Free CompTIA Network+ N10-009 Practice Questions

Correct answer: A. Establish a theory.

After identifying the problem, the next step in the CompTIA troubleshooting methodology is to establish a theory of probable cause, which often involves questioning the obvious and systematically examining each layer of the OSI model to isolate where in the network stack (physical, data link, network, transport, session, presentation, application) the fault may lie. This structured approach helps technicians narrow down potential causes before testing the theory, making it the step most closely associated with methodically reviewing OSI layers.

Why the other options are wrong

• B. Implementing the solution occurs after the cause has been confirmed and a plan devised, not during initial cause analysis.
• C. Creating a plan of action happens after the theory has been tested and confirmed, focused on how to resolve the issue rather than diagnosing it.
• D. Verifying functionality is the final step to confirm the fix works and involves testing the whole system, not layer-by-layer diagnosis of cause.

Correct answer: A. LLDP

LLDP (Link Layer Discovery Protocol) allows devices to discover and identify neighboring network devices and the switch ports they are connected to. This is the standard protocol for determining switch identity and port information without requiring manual configuration or network access.

Why the other options are wrong

• B. IKE (Internet Key Exchange) is related to VPN encryption, not device/port discovery.
• C. VLAN configuration helps segment networks but doesn't identify which physical switch port a device connects to.
• D. netstat displays network connections and statistics from the local device, not switch port information.

Correct answer: B. A reservation for the server based on the MAC address

A DHCP reservation binds a specific MAC address to a fixed IP address, ensuring the file server always receives the same IP while remaining under DHCP management. This provides the reliability needed for a server that must be consistently addressable while maintaining DHCP infrastructure benefits.

Why the other options are wrong

• A. A /32 subnet is a single host and creates unnecessary complexity; reservations are simpler.
• C. Assigning a static IP within the DHCP range can cause conflicts if DHCP also assigns that address.
• D. SLAAC (Stateless Address Auto-Configuration) is for IPv6 and doesn't provide the centralized control needed for server management.

Correct answer: A. PKI

X.509 certificates are the standard certificate format used within Public Key Infrastructure (PKI) systems for digital authentication, encryption, and identity verification. PKI is the framework that manages, distributes, and validates X.509 certificates.

Why the other options are wrong

• B. VLAN tagging is for network segmentation, unrelated to certificate technology.
• C. While LDAP can work with certificates, X.509 is most fundamentally associated with PKI, not LDAP specifically.
• D. MFA uses various authentication factors but X.509 certificates are not its primary association.

Correct answer: A. Captive portal

A captive portal is specifically designed to provide temporary, guest-level network access by presenting an authentication page that users must complete before accessing the network. This is the standard technology for temporary access scenarios.

Why the other options are wrong

• B. Enterprise authentication is designed for permanent organizational users, not temporary access.
• C. Ad hoc networks are peer-to-peer connections, not suitable for centralized temporary access control.
• D. WPA3 is a wireless encryption standard, not an authentication/access control technology for temporary users.

Correct answer: A. Hosts file

A hosts file on the user's local machine can override DNS resolution for specific URLs, causing them to resolve to incorrect IP addresses or not resolve properly while other users are unaffected. This explains why only one user has the issue; it's a local configuration problem rather than a network-wide DNS problem.

Why the other options are wrong

• B. Self-signed certificates cause security warnings, not URL resolution failures.
• C. Nameserver record issues would affect all users trying to reach the site, not just one user.
• D. IP helper is used for DHCP relay, not for DNS resolution issues.

Correct answer: A. Multitenancy

Multitenancy describes a cloud architecture in which a single instance of an application, platform, or infrastructure serves multiple distinct users, groups, or organizations (tenants) while keeping their data and configurations logically separated. Hosting a company application in the cloud so that it is accessible to both internal employees and external third-party users reflects this shared-resource model, where the underlying infrastructure is common but access is extended to multiple types of consumers. This concept underpins most public and hybrid cloud offerings, allowing providers or organizations to efficiently serve a diverse user base without deploying separate dedicated environments for each group.

Why the other options are wrong

• B. A VPC refers to an isolated virtual network segment within a cloud provider's infrastructure, not the concept of serving multiple types of users from a shared application.
• C. NFV refers to virtualizing network functions like routers and firewalls in software, which is unrelated to the scenario of exposing an application to internal and third-party users.
• D. SaaS describes a cloud service delivery model where software is provided over the internet, but it does not specifically describe the arrangement of shared access among multiple user groups.

Correct answer: D. Out-of-band management

Out-of-band management provides remote access to network devices through a separate, independent management channel (such as serial console, IPMI, or dedicated management port) that remains accessible even when the main system has failed. This is essential for recovering devices that won't start normally.

Why the other options are wrong

• A. A crash cart is physical equipment for on-site access, not remote access.
• B. A jump box is for accessing secured networks, not for direct device recovery during startup failures.
• C. SSH requires the device to be fully operational, which won't work for a device that failed to start properly.

Correct answer: B. VLAN hopping

VLAN hopping attacks exploit multiple network tags (double tagging) within a single packet. An attacker inserts an additional 802.1Q tag into a frame, allowing the packet to traverse multiple VLANs and reach restricted network segments. This technique specifically leverages the presence of multiple VLAN tags in a packet structure.

Why the other options are wrong

• A. MAC flooding attacks overwhelm the CAM table with numerous MAC addresses, not involving multiple network tags.
• C. DNS spoofing involves forging DNS responses to redirect users, unrelated to network packet tagging.
• D. ARP poisoning uses fraudulent ARP messages to map IP addresses to incorrect MAC addresses, not involving VLAN tags.

Correct answer: D. Link aggregation

Link aggregation, also called EtherChannel or bonding, joins the two ports into a single logical link with more bandwidth and built-in redundancy. If one member fails, traffic keeps flowing over the other, so the connection to the core switch stays up.

Why the other options are wrong

• A. Full duplex is a communication mode, not a redundancy mechanism.
• B. 802.1Q tagging identifies VLANs and does not provide port redundancy.
• C. A native VLAN carries untagged traffic on a trunk and adds no redundancy.

Correct answer: C. The port is shut down.

No indicator lights blinking on either the computer or the switch indicates a Layer 1 issue where no traffic is being transmitted or received. A shut-down port prevents any electrical signal activity, resulting in no LED activity on either end. This is the most likely cause given that the physical cable is properly connected but there is no signal activity.

Why the other options are wrong

• A. A failed switch would typically affect multiple users and would show different symptoms; a single user suggests a port-level issue.
• B. An incorrect default gateway would not prevent Link Layer communication and LED activity; it would affect higher-layer connectivity.
• D. An incorrect VLAN assignment would still show link activity/LED blinking; the port would be active but the VLAN misconfigured.

Correct answer: C. 32768

The default bridge priority value in Spanning Tree Protocol (STP) is 32768. This is the standard default used by Cisco and most vendors. The priority value is used to determine the root bridge election, with lower values having higher priority. The value 32768 represents a priority of 32768 in the bridge ID calculation.

Why the other options are wrong

• A. 4096 is too low and not the default priority value.
• B. 8192 is not the standard default STP bridge priority.
• D. 36684 is an arbitrary value and not a standard default.

Correct answer: A. With a voice VLAN

An access port configured with more than one VLAN indicates a voice VLAN setup, where the port carries both data traffic on one VLAN and voice traffic on another VLAN simultaneously. This is a standard configuration for IP phones and other devices requiring separate voice and data streams.

Why the other options are wrong

• B. An access port carrying a data VLAN alongside a voice VLAN is the intended design for an IP phone, not an excessive or mistaken number of VLANs.
• C. The default VLAN is the single VLAN a port falls back to when nothing else is assigned, which does not account for a second VLAN on the port.
• D. A native VLAN is a trunk port concept describing where untagged frames land, and this port is an access port.

Correct answer: C. WPA2 / WPA3 mixed mode

WPA2/WPA3 mixed mode provides the best balance of security and compatibility for a mixed environment. It allows modern devices (tablets, new PCs) to use the more secure WPA3 while legacy devices (older card readers) fall back to WPA2. This satisfies both the security requirement and the compatibility need with legacy hardware. Pure WPA3 might not work with legacy readers, pure WPA2 lacks modern security, and WPA/WPA2 mixed mode is less secure overall.

Why the other options are wrong

• A. WPA3 alone may not be compatible with legacy card readers that only support older standards.
• B. WPA2 alone is less secure than WPA3 and fails to leverage modern security improvements.
• D. WPA/WPA2 mixed mode is less secure overall and WPA is outdated; WPA2/WPA3 is the better choice.

Correct answer: D. Out of band

Out-of-band (OOB) management requires a separate, dedicated network and IP address range for managing devices, completely independent from the in-band data network. This isolation ensures management access is available even if the primary network fails. Console connections are local, split tunneling routes traffic selectively, and jump boxes are administrative access tools; none require a separate IP addressing scheme.

Why the other options are wrong

• A. Console connections are local terminal access, not requiring separate IP addresses
• B. Split tunneling selectively routes traffic but uses the same network
• C. Jump boxes are administrative access points on the same network, not requiring separate IPs

Correct answer: D. EOL

End-of-Life (EOL) status indicates that a software product no longer receives updates, security patches, or vendor support. This scenario directly describes EOL: the inability to receive updates and patches, combined with the security vulnerability exposure that results from using unsupported software.

Why the other options are wrong

• A. An SLA is a service level agreement defining performance commitments, not a software lifecycle status.
• B. Licensing refers to usage rights and legal compliance, not the availability of security patches or support status.
• C. SIEM is a security information and event management system, not a software lifecycle descriptor.

Correct answer: C. Non-routable address on the perimeter router

Port Address Translation (PAT) is used to translate non-routable (private) addresses on internal networks to routable addresses for internet communication. Option C correctly identifies that PAT operates on non-routable addresses on the perimeter router, allowing private internal addresses to communicate externally through address translation.

Why the other options are wrong

• A. VLANs on the perimeter are a network segmentation concept unrelated to PAT functionality.
• B. Public addresses on the perimeter are already routable and do not require translation via PAT.
• D. Server placement on the perimeter is a network topology decision separate from the purpose of PAT.

Correct answer: D. Jumbo frames

Jumbo frames increase the maximum transmission unit (MTU) size, allowing larger packets to be transmitted without fragmentation. VXLAN adds a 50-byte header to encapsulated packets, which with standard 1500-byte MTU frames causes fragmentation. Jumbo frames (typically 9000 bytes) accommodate this overhead and resolve both fragmentation and associated performance issues.

Why the other options are wrong

• A. 802.1Q tagging is for VLAN identification and does not address fragmentation in VXLAN overlays.
• B. Spanning tree prevents loops but does not resolve fragmentation or performance issues.
• C. Link aggregation increases bandwidth but does not prevent fragmentation caused by oversized VXLAN packets.

Correct answer: D. NAC

Network Access Control (NAC) is specifically designed to authenticate and authorize devices before they can access the network. It prevents unauthorized devices from connecting to network ports by checking device compliance, credentials, and other security policies. This directly addresses the vulnerability where visitors could plug in personal laptops.

Why the other options are wrong

• A. URL filters control web traffic, not physical port access.
• B. VPN is for remote secure connections, not preventing local port access.
• C. ACLs control traffic rules but don't prevent unauthorized device connections at the port level.

Correct answer: C. Administrative distance

Administrative distance (AD) is a measure of trust assigned to routing information sources. By configuring a backup static route with a higher administrative distance than the primary route, the router will use the primary route and automatically fall back to the backup if the primary fails. This works without dynamic routing protocols. Neighbor adjacency is for dynamic protocols, link state flooding is a specific protocol mechanism, and hop count is a metric; not the feature for configuring backup routes.

Why the other options are wrong

• A. Neighbor adjacency is used by dynamic routing protocols, not applicable here
• B. Link state flooding is a dynamic routing protocol mechanism, not applicable without a protocol
• D. Hop count is a routing metric, not the mechanism for selecting between primary and backup routes

Correct answer: B. Plenum

Plenum cable is fire-rated cabling specifically designed for use in plenum spaces (areas above ceiling tiles and between floors where air circulates). Plenum cable has a special insulation that produces less smoke and toxic fumes when burned, meeting fire code requirements for these critical spaces.

Why the other options are wrong

• A. Coaxial describes how the cable is built, not its fire rating.
  Coax is sold in both plenum and non-plenum versions, so choosing coax doesn't meet the fire-rating requirement.
• C. Crossover cable is a wiring configuration type, not a cable rated for fire safety.
• D. STP describes the cable's shielding, not its fire rating. STP can be bought with a plenum-rated jacket, but STP alone doesn't guarantee one.

Correct answer: A. Risk

Risk management encompasses four primary response strategies: avoidance (eliminating the risk), acceptance (tolerating the risk), mitigation (reducing probability or impact), and transfer (shifting risk through insurance or contracts). These are the foundational risk response strategies in any risk management framework.

Why the other options are wrong

• B. Exploits are attack methods, not strategic responses to risk
• C. Threats are potential harmful events, not management strategies
• D. Vulnerabilities are weaknesses, not risk response strategies

Correct answer: C. FHRP

FHRP (First Hop Redundancy Protocol) is the technology that uses a Virtual IP (VIP) address to provide gateway redundancy between multiple routers. Common implementations include HSRP, VRRP, and GLBP. This allows automatic failover when the primary router fails, ensuring continuous network connectivity.

Why the other options are wrong

• A. LACP is Link Aggregation Control Protocol used for bonding multiple physical links, not gateway redundancy.
• B. PAT is Port Address Translation, a form of NAT for mapping multiple private IPs to one public IP.
• D. BGP is Border Gateway Protocol used for inter-domain routing, not gateway redundancy with a VIP.

Correct answer: A. Document the findings.

According to standard troubleshooting methodology, after implementing and verifying a solution works, the technician must document the findings. This step captures the problem, solution, and resolution for future reference and knowledge management. The other steps (creating plan, establishing theory, identifying problem) all precede the implementation phase.

Why the other options are wrong

• B. Creating a plan of action occurs before implementation, not after.
• C. Establishing a theory occurs during diagnosis, before implementing a solution.
• D. Identifying the problem is the first step, completed long before solution implementation.

