100 Free Network+ N10-009 Practice Questions and Answers
100 questions for the Network+ N10-009 exam, each answer explained. Watch it here, try the questions yourself, or read the transcript.
Questions in this video
Tap an answer to see why it is right or wrong. Tap it again to reset.
Question 1 Play from 00:00
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Multitenancy means several separate customers, called tenants, share the same underlying hardware and facility while the provider keeps each tenant's data and workloads logically isolated.
Not this one. Try another answer.
Why B is wrong
Elasticity is the ability to grow and shrink resources automatically as demand changes; it says nothing about sharing a facility.
Not this one. Try another answer.
Why C is wrong
Scalability is about handling a larger workload by adding capacity, not about housing many customers together.
Not this one. Try another answer.
Why D is wrong
A hybrid cloud links private and public environments, which is a different concept from sharing one public data center.
Question 2 Play from 01:34
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The session layer opens, manages, and closes dialogues between hosts; it does not format or encrypt the data.
Right, B is the answer.
Why B is right
The presentation layer prepares data so the receiving application can understand it. Character encoding, compression, and encryption all belong to this layer.
Not this one. Try another answer.
Why C is wrong
The transport layer handles segmentation, reliability, and port numbers, not data formatting.
Not this one. Try another answer.
Why D is wrong
The application layer is where user-facing network services live; it relies on the layer below it for translation and encryption.
Question 3 Play from 02:59
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The ESSID is the shared name of an extended network and is the same on every AP in it.
Right, B is the answer.
Why B is right
The BSSID is the MAC address of one access point radio, so it separates that device from every other AP broadcasting the same network name.
Not this one. Try another answer.
Why C is wrong
The SSID is the network name, which many access points can broadcast at once.
Not this one. Try another answer.
Why D is wrong
Many access points can share the same channel, so the channel does not single out one device.
Not this one. Try another answer.
Why E is wrong
RSSI only reports signal strength; it is a measurement, not an identifier.
Question 4 Play from 04:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Syslog is only a message transport format; it forwards logs but does not correlate them.
Not this one. Try another answer.
Why B is wrong
Nmap is a scanner that discovers hosts and open ports, not a continuous collector of events.
Right, C is the answer.
Why C is right
A SIEM collects logs and events from diverse sources as they happen and correlates them, which gives broad network and security visibility in one place.
Not this one. Try another answer.
Why D is wrong
SNMP polls and traps device status and counters, but it offers no correlation of events across sources.
Question 5 Play from 06:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Policing drops or marks traffic that exceeds a rate; that limits flows rather than making them more efficient.
Right, B is the answer.
Why B is right
Jumbo frames carry far more payload in each frame, so there is less header overhead and fewer packets to process for every single transfer.
Not this one. Try another answer.
Why C is wrong
Link aggregation adds total bandwidth across several links, but one flow still travels over only one member link.
Not this one. Try another answer.
Why D is wrong
Shaping delays packets to smooth out bursts, which does not reduce per-packet overhead.
Question 6 Play from 07:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The 100 range is not an RFC 1918 private block; it is reserved for carrier-grade address sharing.
Not this one. Try another answer.
Why B is wrong
192.168.0.0/16 is private, but it is the Class C block, not Class A.
Right, C is the answer.
Why C is right
RFC 1918 reserves 10.0.0.0/8 as the private Class A block, and 10.1.1.0/24 falls inside it.
Not this one. Try another answer.
Why D is wrong
172.16.0.0/12 is private, but it is the Class B block, not Class A.
Question 7 Play from 09:05
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Lessons learned come at the very end, once the fix is verified and documented.
Not this one. Try another answer.
Why B is wrong
Documenting findings is the final step, so it waits until the fix is confirmed to work.
Right, C is the answer.
Why C is right
After a solution is implemented, the next step is to verify full system functionality and, where possible, put preventive measures in place. Documentation and lessons learned follow after that.
Not this one. Try another answer.
Why D is wrong
The plan of action was already created before the fix was applied, so a new one is not the next step.
Question 8 Play from 10:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Port security limits which MAC addresses may use a switch port; it does not perform 802.1X authentication or posture checks.
Right, B is the answer.
Why B is right
Network access control builds on 802.1X to authenticate each endpoint and evaluate its compliance before granting access to the network.
Not this one. Try another answer.
Why C is wrong
An access control list filters traffic by address or port and has no way to authenticate users or inspect device posture.
Not this one. Try another answer.
Why D is wrong
MAC filtering relies on easily spoofed hardware addresses and cannot verify user identity or device health.
Question 9 Play from 12:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
BGP exchanges routes between autonomous systems; it does not translate addresses.
Not this one. Try another answer.
Why B is wrong
A virtual IP is a floating address used for redundancy or load balancing, not for sharing public addresses.
Right, C is the answer.
Why C is right
Port address translation lets many private hosts share a few public addresses by tracking each conversation with a unique source port number.
Not this one. Try another answer.
Why D is wrong
EIGRP is an interior routing protocol for exchanging routes, not for address translation.
Question 10 Play from 13:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
One host bit gives only two addresses, and none are usable once network and broadcast are removed.
Not this one. Try another answer.
Why B is wrong
Two host bits give four addresses, which is just two usable hosts.
Not this one. Try another answer.
Why C is wrong
Three host bits give eight addresses, which is only six usable hosts, still too few.
Right, D is the answer.
Why D is right
Four host bits give sixteen addresses; subtracting the network and broadcast addresses leaves exactly fourteen usable hosts.
Show all 100 questionsShow fewer questions
Question 11 Play from 14:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An active-active design runs services in several places at once, so there is no startup delay at all.
Right, B is the answer.
Why B is right
A cold site offers little more than space, so equipment must be installed and data restored before it can run, which takes weeks.
Not this one. Try another answer.
Why C is wrong
A hot site is fully equipped and mirrors the live environment, so it can take over in minutes or hours.
Not this one. Try another answer.
Why D is wrong
A warm site already has hardware and connectivity, so it needs days at most, not weeks.
Question 12 Play from 16:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A VPN builds an encrypted tunnel; it does not rank traffic by importance.
Not this one. Try another answer.
Why B is wrong
A CDN caches content near users, which does not manage priorities on a specific link.
Right, C is the answer.
Why C is right
Quality of service classifies and prioritizes traffic, so important flows get bandwidth first and the link is used more efficiently.
Not this one. Try another answer.
Why D is wrong
TTL is a counter in a packet that limits its hops or lifetime, not a prioritization tool.
Question 13 Play from 17:23
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A next-generation firewall blocks known threats at the perimeter; it is not built to lure and study unknown exploits.
Not this one. Try another answer.
Why B is wrong
An evil twin is a rogue wireless access point used by attackers, not a defensive tool.
Right, C is the answer.
Why C is right
A honeypot is a decoy system that attracts attackers, so the team can watch new techniques, including zero-day exploits, without risking real assets.
Not this one. Try another answer.
Why D is wrong
A central repository simply stores data and has no ability to detect unseen attacks.
Question 14 Play from 18:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Phishing relies on deceiving a user with a message; here the name resolution itself was altered.
Right, B is the answer.
Why B is right
Changing the hosts file makes the computer resolve the real name to the attacker's address, which is a form of DNS spoofing that sends the user to a fake site.
Not this one. Try another answer.
Why C is wrong
ARP poisoning corrupts the mapping of IP addresses to MAC addresses on the local network, not name resolution.
Not this one. Try another answer.
Why D is wrong
VLAN hopping lets an attacker reach another VLAN and has nothing to do with the hosts file.
Question 15 Play from 20:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A scope is the range of addresses a DHCP server can lease; it does not carry requests across networks.
Not this one. Try another answer.
Why B is wrong
An exclusion removes addresses from the lease pool, which does not help a request reach the server.
Right, C is the answer.
Why C is right
An IP helper, also called a DHCP relay, forwards the broadcast requests from clients to a server on another subnet so addresses can be handed out.
Not this one. Try another answer.
Why D is wrong
A reservation ties an address to one device, but it still needs the request to reach the server first.
Question 16 Play from 21:36
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
CRC errors point to corrupted frames, which would not stop a device from receiving power.
Right, B is the answer.
Why B is right
Each switch has a limited total wattage for PoE. After five devices, the remaining budget may be too small to power another access point.
Not this one. Try another answer.
Why C is wrong
Signal strength is a wireless coverage matter and cannot stop an AP from starting up.
Not this one. Try another answer.
Why D is wrong
A duplex mismatch causes slow or error-prone links but does not keep a powered device from turning on.
Question 17 Play from 22:58
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
In an on-path attack the attacker inserts themselves into the path of the conversation, so they can intercept and even modify the data in transit.
Not this one. Try another answer.
Why B is wrong
Phishing tricks people into giving up information; it does not place the attacker in the traffic path.
Not this one. Try another answer.
Why C is wrong
A self-signed certificate is a trust issue that an attacker might exploit, but by itself it does not intercept traffic.
Not this one. Try another answer.
Why D is wrong
VLAN hopping lets an attacker reach other VLANs; it is not by itself an interception of a conversation.
Question 18 Play from 24:22
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A golden configuration is the known-good, approved baseline that devices are compared against to catch drift.
Not this one. Try another answer.
Why B is wrong
A backup configuration is a saved copy of a device's settings, which may or may not be the approved standard.
Not this one. Try another answer.
Why C is wrong
A candidate configuration is a pending set of changes that has not yet been committed.
Not this one. Try another answer.
Why D is wrong
The production configuration is whatever is currently running, which is exactly what is being checked.
Question 19 Play from 25:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
PAT translates addresses and ports; it does not provide gateway redundancy.
Not this one. Try another answer.
Why B is wrong
BGP exchanges routes between autonomous systems and does not provide a virtual gateway.
Right, C is the answer.
Why C is right
First-hop redundancy protocols present a shared virtual gateway address, and a standby router takes over if the active one goes down.
Not this one. Try another answer.
Why D is wrong
LACP bundles physical links into one logical link; it does not create a redundant gateway.
Question 20 Play from 27:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Tailgating is following someone through a door to gain physical entry, not a way to intercept traffic.
Not this one. Try another answer.
Why B is wrong
Phishing seeks credentials through deceptive messages and does not put the attacker in the traffic path.
Not this one. Try another answer.
Why C is wrong
Dumpster diving recovers discarded paperwork or media and does not involve live traffic.
Right, D is the answer.
Why D is right
An evil twin is a rogue access point that imitates a legitimate one. Devices that join it send all their traffic through the attacker.
Question 21 Play from 28:25
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
OSPF routes are learned dynamically and have a higher administrative distance than a static route.
Not this one. Try another answer.
Why B is wrong
A default route is the least specific entry and is used only when nothing more specific matches.
Right, C is the answer.
Why C is right
A manually configured static route carries a very low administrative distance, so the router trusts it over routes learned from dynamic protocols.
Not this one. Try another answer.
Why D is wrong
BGP routes are also learned dynamically and are trusted less than a static entry.
Question 22 Play from 29:46
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
OSPF sends its hello packets and updates to reserved multicast addresses, so only OSPF routers on the segment process them.
Not this one. Try another answer.
Why B is wrong
Broadcast would force every device on the segment to handle the packets, and OSPF does not use it.
Not this one. Try another answer.
Why C is wrong
Unicast is used for one-to-one delivery, not for the routine updates OSPF sends to all neighbors.
Not this one. Try another answer.
Why D is wrong
Anycast delivers to the nearest of several hosts sharing an address, which is not how OSPF shares updates.
Question 23 Play from 31:02
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Ingress is traffic entering a network from outside, not traffic between machines inside.
Not this one. Try another answer.
Why B is wrong
Egress is traffic leaving a network toward the outside.
Not this one. Try another answer.
Why C is wrong
North-south traffic crosses the boundary between the data center and external networks.
Right, D is the answer.
Why D is right
Traffic that moves sideways between servers or virtual machines inside a data center is called east-west traffic.
Question 24 Play from 32:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Ad hoc networks connect devices directly to each other with no access points or controller.
Not this one. Try another answer.
Why B is wrong
A mesh links nodes wirelessly to each other to extend coverage, and is not the controller-managed wired design described.
Right, C is the answer.
Why C is right
Infrastructure mode uses access points connected to a wired network and managed centrally, which is the design a controller supports.
Not this one. Try another answer.
Why D is wrong
A point-to-point link joins just two locations and cannot serve many client devices.
Question 25 Play from 33:43
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Port 69 is TFTP, which sends files with no encryption at all.
Right, B is the answer.
Why B is right
Port 22 is used by SSH, and secure file transfer methods such as SFTP and SCP run over it with encryption.
Not this one. Try another answer.
Why C is wrong
Port 3389 is the Remote Desktop Protocol, a remote-access service and not a file transfer protocol.
Not this one. Try another answer.
Why D is wrong
Port 80 is plain HTTP, which does not encrypt the data.
Question 26 Play from 34:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SNMPv2c relies on a community string sent in clear text and offers no encryption.
Not this one. Try another answer.
Why B is wrong
An access list limits which hosts may query a device, but it does not authenticate users or encrypt the data.
Right, C is the answer.
Why C is right
SNMPv3 adds user-based authentication and optional encryption, so management data can no longer be read or forged easily on the wire.
Not this one. Try another answer.
Why D is wrong
A community string works like a shared password sent in clear text, with no encryption.
Question 27 Play from 36:25
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
A rack must be tall enough for the servers, measured in rack units, and deep enough for the longest switch or other device that will be mounted in it.
Not this one. Try another answer.
Why B is wrong
Outlet amperage concerns the electrical supply, which affects power planning rather than the physical rack dimensions.
Not this one. Try another answer.
Why C is wrong
Fan speed is a cooling detail and does not set how big the rack must be.
Right, D is one of the answers.
Why D is right
A rack must be tall enough for the servers, measured in rack units, and deep enough for the longest switch or other device that will be mounted in it.
Not this one. Try another answer.
Why E is wrong
A KVM is a minor accessory that does not determine the overall rack size.
Not this one. Try another answer.
Why F is wrong
A drive is a component inside a device and has no effect on the rack dimensions.
Question 28 Play from 37:59
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A captive portal redirects new guests to a web page where they must accept terms or log in before network access is granted.
Not this one. Try another answer.
Why B is wrong
WPA2 encrypts wireless traffic but does not show a page asking guests to accept terms.
Not this one. Try another answer.
