CompTIA Network+ — All Questions

Which protocol allows network devices to be monitored and managed by collecting metrics such as interface counters and CPU usage?

• a.TFTP
• b.NTP
• c.SNMP✓
• d.SMTP

SNMP (Simple Network Management Protocol) polls and collects metrics like interface statistics and CPU usage from managed devices. SNMPv3 adds authentication and encryption over earlier versions. It is a foundational tool for network monitoring systems.

An organization wants a centralized record of events from all network devices for correlation and alerting. Which system aggregates these logs?

• a.RADIUS server
• b.DHCP server
• c.DNS resolver
• d.Syslog server✓

A syslog server centralizes log messages from many devices, enabling correlation, retention, and alerting. Consistent timestamps from NTP make correlation reliable. SIEM platforms often ingest syslog data for security analysis.

Why is accurate time synchronization across network devices important for operations?

• a.It replaces the need for DNS resolution
• b.It increases available interface bandwidth
• c.It eliminates the need for routing protocols
• d.It ensures log timestamps align for accurate event correlation✓

Accurate time via NTP ensures that log entries from different devices share a consistent timeline, which is critical for correlating events during troubleshooting or security investigations. Without synchronized clocks, reconstructing an incident becomes difficult. NTP typically uses UDP port 123.

Which metric describes the variation in packet delay that can degrade real-time voice and video quality?

• a.Jitter✓
• b.Attenuation
• c.Bandwidth
• d.Throughput

Jitter is the variation in delay between received packets and is especially harmful to real-time applications like VoIP and video. Buffers can absorb small amounts of jitter, but excessive jitter causes choppy audio. QoS policies help minimize it.

An administrator wants to prioritize voice traffic over bulk file transfers on a congested link. Which mechanism should be configured?

• a.Port mirroring
• b.Quality of Service (QoS)✓
• c.Jumbo frames
• d.Spanning tree

Quality of Service (QoS) classifies and prioritizes traffic so latency-sensitive flows like voice receive preferential treatment during congestion. Marking and queuing ensure critical traffic is served first. Without QoS, all traffic competes equally.

Which document records the physical and logical layout of network cabling, ports, and connections for reference during maintenance?

• a.Network topology diagram✓
• b.Incident response plan
• c.Acceptable use policy
• d.Service level agreement

A network topology diagram documents devices, cabling, and connections, serving as a reference during maintenance and troubleshooting. Keeping it current speeds fault isolation. Physical and logical diagrams may be maintained separately.

What is the primary purpose of establishing a performance baseline for a network?

• a.To replace the need for monitoring tools
• b.To permanently cap the maximum throughput of links
• c.To assign static IP addresses to servers
• d.To define normal behavior so anomalies can be detected✓

A baseline captures normal metrics such as utilization, latency, and error rates so that deviations signaling problems can be identified. Comparing current data against the baseline speeds anomaly detection. Baselines should be updated as the network evolves.

Which agreement defines the guaranteed uptime and response times a service provider commits to deliver?

• a.MOU
• b.SLA✓
• c.AUP
• d.NDA

A Service Level Agreement (SLA) specifies measurable commitments such as guaranteed uptime and response times between a provider and customer. Failing to meet an SLA may trigger penalties or credits. SLAs guide operational priorities and escalation.

An operations team uses a port on a switch to capture all traffic passing through other ports for analysis. What is this feature called?

• a.Trunking
• b.Port mirroring (SPAN)✓
• c.Link aggregation
• d.Port security

Port mirroring, also called SPAN, copies traffic from one or more ports to a monitoring port where a packet analyzer or IDS can inspect it. This provides visibility without inline placement. It is a common tool for troubleshooting and security monitoring.

Which change management step should occur before implementing a major network change?

• a.Disable all monitoring during the change
• b.Obtain approval and prepare a rollback plan✓
• c.Skip documentation to save time
• d.Immediately push the change during peak hours

Sound change management requires securing approval and preparing a rollback plan so the change can be reversed if problems arise. Documentation and scheduling during maintenance windows reduce risk. Skipping these steps increases the chance of prolonged outages.

Which type of backup site is fully equipped and running, allowing near-immediate failover during a disaster?

• a.Warm site
• b.Cold site
• c.Mirror archive
• d.Hot site✓

A hot site is fully operational with hardware, data, and connectivity ready for near-immediate failover, minimizing downtime. Cold sites provide only space and power, and warm sites fall in between. Hot sites cost the most to maintain.

In monitoring terminology, what does SNMP use to send an unsolicited alert from a device to the management station?

• a.Get
• b.Trap✓
• c.Walk
• d.Poll

An SNMP trap is an unsolicited notification a device sends to the management station when an event occurs, such as an interface going down. This is more efficient than waiting for the next poll. Traps enable near-real-time alerting.

Which metric expresses the actual rate of successful data delivery over a link, as opposed to its rated capacity?

• a.Latency
• b.Throughput✓
• c.Frequency
• d.Bandwidth

Throughput is the measured rate of successful data delivery, which is often lower than the link's rated bandwidth due to overhead, congestion, or errors. Bandwidth is the theoretical maximum capacity. Comparing the two reveals efficiency losses.

Which document should users acknowledge to define appropriate use of network resources and prohibited activities?

• a.Bill of materials
• b.Wiring schematic
• c.Acceptable Use Policy✓
• d.Change request form

An Acceptable Use Policy (AUP) defines what users may and may not do with organizational network resources. It sets expectations and provides a basis for enforcement. Users typically sign it during onboarding.

