol provides this?

• a.Address resolution protocol
• b.Spanning tree protocol
• c.First hop redundancy protocol✓
• d.Link aggregation protocol

First hop redundancy protocols such as HSRP, VRRP, and GLBP provide a virtual gateway IP shared by multiple routers for automatic failover. If the active router fails, a standby takes over transparently to hosts. This eliminates the gateway as a single point of failure.

Which technology bundles multiple physical links into one logical link to increase bandwidth and provide redundancy between switches?

• a.Spanning tree
• b.VLAN trunking
• c.Link aggregation (LACP)✓
• d.Port mirroring

Link aggregation, often using LACP (802.3ad), combines several physical ports into a single logical link for greater bandwidth and redundancy. If one member link fails, traffic continues over the others. It is commonly used on switch uplinks and server connections.

An administrator assigns 192.168.1.0/24 but needs subnets of varying host sizes. Which technique allows different subnet mask lengths within the same address block?

• a.VLSM✓
• b.APIPA
• c.Classful addressing
• d.CIDR summarization

Variable Length Subnet Masking (VLSM) lets an administrator apply different mask lengths to subnets within the same network, matching each subnet's host requirement. This conserves address space compared with fixed-size subnets. VLSM requires classless routing protocols.

Which DHCP component defines the range of IP addresses a server can lease to clients?

• a.Scope✓
• b.Exclusion
• c.Reservation
• d.Relay

A DHCP scope defines the pool of addresses available for lease on a given subnet. Reservations assign fixed addresses to specific MACs, and exclusions remove addresses from the pool. Relays forward DHCP requests across subnets.

A technician must extend a wired network into an area where running new cable is impractical. Which device bridges two network segments over the existing electrical wiring?

• a.A powerline (Ethernet-over-power) adapter✓
• b.A loopback plug
• c.A KVM switch
• d.A media converter

Powerline adapters, also called Ethernet-over-power, transmit network data over a building's existing electrical wiring to bridge segments. This avoids running new Ethernet cable. Performance varies with wiring quality and distance.

Which SDN plane is responsible for making forwarding decisions and building the network's logical topology?

• a.Data plane
• b.Management plane
• c.Physical plane
• d.Control plane✓

In software-defined networking, the control plane makes forwarding decisions and maintains the logical topology, then programs the data plane. Separating these planes centralizes intelligence in an SDN controller. The data plane simply forwards packets based on control-plane instructions.

An engineer configures a switch port that should immediately transition to forwarding for a single end host. Which STP feature is appropriate?

• a.Root guard
• b.Trunk negotiation
• c.BPDU flooding
• d.PortFast✓

PortFast lets an access port skip the listening and learning states and move directly to forwarding, which is safe for ports connected to a single end device. It should not be enabled on ports connected to other switches. BPDU guard is often paired with it for protection.

Which type of NAT maps one private IP address to one dedicated public IP address permanently?

• a.Overloaded NAT
• b.Static NAT✓
• c.Port Address Translation
• d.Dynamic NAT

Static NAT creates a permanent one-to-one mapping between a private and a public address, often used to expose an internal server. Dynamic NAT pulls from a pool, and PAT overloads a single public IP. Static NAT provides consistent inbound reachability.

Which Layer 3 switch feature provides a virtual interface used to route traffic for a VLAN without a separate router?

• a.A loopback plug
• b.A switched virtual interface (SVI)✓
• c.A native VLAN
• d.A trunk port

A switched virtual interface (SVI) is a virtual Layer 3 interface on a multilayer switch that routes traffic for an associated VLAN. This enables inter-VLAN routing entirely within the switch, avoiding router-on-a-stick. Each routed VLAN typically has its own SVI acting as the default gateway.

RIP considers a route unreachable once its hop count reaches which value?

• a.255
• b.15
• c.16✓
• d.255 milliseconds

RIP treats a hop count of 16 as infinity, meaning the destination is unreachable, so 15 is the maximum number of usable hops. This limit prevents routing loops but also restricts RIP to small networks. Larger networks use OSPF or EIGRP instead.

When a router learns the same destination from two routing protocols, which value determines the preferred source?