Correct answer: A. NAT

Network Address Translation (NAT) is the function that maps internal IP addresses to external IP addresses for public use. While PAT (Port Address Translation) is a subset of NAT that also translates ports, the question specifically describes basic IP address mapping, which is NAT. VIP refers to virtual IP addresses used for load balancing, and BGP is a routing protocol.

Why the other options are wrong

• B. VIP (Virtual IP) is used for load balancing and failover, not for mapping internal to external addresses.
• C. PAT translates both addresses and ports, but the question asks specifically about IP address mapping.
• D. BGP is a routing protocol used for exchanging routes between autonomous systems, not for address translation.

Correct answer: B. nmap

nmap is a comprehensive network scanning tool that can discover hosts on a network and enumerate the services running on those hosts, including open ports and service versions. This makes it ideal for identifying rogue servers and determining what services they're running.

Why the other options are wrong

• A. tracert traces the route to a destination but doesn't identify services running on hosts.
• C. netstat displays network connections and statistics on a single local system, not for network-wide scanning.
• D. ping only determines if a host is reachable; it doesn't identify services.

Correct answer: A. Patches and bug fixes

An SLA (Service Level Agreement) defines service metrics and expectations between a service provider and customer. Patches and bug fixes are concrete service obligations with measurable timelines and commitments. Licensing pertains to software rights, inventory management is an operational process, and stakeholders are parties to an SLA but not content within it.

Why the other options are wrong

• B. Licensing refers to software usage rights, which is a separate agreement type, not SLA content.
• C. Inventory management is an operational procedure, not a service level commitment.
• D. While stakeholders are involved in an SLA, they are not included as content within the agreement itself.

Correct answer: B. LLDP run

LLDP (Link Layer Discovery Protocol) is used to discover and identify neighboring network devices. Running LLDP allows the administrator to see which port on the remote switch the cable is connected to, making it the best tool for identifying the physical connection point of a faulty cable between switches.

Why the other options are wrong

• A. tracert traces the route packets take to a destination, not useful for identifying physical switch ports
• C. nmap scans for open ports and services on devices, not for discovering physical switch port connections
• D. ping tests basic connectivity but does not identify which remote switch port a cable is connected to

Correct answer: D. NS

NS (nameserver) records specify which servers are authoritative for a domain. When DNS servers move to new IP addresses, the NS records must be updated to point to the new nameserver addresses. This ensures that queries are directed to the correct DNS infrastructure, which is why customers cannot access the website; the old NS records are pointing to the old DNS server IPs.

Why the other options are wrong

• A. AAA records are not a standard DNS record type.
• B. CNAME records point domain aliases to canonical names; they don't need updating when DNS server IPs change.
• C. MX records specify mail servers, not DNS servers, and are unrelated to website accessibility.

Correct answer: B. Decommission and replace the switch.

For a critical infrastructure switch that is end-of-support, the best security practice is to decommission and replace it. End-of-support devices no longer receive security patches, bug fixes, or vendor support, making them vulnerable to exploits. Continuing to operate an unsupported critical device poses unacceptable security and operational risks.

Why the other options are wrong

• A. Patches are no longer available for end-of-support devices, making this option ineffective.
• C. Firmware without ongoing support will eventually have unpatched vulnerabilities; this doesn't resolve the end-of-support issue.
• D. Isolating the switch doesn't address the underlying security vulnerability of running unsupported equipment in critical infrastructure.

Correct answer: B. Roaming between access points

ESSID (Extended Service Set Identifier) is essentially the same as SSID but specifically refers to the identifier used in Extended Service Sets, which consist of multiple access points. The key user benefit of ESSID is the ability to roam between multiple access points while maintaining the same network name and connection, providing seamless mobility.

Why the other options are wrong

• A. ESSID does not provide a stronger wireless connection than SSID.
• C. ESSID does not inherently provide advanced security compared to SSID.
• D. ESSID does not increase throughput; both are just identifiers.

Correct answer: B. dig comptia.org ANY

The 'dig' command with the ANY query type returns all DNS records for a domain, including MX (mail server) records, making it ideal for verifying mail server changes. Ping tests reachability, nslookup with type=ns queries nameservers, and tracert traces the route to a host. None specifically retrieve mail server records like dig does.

Why the other options are wrong

• A. Ping only tests IP connectivity and reachability, not DNS record changes.
• C. The nslookup command with type=ns queries nameserver records, not mail server records.
• D. Tracert traces the network path to a host but does not retrieve DNS records.

Correct answer: B. Voltage

When only 8 of 12 cameras power on from a 12-port PoE switch, the first check should be voltage/power delivery. PoE has power budgets and requirements; if the switch cannot deliver sufficient power to all ports simultaneously, cameras on lower-priority ports may not power on. Voltage levels should be verified to ensure adequate power delivery to all devices.

Why the other options are wrong

• A. Ethernet cable type affects data transmission but not whether devices receive power initially.
• C. Transceiver compatibility would cause connectivity issues, not selective power delivery problems.
• D. DHCP addressing is a Layer 3 concern that occurs after PoE power delivery is established.

Correct answer: A. Lockable cabinets

Lockable cabinets physically restrict access to hardware in the Main Distribution Frame (MDF) closet, preventing unauthorized personnel from making physical modifications to equipment, cables, and switches. This is the primary physical security measure for protecting hardware.

Why the other options are wrong

• B. UPS provides power redundancy, not physical security against unauthorized modifications
• C. Port security is a Layer 2 network security feature that prevents unauthorized network access, not physical hardware modifications
• D. Microsegmentation is a network security strategy for logical network isolation, not physical hardware protection

Correct answer: B. Ports have an incorrect native VLAN.

When users are moved to previously used workspaces, the switch ports retain their original configuration. If those ports were configured with an incorrect native VLAN different from the new users' devices, the devices cannot communicate properly. The new users' devices on a different VLAN would not reach the network gateway. This is a common issue when repurposing old ports without reconfiguring them. Error-disabled ports would show as such in switch status, trunk ports would not affect single-device connectivity as expected, and MDIX is typically auto-detected.

Why the other options are wrong

• A. Error-disabled ports are administratively obvious and would not affect multiple users simultaneously without clear symptoms.
• C. MDIX (Medium Dependent Interface Crossover) is automatically detected on modern switches and would cause sporadic issues, not complete connectivity loss.
• D. Trunk ports would not prevent connectivity; devices would simply be untagged on the default native VLAN.

Correct answer: B. A hot-cold

A hot-cold aisle configuration is the best setup for maximizing thermal dissipation in a data center. This design alternates hot and cold aisles, with cold air supplied to the front of equipment and hot exhaust air collected at the back. This separation prevents hot and cold air from mixing, maximizes cooling efficiency, and allows the cooling system to dissipate heat more effectively.

Why the other options are wrong

• A. Blue-green deployment is a software release strategy, not a thermal design approach.
• C. East-west traffic refers to data flow patterns between servers, not a thermal management design.
• D. Active-passive is a redundancy model for failover, not specifically designed for thermal dissipation optimization.

Correct answer: B. Port mirroring

Port mirroring (also called SPAN - Switched Port Analyzer) is the correct feature to enable on a switch port. It copies traffic from one or more ports to another port where a monitoring appliance is connected, allowing the administrator to analyze network traffic without disrupting normal operations.

Why the other options are wrong

• A. Trunking is used to carry multiple VLANs across a single link, not for traffic monitoring.
• C. Full duplex is a connection mode setting that has no relationship to traffic analysis.
• D. SNMP is a network management protocol for device monitoring, not for capturing traffic on a specific port.

Correct answer: A. Infrastructure as a service

Infrastructure as a Service (IaaS) requires the greatest up-front expense from the customer during data center migration because the customer must provision and manage virtual infrastructure, servers, storage, and networking components. While SaaS and PaaS shift more responsibilities to the provider with predictable subscription costs, IaaS requires significant initial investment in designing, configuring, and migrating existing infrastructure to cloud resources.

Why the other options are wrong

• B. SaaS typically operates on a subscription model with minimal up-front infrastructure costs.
• C. PaaS provides a managed platform reducing customer infrastructure investment requirements.
• D. Network as a Service is not a standard cloud service model and would have lower initial costs than IaaS.

Correct answer: A. GDPR

GDPR (General Data Protection Regulation) is the European Union's comprehensive data protection regulation that governs the security and handling of personal data for EU residents. It is the primary regulatory framework in Europe for personal data protection and privacy compliance.

Why the other options are wrong

• B. SCADA is a control system architecture for industrial operations, not a data protection regulation.
• C. SAML is a single sign-on authentication protocol, not a data protection or privacy regulation.
• D. PCI DSS is a payment card industry security standard, not specifically a European data protection regulation.

Correct answer: A, C. Least privilege network access; Central policy management

Least privilege network access (A) restricts users and systems to only the resources they need, reducing breach impact. Central policy management (C) enables consistent security enforcement across all systems and quick remediation when breaches occur. Together, these reduce the attack surface and allow for rapid policy-wide responses to threats.

Why the other options are wrong

• B. Dynamic inventories are useful for asset tracking but don't directly increase security posture after a breach.
• D. Zero-touch provisioning automates device setup but doesn't address security vulnerabilities from past breaches.
• E. Configuration drift prevention maintains consistency but is secondary to access controls and policy management.
• F. Subnet range limits are too granular and don't address the core security improvements needed post-breach.

Correct answer: D. Load balancer

A load balancer is specifically designed to listen for incoming client requests and distribute them across multiple backend servers based on various algorithms. It handles traffic distribution, health checks, and session persistence, which are the core functions needed for this scenario.

Why the other options are wrong

• A. Routers direct traffic between networks but don't distribute load across servers.
• B. Switches connect devices within a network but don't distribute application traffic.
• C. Firewalls filter traffic but don't distribute requests across multiple servers.

Correct answer: C. Captive portal

A captive portal is a web page that appears before users can access the network, requiring them to accept terms of use before connectivity is granted. This is the standard mechanism for enforcing acceptable use policies on guest networks. Pre-shared keys authenticate devices, autonomous APs are a type of AP, and WPA2 is an encryption standard; none accomplish the specific goal of requiring acceptance of terms.

Why the other options are wrong

• A. Pre-shared keys handle authentication, not terms acceptance
• B. Autonomous APs are a deployment model, not a mechanism for policy acceptance
• D. WPA2 encryption provides security, not user acknowledgment of terms

Correct answer: A. Datagram

At the transport layer, connectionless communication (UDP) transmits data in units called datagrams. Datagrams are independent, self-contained packets of data that may arrive out of order and are not guaranteed delivery. Segments are used in connection-oriented (TCP) communication, frames operate at Layer 2, and packets are a general term that can apply to multiple layers.

Why the other options are wrong

• B. Segments are the transmission unit for TCP (connection-oriented), not UDP (connectionless).
• C. Frames are the transmission unit at the Data Link Layer, not the Transport Layer.
• D. Packets is a generic term; datagrams is the specific term for connectionless transport layer units.

Correct answer: C. SNMP traps

SNMP traps are automated alerts that network devices send to a management station when specific conditions occur. They are the standard tool for proactive server and device monitoring to ensure availability. Packet capture is for traffic analysis, data usage reports track bandwidth, and configuration monitoring tracks changes; none directly monitor availability.

Why the other options are wrong

• A. Packet capture analyzes traffic patterns but does not monitor server availability.
• B. Data usage reports track bandwidth consumption, not server availability status.
• D. Configuration monitoring tracks configuration changes, not whether servers are available and operational.

Correct answer: C. Malware

Malware is the broad category that encompasses any malicious software designed to compromise system security, steal data, and send unauthorized information to external destinations. Ransomware specifically encrypts data for extortion, darkware is not a standard malware term, and adware displays unwanted advertisements. The scenario of sending confidential information to an unknown destination best fits the general definition of malware.

Why the other options are wrong

• A. Ransomware encrypts data and demands payment, typically not sending data to unauthorized destinations.
• B. Darkware is not a recognized or standard malware classification.
• D. Adware displays unwanted advertisements; it doesn't typically exfiltrate confidential data to unknown destinations.

Correct answer: B. Enterprise

Enterprise wireless networks support RADIUS authentication for secure access to internal resources across multiple access points and buildings. Enterprise mode is specifically designed for scalable, secure, centralized authentication in multi-building deployments. Mesh creates self-healing network paths, Ad hoc creates temporary peer-to-peer networks, and Point-to-point links two specific locations without the authentication infrastructure.

Why the other options are wrong

• A. Mesh networks create self-healing wireless paths but don't inherently support RADIUS authentication.
• C. Ad hoc mode creates temporary peer-to-peer connections without centralized authentication.
• D. Point-to-point wireless links two locations but doesn't support multiple user authentication.

Correct answer: B. Clientless

A clientless VPN (also called browser-based or web-based VPN) provides secure remote access to network resources through a web portal without requiring software installation on the client device. Users simply log in through a browser to access protected resources.

Why the other options are wrong

• A. A proxy acts as an intermediary for requests but is not a VPN type for remote access.
• C. Site-to-site VPN connects entire networks together, not individual users via web portal.
• D. Direct connect is a dedicated network connection, not a VPN technology.

Correct answer: A. Syslog

Syslog is the standard protocol for collecting and forwarding system log messages and event data from network devices and servers. It uses UDP port 514 by default, matching the requirement exactly. Syslog allows centralized logging of events from web servers and other network devices.

Why the other options are wrong

• B. SMTP is for email transmission, not event data collection.
• C. DNS is for hostname resolution, not event logging.
• D. DHCP is for IP address assignment, not event data transmission.

Correct answer: B. A partial infrastructure, software, and data on site

A warm site is defined as having partial infrastructure, software, and data already in place and ready for use. It represents the middle ground between a cold site (empty facility) and a hot site (fully operational duplicate). Option B accurately describes this state with partial readiness, allowing faster recovery than a cold site but lower ongoing costs than a hot site.

Why the other options are wrong

• A. This describes hybrid cloud services, not a physical disaster recovery site classification.
• C. This describes a cold site with only electrical infrastructure, lacking software and data.
• D. This describes a hot site with full infrastructure but outdated data, not a warm site.