A network is configured so that DHCP requests from a remote subnet are forwarded to a central DHCP server. Which feature enables this?

• a.Proxy ARP
• b.DNS forwarding
• c.Port forwarding
• d.DHCP relay (IP helper)✓

A DHCP relay, configured with an IP helper address, forwards broadcast DHCP requests from a client subnet to a DHCP server on another subnet. This allows one central server to serve many subnets. Without it, DHCP broadcasts would not cross the router.

Which recovery metric defines the maximum acceptable amount of data loss measured in time?

• a.MTBF
• b.MTTR
• c.RTO
• d.RPO✓

The Recovery Point Objective (RPO) defines how much data, measured in time, an organization can afford to lose, guiding backup frequency. RTO addresses how quickly systems must be restored. Together they shape disaster recovery planning.

An administrator wants to standardize device configurations and deploy them at scale automatically. Which approach best supports this?

• a.Disabling all remote management
• b.Relying only on factory defaults
• c.Configuration management and automation tools✓
• d.Manually typing commands on each device

Configuration management and automation tools apply standardized, version-controlled configurations across many devices consistently and quickly. This reduces human error and configuration drift. Automation is increasingly central to modern network operations.

Which protocol synchronizes clocks across network devices to a reliable time source?

• a.LDAP
• b.SNMP
• c.NTP✓
• d.SMTP

Network Time Protocol (NTP) synchronizes device clocks to authoritative time sources, keeping logs and certificates consistent. It uses a stratum hierarchy to indicate proximity to the reference clock. Accurate time underpins logging and security functions.

Which cloud connectivity model provides a dedicated private circuit between an organization and its cloud provider instead of traversing the public internet?

• a.A direct/private cloud interconnect✓
• b.A remote-access SSL VPN
• c.A public API gateway
• d.A site-to-site VPN over the internet

A direct or private cloud interconnect provides a dedicated circuit between the organization and the cloud provider, offering predictable performance and better security than the public internet. It avoids exposure to internet congestion and threats. Providers market these as direct-connect or express-route style services.

A monitoring team must poll router statistics across a segment where credentials could be captured, so they need both authentication and encryption for the management traffic. Which SNMP version should they deploy?

• a.SNMPv2c
• b.SNMPv3✓
• c.SNMPv1
• d.the community-string model used by the earlier SNMP versions

SNMPv3 adds authentication and encryption (authPriv), unlike v1 and v2c which rely on clear-text community strings. It is the only version that protects management data in transit. Choose v3 whenever confidentiality or integrity of monitoring matters.

Within SNMP, which component is the hierarchical database that defines the managed objects a device exposes, each identified by a numeric object identifier?

• a.The MIB✓
• b.An unsolicited SNMP trap
• c.The read-only community string configured on the agent
• d.A single OID value

The MIB (Management Information Base) is the structured catalog of managed objects, each addressed by an OID. Agents return MIB values when the manager polls them. Understanding the MIB/OID relationship is key to building useful monitoring.

On a syslog server, an engineer wants to alert only on the most critical device messages. Which numeric severity level represents the highest urgency?

• a.0 (emergency)✓
• b.5 (notice)
• c.the highest number in the range, because a larger value signals more urgency
• d.7 (debugging)

Syslog severities run 0 to 7, where 0 (emergency) is the most severe and 7 (debugging) the least. Lower numbers mean higher urgency, which is counterintuitive at first. Filtering on 0-2 captures messages that usually demand immediate attention.

A capacity-planning report needs a summary of which hosts and applications consume the most bandwidth, grouped by conversation rather than by full packet contents. Which data source best provides this?

• a.Flow data such as NetFlow✓
• b.Basic SNMP interface polling
• c.A packet sniffer capturing every full frame on the link
• d.Syslog messages from the router

Flow technologies like NetFlow, sFlow, and IPFIX summarize traffic into conversation records (source, destination, ports, bytes). This gives top-talker and application visibility without storing full packets. It is lighter than a capture yet richer than raw interface counters.

A team finds some SNMP notifications are lost in transit and wants the manager to acknowledge receipt so the agent can retransmit if needed. Which notification type provides this confirmation?

• a.An SNMP GET request
• b.An SNMP trap
• c.A one-way syslog message delivered over UDP without acknowledgment
• d.An SNMP inform✓

An SNMP inform is an acknowledged notification; the manager confirms receipt so the agent can resend if the message is lost. A trap is fire-and-forget with no acknowledgment. Informs trade extra overhead for reliability.

Security operations wants logs from firewalls, servers, and switches gathered in one place, normalized, and correlated to surface multi-device attack patterns. Which platform is designed for this?

• a.A SIEM✓
• b.A DHCP server
• c.An NTP time source
• d.A TFTP server used for config backups

A SIEM (Security Information and Event Management) aggregates and correlates logs from many sources to detect patterns a single device would miss. It adds alerting, retention, and search on top of raw syslog. Synchronized time via NTP makes its correlation trustworthy.

To decide when interface utilization is abnormal, an operations team compares live metrics against previously recorded normal values. What are they comparing against?

• a.The current routing table
• b.The maximum rated link speed
• c.The switch's original factory-default configuration settings
• d.A performance baseline✓

A performance baseline records normal utilization, latency, and error rates so deviations can trigger alerts. Thresholds are usually set relative to the baseline rather than to a device's rated maximum. Baselines must be refreshed as the network grows.