• a.MTU size
• b.Hop count
• c.Bandwidth delay product
• d.Administrative distance✓

Administrative distance ranks the trustworthiness of routing sources, so the route from the protocol with the lower administrative distance is installed. For example, OSPF (110) is preferred over RIP (120). Metrics only compare routes within the same protocol.

A router has routes to 10.1.0.0/16 and 10.1.5.0/24 for a packet destined to 10.1.5.10. Which rule decides which route is used?

• a.Longest prefix match✓
• b.Lowest administrative distance
• c.Round-robin load sharing
• d.First route in the table

Routers select the most specific matching route, known as the longest prefix match, so 10.1.5.0/24 wins over 10.1.0.0/16 for that destination. Administrative distance and metrics only break ties among equally specific routes. Longest match always takes precedence first.

Which Cisco-developed routing protocol uses a composite metric and the DUAL algorithm for fast convergence?

• a.OSPF
• b.RIPv2
• c.BGP
• d.EIGRP✓

EIGRP is an advanced distance-vector protocol that uses a composite metric (bandwidth and delay by default) and the DUAL algorithm to precompute backup routes for rapid convergence. OSPF is link-state and BGP is path-vector. EIGRP was historically Cisco-proprietary before being partially opened.

Which routing protocol exchanges reachability between autonomous systems and is the routing protocol of the internet?

• a.BGP✓
• b.EIGRP
• c.OSPF
• d.RIP

Border Gateway Protocol (BGP) is a path-vector protocol that exchanges routing information between autonomous systems and holds the internet's global routing together. OSPF, EIGRP, and RIP are interior gateway protocols used within a single organization. BGP decisions rely on path attributes rather than simple metrics.

Which routing method requires an administrator to manually enter each destination network and next hop, with no automatic reconvergence?

• a.Static routing✓
• b.OSPF routing
• c.Distance-vector routing
• d.Link-state routing

Static routing relies on manually configured entries and does not adapt automatically when a link fails. It is simple and predictable for small or stub networks but does not scale or self-heal. Dynamic protocols like OSPF reconverge automatically after topology changes.

Which category of routing protocol periodically shares its entire routing table with directly connected neighbors and typically uses hop count?

• a.Path-vector
• b.Link-state
• c.Distance-vector✓
• d.Static

Distance-vector protocols like RIP periodically advertise their whole routing table to neighbors and choose paths using simple metrics such as hop count. Link-state protocols instead flood link information and build a full topology map. Distance-vector is simpler but converges more slowly.

A switch port configured to carry traffic for exactly one VLAN to an end device is known as what?

• a.Access port✓
• b.Trunk port
• c.Native port
• d.Mirror port

An access port belongs to a single VLAN and connects to an end device such as a PC or printer, sending untagged frames. A trunk port carries multiple VLANs between switches. Assigning the wrong VLAN to an access port is a common connectivity fault.

Which switch port type carries traffic for multiple VLANs between switches using 802.1Q tagging?

• a.Trunk port✓
• b.Console port
• c.Access port
• d.Loopback port

A trunk port carries frames for many VLANs across a single link, tagging them with 802.1Q so the far end can separate them. Access ports carry only one VLAN. Trunks are essential for extending VLANs between switches and to routers.

How do switches running Spanning Tree Protocol elect the root bridge?

• a.The first switch powered on always wins
• b.The switch with the lowest bridge ID wins✓
• c.The switch with the most ports wins
• d.The switch with the highest IP address wins

STP elects the root bridge as the switch with the lowest bridge ID, which combines a configurable priority value with the MAC address. Lowering a switch's priority makes it the root. The root bridge becomes the reference point for building the loop-free tree.

Which standard improves on classic STP by converging in seconds rather than up to 50 seconds after a topology change?

• a.802.1X
• b.802.1Q
• c.802.3ad
• d.RSTP (802.1w)✓

Rapid Spanning Tree Protocol (RSTP), defined in 802.1w, converges in seconds using proposal and agreement handshakes and new port roles. Classic STP could take up to 50 seconds. RSTP is backward compatible with legacy STP switches.

Which feature lets a single access port carry both a PC's data VLAN and an IP phone's traffic on a separate tagged VLAN?