Correct answer: B. Port mirroring

Port mirroring (SPAN) copies traffic from one or more switch ports to another port where the IDS can passively inspect it without disrupting the network. This allows the IDS to analyze traffic in real-time without being inline. SNMP traps are for alerts, syslog is for log collection, and API integration is for management; none provide the traffic duplication needed for passive monitoring.

Why the other options are wrong

• A. SNMP traps are for sending alerts, not capturing traffic
• C. Syslog collection gathers logs, not real-time traffic for inspection
• D. API integration is for device management, not traffic duplication

Correct answer: D. Network discovery

Network discovery is the most appropriate method for identifying all digital assets across multiple acquired sites without documentation. It uses automated tools to scan the network, identify devices, services, and systems currently in operation. While physical inventory could complement this, network discovery provides the comprehensive automated approach needed to quickly document unknown infrastructure across multiple sites.

Why the other options are wrong

• A. Availability monitoring tracks whether existing known systems are running, not for discovering unknown assets.
• B. Packet capture analyzes traffic patterns but does not systematically identify and document all digital assets.
• C. Physical inventory is labor-intensive and time-consuming compared to automated network discovery for large infrastructure.

Correct answer: D. MTBF

MTBF (Mean Time Between Failures) is the average time interval between failures of a device and is used to estimate the average lifespan or reliability expectancy of hardware. RPO and RTO are disaster recovery metrics, while MTTR measures repair time.

Why the other options are wrong

• A. RPO (Recovery Point Objective) measures data loss tolerance, not device lifespan.
• B. RTO (Recovery Time Objective) measures downtime tolerance, not device lifespan.
• C. MTTR (Mean Time To Repair) measures how long repairs take, not the device's average life.

Correct answer: D. Cloud-based traffic flows outside of the company's network.

A split-tunnel VPN configuration routes only traffic destined for the corporate network through the encrypted tunnel, while all other traffic, including cloud-based services and general internet browsing, flows directly from the user's device to its destination outside the company's network. This reduces the load on the corporate network's internet connection and infrastructure since cloud and internet traffic no longer needs to traverse company servers, making it a cost-effective design choice compared to full-tunnel VPNs that route all traffic through the corporate network.

Why the other options are wrong

• A. Split-tunnel VPNs do not force all web traffic through a company web filter since only corporate-bound traffic uses the tunnel.
• B. Split-tunneling actually reduces the bandwidth demand on the company's internet connection, it does not increase it.
• C. Split-tunnel VPNs reduce visibility into endpoint traffic since non-corporate traffic bypasses the company's monitoring systems entirely.

Correct answer: A. Evil twin

An evil twin attack involves unauthorized access points broadcasting the same or similar SSIDs as legitimate networks to trick users into connecting. The scenario describes multiple unauthorized APs near headquarters with similar SSIDs, which is the classic signature of an evil twin attack designed to intercept user traffic.

Why the other options are wrong

• B. Wi-Fi jamming involves transmitting signals to disrupt communications, not broadcasting similar SSIDs.
• C. On-path attacks intercept communications between two parties but don't involve broadcasting rogue APs.
• D. Wardriving is the act of searching for wireless networks by driving around, not setting up rogue APs.

Correct answer: B. Class B

After the expected growth the site has 160 users, and each user consumes two addresses for a computer and a phone, so roughly 320 host addresses are required. The question asks for a classful range, so the choice is between the default masks: class C is a /24 and provides only 254 usable hosts, which is short of 320, while class B is a /16 and provides 65,534. Class B is the smallest classful range that still fits the requirement.

Why the other options are wrong

• A. Class D is reserved for multicast and cannot be assigned to hosts at all.
• C. Class A supplies over 16 million hosts on its default /8, far beyond what a 160-user site needs when class B already covers it.
• D. Class C's default /24 caps out at 254 usable addresses, fewer than the 320 the site needs once every user has two devices.

Correct answer: A. Incorrect ACLs

A Layer 3 switch configuration update most commonly causes access problems when ACLs are modified. Incorrect ACLs can block traffic to the file server even though the device is reachable. This is the most probable cause following a configuration change, whereas the other options would typically produce different symptoms or wouldn't be caused by a recent update.

Why the other options are wrong

• B. A switching loop causes widespread network issues, not isolated access to one server.
• C. Duplicate IP addresses would cause intermittent connectivity for the affected device, not complete unreachability.
• D. Wrong default routes would affect all traffic, not just access to a specific server.

Correct answer: B. Twinaxial

Twinaxial cable (direct attach copper or DAC) is a special cable type that connects directly to QSFP (Quad Small Form-factor Pluggable) ports without requiring external transceivers. It's designed specifically for high-speed short-distance connections between switches and servers. Multimode and single-mode fibers require transceivers to convert signals, while Category 6 is twisted-pair copper cabling incompatible with QSFP ports.

Why the other options are wrong

• A. Multimode fiber requires QSFP transceivers to function with QSFP ports.
• C. RG11 is legacy coaxial cabling incompatible with QSFP technology.
• D. Category 6 is twisted-pair Ethernet cabling that uses different connector types than QSFP.

Correct answer: C. BGP

BGP (Border Gateway Protocol) is the de facto standard for interconnecting WANs and managing traffic between autonomous systems across the internet. It is an Exterior Gateway Protocol (EGP) designed specifically for WAN and inter-domain routing. IGP, EIGRP, and OSPF are Interior Gateway Protocols used within a single autonomous system or enterprise network, not for WAN interconnection.

Why the other options are wrong

• A. IGP (Interior Gateway Protocol) operates within a single autonomous system, not across WANs.
• B. EIGRP is an internal routing protocol, not designed for inter-WAN or inter-AS communication.
• D. OSPF is an interior routing protocol for intra-domain routing, not for WAN interconnection.

Correct answer: B. Rogue DHCP

The user has a valid IP configuration (can ping gateway), but cannot access network resources. This indicates the device received an IP address but cannot reach other resources. A rogue DHCP server would assign IPs that appear valid locally but prevent access to actual network resources by pointing clients to incorrect gateways or DNS servers. VLAN hopping and Evil twin require different attack vectors, and DDoS would affect multiple systems differently.

Why the other options are wrong

• A. VLAN hopping requires switch exploitation and would not allow the device to function with a valid gateway IP.
• C. DDoS affects availability globally and would show different symptoms across the network.
• D. Evil twin is a wireless attack and wouldn't prevent access when the device already has a valid IP configuration.

Correct answer: D. dig

Since IP addresses work but URLs fail, the issue is with DNS name resolution. The dig tool is a DNS query utility that allows the technician to test DNS resolution directly, diagnose DNS server issues, and verify whether hostnames are correctly resolving to IP addresses.

Why the other options are wrong

• A. tcpdump captures network packets but does not directly test DNS resolution.
• B. tracert traces the network path to a destination but will not help diagnose DNS resolution failures.
• C. nmap is a port scanning tool used for network discovery and security auditing, not for DNS troubleshooting.

Correct answer: D. RJ11

RJ11 is the standard connector for telephone lines and fax machines. It is a 4-pin or 6-pin modular connector used for analog phone service. Since the fax machine lost its dial tone when the phone cable was damaged, replacing the RJ11 connector on the damaged phone cable will restore the connection. F-type is for coaxial cable, RJ45 is for Ethernet, and SC is for fiber optic connections.

Why the other options are wrong

• A. F-type connectors are used for coaxial cables in cable TV and satellite systems, not telephone lines.
• B. RJ45 connectors are for Ethernet data cables, not telephone lines.
• C. SC connectors are for fiber optic cables, not telephone lines.

Correct answer: A. Colocated VMs

East-west traffic refers to communication between servers or resources within the same data center or network segment, rather than north-south traffic between clients and servers. Colocated VMs in the same infrastructure naturally generate significant east-west traffic as they communicate with each other. Hybrid cloud, client-server, and hub-and-spoke architectures are primarily designed for north-south (external) traffic patterns.

Why the other options are wrong

• B. Hybrid cloud emphasizes connectivity between on-premises and cloud, which is primarily north-south traffic.
• C. Client-server is the classic north-south architecture focused on external client requests.
• D. Hub and spoke is designed to route traffic through a central hub, reflecting north-south patterns.

Correct answer: B. BYOD

BYOD (Bring Your Own Device) is the policy that explicitly addresses employees using personal devices for work purposes. This policy covers the terms under which employees can use their own laptops, phones, or other devices to access company resources and networks. IAM governs identity management, DLP prevents data loss, and AUP defines acceptable use but doesn't specifically address personal device usage.

Why the other options are wrong

• A. IAM (Identity and Access Management) controls authentication and authorization, not personal device usage.
• C. DLP (Data Loss Prevention) prevents unauthorized data movement, not personal device policies.
• D. AUP (Acceptable Use Policy) defines general usage rules but doesn't specifically address personal device scenarios.

Correct answer: B. BGP

BGP (Border Gateway Protocol) is the standard dynamic routing protocol used on the internet. It is an exterior gateway protocol (EGP) designed to route traffic between autonomous systems (AS) on the internet and enables inter-domain routing at the global scale.

Why the other options are wrong

• A. EIGRP is an interior gateway protocol used within private networks, not on the internet.
• C. RIP is an older interior gateway protocol with limited use in modern networks.
• D. OSPF is an interior gateway protocol used within private networks or ISP internal networks, not for internet-wide routing.

Correct answer: B. TTL

TTL (Time To Live) is decremented by one each time a packet passes through a router hop. Tools that measure distance between internet locations, such as traceroute, use TTL to determine the number of hops and identify the path taken. GRE is a tunneling protocol, VPN is a security technology, and QoS relates to traffic prioritization.

Why the other options are wrong

• A. GRE is a tunneling encapsulation protocol, not related to hop counting.
• C. VPN is a security and privacy technology, not a hop metric.
• D. QoS manages traffic prioritization and quality parameters, not hop distance.

Correct answer: C. Cold site

A cold site describes a failover scenario that takes four weeks to become fully operational. Cold sites are preconfigured physical locations with infrastructure but no running systems or current data; they require significant time to restore services. This contrasts with hot sites (immediate failover) and warm sites (hours to days), making cold sites appropriate for non-critical recovery with extended RTO requirements.

Why the other options are wrong

• A. A hot site is immediately available and operational, not requiring four weeks.
• B. A warm site typically takes hours to days to become operational, not four weeks.
• D. Active-active approach provides real-time redundancy with simultaneous operation, not a four-week failover process.

Correct answer: A. EIGRP

EIGRP supports unequal-cost load balancing through its variance setting, which OSPF and RIP can't do. EIGRP runs directly over IP as protocol number 88. The question calls it port 88, but EIGRP doesn't use a TCP or UDP port. For comparison, OSPF is IP protocol 89 and BGP uses TCP port 179.

Why the other options are wrong

• B. BGP uses port 179, not port 88.
• C. RIP does not support unequal cost load balancing.
• D. OSPF uses IP protocol 89 and does not support unequal cost load balancing.

Correct answer: D. Rear

In hot aisle/cold aisle architecture, equipment exhaust should face the hot aisle (typically the rear), allowing hot air to be exhausted away from the cold aisle intake. This design maintains separation between hot and cold air, preventing hot air from being recirculated into cold intake areas, thereby maximizing cooling efficiency and equipment performance.

Why the other options are wrong

• A. Side exhaust doesn't align with hot aisle/cold aisle separation and would mix air streams.
• B. Top exhaust doesn't follow the directional hot aisle/cold aisle design principles.
• C. Front exhaust would direct hot air into the cold aisle, directly defeating the cooling architecture's purpose.

Correct answer: D. Network segmentation

Operational Technology (OT) devices require network segmentation to isolate them from standard IT infrastructure due to their critical nature, different security requirements, and potential vulnerabilities. Segmentation prevents lateral movement of threats and protects OT systems from IT-based attacks while allowing necessary monitoring and control.

Why the other options are wrong

• A. Honeynets are decoy systems for threat detection, not a primary security control for OT devices.
• B. Data-at-rest encryption protects stored data but doesn't address network-level OT security concerns.
• C. Time-based authentication controls access timing but is not the primary consideration when adding OT devices to a network.

Correct answer: A. ESP

ESP (Encapsulating Security Payload) is the IPsec protocol that encrypts all transmitted data end-to-end, providing confidentiality by encrypting the entire packet payload. ESP is the primary encryption mechanism in IPsec. AH provides authentication only, GRE is a tunneling protocol without encryption, and UDP and TCP are transport layer protocols that do not inherently encrypt data.

Why the other options are wrong

• B. AH (Authentication Header) provides authentication and integrity verification but does not encrypt data.
• C. GRE (Generic Routing Encapsulation) is a tunneling protocol that does not provide encryption.
• D. UDP is a transport layer protocol that does not provide encryption functionality.
• E. TCP is a transport layer protocol that does not provide encryption functionality.

Correct answer: C. Multicast

OSPF uses multicast addresses (224.0.0.5 for OSPF routers and 224.0.0.6 for designated routers) to communicate routing updates. Multicast allows OSPF to efficiently send updates to only relevant routers rather than broadcasting to all devices on the network.

Why the other options are wrong

• A. OSPF does not use unicast for standard routing updates; it uses multicast for efficiency.
• B. Anycast is not used by OSPF for routing updates.
• D. Broadcast would reach all devices on a segment, which is inefficient; OSPF uses targeted multicast instead.

Correct answer: A. NTP

NTP (Network Time Protocol) is critical for SIEM systems to properly correlate events across multiple systems. Since SIEM aggregates logs and events from many sources, accurate time synchronization is essential; without it, events cannot be properly sequenced and correlated. All systems must have synchronized clocks to ensure event ordering is accurate.

Why the other options are wrong

• B. DNS resolves domain names but is not essential for event correlation in SIEM.
• C. LDAP provides directory services and authentication but not time synchronization.
• D. DHCP assigns IP addresses but does not provide the time synchronization SIEM needs.

Correct answer: A. Spanning tree

Spanning Tree Protocol (STP) is specifically designed to prevent loops in redundant network topologies by intelligently blocking certain paths while keeping others active, ensuring only one active path exists between any two network segments. When switches are installed in parallel for redundancy, STP detects and blocks redundant paths to prevent broadcast storms and loops.