Which per-port data does a monitoring system read to calculate link utilization, error rates, and discards on a switch?

• a.The ARP cache
• b.The spanning-tree topology table maintained by the switch
• c.Interface counters✓
• d.DNS query logs

Interface counters track bytes, packets, errors, and discards per port, and tools poll them (often via SNMP) to compute utilization. Rising error or discard counters flag physical or congestion problems. They are the foundation of throughput dashboards.

A data-center team wants automated alerts if a wiring closet gets too hot or humid before equipment is damaged. Which monitoring input provides this?

• a.A NetFlow exporter
• b.A syslog facility code
• c.Environmental sensors✓
• d.An SNMP trap threshold set on router CPU load

Environmental sensors report temperature, humidity, water, and airflow, feeding alerts that prevent heat- or moisture-related failures. They are often integrated into the same NMS that tracks network metrics. Early warning here avoids costly hardware damage.

A modern platform needs sub-second, push-based metrics from devices instead of waiting for the next polling interval. Which approach delivers this?

• a.Manual CLI checks by an on-call engineer
• b.SNMP polling on a fixed five-minute interval
• c.Periodic ICMP pings
• d.Streaming telemetry✓

Streaming telemetry has devices continuously push metrics to a collector, giving near-real-time granularity that periodic SNMP polling cannot match. It scales better for large, fast-changing environments. Polling still suits simpler or legacy gear.

An operations lead wants to monitor network devices without installing extra software on each one, relying on protocols already built into the gear. Which monitoring model fits?

• a.Agentless polling✓
• b.Mirroring all ports to a dedicated packet sniffer
• c.Installing a proprietary monitoring agent on every managed device
• d.Exporting device logs by hand each week

Agentless monitoring uses protocols already on the device, such as SNMP, ICMP, or SSH, avoiding software installs. It is quick to deploy across mixed hardware. Agent-based monitoring can offer deeper data but adds installation and upkeep.

To diagnose a subtle application handshake failure, an analyst needs the actual bytes of each packet, not just summary statistics. Which tool output is required?

• a.A NetFlow conversation record
• b.An interface utilization graph
• c.A full packet capture✓
• d.An SNMP walk of the device MIB

A full packet capture (via Wireshark, tcpdump, or a SPAN port) records complete frame contents for deep protocol analysis. Flow and SNMP data only summarize traffic and cannot show payload detail. Captures are powerful but storage-intensive, so they are used selectively.

Auditors ask how long the organization keeps device and security logs before they are purged. Which document defines this?

• a.A log retention policy✓
• b.A memorandum of understanding between two parties
• c.An acceptable use policy
• d.The spanning-tree configuration

A log retention policy specifies how long logs are stored and when they are deleted, balancing investigative and compliance needs against storage cost. It often reflects regulatory requirements. Consistent retention ensures evidence exists when incidents surface late.

In SNMPv2c, which credential lets a manager poll device values but not change the configuration?

• a.A trap receiver address
• b.A read-write credential that also permits pushing configuration changes
• c.An OID
• d.A read-only community string✓

A read-only community string permits GET operations but denies SET, so monitoring cannot alter the device. Because v2c community strings are clear-text, SNMPv3 is preferred where security matters. Read-write strings are far more sensitive and should be tightly controlled.

Management wants an at-a-glance visual view of uptime, utilization, and open alert counts across key links. Which operations artifact provides this?

• a.A one-time ARP table export
• b.A single syslog severity filter
• c.A paper change-request form
• d.A monitoring dashboard✓

A monitoring dashboard visualizes KPIs like uptime, utilization, latency, and open alerts for quick situational awareness. It aggregates data from SNMP, flow, and log sources. Well-designed dashboards speed detection and reporting.

A technician needs to know exactly which patch-panel port and cable run connect a specific wall jack to the switch. Which document shows this?

• a.A logical diagram showing subnets and VLANs
• b.A rack power-load schedule
• c.A physical network diagram✓
• d.An IP address allocation plan

A physical network diagram maps actual cabling, ports, panels, and device locations. A logical diagram instead shows IP subnets, VLANs, and routing relationships. The two are maintained together because each answers different questions.

As subnets multiply, a team wants a single authoritative record of which IP addresses are assigned, reserved, or free. Which tool manages this?

• a.A change advisory board that reviews proposed changes
• b.An IPAM system✓
• c.A syslog server
• d.A rack elevation diagram

IPAM (IP Address Management) tracks address allocation, reservations, and availability, often integrating DNS and DHCP. It prevents conflicts and address exhaustion. Spreadsheets do not scale to large or dynamic networks.

Before installing a new 2U server, an engineer checks a drawing that shows which rack units are occupied and where free space and power exist. What is this document?

• a.A logical topology map of the whole campus
• b.An IP address plan
• c.A rack diagram✓
• d.A cable test report

A rack diagram (rack elevation) depicts the front and rear layout of equipment by rack unit, aiding installation and airflow planning. It shows occupancy, weight, and power distribution. Keeping it current prevents installation surprises.

To speed future troubleshooting, a cabling contractor marks each cable end and patch-panel port with a consistent identifier. Which documentation practice is this?

• a.Publishing a service level agreement
• b.Cable and port labeling✓
• c.Drawing a full mesh topology
• d.Maintaining a spanning-tree convergence diagram

Standardized cable and port labeling lets technicians trace connections quickly and reduces errors during moves and changes. Labels should follow a documented naming convention. Good labeling pays off most during outages.