• a.Management VLAN
• b.Voice VLAN✓
• c.Native VLAN
• d.Private VLAN

A voice VLAN lets a switch port place phone traffic on a dedicated tagged VLAN while the attached PC uses the untagged data VLAN. This separates voice for QoS and security without a second cable. The IP phone typically has a small built-in switch for the PC.

Two hosts are in different VLANs on the same switch and cannot reach each other. What is required to enable their communication?

• a.Placing both ports in the native VLAN
• b.Disabling Spanning Tree Protocol
• c.A Layer 3 device to route between the VLANs✓
• d.A crossover cable between them

VLANs are separate broadcast domains, so traffic between them must be routed by a Layer 3 device such as a router or Layer 3 switch. Simply being on the same physical switch does not allow inter-VLAN communication. A router-on-a-stick or SVI provides this routing.

Which wireless standard is marketed as Wi-Fi 6 and introduces OFDMA to improve efficiency in dense environments?

• a.802.11ax✓
• b.802.11n
• c.802.11ac
• d.802.11g

802.11ax, branded Wi-Fi 6, adds OFDMA and improved MU-MIMO to serve many clients efficiently in congested areas. It operates in both 2.4 and 5 GHz, with Wi-Fi 6E extending into 6 GHz. It boosts real-world throughput in high-density deployments.

Wi-Fi 6E extends Wi-Fi 6 into which additional, less congested frequency band?

• a.2.4 GHz
• b.6 GHz✓
• c.60 GHz
• d.900 MHz

Wi-Fi 6E adds the 6 GHz band, providing many new non-overlapping channels free of legacy device congestion. This reduces interference and supports wide channels for high throughput. Only 6E-capable clients can use the 6 GHz spectrum.

Which wireless standard, branded Wi-Fi 4, first introduced MIMO and can operate in both the 2.4 GHz and 5 GHz bands?

• a.802.11ac
• b.802.11a
• c.802.11n✓
• d.802.11b

802.11n, marketed as Wi-Fi 4, introduced MIMO with multiple antennas and channel bonding, and it works in both 2.4 and 5 GHz. 802.11ac (Wi-Fi 5) operates only in 5 GHz. The dual-band flexibility of 802.11n made it widely adopted.

In an enterprise wireless deployment, which device centrally manages configuration, RF, and roaming for many lightweight access points?

• a.A wireless LAN controller✓
• b.A router-on-a-stick
• c.A layer 2 switch
• d.A DHCP server

A wireless LAN controller (WLC) centrally manages lightweight access points, handling configuration, channel and power tuning, and seamless roaming. This scales far better than configuring each autonomous AP individually. The controller also enforces consistent security policy across all APs.

Which antenna type focuses radio energy in one direction to extend range on a point-to-point link between two buildings?

• a.Isotropic antenna
• b.Omnidirectional dipole
• c.Rubber duck antenna
• d.Directional (Yagi) antenna✓

A directional antenna such as a Yagi concentrates energy into a narrow beam, increasing range and gain along one axis for point-to-point links. Omnidirectional antennas radiate in all horizontal directions for general coverage. Directional antennas require careful aiming between the two endpoints.

Which technique combines adjacent channels into a wider channel, such as 40 or 80 MHz, to increase wireless throughput?

• a.Frequency hopping
• b.Band steering
• c.Channel bonding✓
• d.MAC filtering

Channel bonding merges adjacent channels into a wider one to carry more data, boosting throughput. It works best in the 5 GHz and 6 GHz bands where spectrum is plentiful. In the crowded 2.4 GHz band, wide channels cause interference and are discouraged.

Which access point feature encourages dual-band capable clients to connect on 5 GHz instead of the more crowded 2.4 GHz band?

• a.Power over Ethernet
• b.Band steering✓
• c.Beamforming
• d.Roaming

Band steering nudges capable clients onto the less congested 5 GHz band to improve performance and free up 2.4 GHz for legacy devices. It works by influencing how the AP responds to client probes. This balances load across bands automatically.

Wireless clients that all connect through a central access point rather than directly to each other are operating in which mode?

• a.Infrastructure mode✓
• b.Monitor mode
• c.Mesh backhaul mode
• d.Ad hoc mode

In infrastructure mode, clients associate with a central access point that coordinates all communication, which is the standard enterprise and home setup. Ad hoc mode connects devices peer-to-peer without an AP. Infrastructure mode scales and secures far better than ad hoc.