Why the other options are wrong

• B. CRC (Cyclic Redundancy Check) detects data corruption, not network loops.
• C. Jumbo frames increase the maximum frame size for performance, not loop prevention.
• D. Link aggregation combines multiple links for bandwidth, but doesn't prevent loops without STP.

Correct answer: C. A logical interface used for the routing of VLANs

A Switched Virtual Interface (SVI) is a logical interface created on a Layer 3 switch to enable routing between VLANs. SVIs allow the separation and routing of traffic from different VLANs (such as voice and data) through a single logical interface, enabling inter-VLAN communication while maintaining traffic separation.

Why the other options are wrong

• A. Physical interfaces are used for trunking; SVIs are logical constructs, not physical.
• B. While SVIs can be used for management, the primary use case here is VLAN routing, not management access.
• D. SVIs provide routing capabilities for VLANs, not a workaround for insufficient physical ports.

Correct answer: A. Port mirroring

Port mirroring (SPAN - Switched Port Analyzer) copies traffic from a source port to a destination port, allowing a monitoring device to capture and inspect the actual contents of data packets. This is the only method listed that directly captures full packet contents for deep inspection.

Why the other options are wrong

• B. Flow data provides summary statistics about traffic patterns, not detailed packet contents.
• C. Syslog entries record system events and messages, not the actual contents of data packets.
• D. SNMP traps are alerts and notifications about network events, not mechanisms for inspecting data contents.

Correct answer: A. DNS poisoning

DNS poisoning (also called DNS spoofing) corrupts DNS cache with false DNS records, causing domain names to resolve to attacker-controlled IP addresses. When users attempt to access a company website, the poisoned DNS response redirects them to a completely different website under the attacker's control.

Why the other options are wrong

• B. Denial-of-service attacks make services unavailable but don't redirect users to different websites.
• C. Social engineering manipulates users through deception but doesn't automatically redirect traffic.
• D. ARP spoofing redirects traffic to the attacker's machine on the local network, not to an entirely different website.

Correct answer: A. Mesh

A mesh network is the best solution for public safety vehicles because it provides reliable, self-healing coverage across an area. Mesh networks automatically reroute traffic around obstacles and failed nodes, ensuring continuous connectivity as vehicles move throughout the service area. The decentralized nature of mesh networks eliminates single points of failure, which is critical for public safety operations.

Why the other options are wrong

• B. Ad hoc networks are temporary and lack the reliability and centralized management needed for critical public safety infrastructure.
• C. Point-to-point networks only connect two specific locations and cannot provide the widespread coverage needed for mobile vehicles.
• D. Infrastructure mode requires fixed access points and doesn't provide the self-healing, distributed resilience that mobile public safety operations require.

Correct answer: A. Duplicate the problem.

Duplicating the problem is the standard step to confirm a theory in troubleshooting methodology. By reproducing the issue, the technician verifies that the suspected cause is actually responsible. Identifying symptoms and gathering information occur earlier in the process, and determining changes is a separate investigative step, but reproducing the problem is the confirmation step.

Why the other options are wrong

• B. Identifying symptoms is an early step, not the confirmation step
• C. Gathering information is an investigative step, not the confirmation step
• D. Determining changes is part of information gathering, not theory confirmation

Correct answer: B. netstat

netstat displays network connections and listening ports. Since ping succeeds (network layer works) but browsers cannot reach the web server, the issue is likely that the web server is not listening on the expected port or a firewall is blocking it. netstat will reveal if port 80/443 is open and listening. traceroute, tcpdump, and arp diagnose different issues (routing, packet capture, ARP resolution).

Why the other options are wrong

• A. traceroute diagnoses routing problems, but the ping already confirms basic connectivity.
• C. tcpdump captures packets but is more diagnostic; netstat should be checked first.
• D. arp diagnoses ARP resolution issues, which would affect ping, not just HTTP.

Correct answer: B. The network has too much overlap.

All three mesh nodes are on the same channel, 11, so their overlapping cells share one slice of airtime with each other and with every client. Radios on a shared channel contend for the medium and collide, and the packet capture shows the result as retransmitted frames, which the user feels as latency.

Spreading the nodes across non-overlapping channels (1, 6 and 11 on 2.4 GHz, or 5 GHz for the backhaul) and reducing how much their coverage overlaps fixes it. Identical SSIDs are normal for a mesh, and nothing suggests incompatible devices.

Why the other options are wrong

• A. Having the same SSID for mesh nodes is correct practice for seamless roaming; identical SSIDs enable the mesh network to function properly.
• C. If devices were incompatible with the mesh network, they likely would not connect at all rather than experience retransmissions indicating connection issues.
• D. The -83 and -91 dBm readings are weak, but readings taken from one spot usually show the farther nodes weaker, and the nearest node is heard at a usable -70 dBm. Low power wouldn't explain the retransmissions as well as three nodes sharing channel 11 does.

Correct answer: B. Speed/duplex mismatch

When the Ethernet cable was swapped between File01 and File02, the performance problem moved with the port, not the server. This indicates a port-specific issue. Speed/duplex mismatch on that particular switch port would cause performance degradation that transfers to whichever server is connected to it.

Why the other options are wrong

• A. Port security would block or limit traffic, not follow the physical cable swap
• C. PoE power budget wouldn't affect server performance and wouldn't follow the cable swap
• D. Keep-alive beacon failure is not a standard network issue and wouldn't explain the symptom pattern

Correct answer: C. Access point

An Access Point (AP) is the network device specifically designed to convert wireless signals (radio frequency) into electronic signals that can be transmitted over wired networks and vice versa. It acts as the bridge between wireless clients and the wired network infrastructure. Routers manage traffic, firewalls filter traffic, and load balancers distribute connections; none of these are primarily responsible for wireless signal conversion.

Why the other options are wrong

• A. Routers direct traffic between networks but don't specifically convert wireless signals.
• B. Firewalls filter traffic but are not responsible for wireless signal conversion.
• D. Load balancers distribute traffic across servers, not involved in wireless conversion.

Correct answer: D. Four

To accommodate 14 hosts per subnet, you need enough host bits to represent at least 14 addresses (14 usable hosts plus network and broadcast addresses = 16 total). 2^4 = 16, so 4 host bits are required. With 4 host bits, you get /28 subnets from a /24 Class C network.

Why the other options are wrong

• A. One host bit provides 2^1 = 2 addresses, insufficient for 14 hosts.
• B. Two host bits provide 2^2 = 4 addresses, insufficient for 14 hosts.
• C. Three host bits provide 2^3 = 8 addresses, insufficient for 14 hosts.

Correct answer: B. 802.1Q tagging

802.1Q tagging allows a single physical link between Layer 2 switches to carry traffic from multiple VLANs (networks). This is the standard protocol for VLAN tagging and enables inter-switch communication across different networks. Jumbo frames affect frame size, native VLAN is a configuration concept, and link aggregation combines physical links for bandwidth.

Why the other options are wrong

• A. Jumbo frames increase frame size but do not enable multi-network transfers.
• C. Native VLAN is a configuration setting, not a mechanism for transferring multiple networks.
• D. Link aggregation bundles links for increased bandwidth, not for multi-network support.

Correct answer: A. Channel width configuration

The significant throughput difference (75Mbps vs 500Mbps) between an autonomous AP and others suggests a hardware capability mismatch. Channel width directly impacts throughput; a narrower channel width (20MHz vs 40/80MHz) would substantially reduce speed. DNS, authentication, and DHCP issues would affect connectivity or latency but not cause such a dramatic throughput reduction while still maintaining functional connectivity.

Why the other options are wrong

• B. DNS issues would cause resolution problems, not throughput reduction on a working connection.
• C. Authentication failure would prevent connection entirely, not allow a connection with reduced speed.
• D. Incorrect DHCP settings would cause IP assignment issues or connectivity problems, not selectively reduce throughput.

Correct answer: C. Baseline

After a merger, the company needs to establish a baseline of normal utilization metrics to understand what constitutes 'extremely high' usage and to differentiate between merged network behavior and genuine alerts. A baseline provides the reference point needed to set appropriate alerting thresholds for the newly combined infrastructure.

Why the other options are wrong

• A. SLAs define service level agreements but don't help measure current utilization patterns
• B. Network diagrams show topology but don't capture utilization metrics needed for alerting
• D. Heat maps visualize data but must be based on baseline data first

Correct answer: A. A router with only one available LAN port

Subinterfaces allow a single physical port to be configured as multiple logical interfaces, enabling a router with one LAN port to host multiple virtual networks (VLAN routing). This is a common solution when physical ports are limited. The other options are unrelated to the need for subinterfaces: firewalls use DPI regardless, hubs don't support subinterfaces, and STP is a Layer 2 loop prevention mechanism.

Why the other options are wrong

• B. Deep packet inspection is a firewall function independent of subinterfaces
• C. Hubs do not support subinterfaces or VLANs
• D. Spanning Tree Protocol prevents loops but does not require subinterfaces

Correct answer: B. Network

The Network Layer (Layer 3) uses the connectionless protocol IP (Internet Protocol). IP does not establish a connection before sending packets; it simply delivers them on a best-effort basis without acknowledgment or connection setup.

Why the other options are wrong

• A. The Physical Layer deals with electrical signals and media, not protocols.
• C. The Transport Layer includes both connection-oriented (TCP) and connectionless (UDP) protocols, but UDP is the connectionless example.
• D. The Application Layer protocols vary; many are connection-oriented (HTTP, SMTP) while others are connectionless.

Correct answer: B. Jumbo frames

Jumbo frames increase the maximum transmission unit (MTU) size from the standard 1500 bytes to typically 9000 bytes, reducing protocol overhead and increasing efficiency by allowing more data per frame. This directly reduces overhead and increases throughput for storage networks handling large data transfers.

Why the other options are wrong

• A. Link speed determines bandwidth capacity but does not reduce overhead or improve frame efficiency.
• C. QoS manages traffic prioritization and quality but does not reduce overhead for increased efficiency.
• D. 802.1q tagging adds VLAN information but increases frame size and overhead rather than reducing it.

Correct answer: B. Network

IP addresses operate at Layer 3 (Network Layer) of the OSI model. The Network Layer is responsible for logical addressing, routing, and forwarding packets across networks using IP addresses. When troubleshooting IP address issues such as incorrect assignments, DHCP problems, or routing issues, the administrator must work at Layer 3 to diagnose and resolve the problem.

Why the other options are wrong

• A. Data link (Layer 2) handles MAC addresses, not IP addresses.
• C. Session (Layer 5) manages session establishment and maintenance, not addressing.
• D. Presentation (Layer 6) handles data formatting and encryption, not IP addressing.

Correct answer: D. SNMPv3

SNMPv3 is the only option that provides both authentication and encryption for device monitoring. SNMPv1 and SNMPv2c lack security features, while SNMPv3 includes authentication (using MD5 or SHA) and encryption (using DES or AES) capabilities. SIEM, Syslog, and NetFlow do not inherently provide authentication and encryption at the protocol level for monitoring itself.

Why the other options are wrong

• A. SIEM is a log management and analysis tool, not a protocol that provides authentication and encryption for device monitoring.
• B. Syslog transmits logs in plaintext without authentication or encryption.
• C. NetFlow collects traffic flow data but does not provide authentication or encryption mechanisms.

Correct answer: C. OSPF

OSPF (Open Shortest Path First) is characterized by fast convergence and being loop-free. It uses the Dijkstra algorithm to calculate shortest paths and is link-state based, which provides rapid reconvergence when network topology changes occur. OSPF also prevents routing loops through its algorithm design.

Why the other options are wrong

• A. BGP is an exterior routing protocol, not an interior routing protocol.
• B. STP is a bridging protocol that prevents loops at Layer 2, not a routing protocol.
• D. RIP has slow convergence (up to 3 minutes) and is distance-vector based, making it less efficient than OSPF.

Correct answer: C. A root bridge needs to be identified.

The exhibit shows two links between the switches, and all four ports are forwarding. With nothing blocking, the two links form a Layer 2 loop: broadcasts circulate between the switches without end, the broadcast storm swamps the links and the MAC address tables, and users lose connectivity as soon as the new switch is connected.

Spanning tree prevents this by electing a root bridge and then blocking the redundant port on the other switch. In the exhibit, spanning tree isn't blocking anything, which is what happens when no root bridge is in control of the topology. Identifying a root bridge (for example, giving the existing switch the lower bridge priority) lets STP put one of the new switch's ports into blocking, which removes the loop and keeps the second link as a backup.

Why the other options are wrong

• A. Port cost differences affect path selection but do not typically cause a total loss of connectivity if a root bridge is properly established.
• B. Link aggregation combines multiple physical links into one logical link for bandwidth and redundancy, but it is unrelated to resolving spanning tree topology issues caused by root bridge misconfiguration.
• D. Switching to RSTP could speed convergence, but it does not address the underlying problem of an unidentified or improperly configured root bridge.

Correct answer: D. IPSec

IPSec is the most secure option for site-to-site connectivity because it provides encryption, authentication, and integrity checking at the IP layer. It is the industry standard for establishing secure VPN tunnels between sites. VXLAN and GRE lack encryption, while IKE is a key exchange protocol but not a complete tunneling solution.

Why the other options are wrong

• A. VXLAN is a tunneling protocol but does not provide encryption.
• B. IKE is a key exchange protocol used within IPSec but is not a complete site-to-site solution.
• C. GRE is a tunneling protocol but does not provide encryption or security.

Correct answer: C. The port had an incorrect VLAN assignment.

A VoIP phone unable to receive or place calls on one switchport but working on another suggests a VLAN assignment problem. VoIP phones typically require assignment to a voice VLAN separate from data traffic. If the original port was assigned to the wrong VLAN (likely the data VLAN instead of the voice VLAN), the phone would power up but be unable to reach the call controller and process calls.

Why the other options are wrong

• A. Half-duplex configuration would cause performance degradation and collisions, not complete call failure.
• B. An error-disabled state would prevent the port from functioning at all, not allow the device to power up.
• D. PoE budget issues would prevent the phone from powering up, not allow it to power up but fail to call.

Correct answer: B. 20MHz

In the 2.4GHz spectrum, using 20MHz channel width minimizes interference in dense, overlapping coverage environments. The 2.4GHz band has only three non-overlapping channels, and narrower channel widths reduce the likelihood of interference with neighboring access points. Wider channels (40MHz, 80MHz, 160MHz) consume more spectrum and increase interference risk.