Why C is wrong
A pre-shared key is a common Wi-Fi password and does not present any agreement.
Not this one. Try another answer.
Why D is wrong
An autonomous access point is a self-contained AP and has no built-in terms-of-use screen.
Question 29 Play from 39:19
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A WAN address belongs to the external link of a router and is not assigned to a switch.
Right, B is the answer.
Why B is right
A Layer 2 switch has no routed ports of its own, but its switch virtual interface carries an IP address that responds to ping.
Not this one. Try another answer.
Why C is wrong
A MAC address works at Layer 2, and ping needs an IP address to target.
Not this one. Try another answer.
Why D is wrong
A virtual IP is shared between devices for redundancy, not a management address of a single switch.
Question 30 Play from 40:38
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Port security restricts which devices may plug into a switch port and does not govern traffic between zones.
Not this one. Try another answer.
Why B is wrong
NAC decides whether a device may join the network based on identity or posture, not what it can send between zones.
Right, C is the answer.
Why C is right
Access control lists permit or deny traffic by source, destination, and port, which is how rules between zones are enforced.
Not this one. Try another answer.
Why D is wrong
Content filtering blocks categories of web content rather than controlling traffic between segments.
Question 31 Play from 42:01
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A system built to look like a real production server so attackers will probe it, and be observed, is a honeypot.
Not this one. Try another answer.
Why B is wrong
A firewall filters traffic and does not pose as a fake system.
Not this one. Try another answer.
Why C is wrong
An IDS monitors for malicious activity and does not imitate a server.
Not this one. Try another answer.
Why D is wrong
A rogue device is an unauthorized system on the network, not a deliberately placed decoy.
Question 32 Play from 43:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
ARP spoofing works inside an existing network segment and is not the natural next step after a fake AP.
Not this one. Try another answer.
Why B is wrong
A DDoS floods a target with traffic from many sources and does not follow from an evil twin.
Right, C is the answer.
Why C is right
Once victims connect to the fake access point, all of their traffic passes through the attacker, which puts the attacker in an on-path position.
Not this one. Try another answer.
Why D is wrong
Phishing uses deceptive messages and is a separate technique; the fake AP specifically enables traffic interception.
Question 33 Play from 44:35
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SAML is a protocol for exchanging authentication data and gives no threat insight.
Right, B is the answer.
Why B is right
A honeypot records how outside attackers probe and attack a decoy system, which reveals the threats most worth mitigating.
Not this one. Try another answer.
Why C is wrong
The CIA triad is a security model describing confidentiality, integrity, and availability, not a source of attack data.
Not this one. Try another answer.
Why D is wrong
Compliance benchmarks compare settings with a standard and do not show what attackers are doing.
Question 34 Play from 45:54
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
NetFlow records conversations between hosts and summarizes them by source, destination, and volume, which makes finding top talkers straightforward.
Not this one. Try another answer.
Why B is wrong
Traceroute shows the hops along one path and says nothing about traffic volumes.
Not this one. Try another answer.
Why C is wrong
SNMP reports device status and interface counters but not which destinations received the traffic.
Not this one. Try another answer.
Why D is wrong
A packet capture shows individual packets in detail, which is impractical for ranking destinations across the whole infrastructure.
Question 35 Play from 47:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
IAM is about managing identities and permissions, not personal equipment.
Not this one. Try another answer.
Why B is wrong
DLP aims to stop sensitive data from leaving the organization and is not the policy about personal devices.
Right, C is the answer.
Why C is right
A bring-your-own-device policy sets the rules for using personal equipment for work purposes.
Not this one. Try another answer.
Why D is wrong
An acceptable use policy sets general behavior rules but is not the policy that governs personal devices specifically.
Question 36 Play from 48:27
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Single sign-on lets users authenticate once with an identity provider and then reach multiple applications without signing in again.
Not this one. Try another answer.
Why B is wrong
RADIUS authenticates network access requests, such as for Wi-Fi or VPN, rather than federating SaaS applications.
Not this one. Try another answer.
Why C is wrong
PKI manages certificates and keys, not sign-in across applications.
Not this one. Try another answer.
Why D is wrong
TACACS+ handles administrative access to network devices rather than SaaS sign-in.
Question 37 Play from 49:49
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An API gateway mediates programmatic requests and is not a console for hands-on interactive management.
Right, B is the answer.
Why B is right
A web-based management interface served over HTTPS lets the engineer configure and monitor the devices in real time from a browser.
Not this one. Try another answer.
Why C is wrong
The command line is text-based and is not what is described when a browser over HTTPS is used.
Not this one. Try another answer.
Why D is wrong
An SNMP console monitors devices but does not provide a browser-based management session.
Question 38 Play from 51:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A VPN creates an encrypted tunnel and does not block specific websites.
Not this one. Try another answer.
Why B is wrong
NAC controls which devices may join the network, not which sites they can visit.
Not this one. Try another answer.
Why C is wrong
A screened subnet isolates public-facing servers and does not filter web categories.
Right, D is the answer.
Why D is right
A content filter blocks access to categories of websites, such as social media, according to policy.
Question 39 Play from 52:27
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A programmable interface lets scripts and automation tools send configuration to many devices consistently, with no manual sessions.
Not this one. Try another answer.
Why B is wrong
Telnet gives an interactive text session to one device at a time and is not suited to automation at scale.
Not this one. Try another answer.
Why C is wrong
A graphical interface requires a person clicking through screens, device by device.
Not this one. Try another answer.
Why D is wrong
RDP provides a remote desktop session to a computer, not automated configuration of network devices.
Question 40 Play from 53:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Telnet connects to a single known host and cannot sweep a whole subnet.
Not this one. Try another answer.
Why B is wrong
Tracert shows the route to one destination and does not discover hosts on a subnet.
Right, C is the answer.
Why C is right
Nmap scans an address range, discovers which hosts respond, and can report their open ports and services.
Not this one. Try another answer.
Why D is wrong
Dig queries DNS records and does not scan for devices.
Question 41 Play from 55:05
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
MFA is designed to verify people using multiple factors and is not the strongest way to identify a machine.
Not this one. Try another answer.
Why B is wrong
SAML exchanges authentication assertions between systems for web sign-in; it is not a device identity mechanism.
Right, C is the answer.
Why C is right
With PKI, each device holds a certificate and private key issued by a trusted authority, so it can prove its identity cryptographically without relying on a password.
Not this one. Try another answer.
Why D is wrong
SSO lets users sign in once for several services and does not authenticate devices.
Question 42 Play from 56:27
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The plan of action describes what will be changed and how, which is exactly what a change board reviews before authorizing the work.
Not this one. Try another answer.
Why B is wrong
A theory of probable cause explains why something is failing but does not describe the change to be made.
Not this one. Try another answer.
Why C is wrong
Defining the problem happens at the start and does not detail a proposed change.
Not this one. Try another answer.
Why D is wrong
Testing confirms the cause but is carried out before any change is proposed for approval.
Question 43 Play from 57:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A rack diagram shows how equipment is positioned in the cabinet, not the connector specifications.
Not this one. Try another answer.
Why B is wrong
A routing diagram shows how traffic is directed among networks, not the hardware connections.
Right, C is the answer.
Why C is right
A physical diagram shows cabling, ports, and connector types, so details such as fiber connectors belong there.
Not this one. Try another answer.
Why D is wrong
A logical diagram shows addressing and traffic flow, not the physical connector hardware.
Question 44 Play from 59:07
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
In VLAN hopping with double tagging, a frame is crafted with two tags so that it crosses into a VLAN the attacker should not reach.
Not this one. Try another answer.
Why B is wrong
DNS spoofing falsifies name resolution answers and does not involve VLAN tags.
Not this one. Try another answer.
Why C is wrong
MAC flooding overwhelms a switch's address table and does not rely on stacked tags.
Not this one. Try another answer.
Why D is wrong
ARP poisoning corrupts IP-to-MAC mappings and does not use multiple VLAN tags.
Question 45 Play from 1:00:22
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A virtual IP is a shared floating address used for redundancy or load balancing, not the translation function itself.
Not this one. Try another answer.
Why B is wrong
BGP is a routing protocol and does not translate addresses.
Right, C is the answer.
Why C is right
Network address translation swaps a private address for a public one, and a one-to-one static mapping is the standard way to publish a server.
Not this one. Try another answer.
Why D is wrong
PAT shares one public address among many hosts by changing port numbers, rather than mapping one address to one.
Question 46 Play from 1:01:43
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Opening SSH through the firewall exposes the protected subnet directly rather than using a controlled intermediary.
Not this one. Try another answer.
Why B is wrong
An in-band modem dial-up is an outdated and insecure route that shares the production path.
Not this one. Try another answer.
Why C is wrong
A site-to-site VPN links two whole networks together, not one administrator and a single hardened workstation.
Right, D is the answer.
Why D is right
A jump host is a secured intermediary system that administrators log in to first so they can then manage devices in the protected network.
Question 47 Play from 1:03:12
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
In a full mesh every node has a dedicated connection to all the others, which gives maximum redundancy.
Not this one. Try another answer.
Why B is wrong
A star connects every node to one central device, not to each other.
Not this one. Try another answer.
Why C is wrong
A point-to-point link joins just two endpoints.
Not this one. Try another answer.
Why D is wrong
Hub-and-spoke routes everything through a central site instead of connecting all nodes directly.
Question 48 Play from 1:04:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Multifactor authentication adds more proof of identity at login but does not carry one login across systems.
Right, B is the answer.
Why B is right
Single sign-on lets one authentication cover multiple systems, so the user does not log in again for each one.
Not this one. Try another answer.
Why C is wrong
RADIUS is an authentication protocol for network access; it is not what provides one-login access to several resources.
Not this one. Try another answer.
Why D is wrong
TACACS+ is mainly used to control administrative access to network devices.
Question 49 Play from 1:05:38
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Telnet uses port 23 and sends data in clear text.
Not this one. Try another answer.
Why B is wrong
RDP uses port 3389 for remote desktop connections.
Right, C is the answer.
Why C is right
Secure Shell listens on port 22 and provides an encrypted remote command session.
Not this one. Try another answer.
Why D is wrong
TLS is an encryption layer used by many services and is not tied to port 22 for remote access.
Question 50 Play from 1:06:53
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A DHCP server leases addresses and related settings, such as the gateway and DNS, to clients that join the network.
Not this one. Try another answer.
Why B is wrong
LDAP is a directory access protocol and does not assign addresses.
Not this one. Try another answer.
Why C is wrong
NTP synchronizes clocks across devices.
Not this one. Try another answer.
Why D is wrong
FTP transfers files and has no role in addressing.
Question 51 Play from 1:08:02
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
RADIUS authenticates users to network services and does not encrypt web traffic.
Not this one. Try another answer.
Why B is wrong
SSH provides encrypted remote administration, not the encryption layer of HTTPS.
Not this one. Try another answer.
Why C is wrong
SCADA refers to industrial control systems and is not an encryption protocol.
Right, D is the answer.
Why D is right
HTTPS is simply HTTP carried inside a TLS session, and TLS provides the encryption and server authentication.
Question 52 Play from 1:09:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
IaC means defining infrastructure through code; it is a practice rather than a cloud service model.
Not this one. Try another answer.
Why B is wrong
SaaS delivers finished applications and does not provide raw compute and storage capacity to size.
Right, C is the answer.
Why C is right
Infrastructure as a service delivers virtual compute, storage, and networking that can be sized to the organization's needs.
Not this one. Try another answer.
Why D is wrong
PaaS supplies a platform for developing and running applications rather than raw infrastructure capacity.
Question 53 Play from 1:10:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A management information base is a database of SNMP objects, not a location.
Right, B is the answer.
Why B is right
The main distribution frame is the primary wiring location for a site, where the core equipment and the connections from outside terminate.
Not this one. Try another answer.
Why C is wrong
MPO is a multi-fiber connector type and not a core location.
Not this one. Try another answer.
Why D is wrong
MTU is the maximum packet size a link can carry and not a physical core.
Question 54 Play from 1:11:49
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A /27 offers only 30 usable hosts, which is far too few.
Right, B is the answer.
Why B is right
A /25 provides 126 usable host addresses, which is the smallest block that still covers 75 hosts.
Not this one. Try another answer.
Why C is wrong
A /26 offers only 62 usable hosts, which falls short of 75.
Not this one. Try another answer.
Why D is wrong
A /28 offers only 14 usable hosts, which is much too small.
Question 55 Play from 1:13:24
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A direct attach cable is a short copper link for connecting equipment in a rack and is limited in speed and distance.
Right, B is the answer.
Why B is right
Fiber-optic cable sends light over glass strands, which supports the highest data rates and longest distances of the options.
Not this one. Try another answer.
Why C is wrong
Plenum describes the fire-rated jacket of a cable and is not a speed class.
Not this one. Try another answer.
Why D is wrong
Ethernet is a networking standard that runs over various media and is not the fastest medium itself.
Question 56 Play from 1:14:38
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Once the cause is confirmed, the technician determines the steps needed to fix it, which leads into planning the action.
Not this one. Try another answer.
Why B is wrong
Recreating the problem is for when a theory cannot be confirmed, and here it already has been.
Not this one. Try another answer.
Why C is wrong
A confirmed theory is not submitted for approval; the plan of action is what gets reviewed.
Not this one. Try another answer.
Why D is wrong
Applying a fix without a plan skips the step where the resolution steps are worked out.
Question 57 Play from 1:16:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An end-user license agreement is a contract with a software vendor, not legislation.
Not this one. Try another answer.
Why B is wrong
An acceptable use policy is an internal company rule rather than a law.
Right, C is the answer.
Why C is right
The General Data Protection Regulation is a law, so organizations face legal penalties if they ignore it.
Not this one. Try another answer.
Why D is wrong
A code of conduct is an organizational guideline and is not enacted by lawmakers.
Question 58 Play from 1:17:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A content delivery network caches public content close to users and does not provide secure access to internal systems.
Right, B is the answer.
Why B is right
A virtual private network creates an encrypted tunnel so remote users can reach internal resources safely.
Not this one. Try another answer.
Why C is wrong
An IDS watches for suspicious activity and does not offer remote connectivity.
Not this one. Try another answer.
Why D is wrong
A SAN is dedicated storage networking and not a remote-access tool.
Question 59 Play from 1:18:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Social engineering manipulates people and does not change how names resolve.
Not this one. Try another answer.