An organization stores a known-good, standard device configuration that all similar switches should match. What is this reference called?

• a.A memorandum of understanding
• b.A configuration baseline✓
• c.A disaster recovery plan
• d.An after-action incident report

A configuration baseline is the documented standard build that devices should conform to, making drift easy to spot. Comparing a running config against it reveals unauthorized changes. It also speeds provisioning of replacement hardware.

Finance and security both need an authoritative list of every network device, its model, serial number, and warranty status. Which record provides this?

• a.An asset inventory✓
• b.A logical topology diagram
• c.A quality-of-service marking policy
• d.The firewall rule set

An asset inventory catalogs hardware and software with details like model, serial, location, and lifecycle status. It supports warranty, licensing, and end-of-life planning. Accurate inventory underpins both security and budgeting.

After a Wi-Fi deployment, an engineer documents measured signal strength across the floor as a color-coded coverage map. What is this artifact?

• a.A site survey heat map✓
• b.A rack elevation showing every device mounted in the cabinet
• c.An SLA compliance report
• d.A logical VLAN diagram

A wireless site survey heat map visualizes signal strength and coverage, revealing dead zones and overlap. It guides AP placement and channel planning. Surveys are done before deployment (predictive) and after (validation).

In a multi-floor building, cabling from each floor's wiring closet runs back to a central equipment room. What is the per-floor closet called?

• a.The default gateway for the floor
• b.An IDF✓
• c.The native VLAN on the trunk
• d.A separate broadcast domain

An IDF (intermediate distribution frame) is a floor or zone wiring closet that connects back to the MDF (main distribution frame). Documenting IDF/MDF locations and links is essential for structured cabling. This hierarchy keeps runs within distance limits.

After a project is complete, a team updates the diagrams to reflect exactly how the network was actually built, including last-minute field changes. What is this documentation called?

• a.As-built documentation✓
• b.A predictive site survey
• c.A request-for-change ticket
• d.The original pre-construction design proposal

As-built documentation records the real, final state of an installation, including deviations from the original design. It is more accurate than the planning drawings because it captures field changes. Keeping it current prevents surprises during later work.

A regulator requires proof that network controls are periodically checked against policy and standards by an independent review. Which activity satisfies this?

• a.A network audit✓
• b.A firmware upgrade
• c.A change freeze
• d.A predictive wireless coverage survey

A network audit is an independent review that verifies configurations, access, and controls against policy and standards. It produces findings and remediation items. Regular audits demonstrate compliance and surface drift or gaps.

A new technician needs a documented, repeatable set of steps for safely rebooting a core switch during a maintenance window. Which document provides this?

• a.A vendor master service agreement
• b.An acceptable use policy
• c.A standard operating procedure✓
• d.A network topology diagram

A standard operating procedure (SOP) documents the exact, repeatable steps for a routine task, reducing errors and inconsistency. It captures institutional knowledge so any qualified staff member can perform the work. SOPs support both safety and compliance.

An operations team keeps a record of each vendor, the equipment covered, support entitlements, and renewal dates so contracts do not lapse. Which document is this?

• a.A spanning-tree diagram
• b.A vendor support contract record✓
• c.A one-time packet capture from the core switch
• d.A wireless heat map

A vendor support contract record tracks coverage levels, entitlements, and renewal dates so critical support does not lapse unnoticed. It links assets to their applicable service agreements. This avoids scrambling for support during an outage on out-of-contract gear.

Two routers should share a single virtual gateway IP so that if the active router fails, the standby takes over transparently to hosts. Which category of protocol provides this?

• a.The Address Resolution Protocol used for local delivery
• b.A first hop redundancy protocol✓
• c.Spanning Tree Protocol
• d.Network Time Protocol

A first hop redundancy protocol such as VRRP or HSRP presents one virtual gateway IP backed by multiple routers, enabling automatic failover. Hosts keep the same gateway address regardless of which router is active. This removes the gateway as a single point of failure.

A design distributes live traffic across two data centers simultaneously so both handle load and either can absorb the other's share. Which model is this?

• a.Active-active✓
• b.A single node with no redundancy
• c.Cold standby only
• d.Active-passive with an idle standby node held in reserve

An active-active design runs both nodes or sites simultaneously, sharing load and providing redundancy. If one fails, the other absorbs its traffic, though capacity planning must allow for it. Active-passive instead keeps a standby idle until needed.

A load balancer must send each new client connection to the next server in a repeating list, distributing sessions evenly. Which distribution method is this?

• a.Least connections
• b.Weighted response time
• c.Source-IP hashing that pins a client to one server
• d.Round robin✓

Round robin sends each successive request to the next server in rotation, distributing connections evenly without regard to load. Least-connections and weighted methods account for server capacity or current load. The right method depends on how uniform the servers and sessions are.

A server should keep network connectivity even if one of its two network cards or switch uplinks fails. Which server-side technique provides this?

• a.Static ARP entries
• b.Enabling jumbo frames on the interface
• c.Port mirroring
• d.NIC teaming✓

NIC teaming (bonding) groups multiple physical adapters so the server tolerates a NIC, cable, or switch-port failure, and can add throughput. Modes include active-backup and load-balancing. It protects the host's connection independently of the network core.

A core switch should keep running if a single power source fails, without any interruption. Which hardware feature provides this?

• a.A larger cooling fan
• b.A single higher-wattage power supply
• c.Power over Ethernet on the uplink
• d.Redundant power supplies✓

Dual (redundant) power supplies let a device keep running if one supply or feed fails, ideally each on a separate circuit. This removes the power supply as a single point of failure. Pairing them with independent PDUs and UPS units maximizes resilience.