Why the other options are wrong

• A. 11MHz is not a standard channel width option for WiFi.
• C. 40MHz channel width uses twice the spectrum and increases interference in dense deployments.
• D. 80MHz is not typically available in 2.4GHz and would cause significant interference.
• E. 160MHz is not available in 2.4GHz spectrum.

Correct answer: A. A VLAN with 100Mbps speed limits

A VLAN with speed limits (QoS) allows the network engineer to prioritize and limit videoconferencing traffic to specific thresholds, preventing it from consuming all available bandwidth and impacting other network services. This addresses the CIO's concern about network capacity at peak traffic times.

Why the other options are wrong

• B. An IP helper directs VoIP traffic to servers but does not control bandwidth or address capacity concerns.
• C. A smaller subnet mask reduces the number of available IPs but does not address bandwidth or traffic threshold concerns.
• D. Full duplex on user ports improves communication efficiency but does not inherently limit traffic to prevent threshold concerns.

Correct answer: A. Power redundancy

A second PDU provides power redundancy by distributing power supplies across multiple independent power distribution units. If one PDU fails or loses power, the other PDU can continue supplying power to the equipment, ensuring continuous operation. This is critical for infrastructure with redundant power supplies.

Why the other options are wrong

• B. Failed PSU monitoring can be handled by a single intelligent PDU; a second PDU isn't needed for this.
• C. Surge protection is a feature of PDU design, not addressed by adding a second unit.
• D. Electricity conservation is unrelated to having multiple PDUs; it's about power efficiency, not redundancy.

Correct answer: B. Infrastructure

An infrastructure network topology is the standard enterprise wireless architecture where multiple WAPs (wireless access points) are centrally managed by a wireless LAN controller. This allows centralized configuration, security policies, and roaming. Mesh networks are self-healing but decentralized, point-to-point links two devices, and ad hoc networks operate without central control.

Why the other options are wrong

• A. Mesh networks are decentralized and self-healing, not controlled by a central controller.
• C. Point-to-point connects only two devices, not suitable for multiple WAPs.
• D. Ad hoc networks lack centralized control and are not designed for enterprise deployment.

Correct answer: C. ESP

ESP (Encapsulating Security Payload) provides confidentiality by encrypting the entire data payload, ensuring the data stream remains confidential. GRE is a tunneling protocol without encryption, IKE is a key exchange protocol, and AH (Authentication Header) provides integrity and authentication but not confidentiality.

Why the other options are wrong

• A. GRE is a tunneling protocol that does not provide encryption or confidentiality.
• B. IKE is a key management protocol used to establish security associations, not for data confidentiality.
• D. AH provides authentication and integrity checking but does not encrypt data for confidentiality.

Correct answer: A. ACLs

ACLs (Access Control Lists) are used to control and segment network traffic between security zones by defining which traffic is allowed or denied between departments, making them the primary tool for implementing departmental security zones.

Why the other options are wrong

• B. Port security controls which devices can connect to switch ports based on MAC addresses, not for creating security zones between departments.
• C. Content filtering inspects and blocks specific types of content, not for creating network security zones.
• D. NAC controls device access based on compliance policies but is not the primary mechanism for creating departmental security zones.

Correct answer: A. 2.4GHz

Microwave ovens operate at 2.4GHz, the same frequency band used by Wi-Fi and many other wireless devices. The electromagnetic radiation from microwaves causes significant interference in the 2.4GHz band, leading to wireless connectivity loss. The 5GHz, 6GHz, and 900MHz bands are not affected by microwave interference.

Why the other options are wrong

• B. 5GHz Wi-Fi is not significantly affected by microwave oven interference.
• C. 6GHz is a newer Wi-Fi band that does not overlap with microwave frequencies.
• D. 900MHz isn't used for laptop Wi-Fi (only the low-power 802.11ah standard for IoT devices uses sub-1 GHz bands), and it's far below the microwave oven's 2.45GHz.

Correct answer: D. SC

SC connectors are the standard fiber optic connectors used for terminating fiber cables to patch panels in main distribution frames (MDFs). They are push-pull connectors commonly used in data center and telecom environments. F-type is for coaxial cables, RJ11 for telephone lines, and BNC for legacy coaxial connections.

Why the other options are wrong

• A. F-type connectors are used for coaxial cable (cable TV, satellite), not fiber.
• B. RJ11 is used for telephone lines and low-speed data, not fiber.
• C. BNC connectors are used for legacy coaxial cable, not fiber optic.

Correct answer: D. SAML

SAML (Security Assertion Markup Language) is an XML-based standard that enables single sign-on by securely passing authentication and user attribute information between identity providers and service providers. IAM is a broad concept not XML-based, MFA is multi-factor authentication unrelated to XML protocols, and RADIUS is an authentication protocol that predates and differs from SAML's XML approach.

Why the other options are wrong

• A. IAM is a management framework, not an XML-based protocol for passing user information.
• B. MFA is multi-factor authentication, not an XML-based federation standard.
• C. RADIUS is a protocol for authentication but uses a different mechanism, not XML.

Correct answer: A. OOB management

Out-of-Band (OOB) management allows administrators to access and manage servers through a separate management network or connection that is independent of the primary network infrastructure. When a server is physically unreachable through normal means, OOB management provides an alternative pathway to access the system for troubleshooting, configuration, and recovery.

Why the other options are wrong

• B. A crash cart is a physical tool requiring on-site presence, which contradicts the 'remote site' requirement.
• C. A jump box is used for accessing systems on the same network but doesn't help when the server is physically unreachable.
• D. Console access typically requires physical proximity to the server or direct network connectivity.

Correct answer: A. Reverse the fibers.

When a fiber connection shows no indicator light, the first troubleshooting step should be to reverse the fibers because the transmit (TX) and receive (RX) fibers may be reversed. This is a simple, non-destructive check that often resolves the issue immediately without requiring retermination or inspection.

Why the other options are wrong

• B. Reterminating the fibers is more time-consuming and should only be done after simpler troubleshooting steps.
• C. Verifying fiber size is typically a pre-installation consideration, not a troubleshooting step for a non-functioning connection.
• D. Visual inspection of cable runs is useful but should come after checking the more obvious issue of fiber reversal.

Correct answer: C. Log in to each of the connected networking devices and perform the process again.

LLDP (Link Layer Discovery Protocol) only discovers devices directly connected to the current device, as it operates at Layer 2 and only propagates one hop. To discover all devices in the network topology, the technician must log into each directly connected device and repeat the LLDP discovery process, progressively mapping the entire network by moving from device to device. This hop-by-hop approach reveals the complete network topology.

Why the other options are wrong

• A. Reconfiguring IP addresses doesn't change LLDP's one-hop limitation.
• B. Spanning Tree Protocol is for loop prevention, not device discovery.
• D. Upgrading LLDP won't change its fundamental one-hop discovery limitation by design.

Correct answer: B. Trusted

A Trusted security zone is designed to control access to resources for individuals within the corporation only. It represents the internal network with authenticated users and devices, providing the appropriate level of access control for corporate resources. An Extranet extends beyond the corporation to partners, a VPN is a connectivity method rather than a zone classification, and Public zones are for external/untrusted access.

Why the other options are wrong

• A. Extranet zones are for external partners and vendors, not internal-only access.
• C. VPN is a connectivity mechanism, not a security zone classification.
• D. Public zones are for untrusted external users, opposite of internal-only access.

Correct answer: C. Branching

Branching in source control allows administrators to create separate parallel copies of configurations where changes can be tested and developed without affecting the primary production configuration. This enables testing of new configurations in an isolated environment before merging changes back to the main branch.

Why the other options are wrong

• A. A central repository stores configurations but doesn't inherently allow testing without changing the primary configuration.
• B. Conflict identification helps detect overlapping changes but doesn't provide a mechanism for isolated testing.
• D. Version control tracks changes over time but doesn't provide the isolation needed for safe testing of new configurations.

Correct answer: A. Social engineering

Social engineering is the practice of manipulating people into divulging confidential information or performing actions that compromise security. Pretending to be from the help desk to obtain user credentials is a classic social engineering attack that exploits human trust and authority.

Why the other options are wrong

• B. Tailgating is physically following someone through a secured door without authentication.
• C. Shoulder surfing is observing someone's screen or keyboard without their knowledge.
• D. Smishing is phishing attacks conducted via SMS text messages.
• E. Evil twin is a rogue Wi-Fi access point impersonating a legitimate network.

Correct answer: D. Link aggregation

To take advantage of a 40Gbps broadband connection on a 10G switch, link aggregation must be configured to bond multiple 10Gbps ports together. This combines the bandwidth of multiple physical ports to create a 40Gbps logical connection.

Why the other options are wrong

• A. 802.1Q tagging is for VLAN configuration, not for increasing bandwidth capacity
• B. Jumbo frames increase frame size but do not add bandwidth capacity needed for 40Gbps service
• C. Half duplex reduces throughput and is obsolete; full duplex is used in modern networks

Correct answer: C. Establish a plan of action.

The correct troubleshooting methodology sequence is: identify the problem, establish a theory of probable cause, test the theory, and if confirmed, establish a plan of action to resolve it. After testing the theory to determine cause, the next step is to create an action plan before implementation.

Why the other options are wrong

• A. Verifying full system functionality comes after the plan of action is implemented, not immediately after testing the theory
• B. Documentation occurs at the end of the entire troubleshooting process
• D. Identifying the problem is the first step, not a step that follows testing the theory

Correct answer: A. BNC

External antennas attach through coaxial RF connectors, and BNC is the only coaxial connector among the choices. ST, LC and MPO are all fiber-optic connectors. In practice, most Wi-Fi equipment uses RP-SMA or N-type coaxial connectors for detachable antennas.

Why the other options are wrong

• B. ST is a fiber optic connector for network cables, not RF antennas.
• C. LC is a fiber optic connector for network cables, not RF antennas.
• D. MPO is a multi-fiber optic connector for network cables, not RF antennas.

Correct answer: D. Secure Shell

Secure Shell (SSH) provides a lightweight, encrypted, and secure connection to remote devices with authentication. It's ideal for console access to remote network equipment. Site-to-site VPN is for network-to-network connections, Telnet is unencrypted and insecure, and Console access requires physical proximity; only SSH meets all criteria of lightweight, private, and remote.

Why the other options are wrong

• A. Site-to-site VPN is designed for network-to-network connections, not individual remote box access.
• B. Telnet transmits credentials in cleartext and is not secure for remote administration.
• C. Console access requires direct physical connection to the device, not remote capability.

Correct answer: A. It relies upon other layers for packet delivery.

The application layer, Layer 7 of the OSI model, provides network services directly to end-user applications through protocols such as HTTP, FTP, SMTP and DNS. It does not move data itself. It hands what the application produces to the layers beneath it and depends on them entirely: on the transport layer for reliable delivery and retransmission, on the network layer for routing, and on the data link and physical layers for putting frames on the wire. That reliance on the layers below for packet delivery is what characterises Layer 7.

Why the other options are wrong

• B. Checking independently for packet loss is a function of the transport layer (e.g., TCP), not the application layer.
• C. Encryption in transit is typically handled by the presentation layer or protocols like TLS operating below the application layer, not by the application layer itself.
• D. Address translation, such as NAT, is performed at the network layer, not the application layer.

Correct answer: D. Temperature and humidity control

Electrostatic discharge (ESD) occurs when there is a sudden flow of electricity between two objects with different electrical potentials, often triggered by low humidity and friction, such as walking across carpet in a dry environment. Maintaining proper environmental controls, specifically keeping humidity at recommended levels (typically around 40-60%) and temperature within stable ranges, significantly reduces the buildup of static electricity in a data center or server room. Humidity helps dissipate static charges before they can accumulate to damaging levels, making temperature and humidity control the most effective preventive measure against ESD among the given options.

Why the other options are wrong

• A. An uninterruptable power supply protects against power loss and outages, not static electricity buildup.
• B. A surge protector guards equipment against voltage spikes from the power line, not electrostatic discharge.
• C. Power distribution units manage and distribute electrical power to equipment but do not address static electricity or humidity levels.

Correct answer: A. IP Helper

An IP Helper (DHCP relay) forwards DHCP requests from clients on one network segment to a DHCP server located on a different network segment. This allows a new department to obtain IP addresses from a centralized DHCP server without requiring a local DHCP server on their network.

Why the other options are wrong

• B. A reservation statically assigns an IP to a specific client; it doesn't solve the problem of reaching a remote DHCP server.
• C. An exclusion removes addresses from a scope but doesn't enable communication with a remote DHCP server.
• D. A scope defines the range of addresses a DHCP server distributes but doesn't enable reaching a server on another network.

Correct answer: B. Power budget exceeded

When installing multiple PoE devices like 35 security cameras, exceeding the power budget of the PoE switch is the most likely cause of some cameras not working. Each PoE port supplies limited power, and the total power supplied by the switch is finite. Installing many power-hungry devices can exceed this budget, leaving insufficient power for some cameras.

Why the other options are wrong

• A. Incorrect wiring standards would have been caught during the cable testing phase.
• C. Signal attenuation affects data transmission but not power delivery, and would not have passed testing.
• D. Wrong voltage would cause immediate failure of all cameras using that voltage, not just some.

Correct answer: C. Increase the scope size.

Increasing the DHCP scope size directly addresses the issue of insufficient IP addresses. With more students arriving, the existing scope has exhausted available addresses, preventing new clients from obtaining IPs. Expanding the scope pool provides more available addresses for the increased user population.

Why the other options are wrong

• A. IP helper is used to relay DHCP requests across routers and doesn't increase available addresses.
• B. Changing the subnet mask would complicate network management and doesn't directly solve address exhaustion.
• D. Address exclusions remove addresses from the pool, worsening the shortage rather than solving it.

Correct answer: A. Infrastructure as a service

Infrastructure as a Service (IaaS) provides virtualized computing resources over the internet and enables lift-and-shift migrations where on-premises servers are migrated to cloud-based virtual machines with minimal modification, preserving the existing OS and application stack.