Why B is wrong
ARP spoofing alters local address mappings and is not what redirects domain names.
Not this one. Try another answer.
Why C is wrong
A denial-of-service attack makes a site unavailable instead of sending visitors elsewhere.
Right, D is the answer.
Why D is right
DNS poisoning plants false answers in name resolution, so a legitimate web address resolves to an attacker's server.
Question 60 Play from 1:19:46
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An allow list names approved items but does not itself describe tailoring access to a job role.
Not this one. Try another answer.
Why B is wrong
An ACL is a mechanism for permitting or denying traffic and is not the guiding principle.
Right, C is the answer.
Why C is right
The principle of least privilege gives each person only the access needed for their role, which limits the damage from mistakes or misuse.
Not this one. Try another answer.
Why D is wrong
Multifactor authentication strengthens login and does not limit what a user can reach.
Question 61 Play from 1:21:03
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A jump host is an intermediate server for administration and does not extend the whole network to the laptop.
Not this one. Try another answer.
Why B is wrong
A GRE tunnel encapsulates traffic between two endpoints but provides no encryption by itself.
Not this one. Try another answer.
Why C is wrong
Secure Shell protects individual command sessions, not general access to network resources.
Right, D is the answer.
Why D is right
A client-to-site VPN builds an encrypted tunnel from a single user's device into the corporate network, which then treats it like a local machine.
Question 62 Play from 1:22:30
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
MAC filtering only requires listing approved hardware addresses, so it is the easiest option to put in place, even though it is not the strongest.
Not this one. Try another answer.
Why B is wrong
802.1X needs an authentication server and supplicant configuration, which makes it more complex to roll out.
Not this one. Try another answer.
Why C is wrong
EAPoL is just the framing used to carry 802.1X exchanges and is not a standalone, easy method.
Not this one. Try another answer.
Why D is wrong
Port security applies to switch ports and is not the usual choice for a wireless network.
Question 63 Play from 1:23:53
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Port 80 is plain HTTP and is not used for SFTP.
Not this one. Try another answer.
Why B is wrong
Port 443 is HTTPS and has nothing to do with SFTP.
Right, C is the answer.
Why C is right
SFTP runs inside an SSH session, so it uses port 22.
Not this one. Try another answer.
Why D is wrong
Port 3389 is for Remote Desktop connections.
Question 64 Play from 1:24:55
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
End-of-life documentation states when a vendor stops releasing patches and support for a product.
Not this one. Try another answer.
Why B is wrong
Development stages describe how software is built and do not say whether support continues for a given device.
Not this one. Try another answer.
Why C is wrong
A baseline configuration records approved settings, not vendor support dates.
Not this one. Try another answer.
Why D is wrong
Asset inventory licensing records what is owned and licensed, not when updates end.
Question 65 Play from 1:26:16
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A dedicated line gives a private circuit but is far more expensive to lease.
Not this one. Try another answer.
Why B is wrong
VXLAN extends Layer 2 networks over Layer 3 but provides no encryption and is not designed for this purpose.
Right, C is the answer.
Why C is right
A site-to-site VPN runs encrypted tunnels across the existing internet connections, so it avoids the recurring cost of leased circuits.
Not this one. Try another answer.
Why D is wrong
A GRE tunnel provides no encryption on its own, so it does not give a secure connection.
Question 66 Play from 1:27:43
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The data link layer works with physical MAC addresses on a local segment.
Not this one. Try another answer.
Why B is wrong
The session layer manages dialogues between applications and does not route.
Right, C is the answer.
Why C is right
The network layer handles IP addressing and decides how packets are routed between networks.
Not this one. Try another answer.
Why D is wrong
The transport layer deals with end-to-end delivery and ports, not routing between networks.
Question 67 Play from 1:28:50
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
BGP is the exterior routing protocol that exchanges reachability information between autonomous systems, which is how providers' networks are linked.
Not this one. Try another answer.
Why B is wrong
OSPF is an interior protocol meant for routing inside a single organization.
Not this one. Try another answer.
Why C is wrong
EIGRP is also an interior protocol designed for use within one network domain.
Not this one. Try another answer.
Why D is wrong
IGP is the general category of interior protocols, so it is not the protocol that links separate networks.
Question 68 Play from 1:30:09
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Anycast delivers to the nearest one of a group of hosts sharing an address.
Not this one. Try another answer.
Why B is wrong
Unicast goes from one sender to exactly one receiver.
Right, C is the answer.
Why C is right
A broadcast is sent to all devices on the segment at once.
Not this one. Try another answer.
Why D is wrong
Multicast reaches only the members of a subscribed group, not every node.
Question 69 Play from 1:31:13
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
SSH gives an encrypted command session with little overhead, so it is a simple private way to manage a remote system.
Not this one. Try another answer.
Why B is wrong
A console connection requires a physical or out-of-band link rather than a remote network session.
Not this one. Try another answer.
Why C is wrong
Telnet sends everything in clear text, so it is not private.
Not this one. Try another answer.
Why D is wrong
A site-to-site VPN joins entire networks and is heavier than a single management session.
Question 70 Play from 1:32:22
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SNMPv2 polls device status and has weak security, and it is not a central log analysis platform.
Not this one. Try another answer.
Why B is wrong
An IDS detects suspicious activity on a network or host and does not collect logs from firewalls across sites.
Not this one. Try another answer.
Why C is wrong
An IPS actively blocks threats in line and is not a log collection tool.
Right, D is the answer.
Why D is right
A SIEM gathers logs from many devices and locations into a central point where they can be analyzed and monitored.
Question 71 Play from 1:33:45
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
VRRP lets two devices share a virtual address so the standby unit takes over if the active one fails.
Not this one. Try another answer.
Why B is wrong
BGP exchanges routes between autonomous systems and does not manage gateway failover.
Not this one. Try another answer.
Why C is wrong
OSPF distributes routes within a network and is not designed to fail over a shared gateway.
Not this one. Try another answer.
Why D is wrong
EIGRP shares routing information between routers and does not provide a virtual gateway.
Question 72 Play from 1:35:02
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SLA alignment compares service commitments and does not involve rehearsing the recovery process.
Right, B is the answer.
Why B is right
In a tabletop exercise, representatives from various teams discuss a simulated disaster step by step to find gaps in the plan.
Not this one. Try another answer.
Why C is wrong
A validation test checks that systems actually work, usually by technical staff, rather than a group discussion.
Not this one. Try another answer.
Why D is wrong
An active-active approach is a design for running services in more than one place and is not an exercise.
Question 73 Play from 1:36:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
4096 is a lower, more preferred value that would have to be set manually.
Not this one. Try another answer.
Why B is wrong
8192 is also a lower value than the default and would be a deliberate configuration.
Not this one. Try another answer.
Why C is wrong
36684 is not a valid priority, because values must be multiples of 4096.
Right, D is the answer.
Why D is right
The default bridge priority in spanning tree is 32768, and it can be changed only in multiples of 4096.
Question 74 Play from 1:37:49
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Escalation happens during the process when needed and is not the closing step.
Right, B is the answer.
Why B is right
Documenting what was found, what was done, and what was learned is the closing step, so the knowledge is kept for future incidents.
Not this one. Try another answer.
Why C is wrong
Testing takes place after the fix is applied but before the final write-up.
Not this one. Try another answer.
Why D is wrong
The plan of action is created earlier, before any change is made.
Question 75 Play from 1:39:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Adware shows unwanted advertisements and is not mainly about leaking confidential data.
Right, B is the answer.
Why B is right
Malicious software on a system can quietly send sensitive information to an outside party, so malware is the best general description of the cause.
Not this one. Try another answer.
Why C is wrong
Darkware is not a recognized category of threat.
Not this one. Try another answer.
Why D is wrong
Ransomware encrypts files and demands payment instead of sending data away silently.
Question 76 Play from 1:40:28
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A hot site continuously mirrors the live environment, so operations can resume there with current data almost immediately.
Not this one. Try another answer.
Why B is wrong
Restoring from cloud storage takes time and only brings back data as of the last backup.
Not this one. Try another answer.
Why C is wrong
Backup tapes hold older data and take considerable time to locate and restore.
Not this one. Try another answer.
Why D is wrong
A snapshot is a point-in-time copy that can be stale, and it may be lost along with the primary site.
Question 77 Play from 1:41:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Detecting lost packets is the job of the transport layer, not the application layer.
Right, B is the answer.
Why B is right
The application layer provides network services to software, but it does not move packets itself; the layers beneath it handle delivery.
Not this one. Try another answer.
Why C is wrong
Address translation is performed by network devices at the network layer.
Not this one. Try another answer.
Why D is wrong
Encrypting data is not what defines the application layer, which is concerned with services used by software.
Question 78 Play from 1:43:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Authentication Header proves where packets came from and that they were not altered, but it does not encrypt.
Not this one. Try another answer.
Why B is wrong
GRE wraps packets in a tunnel without encrypting them.
Right, C is the answer.
Why C is right
Encapsulating Security Payload in IPsec encrypts the data it carries and can also authenticate it.
Not this one. Try another answer.
Why D is wrong
TCP provides reliable delivery and has no encryption.
Not this one. Try another answer.
Why E is wrong
UDP provides connectionless delivery and has no encryption.
Question 79 Play from 1:44:30
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A high CRC count usually means corrupted frames from a bad physical medium, and a faulty patch cable is the most common and simplest cause to eliminate.
Not this one. Try another answer.
Why B is wrong
Moving to another port is not the first step, because the problem is more likely the cable.
Not this one. Try another answer.
Why C is wrong
Errdisable means the port has been shut down, whereas this port is active and reporting errors.
Not this one. Try another answer.
Why D is wrong
Class of service prioritizes traffic and does nothing about corrupted frames.
Question 80 Play from 1:45:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Nslookup tests name resolution rather than whether hosts can reach each other.
Right, B is one of the answers.
Why B is right
Ping checks whether a host responds, and traceroute shows the path and where along it communication stops, so both directly test reachability.
Not this one. Try another answer.
Why C is wrong
SNMP is used to monitor device status and does not directly test reachability between hosts.
Right, D is one of the answers.
Why D is right
Ping checks whether a host responds, and traceroute shows the path and where along it communication stops, so both directly test reachability.
Not this one. Try another answer.
Why E is wrong
The arp command shows address mappings and does not test connectivity.
Not this one. Try another answer.
Why F is wrong
LLDP lets devices advertise themselves to neighbors and is not a connectivity test.
Question 81 Play from 1:47:23
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A small form-factor pluggable transceiver is a module that sits in a port and converts electrical signals to light, which lets a fiber cable attach.
Not this one. Try another answer.
Why B is wrong
SC is a type of fiber connector, not a module that attaches to the port and works at the data link layer.
Not this one. Try another answer.
Why C is wrong
Twinaxial cable is a copper cable with its connectors built in, so it does not accept a separate fiber cable.
Not this one. Try another answer.
Why D is wrong
A direct attach cable is a fixed copper link with its own connectors and does not take fiber.
Question 82 Play from 1:48:46
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The network layer handles logical addressing with IP, which identifies hosts across different networks.
Not this one. Try another answer.
Why B is wrong
The session layer manages conversations between applications and does not assign addresses.
Not this one. Try another answer.
Why C is wrong
The application layer provides services to software and does not handle IP addressing.
Not this one. Try another answer.
Why D is wrong
The data link layer uses hardware addresses on a local segment, not IP addresses.
Question 83 Play from 1:49:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Running a store is a workload that could be hosted on many models and is not what defines a platform service.
Right, B is the answer.
Why B is right
A platform service gives developers a ready environment with runtimes and tools, so they can build, test, and deploy applications without managing servers.
Not this one. Try another answer.
Why C is wrong
Cloud-native software is an architectural style rather than a use case that characterizes this model.
Not this one. Try another answer.
Why D is wrong
Mobile access is a way of reaching services, not a use case of this service model.
Question 84 Play from 1:51:17
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A proxy sits between users and the internet, so it can allow connections only to permitted destinations and block everything else.
Not this one. Try another answer.
Why B is wrong
A load balancer spreads incoming requests across servers and does not limit where users can go.
Not this one. Try another answer.
Why C is wrong
An IPS looks for attack signatures and does not enforce a list of approved destinations.
Not this one. Try another answer.
Why D is wrong
A CDN speeds up content delivery and does not restrict outbound access.
Question 85 Play from 1:52:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Quarantining limits exposure but does not remove the flaw.
Right, B is the answer.
Why B is right
Hardware vulnerabilities in a network device are fixed by vendor-supplied firmware updates, which change how the device handles the flaw.
Not this one. Try another answer.
Why C is wrong
Replacing the board is costly and unnecessary when a firmware update addresses the issue.
Not this one. Try another answer.
Why D is wrong
A router has no separate operating system patch for a hardware-level issue; firmware is the update path.
Question 86 Play from 1:53:50
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SSH needs the device to be running and its network interface to be up.
Right, B is the answer.
Why B is right
Out-of-band management uses a separate path to the device, so access works even when the main system or its network stack is down.
Not this one. Try another answer.
Why C is wrong
A crash cart is a physical station wheeled to the device, so it is not remote.
Not this one. Try another answer.
Why D is wrong
A jump box is an intermediary that still depends on the target accepting connections.
Question 87 Play from 1:55:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
255.255.252.0 is a /22.
Not this one. Try another answer.
Why B is wrong
255.255.240.0 is a /20.
Right, C is the answer.
Why C is right
A /21 has 21 network bits: two full octets plus five bits in the third, which equals 248, so the mask is 255.255.248.0.
Not this one. Try another answer.
Why D is wrong
255.255.224.0 is a /19.
Question 88 Play from 1:56:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
MTTR is the average time needed to repair something, not the tolerable data loss.
Not this one. Try another answer.
Why B is wrong
RTO is how long a system may be down, not how much data can be lost.
Right, C is the answer.
Why C is right
The recovery point objective sets how much data, measured in time, an organization can afford to lose, which in this case is eight hours.
Not this one. Try another answer.
Why D is wrong
MTBF is the average time between failures and says nothing about data loss tolerance.
Question 89 Play from 1:57:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A screened subnet isolates public-facing servers and does not restrict web browsing.
Not this one. Try another answer.
Why B is wrong
Port security controls which devices can use a switch port, not the sites visited.
Right, C is the answer.
Why C is right
A content filter blocks categories of websites, such as gambling, based on policy.
Not this one. Try another answer.