Several servers act as one system so that if a node fails, the remaining nodes continue the service with minimal disruption. What is this arrangement called?

• a.A demilitarized zone
• b.Clustering✓
• c.A single-server deployment with nightly backups only
• d.Port aggregation

Clustering groups multiple servers so they function as a single, resilient service, with surviving nodes taking over on failure. It supports high availability and sometimes load sharing. Shared or replicated storage often backs the cluster.

An organization wants its internet access to survive the total failure of one provider by contracting a second, independent carrier. Which approach is this?

• a.Multiple ISPs (multihoming)✓
• b.A larger DHCP scope
• c.Enabling QoS on the WAN edge
• d.A faster single circuit from one provider

Using multiple ISPs (multihoming) provides path and provider redundancy so a single carrier outage does not sever internet access. Ideally the links enter through diverse physical paths. BGP or policy routing steers traffic across the providers.

A facility must keep critical network gear running through a multi-hour utility power outage. Beyond battery backup, which resource provides sustained power?

• a.A backup generator✓
• b.A redundant cooling unit
• c.A second internet circuit
• d.A single uninterruptible power supply on its own

A backup generator supplies sustained power during extended utility outages, well beyond the minutes a UPS battery provides. The UPS bridges the gap while the generator starts. Together they form a layered power-resilience strategy.

After a link failure, a Layer 2 network must recover forwarding paths in a second or two rather than the tens of seconds classic STP takes. Which protocol provides this faster convergence?

• a.RSTP✓
• b.Border Gateway Protocol
• c.Classic STP (802.1D)
• d.The first hop redundancy protocol used for gateways

Rapid Spanning Tree Protocol (RSTP, 802.1w) converges in a few seconds versus the roughly 30-50 seconds of classic STP. It uses proposal/agreement and additional port roles to speed recovery. It is backward compatible with legacy STP.

During a brief utility power sag, network gear must stay up on battery for the few minutes needed to switch to generator or shut down cleanly. Which device provides this immediate bridge?

• a.A second default gateway
• b.A backup generator with a startup delay
• c.A redundant switch fabric
• d.An uninterruptible power supply✓

An uninterruptible power supply (UPS) provides immediate battery power to ride through sags and short outages and to bridge to a generator. It also conditions power against spikes. Sizing it correctly determines how long equipment stays up.

A shelf holds a preconfigured, powered-off replacement switch that can be swapped in quickly, but it is not already running. What is this spare called?

• a.A load-balanced active-active pair already carrying traffic
• b.A hot spare
• c.A cold spare✓
• d.A warm site

A cold spare is a spare device kept powered off and ready to be installed when the primary fails, trading faster-than-procurement recovery for some downtime. A hot spare is already running and can take over immediately. The choice balances cost against recovery speed.

To survive the loss of an entire building or region, an organization replicates services to a second location far from the primary. Which resilience strategy is this?

• a.A larger single data center with more racks
• b.Geographic redundancy✓
• c.NIC teaming on each server
• d.Dual power supplies in one chassis

Geographic (site) redundancy places services in a separate location so a regional disaster does not take down everything at once. Data is replicated between sites to keep them in sync. It is the broadest tier of high-availability design.

A disaster recovery plan states that a critical system must be fully restored and usable within four hours of an outage. Which metric expresses this target?

• a.RPO
• b.MTBF
• c.RTO✓
• d.MTTR, which measures average repair time after a failure

The Recovery Time Objective (RTO) is the maximum tolerable time to restore a system after an outage. It drives investment in failover and recovery capability. RTO differs from RPO, which addresses acceptable data loss rather than downtime.

Management wants to know, on average, how long it takes staff to repair a failed device and restore service once work begins. Which metric captures this?

• a.RPO
• b.The recovery time objective set in the DR plan
• c.MTTR✓
• d.MTBF

Mean Time To Repair (MTTR) is the average time to restore a failed component to service, reflecting maintainability and process efficiency. Lowering MTTR shrinks outage duration. It complements MTBF, which measures how often failures occur.

A vendor advertises how long, on average, a device operates before it fails, helping predict reliability and replacement planning. Which metric is this?

• a.RTO
• b.MTTR
• c.The recovery point objective for acceptable data loss
• d.MTBF✓

Mean Time Between Failures (MTBF) estimates the average operating time between failures of a repairable device, indicating reliability. Higher MTBF suggests longer expected service life. It informs redundancy and spare-parts planning.

A budget-limited backup facility provides floor space, power, and cooling but no installed equipment or current data; hardware must be brought in after a disaster. Which site type is this?

• a.An active-active cloud region
• b.A cold site✓
• c.A warm site with servers preinstalled and data partially synchronized
• d.A hot site

A cold site provides only the physical space, power, and cooling; equipment and data must be delivered and configured after a disaster, so recovery is slow but cheap. A hot site is fully ready and costly. A warm site sits between the two.

A backup job copies only the data that changed since the previous backup of any type, minimizing each night's backup size but requiring the full chain to restore. Which backup type is this?

• a.A differential backup that copies everything changed since the last full backup
• b.An incremental backup✓
• c.A full backup
• d.A snapshot of the live volume

An incremental backup copies only data changed since the last backup of any kind, making each job small and fast. Restoration requires the last full backup plus every incremental in order. This trades quick backups for a longer restore chain.