Which device sits between clients and the internet, forwarding requests on their behalf and often caching content and filtering URLs?

• a.A media converter
• b.A proxy server✓
• c.A DHCP relay
• d.A layer 2 switch

A proxy server forwards client requests to the internet, can cache frequently requested content, and can filter or log web activity. It centralizes control over outbound traffic. Forward proxies serve internal clients, while reverse proxies front internal servers.

Which device distributes incoming client requests across a pool of backend servers to improve capacity and availability?

• a.Hub
• b.Patch panel
• c.Repeater
• d.Load balancer✓

A load balancer spreads incoming requests across multiple backend servers using algorithms like round robin or least connections, improving scalability and resilience. If one server fails, traffic shifts to the others. It also enables maintenance without downtime.

Which device connects a copper Ethernet segment to a fiber segment by converting between electrical and optical signaling?

• a.KVM switch
• b.Punchdown block
• c.Media converter✓
• d.Loopback plug

A media converter translates between copper and fiber media, extending a link across the boundary between the two. It operates at the physical layer, converting electrical signals to light and back. It is common where fiber is needed to reach beyond copper's distance limit.

Which firewall type tracks the state of active connections and permits return traffic only for sessions it has already seen?

• a.Packet-filtering (stateless) firewall
• b.Proxy-only gateway
• c.Layer 2 transparent bridge
• d.Stateful firewall✓

A stateful firewall maintains a connection table and allows return traffic only for sessions it recognizes as established, providing stronger control than stateless filtering. Stateless firewalls evaluate each packet in isolation against static rules. Statefulness is standard in modern firewalls.

In IPv6, which protocol replaces ARP for discovering the link-layer address of a neighbor?

• a.DHCPv6
• b.ARP for IPv6
• c.Neighbor Discovery Protocol (NDP)✓
• d.ICMPv4

IPv6 uses the Neighbor Discovery Protocol (NDP), part of ICMPv6, to resolve link-layer addresses and discover routers, replacing IPv4's ARP. NDP uses neighbor solicitation and advertisement messages. There is no ARP in IPv6.

Which service assigns IPv6 addresses and options centrally, tracking which client received which address?

• a.Stateful DHCPv6✓
• b.SLAAC
• c.APIPA
• d.NAT64

Stateful DHCPv6 centrally assigns IPv6 addresses and configuration and keeps a record of leases, similar to IPv4 DHCP. SLAAC, by contrast, is stateless and lets hosts self-configure. Stateful DHCPv6 is chosen when central tracking and control are required.

Which IPv6 message does a router periodically send so that hosts learn the on-link prefix and default gateway?

• a.Echo request
• b.Neighbor solicitation
• c.Router advertisement✓
• d.DHCP offer

Routers send Router Advertisement (RA) messages announcing the prefix, default gateway, and configuration flags that hosts use for SLAAC. Hosts can also solicit these with a Router Solicitation. RAs are central to IPv6 autoconfiguration.

Which technology allows IPv6-only clients to reach IPv4-only servers by translating between the two address families?

• a.SLAAC
• b.Dual stack
• c.EUI-64
• d.NAT64✓

NAT64 translates between IPv6 and IPv4 so IPv6-only clients can communicate with IPv4-only resources, usually paired with DNS64. Dual stack instead runs both protocols natively. NAT64 is useful during transition when full dual stack is not possible.

When manually assigning a static IPv4 configuration to a server, which set of parameters is minimally required for it to reach remote networks?

• a.VLAN ID and switch port number
• b.IP address and MAC address only
• c.IP address, subnet mask, and default gateway✓
• d.Hostname and DNS suffix only

To reach remote networks a host needs an IP address, a subnet mask to define its local network, and a default gateway to forward off-subnet traffic. A DNS server is also needed to resolve names but not for basic IP reachability. Without a gateway, the host can only talk locally.

Which PoE standard delivers the most power, up to about 90 W at the source, for devices like PTZ cameras and displays?

• a.802.3u Fast Ethernet
• b.802.3bt (PoE++)✓
• c.802.3af (PoE)
• d.802.3at (PoE+)

802.3bt, known as PoE++, supplies up to roughly 90 W at the source across all four pairs, powering high-draw devices. 802.3af provides about 15 W and 802.3at about 30 W. 802.3u is a Fast Ethernet standard, unrelated to power delivery.