Why D is wrong
ACLs filter by address and port, which is not practical for blocking a whole category of websites.
Question 90 Play from 1:59:14
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A router compares the destination address with its route entries and picks the most specific match, which determines the outgoing interface.
Not this one. Try another answer.
Why B is wrong
The ARP table maps IP addresses to MAC addresses and is not used for prefix matching.
Not this one. Try another answer.
Why C is wrong
Netstat output lists connections and statistics and is not a forwarding table.
Not this one. Try another answer.
Why D is wrong
The MAC address table is used by switches to forward frames and does not involve prefixes.
Question 91 Play from 2:00:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The front is the intake side, facing the cold aisle.
Right, B is the answer.
Why B is right
Equipment draws cool air in at the front and exhausts hot air at the rear, into the hot aisle.
Not this one. Try another answer.
Why C is wrong
Venting upward breaks the hot and cold aisle separation.
Not this one. Try another answer.
Why D is wrong
Venting out the sides would blow hot air into neighboring equipment.
Question 92 Play from 2:01:34
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A mother's birth surname is another piece of knowledge, the same factor as a password, and is easy to discover.
Right, B is the answer.
Why B is right
A hardware token is something the user has, which is a different factor from the password, something the user knows.
Not this one. Try another answer.
Why C is wrong
A PIN is also something a user knows, so it would not add a second factor.
Not this one. Try another answer.
Why D is wrong
A favorite color is a guessable piece of knowledge and is not a separate factor.
Question 93 Play from 2:02:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An ACL filters traffic after a device has connected and does not stop it from joining.
Not this one. Try another answer.
Why B is wrong
Port security applies to wired switch ports, not a wireless network.
Right, C is the answer.
Why C is right
802.1X requires every device to authenticate with credentials or a certificate, so unapproved personal devices are refused.
Not this one. Try another answer.
Why D is wrong
MAC filtering can be bypassed by copying an approved address, so it is a weak control.
Question 94 Play from 2:04:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Port 389 is standard LDAP, which is not encrypted by default.
Right, B is the answer.
Why B is right
LDAP over TLS uses port 636, whereas standard LDAP on 389 is unencrypted.
Not this one. Try another answer.
Why C is wrong
Port 22 is SSH and is not a directory service port.
Not this one. Try another answer.
Why D is wrong
Port 445 is SMB file sharing.
Question 95 Play from 2:05:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Multifactor authentication protects logins and does not encrypt the traffic.
Not this one. Try another answer.
Why B is wrong
Role-based access controls limit who can use data but do not protect it in transit.
Right, C is the answer.
Why C is right
Encrypting data as it travels keeps it unreadable to anyone who intercepts it on the network.
Not this one. Try another answer.
Why D is wrong
Least privilege restricts access rights and does not protect data crossing the network.
Question 96 Play from 2:06:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Disabling VLANs would remove the separation and would not fix the voice traffic.
Not this one. Try another answer.
Why B is wrong
Changing the native VLAN affects untagged frames and does not set up the voice VLAN.
Not this one. Try another answer.
Why C is wrong
Trunking every VLAN is unnecessary and insecure, and it still does not tag the voice traffic.
Right, D is the answer.
Why D is right
Phones normally send their traffic in a dedicated voice VLAN, so the port must tag that traffic accordingly for calls to work.
Question 97 Play from 2:07:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Voltage is an electrical measurement, not a device.
Right, B is the answer.
Why B is right
An uninterruptible power supply holds a battery that supplies power immediately when the mains fails.
Not this one. Try another answer.
Why C is wrong
A PDU distributes power to equipment but has no battery to ride out an outage.
Not this one. Try another answer.
Why D is wrong
Power load describes how much power is consumed, not a backup source.
Question 98 Play from 2:09:03
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Port address translation can rewrite the port number as traffic passes through, so a public port maps to a different internal port.
Not this one. Try another answer.
Why B is wrong
SSL encrypts sessions and does not change ports.
Not this one. Try another answer.
Why C is wrong
TLS also provides encryption and does not translate ports.
Not this one. Try another answer.
Why D is wrong
FHRP provides gateway redundancy and has no role in changing port numbers.
Question 99 Play from 2:10:16
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SAML exchanges authentication data between web applications and is not used for Wi-Fi network access.
Not this one. Try another answer.
Why B is wrong
SSO lets users sign in once to multiple applications and is not itself the Wi-Fi authentication service.
Right, C is the answer.
Why C is right
A RADIUS server validates user credentials for network access requests, which is how enterprise Wi-Fi checks company logins.
Not this one. Try another answer.
Why D is wrong
MFA adds more verification factors, but a server is still needed to validate the credentials.
Question 100 Play from 2:11:32
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Frames are the units of the data link layer.
Not this one. Try another answer.
Why B is wrong
Packets are the units of the network layer.
Not this one. Try another answer.
Why C is wrong
Segments are the units of connection-oriented TCP communication.
Right, D is the answer.
Why D is right
Connectionless transport such as UDP sends self-contained units called datagrams.
Transcript
Play from 00:00 Question 1. A cloud provider runs workloads for many unrelated customers on the same shared physical infrastructure inside one data center. What term describes this arrangement? Here are the options. Option A. Multitenancy. Option B. Elasticity. Option C. Scalability. Option D. Hybrid cloud. Pause the video now if you want time to think about the answer.
The correct answer is A. Multitenancy. Multitenancy means several separate customers, called tenants, share the same underlying hardware and facility while the provider keeps each tenant's data and workloads logically isolated. Now, why are the other options incorrect? Option B is incorrect. Elasticity is the ability to grow and shrink resources automatically as demand changes; it says nothing about sharing a facility. Option C is incorrect. Scalability is about handling a larger workload by adding capacity, not about housing many customers together. Option D is incorrect. A hybrid cloud links private and public environments, which is a different concept from sharing one public data center. Therefore, A, Multitenancy, is the correct answer.
Play from 01:34 Question 2. Which layer of the OSI model translates and formats data and handles encryption on behalf of applications? Here are the options. Option A. Session. Option B. Presentation. Option C. Transport. Option D. Application. Pause the video now if you want time to think about the answer.
The correct answer is B. Presentation. The presentation layer prepares data so the receiving application can understand it. Character encoding, compression, and encryption all belong to this layer. Now, why are the other options incorrect? Option A is incorrect. The session layer opens, manages, and closes dialogues between hosts; it does not format or encrypt the data. Option C is incorrect. The transport layer handles segmentation, reliability, and port numbers, not data formatting. Option D is incorrect. The application layer is where user-facing network services live; it relies on the layer below it for translation and encryption. Therefore, B, Presentation, is the correct answer.
Play from 02:59 Question 3. During an 802.11ax rollout, a technician must find one particular access point with a wireless analyzer. Which value shown by the tool is unique to that single access point radio? Here are the options. Option A. ESSID. Option B. BSSID. Option C. SSID. Option D. Channel number. Option E. RSSI. Pause the video now if you want time to think about the answer.
The correct answer is B. BSSID. The BSSID is the MAC address of one access point radio, so it separates that device from every other AP broadcasting the same network name. Now, why are the other options incorrect? Option A is incorrect. The ESSID is the shared name of an extended network and is the same on every AP in it. Option C is incorrect. The SSID is the network name, which many access points can broadcast at once. Option D is incorrect. Many access points can share the same channel, so the channel does not single out one device. Option E is incorrect. RSSI only reports signal strength; it is a measurement, not an identifier. Therefore, B, BSSID, is the correct answer.
Show full transcriptShow less
Play from 04:37 Question 4. A managed service provider wants one platform that gathers events in real time from devices running many different vendors' software and then correlates them to reveal patterns. Which tool fits best? Here are the options. Option A. Syslog. Option B. Nmap. Option C. SIEM. Option D. SNMP. Pause the video now if you want time to think about the answer.
The correct answer is C. SIEM. A SIEM collects logs and events from diverse sources as they happen and correlates them, which gives broad network and security visibility in one place. Now, why are the other options incorrect? Option A is incorrect. Syslog is only a message transport format; it forwards logs but does not correlate them. Option B is incorrect. Nmap is a scanner that discovers hosts and open ports, not a continuous collector of events. Option D is incorrect. SNMP polls and traps device status and counters, but it offers no correlation of events across sources. Therefore, C, SIEM, is the correct answer.
Play from 06:00 Question 5. A research lab runs large, sustained data transfers between the nodes of a high-performance computing cluster. Which feature gives the best efficiency for each individual flow? Here are the options. Option A. QoS policing. Option B. Jumbo frames. Option C. Link aggregation. Option D. Traffic shaping. Pause the video now if you want time to think about the answer.
The correct answer is B. Jumbo frames. Jumbo frames carry far more payload in each frame, so there is less header overhead and fewer packets to process for every single transfer. Now, why are the other options incorrect? Option A is incorrect. Policing drops or marks traffic that exceeds a rate; that limits flows rather than making them more efficient. Option C is incorrect. Link aggregation adds total bandwidth across several links, but one flow still travels over only one member link. Option D is incorrect. Shaping delays packets to smooth out bursts, which does not reduce per-packet overhead. Therefore, B, Jumbo frames, is the correct answer.
Play from 07:26 Question 6. Which subnet comes from the private Class A range reserved by RFC 1918 and could be assigned to staff laptops? Here are the options. Option A. 100.1.1.0/24. Option B. 192.168.1.0/24. Option C. 10.1.1.0/24. Option D. 172.16.1.0/24. Pause the video now if you want time to think about the answer.
The correct answer is C. 10.1.1.0/24. RFC 1918 reserves 10.0.0.0/8 as the private Class A block, and 10.1.1.0/24 falls inside it. Now, why are the other options incorrect? Option A is incorrect. The 100 range is not an RFC 1918 private block; it is reserved for carrier-grade address sharing. Option B is incorrect. 192.168.0.0/16 is private, but it is the Class C block, not Class A. Option D is incorrect. 172.16.0.0/12 is private, but it is the Class B block, not Class A. Therefore, C, 10.1.1.0/24, is the correct answer.
Play from 09:05 Question 7. A support engineer has just applied a fix for an outage. According to the standard troubleshooting methodology, what comes immediately next? Here are the options. Option A. Hold a review meeting about lessons learned. Option B. Write down the actions taken and their results. Option C. Confirm that the entire system now works normally. Option D. Draft a fresh plan of action. Pause the video now if you want time to think about the answer.
The correct answer is C. Confirm that the entire system now works normally. After a solution is implemented, the next step is to verify full system functionality and, where possible, put preventive measures in place. Documentation and lessons learned follow after that. Now, why are the other options incorrect? Option A is incorrect. Lessons learned come at the very end, once the fix is verified and documented. Option B is incorrect. Documenting findings is the final step, so it waits until the fix is confirmed to work. Option D is incorrect. The plan of action was already created before the fix was applied, so a new one is not the next step. Therefore, C, Confirm that the entire system now works normally, is the correct answer.
Play from 10:39 Question 8. A university wants students' own devices to reach the secure campus Wi-Fi only after they have been authenticated through 802.1X and checked against policy. What should the network team deploy? Here are the options. Option A. Port security. Option B. NAC. Option C. ACL. Option D. MAC filtering. Pause the video now if you want time to think about the answer.
The correct answer is B. NAC. Network access control builds on 802.1X to authenticate each endpoint and evaluate its compliance before granting access to the network. Now, why are the other options incorrect? Option A is incorrect. Port security limits which MAC addresses may use a switch port; it does not perform 802.1X authentication or posture checks. Option C is incorrect. An access control list filters traffic by address or port and has no way to authenticate users or inspect device posture. Option D is incorrect. MAC filtering relies on easily spoofed hardware addresses and cannot verify user identity or device health. Therefore, B, NAC, is the correct answer.
Play from 12:07 Question 9. A small office has only two public IP addresses but hundreds of employees who all need internet access. Which technology makes that possible? Here are the options. Option A. BGP. Option B. VIP. Option C. PAT. Option D. EIGRP. Pause the video now if you want time to think about the answer.
The correct answer is C. PAT. Port address translation lets many private hosts share a few public addresses by tracking each conversation with a unique source port number. Now, why are the other options incorrect? Option A is incorrect. BGP exchanges routes between autonomous systems; it does not translate addresses. Option B is incorrect. A virtual IP is a floating address used for redundancy or load balancing, not for sharing public addresses. Option D is incorrect. EIGRP is an interior routing protocol for exchanging routes, not for address translation. Therefore, C, PAT, is the correct answer.
Play from 13:30 Question 10. A technician is dividing a Class C network into subnets that must each support 14 usable hosts. How many host bits must be left in each subnet? Here are the options. Option A. One. Option B. Two. Option C. Three. Option D. Four. Pause the video now if you want time to think about the answer.
The correct answer is D. Four. Four host bits give sixteen addresses; subtracting the network and broadcast addresses leaves exactly fourteen usable hosts. Now, why are the other options incorrect? Option A is incorrect. One host bit gives only two addresses, and none are usable once network and broadcast are removed. Option B is incorrect. Two host bits give four addresses, which is just two usable hosts. Option C is incorrect. Three host bits give eight addresses, which is only six usable hosts, still too few. Therefore, D, Four, is the correct answer.
Play from 14:42 Question 11. A firm's recovery plan states that after a failure its services will move to a secondary location that needs about four weeks before it is completely up and running. What type of recovery site is this? Here are the options. Option A. Active-active approach. Option B. Cold site. Option C. Hot site. Option D. Warm site. Pause the video now if you want time to think about the answer.
The correct answer is B. Cold site. A cold site offers little more than space, so equipment must be installed and data restored before it can run, which takes weeks. Now, why are the other options incorrect? Option A is incorrect. An active-active design runs services in several places at once, so there is no startup delay at all. Option C is incorrect. A hot site is fully equipped and mirrors the live environment, so it can take over in minutes or hours. Option D is incorrect. A warm site already has hardware and connectivity, so it needs days at most, not weeks. Therefore, B, Cold site, is the correct answer.
Play from 16:04 Question 12. An administrator wants certain kinds of traffic on a congested link to receive priority so the link capacity is used more effectively. Which mechanism should be configured? Here are the options. Option A. VPN. Option B. CDN. Option C. QoS. Option D. TTL. Pause the video now if you want time to think about the answer.