A team gathers stakeholders in a room to walk through the disaster recovery plan step by step and discuss responses, without touching production systems. Which exercise is this?

• a.A tabletop exercise✓
• b.A live failover cutover of production traffic
• c.A full restore of every backup to new hardware
• d.A penetration test against the perimeter

A tabletop exercise is a discussion-based walkthrough of the DR or incident plan that validates roles and steps without disrupting production. It surfaces gaps cheaply before a real event. More disruptive tests, like full failover, come later.

Beyond restoring IT systems, an organization documents how the whole business will keep operating essential functions during a major disruption. Which plan covers this broader scope?

• a.A disaster recovery plan focused only on IT systems
• b.A change management record
• c.A business continuity plan✓
• d.An acceptable use policy

A business continuity plan (BCP) addresses keeping essential business functions running during a disruption, of which IT disaster recovery is one part. It covers people, facilities, and processes, not just technology. DR plans nest inside the broader BCP.

A best-practice backup strategy calls for three copies of data on two different media types with one copy kept offsite. What is this guideline commonly called?

• a.The default gateway of last resort
• b.The single-copy nightly backup approach
• c.Continuous active-active replication between two data centers
• d.The 3-2-1 backup rule✓

The 3-2-1 rule keeps three copies of data on two media types with one copy offsite, protecting against device, site, and media failures. The offsite copy guards against local disasters. Many teams add an offline copy to resist ransomware.

When a primary system fails, operations automatically shifts to a standby system so service continues. What is this transition called?

• a.Load balancing
• b.Failover✓
• c.Failback to the original primary once it is repaired
• d.A backup restore from tape

Failover is the automatic (or manual) switch of operations from a failed primary to a standby system to preserve service. Returning to the primary once repaired is called failback. Well-tested failover minimizes downtime during incidents.

A storage system keeps a continuously updated copy of data on a second array so that a copy is always current if the primary array fails. Which technique is this?

• a.An archived copy stored offline for compliance
• b.A weekly full tape backup
• c.Replication✓
• d.A point-in-time snapshot taken once per day

Replication maintains a continuously updated copy of data on another system or site, keeping a near-current copy available for recovery. Synchronous replication keeps copies identical; asynchronous lags slightly to reduce latency. It underpins low-RPO recovery.

Users on a satellite WAN link report that interactive applications feel sluggish even though the link is not congested and no packets are lost. Which metric best explains this?

• a.Excessive jitter between packets
• b.Low bandwidth
• c.Insufficient throughput on the local LAN segment
• d.High latency✓

Latency is the time a packet takes to travel end to end, and high latency (as on satellite links) makes interactive apps feel sluggish even without loss or congestion. It is distinct from bandwidth, which is capacity. Propagation distance is a major latency contributor.

A VoIP call breaks up and words drop out, and monitoring shows some packets never arrive at the far end. Which metric describes this?

• a.Bandwidth
• b.The signal-to-noise ratio measured on the wireless link
• c.Jitter
• d.Packet loss✓

Packet loss is the percentage of packets that never reach the destination, and even small amounts badly degrade real-time voice. Causes include congestion, errors, and faulty links. QoS and capacity fixes reduce it.

VoIP audio is uneven because packets arrive with inconsistent spacing, so an engineer configures a mechanism to hold and release them at a steady rate. What is this mechanism?

• a.An access control list that filters unwanted traffic
• b.A jitter buffer✓
• c.A spanning-tree recalculation
• d.A larger DHCP scope

A jitter buffer temporarily holds arriving packets and releases them at a steady interval, smoothing out variation in delay. Too small a buffer fails to absorb jitter; too large adds latency. It is a standard mitigation for real-time media.

A voice platform reports a numeric score from 1 to 5 that summarizes perceived call quality for stakeholders. Which metric is this?

• a.RTT
• b.The link utilization percentage during the busy hour
• c.DSCP
• d.MOS✓

Mean Opinion Score (MOS) rates perceived voice quality on a 1-to-5 scale, condensing latency, jitter, and loss into one figure. Scores above about 4 are considered good. It gives non-technical stakeholders an intuitive quality measure.

A technician pings a server and reads the time reported for an echo request to be sent and its reply received. Which metric is this measuring?

• a.The number of hops between the source and destination
• b.Round-trip time✓
• c.Total available bandwidth
• d.One-way delay in a single direction only

Round-trip time (RTT) is the time for a packet to reach a destination and its reply to return, which ping reports directly. It reflects two-way latency along the path. Rising RTT often signals congestion or a longer route.

For acceptable interactive voice, engineers target keeping delay in a single direction under roughly a specific threshold. What is the commonly cited one-way delay budget for VoIP?

• a.About 5 ms
• b.About 2 seconds
• c.About 500 ms, which is the point at which callers stop noticing delay
• d.About 150 ms✓

A common design target keeps one-way delay under about 150 ms for good interactive voice quality. Beyond that, callers begin talking over each other. Jitter and loss budgets accompany this latency target.

To ensure voice packets receive top priority through the network, an engineer marks them with a specific Layer 3 code point that routers honor. Which marking is standard for voice?

• a.The 802.1Q VLAN tag value
• b.DSCP default (0)
• c.A best-effort class with no special priority applied at all
• d.DSCP EF (46)✓

Expedited Forwarding (EF, DSCP 46) is the standard DiffServ marking for voice, giving it low-latency, priority handling. Routers map EF to a priority queue. Consistent marking end to end is what makes QoS effective.