Which switch configuration forces a port to operate as a trunk regardless of the neighbor's negotiation settings?

• a.switchport nonegotiate off
• b.switchport mode trunk✓
• c.no switchport
• d.switchport mode access

The command switchport mode trunk statically sets the port to trunk, carrying tagged VLAN traffic without relying on dynamic negotiation. switchport mode access fixes it as an access port. Hard-setting trunk mode avoids issues from mismatched auto-negotiation.

Enabling jumbo frames on a storage network changes which interface setting to roughly 9000 bytes?

• a.The VLAN ID
• b.The maximum transmission unit (MTU)✓
• c.The spanning-tree cost
• d.The administrative distance

Jumbo frames raise the interface MTU to about 9000 bytes so large payloads move with less per-packet overhead, benefiting iSCSI and backup traffic. Every device in the path must support the same larger MTU. A mismatch causes fragmentation or dropped frames.

Disabling SSID broadcast on an access point has which practical effect?

• a.It hides the network name from casual scans but not from determined attackers✓
• b.It encrypts all wireless traffic automatically
• c.It doubles the available bandwidth
• d.It prevents all deauthentication attacks

Hiding the SSID stops the name from appearing in ordinary device scans but does not provide real security, since the SSID still travels in other frames and tools can reveal it. It offers no encryption and does not stop skilled attackers. Strong encryption like WPA3 is the actual protection.

Which feature presents a web page requiring acceptance of terms or login before granting guests wireless internet access?

• a.MAC randomization
• b.Band steering
• c.WPA3-Enterprise
• d.Captive portal✓

A captive portal intercepts a new client's web traffic and forces it to a page for authentication or acceptance of terms before allowing access. It is common on guest and public Wi-Fi. It controls access without distributing a shared passphrase.

For seamless roaming as a user walks between two access points, how should the APs be configured?

• a.Hidden SSIDs with static client IPs
• b.Different SSIDs and the same channel
• c.The same SSID on non-overlapping channels✓
• d.The same SSID and the same channel

Seamless roaming needs the same SSID across APs so clients see one network, with each AP on a non-overlapping channel to avoid co-channel interference. Matching channels would cause interference in overlapping coverage. Consistent security settings are also required for smooth handoff.

In a router's table, which route source has the most trustworthy administrative distance of 0?

• a.Static routes
• b.RIP-learned routes
• c.Directly connected interfaces✓
• d.OSPF-learned routes

Directly connected networks have an administrative distance of 0, the most trusted, because the router has a live interface on that network. Static routes default to 1, OSPF to 110, and RIP to 120. Lower administrative distance always wins when routes overlap.

When configuring router-on-a-stick, what must be applied to each subinterface for it to service a specific VLAN?

• a.An 802.1Q encapsulation tag matching the VLAN ID✓
• b.A separate physical NIC per VLAN
• c.An access-list that permits any
• d.A crossover cable to the switch

Each router subinterface must be configured with 802.1Q encapsulation for the specific VLAN ID so it can send and receive tagged frames on the trunk. The switch port to the router is configured as a trunk. This lets one physical link route among many VLANs.

Which device combines high-speed hardware switching with the ability to route between VLANs using ASICs?

• a.A media converter
• b.A wireless controller
• c.A Layer 3 (multilayer) switch✓
• d.An unmanaged hub

A Layer 3 or multilayer switch performs both switching and routing in hardware, routing between VLANs at wire speed via switched virtual interfaces. This outperforms router-on-a-stick for high inter-VLAN traffic. It is the standard core and distribution device in campus networks.

Which feature shuts down a PortFast-enabled access port if it unexpectedly receives a BPDU, protecting the spanning-tree topology?

• a.Storm control
• b.BPDU guard✓
• c.Root guard
• d.DHCP snooping

BPDU guard disables a PortFast access port the moment it receives a BPDU, since that indicates an unauthorized switch was connected. This protects the topology from accidental loops or rogue switches. It is commonly paired with PortFast on edge ports.

Which open-standard first-hop redundancy protocol lets multiple routers share a virtual IP so hosts keep a single default gateway?