The correct answer is C. QoS. Quality of service classifies and prioritizes traffic, so important flows get bandwidth first and the link is used more efficiently. Now, why are the other options incorrect? Option A is incorrect. A VPN builds an encrypted tunnel; it does not rank traffic by importance. Option B is incorrect. A CDN caches content near users, which does not manage priorities on a specific link. Option D is incorrect. TTL is a counter in a packet that limits its hops or lifetime, not a prioritization tool. Therefore, C, QoS, is the correct answer.
Play from 17:23 Question 13. A security team wants a way to catch brand-new attack techniques, ones with no known signature, before they are used against production systems. Which tool should they set up? Here are the options. Option A. Next-generation firewall. Option B. Evil twin. Option C. Honeypot. Option D. Central repository. Pause the video now if you want time to think about the answer.
The correct answer is C. Honeypot. A honeypot is a decoy system that attracts attackers, so the team can watch new techniques, including zero-day exploits, without risking real assets. Now, why are the other options incorrect? Option A is incorrect. A next-generation firewall blocks known threats at the perimeter; it is not built to lure and study unknown exploits. Option B is incorrect. An evil twin is a rogue wireless access point used by attackers, not a defensive tool. Option D is incorrect. A central repository simply stores data and has no ability to detect unseen attacks. Therefore, C, Honeypot, is the correct answer.
Play from 18:47 Question 14. Employees are landing on a counterfeit website whenever they type the company's address into a browser. The investigation shows someone edited the local hosts file on a workstation. What most likely occurred? Here are the options. Option A. Phishing. Option B. DNS spoofing. Option C. ARP poisoning. Option D. VLAN hopping. Pause the video now if you want time to think about the answer.
The correct answer is B. DNS spoofing. Changing the hosts file makes the computer resolve the real name to the attacker's address, which is a form of DNS spoofing that sends the user to a fake site. Now, why are the other options incorrect? Option A is incorrect. Phishing relies on deceiving a user with a message; here the name resolution itself was altered. Option C is incorrect. ARP poisoning corrupts the mapping of IP addresses to MAC addresses on the local network, not name resolution. Option D is incorrect. VLAN hopping lets an attacker reach another VLAN and has nothing to do with the hosts file. Therefore, B, DNS spoofing, is the correct answer.
Play from 20:14 Question 15. Staff in a newly added office segment must get their addresses from a DHCP server that sits on a different network. Which feature on the router relays their requests? Here are the options. Option A. Scope. Option B. Exclusion. Option C. IP Helper. Option D. Reservation. Pause the video now if you want time to think about the answer.
The correct answer is C. IP Helper. An IP helper, also called a DHCP relay, forwards the broadcast requests from clients to a server on another subnet so addresses can be handed out. Now, why are the other options incorrect? Option A is incorrect. A scope is the range of addresses a DHCP server can lease; it does not carry requests across networks. Option B is incorrect. An exclusion removes addresses from the lease pool, which does not help a request reach the server. Option D is incorrect. A reservation ties an address to one device, but it still needs the request to reach the server first. Therefore, C, IP Helper, is the correct answer.
Play from 21:36 Question 16. A technician installs several PoE-powered wireless access points on a single switch. The first five boot normally, but the sixth never powers on. What should be investigated first? Here are the options. Option A. CRC. Option B. Power budget. Option C. Signal strength. Option D. Duplex mismatch. Pause the video now if you want time to think about the answer.
The correct answer is B. Power budget. Each switch has a limited total wattage for PoE. After five devices, the remaining budget may be too small to power another access point. Now, why are the other options incorrect? Option A is incorrect. CRC errors point to corrupted frames, which would not stop a device from receiving power. Option C is incorrect. Signal strength is a wireless coverage matter and cannot stop an AP from starting up. Option D is incorrect. A duplex mismatch causes slow or error-prone links but does not keep a powered device from turning on. Therefore, B, Power budget, is the correct answer.
Play from 22:58 Question 17. Which attack allows an adversary to sit between two communicating parties so that the traffic can be read or altered? Here are the options. Option A. On-path attack. Option B. Phishing. Option C. Self-signed certificate. Option D. VLAN hopping. Pause the video now if you want time to think about the answer.
The correct answer is A. On-path attack. In an on-path attack the attacker inserts themselves into the path of the conversation, so they can intercept and even modify the data in transit. Now, why are the other options incorrect? Option B is incorrect. Phishing tricks people into giving up information; it does not place the attacker in the traffic path. Option C is incorrect. A self-signed certificate is a trust issue that an attacker might exploit, but by itself it does not intercept traffic. Option D is incorrect. VLAN hopping lets an attacker reach other VLANs; it is not by itself an interception of a conversation. Therefore, A, On-path attack, is the correct answer.
Play from 24:22 Question 18. During an audit, a network administrator finds switches whose settings differ from the approved standard. What is the approved reference configuration that every device should match called? Here are the options. Option A. Golden. Option B. Backup. Option C. Candidate. Option D. Production. Pause the video now if you want time to think about the answer.
The correct answer is A. Golden. A golden configuration is the known-good, approved baseline that devices are compared against to catch drift. Now, why are the other options incorrect? Option B is incorrect. A backup configuration is a saved copy of a device's settings, which may or may not be the approved standard. Option C is incorrect. A candidate configuration is a pending set of changes that has not yet been committed. Option D is incorrect. The production configuration is whatever is currently running, which is exactly what is being checked. Therefore, A, Golden, is the correct answer.
Play from 25:42 Question 19. Which category of protocol lets two routers share a virtual IP address so hosts keep a working default gateway if one router fails? Here are the options. Option A. PAT. Option B. BGP. Option C. FHRP. Option D. LACP. Pause the video now if you want time to think about the answer.
The correct answer is C. FHRP. First-hop redundancy protocols present a shared virtual gateway address, and a standby router takes over if the active one goes down. Now, why are the other options incorrect? Option A is incorrect. PAT translates addresses and ports; it does not provide gateway redundancy. Option B is incorrect. BGP exchanges routes between autonomous systems and does not provide a virtual gateway. Option D is incorrect. LACP bundles physical links into one logical link; it does not create a redundant gateway. Therefore, C, FHRP, is the correct answer.
Play from 27:07 Question 20. An attacker wants to place themselves between users and the network they depend on. Which of these gives them the opening to do that? Here are the options. Option A. Tailgating. Option B. Phishing. Option C. Dumpster diving. Option D. Evil twin. Pause the video now if you want time to think about the answer.
The correct answer is D. Evil twin. An evil twin is a rogue access point that imitates a legitimate one. Devices that join it send all their traffic through the attacker. Now, why are the other options incorrect? Option A is incorrect. Tailgating is following someone through a door to gain physical entry, not a way to intercept traffic. Option B is incorrect. Phishing seeks credentials through deceptive messages and does not put the attacker in the traffic path. Option C is incorrect. Dumpster diving recovers discarded paperwork or media and does not involve live traffic. Therefore, D, Evil twin, is the correct answer.
Play from 28:25 Question 21. A router has learned several possible routes to the same destination subnet from different sources. Which kind of route is preferred when the routing table is built? Here are the options. Option A. OSPF. Option B. Default. Option C. Static. Option D. BGP. Pause the video now if you want time to think about the answer.
The correct answer is C. Static. A manually configured static route carries a very low administrative distance, so the router trusts it over routes learned from dynamic protocols. Now, why are the other options incorrect? Option A is incorrect. OSPF routes are learned dynamically and have a higher administrative distance than a static route. Option B is incorrect. A default route is the least specific entry and is used only when nothing more specific matches. Option D is incorrect. BGP routes are also learned dynamically and are trusted less than a static entry. Therefore, C, Static, is the correct answer.
Play from 29:46 Question 22. Link-state updates in OSPF are delivered to neighboring routers using which type of transmission? Here are the options. Option A. Multicast. Option B. Broadcast. Option C. Unicast. Option D. Anycast. Pause the video now if you want time to think about the answer.
The correct answer is A. Multicast. OSPF sends its hello packets and updates to reserved multicast addresses, so only OSPF routers on the segment process them. Now, why are the other options incorrect? Option B is incorrect. Broadcast would force every device on the segment to handle the packets, and OSPF does not use it. Option C is incorrect. Unicast is used for one-to-one delivery, not for the routine updates OSPF sends to all neighbors. Option D is incorrect. Anycast delivers to the nearest of several hosts sharing an address, which is not how OSPF shares updates. Therefore, A, Multicast, is the correct answer.
Play from 31:02 Question 23. A virtualization administrator adds a hypervisor extension that lets them watch data passing between virtual machines on the same host. What is this kind of traffic called? Here are the options. Option A. Ingress. Option B. Egress. Option C. North-south. Option D. East-west. Pause the video now if you want time to think about the answer.
The correct answer is D. East-west. Traffic that moves sideways between servers or virtual machines inside a data center is called east-west traffic. Now, why are the other options incorrect? Option A is incorrect. Ingress is traffic entering a network from outside, not traffic between machines inside. Option B is incorrect. Egress is traffic leaving a network toward the outside. Option C is incorrect. North-south traffic crosses the boundary between the data center and external networks. Therefore, D, East-west, is the correct answer.
Play from 32:17 Question 24. A consultant is installing dozens of access points that will all be managed from a single wireless LAN controller. Which wireless network type should be used? Here are the options. Option A. Ad hoc. Option B. Mesh. Option C. Infrastructure. Option D. Point-to-point. Pause the video now if you want time to think about the answer.
The correct answer is C. Infrastructure. Infrastructure mode uses access points connected to a wired network and managed centrally, which is the design a controller supports. Now, why are the other options incorrect? Option A is incorrect. Ad hoc networks connect devices directly to each other with no access points or controller. Option B is incorrect. A mesh links nodes wirelessly to each other to extend coverage, and is not the controller-managed wired design described. Option D is incorrect. A point-to-point link joins just two locations and cannot serve many client devices. Therefore, C, Infrastructure, is the correct answer.
Play from 33:43 Question 25. A technician needs to send a file across the network with encryption protecting it in transit. Which port should be used? Here are the options. Option A. 69. Option B. 22. Option C. 3389. Option D. 80. Pause the video now if you want time to think about the answer.
The correct answer is B. 22. Port 22 is used by SSH, and secure file transfer methods such as SFTP and SCP run over it with encryption. Now, why are the other options incorrect? Option A is incorrect. Port 69 is TFTP, which sends files with no encryption at all. Option C is incorrect. Port 3389 is the Remote Desktop Protocol, a remote-access service and not a file transfer protocol. Option D is incorrect. Port 80 is plain HTTP, which does not encrypt the data. Therefore, B, 22, is the correct answer.
Play from 34:58 Question 26. To protect device management traffic with both authentication and encryption, which option should the administrator choose? Here are the options. Option A. SNMPv2c. Option B. An access list restricting SNMP clients. Option C. SNMPv3. Option D. SNMP community string. Pause the video now if you want time to think about the answer.
The correct answer is C. SNMPv3. SNMPv3 adds user-based authentication and optional encryption, so management data can no longer be read or forged easily on the wire. Now, why are the other options incorrect? Option A is incorrect. SNMPv2c relies on a community string sent in clear text and offers no encryption. Option B is incorrect. An access list limits which hosts may query a device, but it does not authenticate users or encrypt the data. Option D is incorrect. A community string works like a shared password sent in clear text, with no encryption. Therefore, C, SNMPv3, is the correct answer.
Play from 36:25 Question 27. Which two equipment characteristics most directly decide what size of rack is needed? (Choose two.) Here are the options. Option A. Server height. Option B. Outlet amperage. Option C. Cooling fan speed. Option D. Switch depth. Option E. KVM size. Option F. Hard drive size. Pause the video now if you want time to think about the answer.
The correct answers are A. Server height, and D. Switch depth. A rack must be tall enough for the servers, measured in rack units, and deep enough for the longest switch or other device that will be mounted in it. Now, why are the other options incorrect? Option B is incorrect. Outlet amperage concerns the electrical supply, which affects power planning rather than the physical rack dimensions. Option C is incorrect. Fan speed is a cooling detail and does not set how big the rack must be. Option E is incorrect. A KVM is a minor accessory that does not determine the overall rack size. Option F is incorrect. A drive is a component inside a device and has no effect on the rack dimensions. Therefore, A and D are the correct answers.
Play from 37:59 Question 28. A coffee shop wants visitors to see and accept a usage agreement before they can browse on the guest Wi-Fi. What should be set up? Here are the options. Option A. Captive portal. Option B. WPA2 encryption. Option C. Pre-shared key. Option D. Autonomous access point. Pause the video now if you want time to think about the answer.
The correct answer is A. Captive portal. A captive portal redirects new guests to a web page where they must accept terms or log in before network access is granted. Now, why are the other options incorrect? Option B is incorrect. WPA2 encrypts wireless traffic but does not show a page asking guests to accept terms. Option C is incorrect. A pre-shared key is a common Wi-Fi password and does not present any agreement. Option D is incorrect. An autonomous access point is a self-contained AP and has no built-in terms-of-use screen. Therefore, A, Captive portal, is the correct answer.
Play from 39:19 Question 29. An administrator wants to confirm IP-level reachability to a Layer 2 switch. Which kind of address should be the target of the ping? Here are the options. Option A. WAN address. Option B. SVI address. Option C. MAC address. Option D. VIP address. Pause the video now if you want time to think about the answer.
The correct answer is B. SVI address. A Layer 2 switch has no routed ports of its own, but its switch virtual interface carries an IP address that responds to ping. Now, why are the other options incorrect? Option A is incorrect. A WAN address belongs to the external link of a router and is not assigned to a switch. Option C is incorrect. A MAC address works at Layer 2, and ping needs an IP address to target. Option D is incorrect. A virtual IP is shared between devices for redundancy, not a management address of a single switch. Therefore, B, SVI address, is the correct answer.
Play from 40:38 Question 30. A network team is splitting the internal network into separate security zones for each department. Which control would be used to set which traffic may pass between those zones? Here are the options. Option A. Port security. Option B. NAC. Option C. ACLs. Option D. Content filtering. Pause the video now if you want time to think about the answer.
The correct answer is C. ACLs. Access control lists permit or deny traffic by source, destination, and port, which is how rules between zones are enforced. Now, why are the other options incorrect? Option A is incorrect. Port security restricts which devices may plug into a switch port and does not govern traffic between zones. Option B is incorrect. NAC decides whether a device may join the network based on identity or posture, not what it can send between zones. Option D is incorrect. Content filtering blocks categories of web content rather than controlling traffic between segments. Therefore, C, ACLs, is the correct answer.