Why the other options are wrong

• B. Infrastructure as code is a methodology for defining infrastructure through code; it doesn't represent a cloud service model for server migration.
• C. Software as a Service (SaaS) provides fully managed applications in the cloud, not the underlying infrastructure for migrating existing servers.
• D. Software-defined networking is a networking architecture approach, not a cloud service model for server migration.

Correct answer: B. TLS

TLS (Transport Layer Security) is the cryptographic protocol that provides encryption in transit for HTTPS. TLS encrypts the data traveling between the client and server, replacing the older SSL protocol.

Why the other options are wrong

• A. SSH is used for secure remote shell access, not for HTTPS web traffic encryption.
• C. SCADA is an industrial control system, not an encryption protocol.
• D. RADIUS is an authentication protocol, not used for HTTPS encryption.

Correct answer: D. 255.255.255.240

A /28 subnet mask (255.255.255.240) provides 16 total addresses with 14 usable addresses (16 - 2 for network and broadcast). This is the smallest subnet that meets the requirement of six usable IP addresses while being the most efficient allocation.

Why the other options are wrong

• A. /25 (255.255.255.128) provides 126 usable addresses, more than needed.
• B. /26 (255.255.255.192) provides 62 usable addresses, more than needed.
• C. /27 (255.255.255.224) provides 30 usable addresses, more than needed.

Correct answer: A. 22

SFTP (SSH File Transfer Protocol) operates over SSH and uses port 22. It provides secure file transfer with encryption and authentication built into the SSH protocol.

Why the other options are wrong

• B. Port 80 is used for HTTP web traffic, not SFTP.
• C. Port 443 is used for HTTPS web traffic, not SFTP.
• D. Port 3389 is used for RDP (Remote Desktop Protocol), not SFTP.

Correct answer: C. Access point

An access point (AP) is specifically designed to extend wireless network coverage and allow multiple devices to connect to the same WLAN within its designated service area. Access points broadcast SSID beacons and handle wireless client associations to provide extended footprint coverage.

Why the other options are wrong

• A. A router primarily routes traffic between networks and may have limited wireless range compared to dedicated APs.
• B. A switch operates at layer 2 and provides wired connectivity, not wireless WLAN extension.
• D. A firewall is a security device that filters traffic, not a device for extending WLAN coverage.

Correct answer: B. SLA

A Service Level Agreement (SLA) is a contract that guarantees the availability and performance of cloud resources, specifying uptime percentages and compensation if those guarantees are not met. It directly addresses the guaranteed availability concern for cloud services.

Why the other options are wrong

• A. IPAM (IP Address Management) manages IP address allocation, not availability guarantees.
• C. MTBF (Mean Time Between Failures) is a reliability metric but doesn't guarantee availability in contractual terms.
• D. EOL (End of Life) indicates when a product is no longer supported, not availability guarantees.

Correct answer: D. A microwave is in the office.

A microwave oven is the most likely culprit because it operates on the 2.4GHz frequency band and causes significant electromagnetic interference in that range. Since the WAP was recently moved, it may now be positioned closer to a microwave or other 2.4GHz interference source. Microwaves are a well-known cause of intermittent wireless connectivity issues in office environments. While excessive noise could also cause problems, the specific mention of a 2.4GHz network and a recent move makes microwave interference the most direct explanation.

Why the other options are wrong

• A. Non-overlapping channels would actually help prevent interference, not cause it.
• B. Signal reflection (multipath) typically causes slower performance or dead zones but not the kind of intermittent office-wide issues described.
• C. While excessive noise is possible, the most common and likely cause in a 2.4GHz office environment is microwave interference specifically.

Correct answer: B. The router interface is a broadcast address.

With a /28 mask (255.255.255.240) the subnet holding both addresses is 10.0.0.80/28: the usable host range is 10.0.0.81 through 10.0.0.94 and 10.0.0.95 is the broadcast address. The administrator assigned that broadcast address to the router interface, so the interface has no valid host address on the segment and cannot forward packets to the web server at 10.0.0.81. Reassigning the interface to any address in 10.0.0.81 through 10.0.0.94 restores routing.

Why the other options are wrong

• A. Both addresses fall inside 10.0.0.80/28, so the web server is on the same subnet as the router interface, not a different one.
• C. 10.0.0.0 is class A by default, but the interface here is masked to /28 and the class of the address is not what stops the traffic.
• D. Private address space routes normally inside an internal network, so being in 10.0.0.0/8 is not the reason the packets are dropped.

Correct answer: B. Tailgating

Tailgating (also called piggybacking) is when an attacker follows an authorized person through a secured entrance before the door closes. This exploits the trust placed in badge-secured systems and the human tendency not to challenge someone appearing to follow them through a door.

Why the other options are wrong

• A. Shoulder surfing involves looking over someone's shoulder to steal information like passwords.
• C. Phishing is a social engineering attack using deceptive emails or messages.
• D. On-path (man-in-the-middle) is a network attack intercepting communications.

Correct answer: C. On-path attack

An on-path attack (formerly called man-in-the-middle) positions an attacker between source and destination to intercept, monitor, and potentially modify traffic. Self-signed certificates relate to encryption, VLAN hopping is switch exploitation, and phishing is social engineering. None directly intercept traffic between source and destination.

Why the other options are wrong

• A. Self-signed certificates are related to encryption mechanisms, not traffic interception.
• B. VLAN hopping exploits switch configuration but doesn't intercept traffic between source and destination.
• D. Phishing is a social engineering attack to obtain credentials, not a traffic interception technique.

Correct answer: C. The IP address was not reserved.

If the IP address (10.0.100.19) was not reserved in DHCP, the lease could have expired or been reassigned to another device, causing the hostname TS19 to resolve to an unreachable IP. A non-reserved address is vulnerable to dynamic reassignment, which explains why the ping fails after the recent inability to connect.

Why the other options are wrong

• A. If users were on the wrong subnet, they wouldn't be able to ping the IP at all initially, but this was working before.
• B. DHCP renewal would assign a new address, but the question asks about a specific IP that is now unreachable.
• D. Changing the hostname wouldn't make the IP address unreachable; the IP would still be valid regardless of hostname.

Correct answer: A. Spanning Tree Protocol

Spanning Tree Protocol (STP) prevents loops in redundant link topologies by selectively blocking ports while keeping backup links ready. This allows multiple physical connections between switches without broadcast storms while enabling failover capabilities.

Why the other options are wrong

• B. Switch Virtual Interfaces are for inter-VLAN routing, not for uplink redundancy.
• C. Native VLAN configuration is unrelated to uplink redundancy or throughput.
• D. First Hop Redundancy Protocol is for gateway redundancy, not switch-to-switch uplink aggregation.

Correct answer: A. Subinterfaces

Subinterfaces allow a single physical router interface to be divided into multiple logical interfaces, each assigned to a different VLAN. This enables inter-VLAN routing without requiring additional hardware. VXLAN is for overlay networks over larger distances, a Layer 3 switch would require purchasing hardware which is prohibited by the scenario, and VIP is a load balancing concept.

Why the other options are wrong

• B. VXLAN is designed for large-scale network overlays, not single-router VLAN routing.
• C. A Layer 3 switch would accomplish the goal but requires purchasing additional hardware, which the scenario prohibits.
• D. VIP (Virtual IP) is used for load balancing and redundancy, not inter-VLAN communication.

Correct answer: A. To encrypt sensitive data in transit

An insurance brokerage handles highly sensitive financial and personal client information. The primary reason to enforce VPN usage is to encrypt sensitive data in transit, protecting confidential information from interception. This is especially critical for an organization dealing with client financial and healthcare data that requires confidentiality.

Why the other options are wrong

• B. While VPNs can contribute to endpoint security, endpoint protection is typically handled by dedicated security tools, not VPNs alone.
• C. VPN enforcement alone doesn't directly maintain contractual agreements; compliance with agreements requires multiple security measures.
• D. Data retention requirements are met through backup and archival policies, not through VPN usage.

Correct answer: C. VPC

A VPC (Virtual Private Cloud) is the primary mechanism for segmenting compute resources within a single cloud account. It provides logical isolation of cloud resources, allowing users to define their own network topology, IP address ranges, and security policies. Network security groups operate at a lower layer for traffic filtering, IaaS is a service model, and hybrid cloud refers to multi-environment deployments.

Why the other options are wrong

• A. Network security groups filter traffic but don't segment the compute resources themselves.
• B. IaaS is a service delivery model, not a segmentation mechanism.
• D. Hybrid cloud involves multiple environments, not segmentation within a single account.

Correct answer: C. 224.0.0.1

224.0.0.1 is a Class D multicast address used for group-based communications. Video streaming to multiple computers in a group requires multicast, making this the appropriate IP range for ACL rules. 127.0.0.1 is loopback, 172.17.1.1 is unicast, and 240.0.0.1 is reserved; none support group multicast delivery.

Why the other options are wrong

• A. 127.0.0.1 is a loopback address for local testing only, not for network group communication.
• B. 172.17.1.1 is a unicast private address meant for single destinations, not multicast groups.
• D. 240.0.0.1 is in the reserved experimental address range, not a valid multicast address.

Correct answer: A. LC

LC (Lucent Connector) is the most common fiber connector type used on modern network interface cards due to its small form factor and high density capabilities. SC and ST are older connector types, while MPO is used for high-density applications but less common on standard NICs.

Why the other options are wrong

• B. SC connectors are older fiber connectors less commonly used on modern NICs.
• C. ST connectors are legacy fiber connectors rarely found on contemporary network interface cards.
• D. MPO connectors are designed for high-density parallel fiber applications, not typical NICs.

Correct answer: D. Increased compute density

Installing server equipment in a rack provides increased compute density by allowing multiple servers to occupy a smaller physical footprint in a standardized vertical arrangement. This maximizes space utilization in data centers, allowing organizations to fit more computing power into the same floor space.

Why the other options are wrong

• A. Rack installation does not inherently simplify troubleshooting; it may actually complicate it due to dense equipment arrangement.
• B. Rack installation has no direct effect on power consumption; power usage depends on the equipment itself, not its mounting configuration.
• C. Network performance is determined by equipment capabilities and configuration, not by whether devices are installed in a rack.

Correct answer: C. Exchanging router updates with a different ISP

BGP (Border Gateway Protocol) is an exterior gateway protocol specifically designed for exchanging routing information between different autonomous systems, making it the ideal choice for communicating with different ISPs. This is its primary use case in modern networks.

Why the other options are wrong

• A. Loop prevention within a LAN is handled by STP, not BGP
• B. BGP has slow convergence times; it is not used for improving reconvergence
• D. Direct route sharing with a Layer 3 switch would use IGPs like OSPF or EIGRP, not BGP

Correct answer: C. DNS poisoning

DNS poisoning is the most likely cause because the user is accessing the website through a saved shortcut (which typically contains a domain name), and if DNS has been poisoned, the domain name resolves to a malicious IP address instead of the legitimate corporate server. This would cause the website to appear different while using the same familiar shortcut. The other attacks target different layers: VLAN hopping targets network segmentation, ARP spoofing targets local network traffic, and MAC flooding targets switch operations.

Why the other options are wrong

• A. VLAN hopping would not typically affect a website accessed via shortcut unless the entire network architecture changed.
• B. ARP spoofing affects local network traffic resolution, not website content accessed via domain names.
• D. MAC flooding is a denial-of-service attack on switches and would cause connectivity loss, not content discrepancies.

Correct answer: C. Tag the traffic to voice VLAN.

VoIP phones require their traffic to be tagged to a voice VLAN to function properly. The switch port must be configured to tag (or identify) traffic destined for the VoIP phone with the appropriate voice VLAN tag so that the phone can receive calls and communicate with the VoIP infrastructure on the correct VLAN.

Why the other options are wrong

• A. Trunking all VLANs is unnecessary; only the voice VLAN needs to be configured.
• B. Configuring the native VLAN alone does not enable VoIP functionality.
• D. Disabling VLANs would break VLAN-based services including VoIP.

Correct answer: A. Patch

A patch panel provides the central termination point for all network cables on a floor, allowing organized cable management and easy reconfiguration of connections. While an MDF serves as the main distribution frame for the entire building, a patch panel is the most direct and common answer for facilitating central termination on a single floor.

Why the other options are wrong

• B. A UPS provides backup power, not cable termination.
• C. An MDF is the main distribution frame for the entire building; a patch panel is more appropriate for a single floor's central termination.
• D. A rack is an equipment enclosure, not specifically designed as a termination point for network cables.

Correct answer: C. VLAN misconfiguration

A VLAN misconfiguration after switch replacement explains why users cannot reach the server subnet while voice traffic remains unaffected. The new switch likely has incorrect VLAN assignments or trunk configurations, isolating the user VLAN from the server VLAN. Discarded packets on the voice switch suggest traffic is being sent to the wrong VLAN or being dropped at VLAN boundaries.

Why the other options are wrong

• A. An incorrect cable would cause complete connectivity loss, not selective subnet isolation.
• B. A disabled port would show no connectivity at all, not thousands of discarded packets.
• D. Duplex mismatch causes collisions and errors but wouldn't prevent inter-VLAN routing or isolate specific subnets.

Correct answer: D. Switch

Switches can support jumbo frames (typically 9000+ bytes) as they operate at Layer 2 and can be configured to handle larger frame sizes. Switches are intelligent devices with configurable hardware that can manage oversized frames throughout the switched network infrastructure.

Why the other options are wrong

• A. Access points operate at Layer 1-2 and typically have fixed frame size limitations.
• B. Bridges are basic Layer 2 devices with limited ability to handle jumbo frames.
• C. Hubs are Layer 1 devices that simply repeat signals and do not process frame sizes intelligently.

Correct answer: C. IaaS

IaaS (Infrastructure as a Service) provides virtualized computing resources over the internet, allowing the company to scale compute and storage capacity based on current and future needs. It offers the most control over infrastructure while maintaining flexibility for growth.

Why the other options are wrong

• A. SaaS provides applications, not underlying compute/storage infrastructure
• B. PaaS provides a development platform but not direct control of underlying compute/storage capacity
• D. IaC (Infrastructure as Code) is a method of managing infrastructure, not a deployment model

Correct answer: B. DoH

DoH (DNS over HTTPS) specifically encrypts fully qualified domain names (FQDNs) in DNS queries by tunneling them through HTTPS. This prevents on-path attackers from viewing what domains are being queried. SSL/TLS are general encryption protocols, and DNSSEC provides authentication rather than encryption of the DNS queries themselves.