On a trunk, an engineer wants switches to prioritize frames at Layer 2 using a 3-bit priority field in the VLAN tag. Which mechanism provides this?

• a.A spanning-tree priority value
• b.DSCP marking at Layer 3
• c.The differentiated services field carried in the IP header
• d.802.1p CoS✓

The 802.1p Class of Service (CoS) uses a 3-bit priority field in the 802.1Q tag for Layer 2 prioritization. It is the Layer 2 counterpart to Layer 3 DSCP marking. Switches map CoS values to egress queues.

During congestion, a policy should buffer and delay excess traffic to smooth bursts rather than immediately discarding it. Which QoS technique does this?

• a.Spanning-tree blocking
• b.Port mirroring
• c.Traffic shaping✓
• d.Traffic policing that drops packets exceeding the rate

Traffic shaping buffers and delays excess traffic to smooth bursts to a target rate, whereas policing simply drops or remarks traffic above the rate. Shaping adds latency but avoids drops. The choice depends on whether smoothing or hard limiting is desired.

An engineer wants to measure the actual achievable transfer rate between two endpoints by pushing test traffic across the link. Which type of tool provides this?

• a.A physical cable continuity tester that checks pin mapping
• b.A bandwidth speed test tool✓
• c.A DNS lookup utility
• d.An ARP cache viewer

A throughput/bandwidth test tool (such as iperf) generates traffic between endpoints to measure achievable transfer rates. It reveals real performance versus the link's rated speed. Results depend on latency, loss, and TCP tuning.

A monitoring system reports that a WAN link averaged 85 percent of its capacity during business hours. Which metric is being reported?

• a.Link utilization✓
• b.Latency
• c.The mean time between failures of the WAN router
• d.Jitter

Link utilization expresses used capacity as a percentage of the link's total, here 85 percent, and sustained high values warn of congestion risk. It is derived from interface byte counters over time. Trending it guides capacity upgrades.

A server room's equipment keeps overheating, and staff must guarantee stable temperature and airflow year-round. Which facility system addresses this?

• a.HVAC✓
• b.A UPS
• c.A power distribution unit feeding the racks
• d.A fire suppression system

HVAC (heating, ventilation, and air conditioning) maintains stable temperature and airflow so equipment stays within safe operating ranges. Hot- and cold-aisle layouts improve its efficiency. Inadequate cooling causes thermal shutdowns and shortened hardware life.

A data center needs to extinguish fires without soaking and destroying electronic equipment with water. Which protection approach fits?

• a.An HVAC economizer that brings in outside air
• b.A UPS
• c.Standard water sprinklers over the racks
• d.Clean-agent fire suppression✓

A clean-agent (gaseous) fire suppression system extinguishes fires without water, protecting electronics from damage. Water-based sprinklers would ruin equipment. Such systems are standard in equipment rooms and data centers.

Technicians handling circuit boards in a dry equipment room keep damaging components with static discharge. Controlling which environmental factor most reduces this risk?

• a.Humidity✓
• b.Air pressure
• c.Ambient light level
• d.The temperature set point of the cooling system

Maintaining adequate humidity reduces static buildup and the electrostatic discharge (ESD) that damages components. Air that is too dry raises ESD risk, while too humid promotes condensation. ESD wrist straps and mats add further protection.

An engineer must ensure that if utility power fails, several racks receive conditioned, distributed power from a single managed unit that also reports per-outlet load. Which device is this?

• a.A managed PDU✓
• b.A single power strip
• c.A network interface card teamed for redundancy
• d.A KVM switch

A managed PDU (power distribution unit) distributes and monitors power to multiple devices in a rack, often reporting per-outlet load and enabling remote switching. Fed by a UPS or generator, it supports resilient power design. Monitoring helps avoid overloading circuits.

Operations wants an automatic alert if a wiring closet exceeds a safe temperature threshold so staff can intervene before a shutdown. Which control provides this?

• a.A smoke detector
• b.A humidity-only sensor
• c.A power distribution unit that reports outlet current
• d.A temperature monitor with alert thresholds✓

A temperature monitor with an alerting threshold notifies staff when a closet exceeds safe limits, allowing intervention before thermal shutdown. It integrates with the NMS or environmental system. Early alerts prevent heat-related outages and hardware damage.

An organization wants to enforce minimum length, complexity, and periodic change of user credentials across all systems. Which document defines these rules?

• a.A network topology diagram
• b.A memorandum of understanding
• c.An acceptable use policy governing general resource use
• d.A password policy✓

A password policy defines requirements such as length, complexity, history, and rotation for credentials. It standardizes account security across systems. Enforcement is typically automated through directory settings.

When an employee leaves, IT must reliably disable accounts, reclaim equipment, and revoke access on their last day. Which documented process ensures this happens consistently?

• a.A password complexity requirement in the account policy
• b.An offboarding process✓
• c.A disaster recovery tabletop exercise
• d.A change advisory board review

An offboarding process defines the steps to disable accounts, revoke access, and recover assets when someone leaves, closing security gaps. It mirrors the onboarding process that grants access. Consistent execution prevents lingering access by former staff.

A company lets staff use personal phones and laptops for work and needs rules covering security requirements and acceptable use of those devices. Which policy governs this?

• a.A BYOD policy✓
• b.A quality-of-service policy
• c.A service level agreement with an external provider
• d.A rack elevation diagram

A BYOD (bring your own device) policy sets the security and usage rules for employee-owned devices accessing company resources. It typically requires controls like passcodes, encryption, and remote wipe. It balances flexibility against data protection.