Play from 42:01 Question 31. A technician places a decoy server in the screened subnet that imitates a production system and can be reached from the internet. What has the technician created? Here are the options. Option A. Honeypot. Option B. Firewall. Option C. IDS. Option D. Rogue device. Pause the video now if you want time to think about the answer.
The correct answer is A. Honeypot. A system built to look like a real production server so attackers will probe it, and be observed, is a honeypot. Now, why are the other options incorrect? Option B is incorrect. A firewall filters traffic and does not pose as a fake system. Option C is incorrect. An IDS monitors for malicious activity and does not imitate a server. Option D is incorrect. A rogue device is an unauthorized system on the network, not a deliberately placed decoy. Therefore, A, Honeypot, is the correct answer.
Play from 43:18 Question 32. An attacker sets up a rogue access point that copies the name of a legitimate Wi-Fi network. Which attack is most likely to follow? Here are the options. Option A. ARP spoofing. Option B. DDoS. Option C. On-path. Option D. Phishing. Pause the video now if you want time to think about the answer.
The correct answer is C. On-path. Once victims connect to the fake access point, all of their traffic passes through the attacker, which puts the attacker in an on-path position. Now, why are the other options incorrect? Option A is incorrect. ARP spoofing works inside an existing network segment and is not the natural next step after a fake AP. Option B is incorrect. A DDoS floods a target with traffic from many sources and does not follow from an evil twin. Option D is incorrect. Phishing uses deceptive messages and is a separate technique; the fake AP specifically enables traffic interception. Therefore, C, On-path, is the correct answer.
Play from 44:35 Question 33. Which tool gives a network administrator insight into the threats posed by outside attackers so the most relevant ones can be addressed? Here are the options. Option A. SAML. Option B. Honeypot. Option C. CIA triad. Option D. Compliance benchmarks. Pause the video now if you want time to think about the answer.
The correct answer is B. Honeypot. A honeypot records how outside attackers probe and attack a decoy system, which reveals the threats most worth mitigating. Now, why are the other options incorrect? Option A is incorrect. SAML is a protocol for exchanging authentication data and gives no threat insight. Option C is incorrect. The CIA triad is a security model describing confidentiality, integrity, and availability, not a source of attack data. Option D is incorrect. Compliance benchmarks compare settings with a standard and do not show what attackers are doing. Therefore, B, Honeypot, is the correct answer.
Play from 45:54 Question 34. An administrator wants to learn which destination received the most traffic across the infrastructure on a given day. Which tool should be used? Here are the options. Option A. NetFlow. Option B. traceroute. Option C. SNMP. Option D. Packet capture. Pause the video now if you want time to think about the answer.
The correct answer is A. NetFlow. NetFlow records conversations between hosts and summarizes them by source, destination, and volume, which makes finding top talkers straightforward. Now, why are the other options incorrect? Option B is incorrect. Traceroute shows the hops along one path and says nothing about traffic volumes. Option C is incorrect. SNMP reports device status and interface counters but not which destinations received the traffic. Option D is incorrect. A packet capture shows individual packets in detail, which is impractical for ranking destinations across the whole infrastructure. Therefore, A, NetFlow, is the correct answer.
Play from 47:12 Question 35. A new hire is told to work from their own laptop until the company can issue one. Which policy covers this arrangement? Here are the options. Option A. IAM. Option B. DLP. Option C. BYOD. Option D. AUP. Pause the video now if you want time to think about the answer.
The correct answer is C. BYOD. A bring-your-own-device policy sets the rules for using personal equipment for work purposes. Now, why are the other options incorrect? Option A is incorrect. IAM is about managing identities and permissions, not personal equipment. Option B is incorrect. DLP aims to stop sensitive data from leaving the organization and is not the policy about personal devices. Option D is incorrect. An acceptable use policy sets general behavior rules but is not the policy that governs personal devices specifically. Therefore, C, BYOD, is the correct answer.
Play from 48:27 Question 36. Which technology lets an organization depend on a central identity provider to control user access across many cloud software applications? Here are the options. Option A. SSO. Option B. RADIUS. Option C. PKI. Option D. TACACS+. Pause the video now if you want time to think about the answer.
The correct answer is A. SSO. Single sign-on lets users authenticate once with an identity provider and then reach multiple applications without signing in again. Now, why are the other options incorrect? Option B is incorrect. RADIUS authenticates network access requests, such as for Wi-Fi or VPN, rather than federating SaaS applications. Option C is incorrect. PKI manages certificates and keys, not sign-in across applications. Option D is incorrect. TACACS+ handles administrative access to network devices rather than SaaS sign-in. Therefore, A, SSO, is the correct answer.
Play from 49:49 Question 37. An engineer needs to change and manage wireless access points remotely, with live visibility, through a browser over HTTPS. Which management method suits this? Here are the options. Option A. API gateway. Option B. Web interface. Option C. Command line. Option D. SNMP console. Pause the video now if you want time to think about the answer.
The correct answer is B. Web interface. A web-based management interface served over HTTPS lets the engineer configure and monitor the devices in real time from a browser. Now, why are the other options incorrect? Option A is incorrect. An API gateway mediates programmatic requests and is not a console for hands-on interactive management. Option C is incorrect. The command line is text-based and is not what is described when a browser over HTTPS is used. Option D is incorrect. An SNMP console monitors devices but does not provide a browser-based management session. Therefore, B, Web interface, is the correct answer.
Play from 51:12 Question 38. A cloud administrator must stop employees from reaching social media websites. Which control accomplishes this? Here are the options. Option A. VPN. Option B. NAC. Option C. Screened subnet. Option D. Content filter. Pause the video now if you want time to think about the answer.
The correct answer is D. Content filter. A content filter blocks access to categories of websites, such as social media, according to policy. Now, why are the other options incorrect? Option A is incorrect. A VPN creates an encrypted tunnel and does not block specific websites. Option B is incorrect. NAC controls which devices may join the network, not which sites they can visit. Option C is incorrect. A screened subnet isolates public-facing servers and does not filter web categories. Therefore, D, Content filter, is the correct answer.
Play from 52:27 Question 39. Which management connection method best allows an engineer to push configuration changes automatically to all network devices? Here are the options. Option A. API. Option B. Telnet. Option C. GUI. Option D. RDP. Pause the video now if you want time to think about the answer.
The correct answer is A. API. A programmable interface lets scripts and automation tools send configuration to many devices consistently, with no manual sessions. Now, why are the other options incorrect? Option B is incorrect. Telnet gives an interactive text session to one device at a time and is not suited to automation at scale. Option C is incorrect. A graphical interface requires a person clicking through screens, device by device. Option D is incorrect. RDP provides a remote desktop session to a computer, not automated configuration of network devices. Therefore, A, API, is the correct answer.
Play from 53:47 Question 40. A team manages devices on the 192.168.1.0/24 network over Telnet and now needs to discover which hosts are actually present there. Which tool is best for identifying them? Here are the options. Option A. telnet. Option B. tracert. Option C. nmap. Option D. dig. Pause the video now if you want time to think about the answer.
The correct answer is C. nmap. Nmap scans an address range, discovers which hosts respond, and can report their open ports and services. Now, why are the other options incorrect? Option A is incorrect. Telnet connects to a single known host and cannot sweep a whole subnet. Option B is incorrect. Tracert shows the route to one destination and does not discover hosts on a subnet. Option D is incorrect. Dig queries DNS records and does not scan for devices. Therefore, C, nmap, is the correct answer.
Play from 55:05 Question 41. Which approach provides the strongest way to authenticate devices, rather than people, to a network? Here are the options. Option A. MFA. Option B. SAML. Option C. PKI. Option D. SSO. Pause the video now if you want time to think about the answer.
The correct answer is C. PKI. With PKI, each device holds a certificate and private key issued by a trusted authority, so it can prove its identity cryptographically without relying on a password. Now, why are the other options incorrect? Option A is incorrect. MFA is designed to verify people using multiple factors and is not the strongest way to identify a machine. Option B is incorrect. SAML exchanges authentication assertions between systems for web sign-in; it is not a device identity mechanism. Option D is incorrect. SSO lets users sign in once for several services and does not authenticate devices. Therefore, C, PKI, is the correct answer.
Play from 56:27 Question 42. A change advisory board must approve a fix before it is applied. Which step of the troubleshooting methodology gives the board the information it needs to decide? Here are the options. Option A. Write the plan of action for the fix. Option B. Come up with a probable cause hypothesis. Option C. Gather information to define the problem. Option D. Perform tests to confirm the cause. Pause the video now if you want time to think about the answer.
The correct answer is A. Write the plan of action for the fix. The plan of action describes what will be changed and how, which is exactly what a change board reviews before authorizing the work. Now, why are the other options incorrect? Option B is incorrect. A theory of probable cause explains why something is failing but does not describe the change to be made. Option C is incorrect. Defining the problem happens at the start and does not detail a proposed change. Option D is incorrect. Testing confirms the cause but is carried out before any change is proposed for approval. Therefore, A, Write the plan of action for the fix, is the correct answer.
Play from 57:57 Question 43. Which type of network diagram would typically list the specifications for fiber connector types? Here are the options. Option A. Rack. Option B. Routing. Option C. Physical. Option D. Logical. Pause the video now if you want time to think about the answer.
The correct answer is C. Physical. A physical diagram shows cabling, ports, and connector types, so details such as fiber connectors belong there. Now, why are the other options incorrect? Option A is incorrect. A rack diagram shows how equipment is positioned in the cabinet, not the connector specifications. Option B is incorrect. A routing diagram shows how traffic is directed among networks, not the hardware connections. Option D is incorrect. A logical diagram shows addressing and traffic flow, not the physical connector hardware. Therefore, C, Physical, is the correct answer.
Play from 59:07 Question 44. Which attack relies on a frame that carries more than one VLAN tag? Here are the options. Option A. VLAN hopping. Option B. DNS spoofing. Option C. MAC flooding. Option D. ARP poisoning. Pause the video now if you want time to think about the answer.
The correct answer is A. VLAN hopping. In VLAN hopping with double tagging, a frame is crafted with two tags so that it crosses into a VLAN the attacker should not reach. Now, why are the other options incorrect? Option B is incorrect. DNS spoofing falsifies name resolution answers and does not involve VLAN tags. Option C is incorrect. MAC flooding overwhelms a switch's address table and does not rely on stacked tags. Option D is incorrect. ARP poisoning corrupts IP-to-MAC mappings and does not use multiple VLAN tags. Therefore, A, VLAN hopping, is the correct answer.
Play from 1:00:22 Question 45. A firewall administrator maps one internal server address to one public address so the server can be reached from outside. What is this function called? Here are the options. Option A. VIP. Option B. BGP. Option C. NAT. Option D. PAT. Pause the video now if you want time to think about the answer.
The correct answer is C. NAT. Network address translation swaps a private address for a public one, and a one-to-one static mapping is the standard way to publish a server. Now, why are the other options incorrect? Option A is incorrect. A virtual IP is a shared floating address used for redundancy or load balancing, not the translation function itself. Option B is incorrect. BGP is a routing protocol and does not translate addresses. Option D is incorrect. PAT shares one public address among many hosts by changing port numbers, rather than mapping one address to one. Therefore, C, NAT, is the correct answer.
Play from 1:01:43 Question 46. An administrator needs to reach a protected subnet remotely by going through a shared, hardened workstation. Which approach allows this? Here are the options. Option A. Open SSH access through the firewall. Option B. Use an in-band modem dial-up. Option C. Create a site-to-site VPN tunnel. Option D. Go in by way of a jump host. Pause the video now if you want time to think about the answer.
The correct answer is D. Go in by way of a jump host. A jump host is a secured intermediary system that administrators log in to first so they can then manage devices in the protected network. Now, why are the other options incorrect? Option A is incorrect. Opening SSH through the firewall exposes the protected subnet directly rather than using a controlled intermediary. Option B is incorrect. An in-band modem dial-up is an outdated and insecure route that shares the production path. Option C is incorrect. A site-to-site VPN links two whole networks together, not one administrator and a single hardened workstation. Therefore, D, Go in by way of a jump host, is the correct answer.
Play from 1:03:12 Question 47. Which topology gives every node its own direct link to every other node? Here are the options. Option A. Mesh. Option B. Star. Option C. Point-to-point. Option D. Hub-and-spoke. Pause the video now if you want time to think about the answer.
The correct answer is A. Mesh. In a full mesh every node has a dedicated connection to all the others, which gives maximum redundancy. Now, why are the other options incorrect? Option B is incorrect. A star connects every node to one central device, not to each other. Option C is incorrect. A point-to-point link joins just two endpoints. Option D is incorrect. Hub-and-spoke routes everything through a central site instead of connecting all nodes directly. Therefore, A, Mesh, is the correct answer.
Play from 1:04:18 Question 48. Which capability lets an ordinary user sign in once and then use several resources with the same account? Here are the options. Option A. MFA. Option B. SSO. Option C. RADIUS. Option D. TACACS+. Pause the video now if you want time to think about the answer.
The correct answer is B. SSO. Single sign-on lets one authentication cover multiple systems, so the user does not log in again for each one. Now, why are the other options incorrect? Option A is incorrect. Multifactor authentication adds more proof of identity at login but does not carry one login across systems. Option C is incorrect. RADIUS is an authentication protocol for network access; it is not what provides one-login access to several resources. Option D is incorrect. TACACS+ is mainly used to control administrative access to network devices. Therefore, B, SSO, is the correct answer.
Play from 1:05:38 Question 49. A technician sees remote administration traffic on TCP port 22. Which protocol is being used? Here are the options. Option A. Telnet. Option B. RDP. Option C. SSH. Option D. TLS. Pause the video now if you want time to think about the answer.
The correct answer is C. SSH. Secure Shell listens on port 22 and provides an encrypted remote command session. Now, why are the other options incorrect? Option A is incorrect. Telnet uses port 23 and sends data in clear text. Option B is incorrect. RDP uses port 3389 for remote desktop connections. Option D is incorrect. TLS is an encryption layer used by many services and is not tied to port 22 for remote access. Therefore, C, SSH, is the correct answer.
Play from 1:06:53 Question 50. Which server role automatically hands out IP addressing information to client devices? Here are the options. Option A. DHCP. Option B. LDAP. Option C. NTP. Option D. FTP. Pause the video now if you want time to think about the answer.