• a.OSPF
• b.STP
• c.VRRP✓
• d.LACP

Virtual Router Redundancy Protocol (VRRP) is an open standard that lets multiple routers present one virtual gateway IP, with a backup taking over if the master fails. HSRP is a Cisco equivalent. This removes the default gateway as a single point of failure.

Before deploying wireless in a warehouse, which activity maps signal strength and identifies interference and coverage gaps?

• a.A port scan
• b.A cable certification test
• c.A packet capture
• d.A wireless site survey✓

A wireless site survey measures signal strength, interference, and coverage across the space, guiding AP placement, channel plans, and power levels. It produces heat maps that reveal dead zones before deployment. Skipping it often leads to coverage and roaming problems.

An administrator wants the DHCP scope to skip .1 through .10 because those are statically assigned to servers. Which setting accomplishes this?

• a.A reservation
• b.An exclusion range✓
• c.A shorter lease time
• d.A relay agent

An exclusion range removes specific addresses from the DHCP pool so they are never leased, protecting statically assigned server addresses. A reservation, by contrast, hands a fixed address to a particular device via DHCP. Exclusions prevent address conflicts with manual assignments.

How does a switch build its MAC address table?

• a.By recording the source MAC and ingress port of frames it receives✓
• b.By copying the routing table from the gateway
• c.By querying DNS for each destination host
• d.By broadcasting ARP on every port at boot

A switch learns by examining the source MAC address of incoming frames and associating it with the port they arrived on. It then forwards frames only to the known port for a destination, flooding only when the destination is unknown. Entries age out after a period of inactivity.

In the static route 'ip route 192.168.50.0 255.255.255.0 10.0.0.2', what does 10.0.0.2 represent?

• a.The subnet mask
• b.The administrative distance
• c.The next-hop address✓
• d.The destination network

In that command, 192.168.50.0 is the destination network, 255.255.255.0 is its mask, and 10.0.0.2 is the next-hop IP to which matching traffic is forwarded. The router sends packets for that network toward 10.0.0.2. An optional trailing number would set the administrative distance.

In OSPF, which area must all other areas connect to, acting as the backbone?

• a.The not-so-stubby area
• b.Area 1
• c.The stub area
• d.Area 0✓

OSPF designates Area 0 as the backbone, and all other areas must connect to it, directly or via virtual links, so inter-area routing passes through the backbone. This hierarchy keeps the topology scalable and loop-free. Stub and NSSA areas are special non-backbone area types.

A 370 W PoE switch cannot power the 30th camera even though ports are free. What has most likely been exceeded?

• a.The DHCP scope
• b.The MAC address table size
• c.The spanning-tree diameter
• d.The switch's total PoE power budget✓

Each PoE switch has a finite power budget shared across all ports, and adding devices can exhaust it even when physical ports remain. The switch then stops powering additional devices. The fix is a higher-wattage power supply or a switch with a larger PoE budget.

Traffic for VLAN 40 is not crossing a trunk, though VLAN 40 exists on both switches. Which trunk setting should be checked first?

• a.The port speed and duplex
• b.The list of VLANs allowed on the trunk✓
• c.The PoE class of the port
• d.The DNS server address

Trunks can be configured to allow only specific VLANs, so VLAN 40 may simply be missing from the allowed list on the trunk. Verifying and adding it to the allowed VLANs restores the traffic. Native VLAN mismatches are another common trunking issue to check.

Which wireless security mode authenticates each user against a central RADIUS server rather than a shared passphrase?

• a.WPA3-Personal
• b.WEP
• c.WPA3-Enterprise✓
• d.Open with MAC filtering

WPA3-Enterprise uses 802.1X with a RADIUS server so each user authenticates with unique credentials rather than one shared key. This enables per-user access control and easy revocation. Personal modes rely on a single pre-shared key for everyone.

Which is the correctly compressed form of 2001:0db8:0000:0000:0000:0000:0000:0001?

• a.2001:db8::1✓
• b.2001:db8:0:1
• c.2001:0db8::0001::
• d.2001:db8:::1

Leading zeros in each group are dropped and one run of all-zero groups is replaced by a single double colon, giving 2001:db8::1. The double colon may appear only once in an address. Two double colons or an incomplete result would be invalid.