An organization must define how staff may connect from outside the office, including required VPN use and authentication for remote sessions. Which policy covers this?

• a.A memorandum of understanding between two organizations
• b.A remote access policy✓
• c.A rack diagram
• d.A wiring standard

A remote access policy defines the approved methods, security requirements, and authentication for connecting from outside the network, such as mandatory VPN and multifactor authentication. It reduces risk from remote connections. It complements broader acceptable use rules.

Before a risky configuration change reaches production, a group formally reviews and approves it, weighing risk and scheduling. What is this body called?

• a.A penetration testing crew
• b.A change advisory board✓
• c.An incident response team
• d.A disaster recovery site coordinator

A change advisory board (CAB) reviews, prioritizes, and approves proposed changes, weighing risk, impact, and timing. Its sign-off is part of formal change management. This governance reduces the chance of unplanned outages from unvetted changes.

When a security breach is detected, staff follow a predefined set of stages to detect, contain, eradicate, and recover from the event. Which document guides these stages?

• a.A rack elevation diagram
• b.An incident response plan✓
• c.An acceptable use policy
• d.A service level agreement with the cloud provider

An incident response plan defines the phases (such as preparation, detection, containment, eradication, recovery, and lessons learned) for handling security events. It assigns roles and communication paths. Practicing it improves real-world response speed.

A contractor and client sign a document that spells out exactly the deliverables, tasks, timeline, and price for a specific network project. Which document is this?

• a.A statement of work (SOW)✓
• b.A non-disclosure agreement protecting shared information
• c.A memorandum of understanding
• d.An acceptable use policy

A statement of work (SOW) details the specific deliverables, tasks, timeline, and cost for a defined project. It sits under a broader master agreement and prevents scope disputes. Clear SOWs align expectations between client and vendor.

Two organizations sign a non-binding document expressing their intent to cooperate and outlining broad roles before any formal contract. Which document is this?

• a.A service level agreement
• b.A statement of work
• c.A memorandum of understanding✓
• d.A master service agreement setting overall contract terms

A memorandum of understanding (MOU) expresses a mutual, generally non-binding intent to cooperate and outlines broad responsibilities. It precedes more formal, binding contracts. It signals commitment while details are still negotiated.

A company and a vendor sign one overarching contract that sets the general legal and commercial terms governing all future projects between them. Which document is this?

• a.A master service agreement✓
• b.A memorandum of understanding
• c.A statement of work
• d.A non-disclosure agreement covering confidential data only

A master service agreement (MSA) establishes the overarching terms that govern all future engagements between two parties, so each new project needs only a short statement of work. It streamlines repeated work. Individual SOWs reference the MSA for legal terms.

A vendor announces a date after which a switch model will receive no further updates, patches, or support. Which term describes this milestone?

• a.A recovery point objective
• b.End of life / end of support✓
• c.A service level agreement renewal date
• d.A maintenance window

End of life / end of support (EOL/EOS) marks when a product no longer receives updates, patches, or vendor support, making continued use a security and reliability risk. Tracking these dates drives replacement planning. Running EOL gear can also break compliance.

An operations team schedules disruptive upgrades for 2 a.m. Sunday when usage is lowest to limit impact on users. What is this pre-approved timeframe called?

• a.A change freeze
• b.A recovery time objective
• c.An acceptable use policy signed at onboarding
• d.A maintenance window✓

A maintenance window is a pre-approved, scheduled period, usually during low-usage hours, for performing disruptive changes with minimal user impact. It is coordinated through change management. Communicating it in advance sets user expectations.

A team wants every device configuration stored in version control so changes are tracked and any prior known-good version can be restored. Which practice provides this?

• a.Disabling remote management to prevent changes
• b.Configuration management with version control✓
• c.Manually retyping commands on each device
• d.Relying on each device's factory defaults

Configuration management with version control tracks every change to device configs and lets teams roll back to a known-good version. It reveals who changed what and when, and detects drift from the baseline. Automation tools often enforce it at scale.

Before sharing sensitive network diagrams with a consultant, the company requires them to sign an agreement not to disclose the information. Which document is this?

• a.A non-disclosure agreement✓
• b.A memorandum of understanding outlining cooperative intent
• c.A service level agreement
• d.A statement of work

A non-disclosure agreement (NDA) legally binds a party to keep shared confidential information private. It protects sensitive designs and data disclosed during an engagement. Signing it precedes sharing proprietary details.

A provider's contract promises 99.9 percent uptime and specifies credits to the customer if that level is not met. Which document defines these commitments and penalties?

• a.A service level agreement✓
• b.A memorandum of understanding between the parties
• c.A statement of work
• d.A non-disclosure agreement

A service level agreement (SLA) defines measurable commitments such as uptime and response time, plus remedies like credits when they are missed. It sets accountability between provider and customer. SLA terms guide escalation and prioritization.

When provisioning a new switch, technicians must apply a standard set of steps to disable defaults, set strong credentials, and enable logging before it goes live. Which process ensures this?

• a.A disaster recovery tabletop test
• b.A predictive wireless site survey
• c.A change advisory board approval for the purchase
• d.A device hardening baseline✓

A device hardening (secure onboarding) baseline is the standard set of steps applied to new gear, disabling insecure defaults, setting strong credentials, and enabling logging before deployment. It ensures every device starts from a consistent secure state. Automation keeps it repeatable.