Why the other options are wrong

• A. SSL is a general encryption protocol not specifically designed for DNS query encryption.
• C. TLS is a general encryption protocol but DoH is the specific protocol that encrypts DNS queries over HTTPS.
• D. DNSSEC provides authentication and integrity verification of DNS data, not encryption of the queries themselves.

Correct answer: D. Enable link aggregation.

Link aggregation (LAG/EtherChannel) combines multiple physical links into a single logical link, immediately increasing bandwidth between switches without requiring new hardware. This provides a temporary solution to the bottleneck while the company waits to acquire and deploy the new 40GB switch and redesigned network architecture.

Why the other options are wrong

• A. FHRP provides redundancy and failover, not increased bandwidth to address a bottleneck.
• B. Changing route selection metrics doesn't increase throughput; it only affects path selection.
• C. A load balancer distributes traffic across servers but doesn't resolve core network bottlenecks between switches.

Correct answer: C. Signal degradation

Signal degradation is the most likely cause because the outdoor patio location is physically distant from the access point, resulting in weakened wireless signal strength. This reduced signal quality causes reduced bandwidth and slower data transmission speeds, leading to buffering during large file downloads and video streaming. While interference and congestion could occur, signal degradation from distance is the most probable cause in an outdoor scenario far from the office.

Why the other options are wrong

• A. Network congestion would affect all users equally and is less likely in an outdoor location.
• B. Wireless interference is possible but less likely than simple distance-related signal loss.
• D. Client disassociation would cause complete loss of connection, not buffering issues.

Correct answer: A. Quality of service

Quality of Service (QoS) is the primary focus for videoconferencing issues at a satellite office. QoS prioritizes real-time traffic like video and audio, ensuring adequate bandwidth and low latency. Implementing QoS policies directly addresses the buffering, lag, and dropped calls typical of videoconferencing problems.

Why the other options are wrong

• B. Network signal applies to wireless strength, not overall videoconferencing quality.
• C. Time to Live (TTL) affects routing but not videoconferencing quality.
• D. Load balancing distributes traffic but does not prioritize real-time communication flows.

Correct answer: D. Change the default admin passwords.

Changing default admin passwords is the first critical step in device hardening. Default credentials are widely known and published, making them a primary attack vector. This must be done before connecting the device to the network to prevent immediate compromise. All other hardening steps depend on first securing administrative access.

Why the other options are wrong

• A. ACLs are configured on network devices, not on the device being hardened, and should come after the device is secured.
• B. Placing the device in a screened subnet is a network architecture decision that comes after initial hardening.
• C. Content filtering is a security policy that is applied after the device is hardened and connected to the network.

Correct answer: A. East-west

East-west traffic refers to lateral communication between systems on the same network or subnet, as opposed to north-south traffic between a client and external services. The administrator observing uncommon communication between VMs on the same subnet using ephemeral ports is analyzing east-west traffic flow, which is a key concern for detecting lateral movement attacks within a network segment.

Why the other options are wrong

• B. Point-to-point describes a one-to-one connection but not the directional classification of lateral network traffic.
• C. Horizontal-scaling refers to adding more instances/resources, not a traffic flow classification.
• D. Hub-and-spoke describes a network topology, not the direction of traffic between systems on the same subnet.

Correct answer: A. Toner

A toner (tone generator and probe) is the quickest way to match unlabeled patch panel ports to the offices they serve. The technician connects the tone generator to the wall jack in one of the new offices, then moves the probe along the patch panel ports: the port carrying that office's cable is the one where the tone is loudest. That's the port to patch to the access switch, and the technician repeats this for each office.

Why the other options are wrong

• B. A laptop can test connectivity but requires the cable to be properly connected and patched, which is what the technician is trying to accomplish.
• C. A cable tester verifies cable integrity but does not identify which physical port a cable connects to.
• D. A visual fault locator detects breaks in fiber optic cables and is not applicable to identifying patch panel ports.

Correct answer: A. Implementing enterprise authentication

Enterprise authentication requires individual user credentials to be authenticated against a centralized directory, allowing each network connection to be traced back to a specific user. This provides accountability and auditability for all network connections on the wireless network.

Why the other options are wrong

• B. PSKs (Pre-Shared Keys) are shared among all users, making it impossible to trace connections to individual users.
• C. A captive portal provides access control but does not necessarily trace connections to authenticated users unless combined with individual authentication.
• D. WEP (Wired Equivalent Privacy) is a deprecated encryption standard that does not provide user-level traceability.

Correct answer: A. Web interface

A web interface provides real-time visibility and control over access points through HTTPS, allowing remote changes and updates with secure encrypted communication. While an API gateway could technically work, a web interface is the most direct and commonly implemented solution for this use case, offering both management capabilities and the specified HTTPS security.

Why the other options are wrong

• B. Command line access lacks the real-time visibility and graphical interface typically required for AP management.
• C. SNMP console is primarily for monitoring and performance metrics, not for configuration changes and control.
• D. While an API gateway could work, it requires integration and development and is not the primary management interface for real-time AP visibility and control.

Correct answer: D. Content

Content filtering is the appropriate method to restrict access to specific types of websites and services like social media platforms and personal cloud storage. Content filters inspect application-layer data to identify and block access to specific categories of sites and services, regardless of port or protocol.

Why the other options are wrong

• A. Port filtering operates at the transport layer and cannot distinguish between social media and legitimate services on the same ports.
• B. DNS filtering blocks domain resolution but is less effective for encrypted connections and cannot categorize all services granularly.
• C. MAC filtering controls device access to the network, not content or service access restrictions.

Correct answer: B. DNS filtering

DNS filtering is the best solution for controlling internet access based on site reputation and categorization without requiring traffic flow changes. DNS filtering intercepts DNS queries and blocks or allows access based on domain categorization before the connection is established. It requires no changes to network topology or traffic routing, making it transparent to implement.

Why the other options are wrong

• A. Proxies require traffic flow changes and explicit configuration or client setup to route traffic through them.
• C. Router ACLs require traffic flow analysis and configuration changes to the network infrastructure.
• D. Load balancers distribute traffic across servers but do not perform content filtering or site categorization.

Correct answer: A. Test the theory.

Working through the OSI model from top to bottom is one of the approaches used while establishing a theory of probable cause. The next step in the CompTIA methodology is to test the theory to determine the cause. The full order is: identify the problem; establish a theory of probable cause; test the theory to determine the cause; establish a plan of action to resolve the problem and identify potential effects; implement the solution or escalate as necessary; verify full system functionality and, if applicable, implement preventive measures; and document findings, actions, outcomes, and lessons learned.

Why the other options are wrong

• B. Establishing a plan of action comes after the theory has been tested and confirmed, so it isn't the next step.
• C. Verifying full system functionality is a later step that comes after successfully testing the theory.
• D. Identifying the problem comes before the top-to-bottom OSI examination, not after.

Correct answer: A. PDU

A Power Distribution Unit (PDU) is specifically designed for data centers and network equipment, providing multiple outlets with safety features, monitoring, and management capabilities. It is the most cost-effective and professional solution for expanding outlet capacity in an IDF (Intermediate Distribution Frame), a network closet.

Why the other options are wrong

• B. Surge protectors are consumer-grade and lack the robustness, monitoring, and outlet count needed for a professional IDF.
• C. UPS systems are primarily for backup power, not outlet expansion, and are much more expensive than needed.
• D. Power strips are consumer-grade, unsafe for permanent IDF installations, and lack the features and durability of a PDU.

Correct answer: D. IPSec

IPSec is the industry-standard protocol for creating secure, encrypted VPN tunnels over the internet between remote sites. It provides authentication and encryption for site-to-site communication across untrusted networks. While GRE can tunnel traffic, it lacks encryption; VXLAN is for data center overlay networks; DCI is not a standard protocol.

Why the other options are wrong

• A. DCI is not a recognized secure tunneling protocol for internet-based communication.
• B. GRE provides tunneling but lacks encryption needed for secure communication over the internet.
• C. VXLAN is designed for overlay networks within data centers, not for secure inter-datacenter links over the internet.

Correct answer: D. Heat map

A heat map is a graphical representation that uses colors (typically from cool to warm) to illustrate data density or intensity across a geographic area. In wireless networking, heat maps display signal strength and coverage effectiveness throughout a building.

Why the other options are wrong

• A. Logical diagrams show network topology and connections, not coverage intensity.
• B. Layer 3 diagrams illustrate IP addressing and routing, not wireless coverage.
• C. Service-level agreements are documents defining performance standards, not visual coverage illustrations.

Correct answer: A. 255.255.252.0

A /25 subnet provides 126 usable hosts, insufficient for 700 people. A 255.255.252.0 (/22) subnet provides 1,022 usable hosts, which efficiently supports 700 people while minimizing wasted addresses. The /24 and /25 masks provide only 254 and 126 hosts respectively, while /23 (255.255.254.0) provides 510 hosts, which is also insufficient.

Why the other options are wrong

• B. 255.255.254.0 (/23) provides only 510 usable hosts, insufficient for 700 people.
• C. 255.255.255.0 (/24) provides only 254 usable hosts, insufficient for 700 people.
• D. 255.255.255.128 (/25) provides only 126 usable hosts, insufficient for 700 people.

Correct answer: B. DDoS

A Distributed Denial of Service (DDoS) attack uses multiple computers or bots (a botnet) to send repeated requests to the same resource, overwhelming it and making it unavailable to legitimate users. This is the defining characteristic of DDoS attacks.

Why the other options are wrong

• A. On-path attacks intercept communications between two parties but don't necessarily involve multiple systems requesting the same resource.
• C. ARP spoofing involves falsifying ARP messages to intercept traffic, not multiple bots requesting a resource.
• D. MAC flooding fills a switch's MAC table to cause switching failures, not multiple computers requesting the same resource.

Correct answer: D. LDAPS

LDAPS (LDAP Secure) runs on port 636 and provides encrypted LDAP connections over SSL/TLS. This is the standard secure port for LDAP directory services authentication and communication.

Why the other options are wrong

• A. SMTP (Simple Mail Transfer Protocol) runs on port 25 or 587.
• B. Syslog runs on port 514.
• C. TFTP (Trivial File Transfer Protocol) runs on port 69.

Correct answer: B. DDoS attack

DDoS (Distributed Denial of Service) attacks typically utilize compromised systems organized into bot networks (botnets) to launch coordinated attacks from multiple sources simultaneously, overwhelming target systems.

Why the other options are wrong

• A. Evil twin attacks involve rogue wireless access points, not bot networks.
• C. XML injection is a code injection vulnerability, not related to bot networks.
• D. Brute-force attacks attempt password guessing, not involving compromised bot networks.

Correct answer: C, D. ESP provides confidentiality through the use of encryption; AH provides authentication for IP headers and their payloads.

ESP (Encapsulating Security Payload) provides confidentiality through encryption of data, while AH (Authentication Header) provides authentication for IP headers and their payloads without encryption. These are the primary technical differences between the two IPsec protocols.

Why the other options are wrong

• A. AH provides authentication, not confidentiality through encryption
• B. AH provides authentication for IP headers and payloads, but ESP (not AH) also covers payloads
• E. AH does not provide data origin authorization over shared secret; it uses HMAC for authentication
• F. ESP does not provide data origin authorization over shared secret in the way this implies

Correct answer: C. CNAME

A CNAME (Canonical Name) record is used to create an alias that points one domain name to another domain name. This allows newapplication.comptia.org to always resolve to the same address as www.comptia.org by aliasing it to that domain. CNAME records are the standard solution for creating domain aliases.

Why the other options are wrong

• A. An SOA (Start of Authority) record defines zone parameters, not domain aliases.
• B. An MX (Mail Exchange) record specifies mail servers for a domain, not web application aliases.
• D. An NS (Name Server) record specifies authoritative nameservers for a domain, not domain aliases.

Correct answer: C. Data can be accessed after privileged access is granted.

Confidentiality with regard to data at rest means that stored data is protected and can only be accessed by authorized individuals who have been granted appropriate privileges and permissions. This ensures that sensitive information remains secure and inaccessible to unauthorized users.

Why the other options are wrong

• A. Confidentiality restricts access; it doesn't allow anyone on the administrative network to access data.
• B. Remote access with training relates to authentication and authorization, not the core definition of confidentiality.
• D. Hash verification ensures data integrity, not confidentiality.

Correct answer: D. Airspaces above a ceiling

Plenum cables are specifically designed for use in airspaces above ceilings and other plenum spaces because they are fire-rated and produce minimal smoke when burned. Building codes require plenum-rated cables in these spaces where air circulation occurs for HVAC systems, as standard cables release toxic fumes when ignited.

Why the other options are wrong

• A. Frequently traveled areas require durable conduit protection rather than plenum cable specifically.
• B. Outdoor environments require outdoor-rated cables with weather resistance, not plenum cables.
• C. Inside conduits, standard cables are acceptable since the conduit itself provides fire protection.

Correct answer: A. Link aggregation

Link aggregation (also called EtherChannel or port channeling) combines multiple physical links into a single logical link, providing redundancy without requiring Spanning Tree Protocol. This allows the technician to create multiple connections to the distribution switch that operate as one logical link, eliminating the loop problem that STP normally prevents. Subinterfaces and SVIs are VLAN-related configurations, and half-duplex is outdated and unreliable.

Why the other options are wrong

• B. Subinterfaces are used for VLAN routing, not physical link redundancy.
• C. Switch virtual interfaces are logical VLAN interfaces, not physical redundancy solutions.
• D. Half-duplex connections are outdated and actually reduce performance compared to full-duplex.

Correct answer: C. Deny any 192.168.16.100 255.255.255.255 80

The rule must block non-secure connections (port 80 HTTP) specifically to the new web server while allowing other traffic. Option C denies any traffic destined for port 80 on the specific server IP 192.168.16.100, which blocks HTTP without affecting other services or other hosts. This is the most specific and appropriate rule that satisfies the security policy requirement.

Why the other options are wrong

• A. Denies port 80 to the entire subnet, preventing other legitimate services on other hosts in that range.
• B. Denies all traffic to the server, not just non-secure connections, breaking all connectivity.
• D. Permits port 80 instead of denying it, which is opposite of the security requirement.
• E. Permits all traffic to the server, allowing non-secure connections to remain.