The correct answer is A. DHCP. A DHCP server leases addresses and related settings, such as the gateway and DNS, to clients that join the network. Now, why are the other options incorrect? Option B is incorrect. LDAP is a directory access protocol and does not assign addresses. Option C is incorrect. NTP synchronizes clocks across devices. Option D is incorrect. FTP transfers files and has no role in addressing. Therefore, A, DHCP, is the correct answer.
Play from 1:08:02 Question 51. Which protocol most commonly supplies the encryption in transit for HTTPS connections? Here are the options. Option A. RADIUS. Option B. SSH. Option C. SCADA. Option D. TLS. Pause the video now if you want time to think about the answer.
The correct answer is D. TLS. HTTPS is simply HTTP carried inside a TLS session, and TLS provides the encryption and server authentication. Now, why are the other options incorrect? Option A is incorrect. RADIUS authenticates users to network services and does not encrypt web traffic. Option B is incorrect. SSH provides encrypted remote administration, not the encryption layer of HTTPS. Option C is incorrect. SCADA refers to industrial control systems and is not an encryption protocol. Therefore, D, TLS, is the correct answer.
Play from 1:09:17 Question 52. An engineer is designing a cloud solution that must match the company's present size along with its compute and storage requirements. Which service model fulfills this? Here are the options. Option A. IaC. Option B. SaaS. Option C. IaaS. Option D. PaaS. Pause the video now if you want time to think about the answer.
The correct answer is C. IaaS. Infrastructure as a service delivers virtual compute, storage, and networking that can be sized to the organization's needs. Now, why are the other options incorrect? Option A is incorrect. IaC means defining infrastructure through code; it is a practice rather than a cloud service model. Option B is incorrect. SaaS delivers finished applications and does not provide raw compute and storage capacity to size. Option D is incorrect. PaaS supplies a platform for developing and running applications rather than raw infrastructure capacity. Therefore, C, IaaS, is the correct answer.
Play from 1:10:37 Question 53. Which of these is the central point where a network's main equipment and incoming connections are gathered? Here are the options. Option A. MIB. Option B. MDF. Option C. MPO. Option D. MTU. Pause the video now if you want time to think about the answer.
The correct answer is B. MDF. The main distribution frame is the primary wiring location for a site, where the core equipment and the connections from outside terminate. Now, why are the other options incorrect? Option A is incorrect. A management information base is a database of SNMP objects, not a location. Option C is incorrect. MPO is a multi-fiber connector type and not a core location. Option D is incorrect. MTU is the maximum packet size a link can carry and not a physical core. Therefore, B, MDF, is the correct answer.
Play from 1:11:49 Question 54. A new branch office must be split into subnets that can each hold 75 hosts. Which subnet is the most efficient choice? Here are the options. Option A. 172.16.8.0/27. Option B. 172.16.8.0/25. Option C. 172.16.8.0/26. Option D. 172.16.8.0/28. Pause the video now if you want time to think about the answer.
The correct answer is B. 172.16.8.0/25. A /25 provides 126 usable host addresses, which is the smallest block that still covers 75 hosts. Now, why are the other options incorrect? Option A is incorrect. A /27 offers only 30 usable hosts, which is far too few. Option C is incorrect. A /26 offers only 62 usable hosts, which falls short of 75. Option D is incorrect. A /28 offers only 14 usable hosts, which is much too small. Therefore, B, 172.16.8.0/25, is the correct answer.
Play from 1:13:24 Question 55. Which cabling option can carry data at the highest possible speed? Here are the options. Option A. DAC. Option B. Fiber-optic. Option C. Plenum. Option D. Ethernet. Pause the video now if you want time to think about the answer.
The correct answer is B. Fiber-optic. Fiber-optic cable sends light over glass strands, which supports the highest data rates and longest distances of the options. Now, why are the other options incorrect? Option A is incorrect. A direct attach cable is a short copper link for connecting equipment in a rack and is limited in speed and distance. Option C is incorrect. Plenum describes the fire-rated jacket of a cable and is not a speed class. Option D is incorrect. Ethernet is a networking standard that runs over various media and is not the fastest medium itself. Therefore, B, Fiber-optic, is the correct answer.
Play from 1:14:38 Question 56. In the troubleshooting methodology, what comes next after the theory about the root cause has been tested and confirmed? Here are the options. Option A. Work out the steps needed to resolve the problem. Option B. Recreate the issue in a lab environment. Option C. Send the theory up for sign-off. Option D. Apply the fix right away. Pause the video now if you want time to think about the answer.
The correct answer is A. Work out the steps needed to resolve the problem. Once the cause is confirmed, the technician determines the steps needed to fix it, which leads into planning the action. Now, why are the other options incorrect? Option B is incorrect. Recreating the problem is for when a theory cannot be confirmed, and here it already has been. Option C is incorrect. A confirmed theory is not submitted for approval; the plan of action is what gets reviewed. Option D is incorrect. Applying a fix without a plan skips the step where the resolution steps are worked out. Therefore, A, Work out the steps needed to resolve the problem, is the correct answer.
Play from 1:16:00 Question 57. What is backed by law, rather than being only a company or vendor rule? Here are the options. Option A. EULA. Option B. AUP. Option C. GDPR. Option D. Code of conduct. Pause the video now if you want time to think about the answer.
The correct answer is C. GDPR. The General Data Protection Regulation is a law, so organizations face legal penalties if they ignore it. Now, why are the other options incorrect? Option A is incorrect. An end-user license agreement is a contract with a software vendor, not legislation. Option B is incorrect. An acceptable use policy is an internal company rule rather than a law. Option D is incorrect. A code of conduct is an organizational guideline and is not enacted by lawmakers. Therefore, C, GDPR, is the correct answer.
Play from 1:17:14 Question 58. Which technology gives employees a secure connection to internal applications from outside the office? Here are the options. Option A. CDN. Option B. VPN. Option C. IDS. Option D. SAN. Pause the video now if you want time to think about the answer.
The correct answer is B. VPN. A virtual private network creates an encrypted tunnel so remote users can reach internal resources safely. Now, why are the other options incorrect? Option A is incorrect. A content delivery network caches public content close to users and does not provide secure access to internal systems. Option C is incorrect. An IDS watches for suspicious activity and does not offer remote connectivity. Option D is incorrect. A SAN is dedicated storage networking and not a remote-access tool. Therefore, B, VPN, is the correct answer.
Play from 1:18:30 Question 59. Which attack can send visitors who type a company's web address to an entirely different site? Here are the options. Option A. Social engineering. Option B. ARP spoofing. Option C. Denial-of-service. Option D. DNS poisoning. Pause the video now if you want time to think about the answer.
The correct answer is D. DNS poisoning. DNS poisoning plants false answers in name resolution, so a legitimate web address resolves to an attacker's server. Now, why are the other options incorrect? Option A is incorrect. Social engineering manipulates people and does not change how names resolve. Option B is incorrect. ARP spoofing alters local address mappings and is not what redirects domain names. Option C is incorrect. A denial-of-service attack makes a site unavailable instead of sending visitors elsewhere. Therefore, D, DNS poisoning, is the correct answer.
Play from 1:19:46 Question 60. What term describes granting people access to systems or areas only as their job duties require? Here are the options. Option A. Allow list. Option B. ACL. Option C. Least privilege. Option D. MFA. Pause the video now if you want time to think about the answer.
The correct answer is C. Least privilege. The principle of least privilege gives each person only the access needed for their role, which limits the damage from mistakes or misuse. Now, why are the other options incorrect? Option A is incorrect. An allow list names approved items but does not itself describe tailoring access to a job role. Option B is incorrect. An ACL is a mechanism for permitting or denying traffic and is not the guiding principle. Option D is incorrect. Multifactor authentication strengthens login and does not limit what a user can reach. Therefore, C, Least privilege, is the correct answer.
Play from 1:21:03 Question 61. A traveling employee needs encrypted access to company resources so that the laptop behaves as if it were plugged into the office network. Which access method should be used? Here are the options. Option A. Jump box/host. Option B. GRE tunnel. Option C. Secure Shell. Option D. Client-to-site VPN. Pause the video now if you want time to think about the answer.
The correct answer is D. Client-to-site VPN. A client-to-site VPN builds an encrypted tunnel from a single user's device into the corporate network, which then treats it like a local machine. Now, why are the other options incorrect? Option A is incorrect. A jump host is an intermediate server for administration and does not extend the whole network to the laptop. Option B is incorrect. A GRE tunnel encapsulates traffic between two endpoints but provides no encryption by itself. Option C is incorrect. Secure Shell protects individual command sessions, not general access to network resources. Therefore, D, Client-to-site VPN, is the correct answer.
Play from 1:22:30 Question 62. A technician is trialing network access control on a Wi-Fi network and values simple setup above everything else. Which NAC technique should be chosen? Here are the options. Option A. MAC filtering. Option B. 802.1X. Option C. EAPoL. Option D. Port security. Pause the video now if you want time to think about the answer.
The correct answer is A. MAC filtering. MAC filtering only requires listing approved hardware addresses, so it is the easiest option to put in place, even though it is not the strongest. Now, why are the other options incorrect? Option B is incorrect. 802.1X needs an authentication server and supplicant configuration, which makes it more complex to roll out. Option C is incorrect. EAPoL is just the framing used to carry 802.1X exchanges and is not a standalone, easy method. Option D is incorrect. Port security applies to switch ports and is not the usual choice for a wireless network. Therefore, A, MAC filtering, is the correct answer.
Play from 1:23:53 Question 63. Which port does a client connect to when it uses an SFTP server? Here are the options. Option A. 80. Option B. 443. Option C. 22. Option D. 3389. Pause the video now if you want time to think about the answer.
The correct answer is C. 22. SFTP runs inside an SSH session, so it uses port 22. Now, why are the other options incorrect? Option A is incorrect. Port 80 is plain HTTP and is not used for SFTP. Option B is incorrect. Port 443 is HTTPS and has nothing to do with SFTP. Option D is incorrect. Port 3389 is for Remote Desktop connections. Therefore, C, 22, is the correct answer.
Play from 1:24:55 Question 64. Which resource should an engineer review to learn whether the vendor still issues updates for a device? Here are the options. Option A. EOL documentation. Option B. Application development stages. Option C. Baseline configuration. Option D. Asset inventory licensing. Pause the video now if you want time to think about the answer.
The correct answer is A. EOL documentation. End-of-life documentation states when a vendor stops releasing patches and support for a product. Now, why are the other options incorrect? Option B is incorrect. Development stages describe how software is built and do not say whether support continues for a given device. Option C is incorrect. A baseline configuration records approved settings, not vendor support dates. Option D is incorrect. Asset inventory licensing records what is owned and licensed, not when updates end. Therefore, A, EOL documentation, is the correct answer.
Play from 1:26:16 Question 65. Two company sites need a permanent, protected link between them, and the company wants the least expensive option that meets the need. What should it use? Here are the options. Option A. Dedicated line. Option B. VXLAN. Option C. Site-to-site VPN. Option D. GRE tunnel. Pause the video now if you want time to think about the answer.
The correct answer is C. Site-to-site VPN. A site-to-site VPN runs encrypted tunnels across the existing internet connections, so it avoids the recurring cost of leased circuits. Now, why are the other options incorrect? Option A is incorrect. A dedicated line gives a private circuit but is far more expensive to lease. Option B is incorrect. VXLAN extends Layer 2 networks over Layer 3 but provides no encryption and is not designed for this purpose. Option D is incorrect. A GRE tunnel provides no encryption on its own, so it does not give a secure connection. Therefore, C, Site-to-site VPN, is the correct answer.
Play from 1:27:43 Question 66. A packet needs an IP address and a path chosen across several networks. Which OSI layer does that work? Here are the options. Option A. Data Link. Option B. Session. Option C. Network. Option D. Transport. Pause the video now if you want time to think about the answer.
The correct answer is C. Network. The network layer handles IP addressing and decides how packets are routed between networks. Now, why are the other options incorrect? Option A is incorrect. The data link layer works with physical MAC addresses on a local segment. Option B is incorrect. The session layer manages dialogues between applications and does not route. Option D is incorrect. The transport layer deals with end-to-end delivery and ports, not routing between networks. Therefore, C, Network, is the correct answer.
Play from 1:28:50 Question 67. Which routing protocol is typically used to connect separate wide-area networks, such as those belonging to different internet providers? Here are the options. Option A. BGP. Option B. OSPF. Option C. EIGRP. Option D. IGP. Pause the video now if you want time to think about the answer.
The correct answer is A. BGP. BGP is the exterior routing protocol that exchanges reachability information between autonomous systems, which is how providers' networks are linked. Now, why are the other options incorrect? Option B is incorrect. OSPF is an interior protocol meant for routing inside a single organization. Option C is incorrect. EIGRP is also an interior protocol designed for use within one network domain. Option D is incorrect. IGP is the general category of interior protocols, so it is not the protocol that links separate networks. Therefore, A, BGP, is the correct answer.
Play from 1:30:09 Question 68. Which type of transmission delivers a message to every node on the network segment? Here are the options. Option A. Anycast. Option B. Unicast. Option C. Broadcast. Option D. Multicast. Pause the video now if you want time to think about the answer.
The correct answer is C. Broadcast. A broadcast is sent to all devices on the segment at once. Now, why are the other options incorrect? Option A is incorrect. Anycast delivers to the nearest one of a group of hosts sharing an address. Option B is incorrect. Unicast goes from one sender to exactly one receiver. Option D is incorrect. Multicast reaches only the members of a subscribed group, not every node. Therefore, C, Broadcast, is the correct answer.
Play from 1:31:13 Question 69. Which option provides a lightweight, private connection for managing a remote machine? Here are the options. Option A. Secure Shell. Option B. Console. Option C. Telnet. Option D. Site-to-site VPN. Pause the video now if you want time to think about the answer.
The correct answer is A. Secure Shell. SSH gives an encrypted command session with little overhead, so it is a simple private way to manage a remote system. Now, why are the other options incorrect? Option B is incorrect. A console connection requires a physical or out-of-band link rather than a remote network session. Option C is incorrect. Telnet sends everything in clear text, so it is not private. Option D is incorrect. A site-to-site VPN joins entire networks and is heavier than a single management session. Therefore, A, Secure Shell, is the correct answer.