Correct answer: A. Direct Connect

AWS Direct Connect (and similar services like Azure ExpressRoute) provides a dedicated network link directly to a cloud provider. It is a physical, private connection that bypasses the internet. The key characteristic is that it may not include encryption by default, unlike VPNs which inherently provide encryption.

Why the other options are wrong

• B. Internet gateway is a basic networking component, not a dedicated cloud link.
• C. Captive portal is a login page for network access, not a cloud connectivity service.
• D. VPN provides encrypted tunneled connectivity, not a dedicated physical link.

Correct answer: C. BGP

BGP (Border Gateway Protocol) supports both IPv4 and IPv6 routing through its multiprotocol extensions (MP-BGP), making it capable of handling dual-stack networks. It is designed as a scalable routing protocol for both internal and external routing with support for multiple address families.

Why the other options are wrong

• A. OSPFv3 was built for IPv6, and IPv4 is normally routed with OSPFv2. (Later extensions let OSPFv3 carry IPv4 too, but the exam treats OSPFv3 as the IPv6 version.)
• B. RIPv2 routes IPv4 only. IPv6 needs a separate protocol, RIPng.
• D. EIGRP can also route IPv6 (in named mode one process carries both). BGP is keyed because its multiprotocol extensions (MP-BGP) are the textbook example of one protocol carrying both IPv4 and IPv6.

Correct answer: C. 10.152.4.192/26

45 hosts need at least 45 usable addresses, or 47 once the network and broadcast addresses are counted. A /27 has only 30 usable addresses, so the next size up, a /26 (64 addresses, 62 usable), is the smallest block that fits. That makes 10.152.4.192/26 the most efficient choice. A /25 wastes far more space, and a /28 (14 usable) is much too small.

Why the other options are wrong

• A. A /25 subnet provides 126 usable hosts, which is far more address space than needed for 45 hosts and is not the most efficient option.
• B. A /27 subnet only provides 30 usable host addresses, which is insufficient to support 45 hosts.
• D. A /28 subnet provides only 14 usable host addresses, which is far too small to support 45 hosts.

Correct answer: B. SIEM

SIEM (Security Information and Event Management) systems are specifically designed to provide multivendor/OS-monitoring capabilities, collect data in real-time from various sources, and perform data correlation across diverse infrastructure. SIEM platforms aggregate logs and events from multiple devices and systems, analyze them for security threats, and provide comprehensive network visibility. SNMP is limited to device monitoring, nmap is a scanning tool, and syslog only handles log forwarding without correlation.

Why the other options are wrong

• A. SNMP is limited to device monitoring and lacks multivendor data correlation capabilities
• C. nmap is a scanning tool for network reconnaissance, not a monitoring or correlation platform
• D. Syslog only forwards log messages and does not provide data correlation or real-time analysis

Correct answer: B, D. Default gateway; One static IP address

The firewall requires a default gateway (the modem's IP address serving as the next hop) to reach the internet and at least one of the provided static IP addresses to configure its own internet-facing interface. These are the minimum network layer configurations needed to establish internet connectivity.

Why the other options are wrong

• A. NTP server is for time synchronization, not required for basic internet access.
• C. While related to B, this is redundant since the modem's IP address is the default gateway itself.
• E. DNS servers are useful for domain resolution but not strictly required for basic internet connectivity at the network layer.
• F. DHCP server is not needed when static IP addresses are provided and configured.

Correct answer: C. SLA

An SLA (Service Level Agreement) defines priority levels, response times, and resolution times for different ticket severities. This is the document that specifies which critical business operations tickets should be handled first. NDAs cover confidentiality, AUPs define acceptable use policies, and MOUs are general agreements; none specify ticket prioritization.

Why the other options are wrong

• A. NDA (Non-Disclosure Agreement) covers confidentiality, not ticket prioritization.
• B. AUP (Acceptable Use Policy) defines acceptable system usage, not service priorities.
• D. MOU (Memorandum of Understanding) is a general agreement framework, not a ticket prioritization document.

Correct answer: A. Single-mode fiber

Single-mode fiber can transmit data over distances of 10+ kilometers, far exceeding the 492ft (150m) requirement. Copper cables have distance limitations: DAC (Direct Attach Copper) is limited to about 30ft, STP (Shielded Twisted Pair) is limited to 328ft for Gigabit Ethernet, and coaxial has similar limitations. Single-mode fiber is the only option that reliably supports this distance without requiring additional equipment.

Why the other options are wrong

• B. Coaxial cable has distance limitations typically under 500ft for high-speed data and would be marginal at best.
• C. DAC is limited to approximately 30 feet, far less than the required 492ft distance.
• D. STP is limited to approximately 328 feet for Gigabit Ethernet, which is insufficient for 492ft.

Correct answer: D. IP helper

When a new VLAN is added and users cannot obtain IP addresses, the DHCP server likely cannot reach that VLAN because there is no IP helper (DHCP relay) configured on the router or Layer 3 device to forward DHCP requests from the new VLAN to the DHCP server. This is a routing/forwarding issue, not a DHCP pool issue.

Why the other options are wrong

• A. Scope size would only matter if the pool was exhausted, but existing VLANs work fine
• B. Address reservations do not prevent users from obtaining addresses in general
• C. Lease time does not affect the initial ability to obtain an IP address

Correct answer: A. Static

Static routes take the highest precedence in a routing table. They are assigned a lower administrative distance (typically 1 or 0) compared to dynamic routing protocols: BGP has an administrative distance of 20 for eBGP and 200 for iBGP, and OSPF has 110. Default routes have the lowest precedence. Administrative distance determines which route source is preferred when multiple routes to the same destination exist.

Why the other options are wrong

• B. BGP has a higher administrative distance (20) than static routes (1), so it has lower precedence.
• C. OSPF has an administrative distance of 110, making it lower precedence than static routes.
• D. Default routes are fallback routes with the lowest precedence of all routing sources.

Correct answer: B. RJ45

Switches provide console access through an RJ45 console port. A rollover (console) cable carries RS-232 serial signaling to that jack, usually from a USB-to-serial adapter on the laptop. ST is a fiber connector, BNC is a coaxial connector, and SFP is a slot for pluggable fiber or copper transceivers.

Why the other options are wrong

• A. ST is a fiber connector used for network data transmission, not console access.
• C. BNC is a legacy coaxial connector not used for modern switch console access.
• D. SFP is a fiber transceiver module used for network data, not console management.

Correct answer: C. Fail over to a hot site.

A hot site provides a fully operational backup facility that is continuously maintained and updated in real-time, allowing immediate failover with current data. This enables the administrator to work with current data immediately after a disaster without any delay. While snapshots and cloud storage are useful, they may not be real-time, and backup tapes require time-consuming restore processes that result in data loss from the last backup point.

Why the other options are wrong

• A. Backup tapes involve restore time and represent older data from the last backup cycle.
• B. Cloud storage recovery requires restoration processes and may not have real-time currency.
• D. Snapshots are useful but may not be as current as a hot site's continuous synchronization.

Correct answer: D. Tailgating

Tailgating is the practice of following an authorized person through a secure entrance without using credentials. This physical security vulnerability allowed the unauthorized person to enter the secure facility and install the rogue access point. The other options describe wireless attack methods, not physical access methods.

Why the other options are wrong

• A. Evil twin is a rogue wireless access point attack, not a physical entry method.
• B. Honeytrap is a security deception technique to catch attackers, not a breach method.
• C. Wardriving is scanning for wireless networks from a vehicle, not gaining physical facility access.

Correct answer: C. BGP

BGP is the protocol built around autonomous system numbers. Every autonomous system on the internet is identified by an ASN, BGP neighbors are configured by ASN, and each route's AS_PATH lists the ASNs it has crossed.

EIGRP configurations also include an AS number (see question 278), but there it identifies the EIGRP routing domain, a number every neighbor must share, not a registered, globally unique ASN. OSPF and IS-IS organize routers into areas and don't use ASNs.

Why the other options are wrong

• A. IS-IS is an interior gateway protocol that does not use autonomous system numbers.
• B. OSPF is an interior gateway protocol that operates within a single AS without using ASNs.
• D. EIGRP does take an AS number (question 278 relies on that), but it only identifies the EIGRP routing domain that neighbors must share. BGP is the protocol built around registered ASNs, which makes it the best answer here.

Correct answer: C. Voltage transformers

Voltage transformers are electrical devices that generate electromagnetic interference (EMI), which can couple into nearby network cabling and cause signal errors and corruption on high-speed links. When a switch shows unexpected port errors and tracing the cabling reveals proximity to electrical sources, voltage transformers are a primary culprit. Shielded conduit actually protects cables, plenum spaces are fire-rating designations, and hydraulic lifts would only affect cables in very specific environments.

Why the other options are wrong

• A. Shielded conduit protects cables from interference rather than causing it.
• B. Plenum spaces refer to air handling areas and fire ratings, not EMI sources.
• D. Hydraulic lifts would affect cabling in limited specific environments and are less common causes.

Correct answer: A. NFV

NFV (Network Function Virtualization) enables the virtualization of network services and functions, including routers, firewalls, and other network appliances, on standard hardware at remote locations. This allows a branch to have virtualized network services without dedicated hardware. VRF is for routing isolation, VLAN is for network segmentation, and VPC is for cloud infrastructure, none of which specifically virtualize network functions like routers.

Why the other options are wrong

• B. VRF (Virtual Routing and Forwarding) provides routing isolation but doesn't virtualize network services.
• C. VLAN provides network segmentation but doesn't virtualize network functions like routers.
• D. VPC (Virtual Private Cloud) is a cloud infrastructure concept, not a solution for virtualizing network services at branch locations.

Correct answer: A. PAT

Port Address Translation (PAT) is the technique most commonly used to allow many systems on a private network to share a single public IP address by translating both IP addresses and port numbers. This is the standard method used in most small office and home networks.

Why the other options are wrong

• B. NAT translates addresses but doesn't typically involve port translation and is less efficient for many-to-one scenarios.
• C. VIP (Virtual IP) is used for load balancing and failover, not for sharing a public address across many systems.
• D. NAT64 is specifically for IPv6-to-IPv4 translation, not for many-to-one public address sharing.

Correct answer: D. Multimode

Multimode fiber uses multiple light paths (modes) that bounce off the protective cladding at different angles as they travel through the core. This characteristic defines multimode fiber and distinguishes it from single-mode fiber, which uses a single light path with minimal bouncing off the cladding.

Why the other options are wrong

• A. Twinaxial is a copper-based cable, not fiber optic.
• B. Coaxial is a copper-based cable with a center conductor, not fiber optic.
• C. Single-mode fiber uses a single light path with minimal reflection off the cladding, not bouncing.

Correct answer: C. MFA

Multi-Factor Authentication (MFA) requires two or more verification methods from different categories. The scenario describes something you know (username and password) plus something you have (phone application generating passcode), which is the definition of MFA. This combination of authentication factors significantly increases security.

Why the other options are wrong

• A. SSO (Single Sign-On) allows one set of credentials across multiple systems, not multiple authentication factors.
• B. LDAP is a directory service protocol for authentication lookup, not a multi-factor mechanism.
• D. SAML is a federation protocol for authentication, not specifically a multi-factor approach.

Correct answer: C. 3

The 2.4GHz WiFi band has 11 channels in North America (13 in most other regions), but only 3 non-overlapping channels can be used simultaneously when using 22MHz channels: channels 1, 6, and 11. These channels are spaced 25MHz apart, preventing interference with adjacent APs.

Why the other options are wrong

• A. One channel is insufficient for multiple access points with interference mitigation
• B. Two channels do not provide optimal spacing; only three channels can truly operate without overlap
• D. Four non-overlapping 22MHz channels cannot fit in the 2.4GHz band; only three are available

Correct answer: C. Migrate from PSK to Enterprise.

Migrating from PSK (Pre-Shared Key) to Enterprise authentication enables individual user credentials and centralized authentication via RADIUS. This provides per-user accountability and logging, making it possible to narrow specific user activities during security incidents. PSK shares one password, preventing user attribution.

Why the other options are wrong

• A. Restricting to 5GHz improves performance but doesn't enable user attribution for incident investigation.
• B. Upgrading to mesh networks improves coverage and reliability but doesn't add user-level accountability.
• D. WPA2 encryption protects data in transit but doesn't provide per-user authentication or audit trails.

Correct answer: C. 255.255.255.128

A /25 CIDR notation means 25 bits for the network portion and 7 bits for hosts. The subnet mask is calculated as 255.255.255.128 (the first 25 bits set to 1: 11111111.11111111.11111111.10000000 in binary equals 255.255.255.128 in decimal).

Why the other options are wrong

• A. 255.255.254.0 represents a /23 network, not /25.
• B. 255.255.255.1 is not a valid subnet mask.
• D. 255.255.255.192 represents a /26 network, not /25.

Correct answer: C. Evil twin

An evil twin is a rogue wireless access point that mimics a legitimate network, positioning the attacker on the network path between users and legitimate services. This creates an on-path (formerly man-in-the-middle) attack opportunity where the attacker can intercept and manipulate traffic. Phishing is social engineering via email, dumpster diving is physical information gathering, and tailgating is unauthorized physical access.

Why the other options are wrong

• A. Phishing is a social engineering attack delivered via email, not an on-path attack.
• B. Dumpster diving is a physical security breach to retrieve discarded information, not an on-path attack.
• D. Tailgating is unauthorized physical access by following someone through a door, not an on-path attack.

Correct answer: C. Corporate inspection of all network traffic

A full-tunnel VPN routes all network traffic through the VPN connection to the corporate network, enabling the organization to inspect and monitor all user traffic for security and compliance purposes. This provides complete visibility and control over employee network activity regardless of the destination.

Why the other options are wrong

• A. Full-tunnel VPNs typically increase bandwidth requirements by routing all traffic through the tunnel.
• B. VPNs do not provide the capability to reset local computer passwords; that requires separate authentication mechanisms.
• D. Preventing access to blocked sites is the purpose of corporate filtering, and full-tunnel VPNs enforce this but don't inherently enable access to blocked sites.