Play from 1:32:22 Question 70. An administrator needs one place to monitor log data from newly deployed firewalls at several sites. Which solution fits? Here are the options. Option A. SNMPv2. Option B. IDS. Option C. IPS. Option D. SIEM. Pause the video now if you want time to think about the answer.
The correct answer is D. SIEM. A SIEM gathers logs from many devices and locations into a central point where they can be analyzed and monitored. Now, why are the other options incorrect? Option A is incorrect. SNMPv2 polls device status and has weak security, and it is not a central log analysis platform. Option B is incorrect. An IDS detects suspicious activity on a network or host and does not collect logs from firewalls across sites. Option C is incorrect. An IPS actively blocks threats in line and is not a log collection tool. Therefore, D, SIEM, is the correct answer.
Play from 1:33:45 Question 71. Which protocol provides automatic failover of the gateway address for a pair of firewalls running in active-passive mode? Here are the options. Option A. VRRP. Option B. BGP. Option C. OSPF. Option D. EIGRP. Pause the video now if you want time to think about the answer.
The correct answer is A. VRRP. VRRP lets two devices share a virtual address so the standby unit takes over if the active one fails. Now, why are the other options incorrect? Option B is incorrect. BGP exchanges routes between autonomous systems and does not manage gateway failover. Option C is incorrect. OSPF distributes routes within a network and is not designed to fail over a shared gateway. Option D is incorrect. EIGRP shares routing information between routers and does not provide a virtual gateway. Therefore, A, VRRP, is the correct answer.
Play from 1:35:02 Question 72. Which exercise brings staff from different departments together to walk through and evaluate the disaster recovery process? Here are the options. Option A. SLA alignment. Option B. Tabletop exercises. Option C. Validation test. Option D. Active-active approach. Pause the video now if you want time to think about the answer.
The correct answer is B. Tabletop exercises. In a tabletop exercise, representatives from various teams discuss a simulated disaster step by step to find gaps in the plan. Now, why are the other options incorrect? Option A is incorrect. SLA alignment compares service commitments and does not involve rehearsing the recovery process. Option C is incorrect. A validation test checks that systems actually work, usually by technical staff, rather than a group discussion. Option D is incorrect. An active-active approach is a design for running services in more than one place and is not an exercise. Therefore, B, Tabletop exercises, is the correct answer.
Play from 1:36:26 Question 73. A new switch is being installed, and the administrator wants to confirm the spanning tree bridge priority is still at the factory default. Which value should be displayed? Here are the options. Option A. 4096. Option B. 8192. Option C. 36684. Option D. 32768. Pause the video now if you want time to think about the answer.
The correct answer is D. 32768. The default bridge priority in spanning tree is 32768, and it can be changed only in multiples of 4096. Now, why are the other options incorrect? Option A is incorrect. 4096 is a lower, more preferred value that would have to be set manually. Option B is incorrect. 8192 is also a lower value than the default and would be a deliberate configuration. Option C is incorrect. 36684 is not a valid priority, because values must be multiples of 4096. Therefore, D, 32768, is the correct answer.
Play from 1:37:49 Question 74. In a ticket's lifecycle, what is the last step performed before the ticket is closed? Here are the options. Option A. Notifying senior leadership. Option B. Recording the findings, results, and lessons learned. Option C. Running functional and non-functional tests. Option D. Drafting a detailed plan of action. Pause the video now if you want time to think about the answer.
The correct answer is B. Recording the findings, results, and lessons learned. Documenting what was found, what was done, and what was learned is the closing step, so the knowledge is kept for future incidents. Now, why are the other options incorrect? Option A is incorrect. Escalation happens during the process when needed and is not the closing step. Option C is incorrect. Testing takes place after the fix is applied but before the final write-up. Option D is incorrect. The plan of action is created earlier, before any change is made. Therefore, B, Recording the findings, results, and lessons learned, is the correct answer.
Play from 1:39:12 Question 75. A network engineer sees traffic carrying confidential data to an unknown, unauthorized destination. What is the most likely cause? Here are the options. Option A. Adware. Option B. Malware. Option C. Darkware. Option D. Ransomware. Pause the video now if you want time to think about the answer.
The correct answer is B. Malware. Malicious software on a system can quietly send sensitive information to an outside party, so malware is the best general description of the cause. Now, why are the other options incorrect? Option A is incorrect. Adware shows unwanted advertisements and is not mainly about leaking confidential data. Option C is incorrect. Darkware is not a recognized category of threat. Option D is incorrect. Ransomware encrypts files and demands payment instead of sending data away silently. Therefore, B, Malware, is the correct answer.
Play from 1:40:28 Question 76. After a disaster, which option would most likely allow the administrator to keep working with up-to-date data? Here are the options. Option A. Switch operations to a hot site. Option B. Pull data back from cloud storage. Option C. Search through archived backup tapes. Option D. Roll back to a stored snapshot. Pause the video now if you want time to think about the answer.
The correct answer is A. Switch operations to a hot site. A hot site continuously mirrors the live environment, so operations can resume there with current data almost immediately. Now, why are the other options incorrect? Option B is incorrect. Restoring from cloud storage takes time and only brings back data as of the last backup. Option C is incorrect. Backup tapes hold older data and take considerable time to locate and restore. Option D is incorrect. A snapshot is a point-in-time copy that can be stale, and it may be lost along with the primary site. Therefore, A, Switch operations to a hot site, is the correct answer.
Play from 1:41:52 Question 77. Which statement describes the application layer of the OSI model? Here are the options. Option A. It detects packet loss on its own. Option B. It depends on the lower layers to carry packets. Option C. It converts private addresses to public ones. Option D. It encrypts data while it is in transit. Pause the video now if you want time to think about the answer.
The correct answer is B. It depends on the lower layers to carry packets. The application layer provides network services to software, but it does not move packets itself; the layers beneath it handle delivery. Now, why are the other options incorrect? Option A is incorrect. Detecting lost packets is the job of the transport layer, not the application layer. Option C is incorrect. Address translation is performed by network devices at the network layer. Option D is incorrect. Encrypting data is not what defines the application layer, which is concerned with services used by software. Therefore, B, It depends on the lower layers to carry packets, is the correct answer.
Play from 1:43:14 Question 78. Which of these protocols carried in IP packets encrypts the payload it transports? Here are the options. Option A. AH. Option B. GRE. Option C. ESP. Option D. TCP. Option E. UDP. Pause the video now if you want time to think about the answer.
The correct answer is C. ESP. Encapsulating Security Payload in IPsec encrypts the data it carries and can also authenticate it. Now, why are the other options incorrect? Option A is incorrect. Authentication Header proves where packets came from and that they were not altered, but it does not encrypt. Option B is incorrect. GRE wraps packets in a tunnel without encrypting them. Option D is incorrect. TCP provides reliable delivery and has no encryption. Option E is incorrect. UDP provides connectionless delivery and has no encryption. Therefore, C, ESP, is the correct answer.
Play from 1:44:30 Question 79. A technician notices more than 5,000 CRC errors counted on one switch port. What should be done next? Here are the options. Option A. Replace the patch cable. Option B. Plug the device into another switch port. Option C. Look for an errdisable state. Option D. Turn on class of service. Pause the video now if you want time to think about the answer.
The correct answer is A. Replace the patch cable. A high CRC count usually means corrupted frames from a bad physical medium, and a faulty patch cable is the most common and simplest cause to eliminate. Now, why are the other options incorrect? Option B is incorrect. Moving to another port is not the first step, because the problem is more likely the cable. Option C is incorrect. Errdisable means the port has been shut down, whereas this port is active and reporting errors. Option D is incorrect. Class of service prioritizes traffic and does nothing about corrupted frames. Therefore, A, Replace the patch cable, is the correct answer.
Play from 1:45:52 Question 80. A network administrator wants to confirm that machines can still communicate with each other after an outage at the office. Which two tools will best test this? (Choose two.) Here are the options. Option A. nslookup. Option B. traceroute. Option C. SNMP. Option D. ping. Option E. arp. Option F. LLDP. Pause the video now if you want time to think about the answer.
The correct answers are B. traceroute, and D. ping. Ping checks whether a host responds, and traceroute shows the path and where along it communication stops, so both directly test reachability. Now, why are the other options incorrect? Option A is incorrect. Nslookup tests name resolution rather than whether hosts can reach each other. Option C is incorrect. SNMP is used to monitor device status and does not directly test reachability between hosts. Option E is incorrect. The arp command shows address mappings and does not test connectivity. Option F is incorrect. LLDP lets devices advertise themselves to neighbors and is not a connectivity test. Therefore, B and D are the correct answers.
Play from 1:47:23 Question 81. Which hardware part works mainly at the data link layer and lets a fiber optic cable plug into a switch or network card port? Here are the options. Option A. SFP transceiver. Option B. SC. Option C. Twinaxial cable. Option D. DAC. Pause the video now if you want time to think about the answer.
The correct answer is A. SFP transceiver. A small form-factor pluggable transceiver is a module that sits in a port and converts electrical signals to light, which lets a fiber cable attach. Now, why are the other options incorrect? Option B is incorrect. SC is a type of fiber connector, not a module that attaches to the port and works at the data link layer. Option C is incorrect. Twinaxial cable is a copper cable with its connectors built in, so it does not accept a separate fiber cable. Option D is incorrect. A direct attach cable is a fixed copper link with its own connectors and does not take fiber. Therefore, A, SFP transceiver, is the correct answer.
Play from 1:48:46 Question 82. At which OSI layer is a host's IP address applied? Here are the options. Option A. Network. Option B. Session. Option C. Application. Option D. Data link. Pause the video now if you want time to think about the answer.
The correct answer is A. Network. The network layer handles logical addressing with IP, which identifies hosts across different networks. Now, why are the other options incorrect? Option B is incorrect. The session layer manages conversations between applications and does not assign addresses. Option C is incorrect. The application layer provides services to software and does not handle IP addressing. Option D is incorrect. The data link layer uses hardware addresses on a local segment, not IP addresses. Therefore, A, Network, is the correct answer.
Play from 1:49:57 Question 83. Which scenario is a typical use case for platform as a service? Here are the options. Option A. E-commerce site. Option B. Application development. Option C. Cloud-native software. Option D. Mobile access. Pause the video now if you want time to think about the answer.
The correct answer is B. Application development. A platform service gives developers a ready environment with runtimes and tools, so they can build, test, and deploy applications without managing servers. Now, why are the other options incorrect? Option A is incorrect. Running a store is a workload that could be hosted on many models and is not what defines a platform service. Option C is incorrect. Cloud-native software is an architectural style rather than a use case that characterizes this model. Option D is incorrect. Mobile access is a way of reaching services, not a use case of this service model. Therefore, B, Application development, is the correct answer.
Play from 1:51:17 Question 84. A sensitive department's subnet must be able to reach only approved external HTTPS sites. What should be put in place? Here are the options. Option A. Proxy. Option B. Load balancer. Option C. IPS. Option D. CDN. Pause the video now if you want time to think about the answer.
The correct answer is A. Proxy. A proxy sits between users and the internet, so it can allow connections only to permitted destinations and block everything else. Now, why are the other options incorrect? Option B is incorrect. A load balancer spreads incoming requests across servers and does not limit where users can go. Option C is incorrect. An IPS looks for attack signatures and does not enforce a list of approved destinations. Option D is incorrect. A CDN speeds up content delivery and does not restrict outbound access. Therefore, A, Proxy, is the correct answer.
Play from 1:52:29 Question 85. A vendor warns of a flaw in the processor of a router. What should the engineer do to correct it? Here are the options. Option A. Quarantine the device from the network. Option B. Upgrade the firmware on the router. Option C. Install a new system board in the router. Option D. Install an operating system patch. Pause the video now if you want time to think about the answer.
The correct answer is B. Upgrade the firmware on the router. Hardware vulnerabilities in a network device are fixed by vendor-supplied firmware updates, which change how the device handles the flaw. Now, why are the other options incorrect? Option A is incorrect. Quarantining limits exposure but does not remove the flaw. Option C is incorrect. Replacing the board is costly and unnecessary when a firmware update addresses the issue. Option D is incorrect. A router has no separate operating system patch for a hardware-level issue; firmware is the update path. Therefore, B, Upgrade the firmware on the router, is the correct answer.
Play from 1:53:50 Question 86. A network appliance has failed to boot properly. Which method can still give an administrator remote access to it? Here are the options. Option A. Secure Shell. Option B. Out-of-band management. Option C. Crash cart. Option D. Jump box. Pause the video now if you want time to think about the answer.
The correct answer is B. Out-of-band management. Out-of-band management uses a separate path to the device, so access works even when the main system or its network stack is down. Now, why are the other options incorrect? Option A is incorrect. SSH needs the device to be running and its network interface to be up. Option C is incorrect. A crash cart is a physical station wheeled to the device, so it is not remote. Option D is incorrect. A jump box is an intermediary that still depends on the target accepting connections. Therefore, B, Out-of-band management, is the correct answer.
Play from 1:55:07 Question 87. A device accepts only dotted-decimal subnet masks, but the network uses a /21 prefix. Which mask should the administrator enter? Here are the options. Option A. 255.255.252.0. Option B. 255.255.240.0. Option C. 255.255.248.0. Option D. 255.255.224.0. Pause the video now if you want time to think about the answer.
The correct answer is C. 255.255.248.0. A /21 has 21 network bits: two full octets plus five bits in the third, which equals 248, so the mask is 255.255.248.0. Now, why are the other options incorrect? Option A is incorrect. 255.255.252.0 is a /22. Option B is incorrect. 255.255.240.0 is a /20. Option D is incorrect. 255.255.224.0 is a /19. Therefore, C, 255.255.248.0, is the correct answer.
Play from 1:56:42 Question 88. A recovery plan promises the business will never lose more than eight hours' worth of information. Which disaster recovery metric expresses that limit? Here are the options. Option A. MTTR. Option B. RTO. Option C. RPO. Option D. MTBF. Pause the video now if you want time to think about the answer.
The correct answer is C. RPO. The recovery point objective sets how much data, measured in time, an organization can afford to lose, which in this case is eight hours. Now, why are the other options incorrect? Option A is incorrect. MTTR is the average time needed to repair something, not the tolerable data loss. Option B is incorrect. RTO is how long a system may be down, not how much data can be lost. Option D is incorrect. MTBF is the average time between failures and says nothing about data loss tolerance. Therefore, C, RPO, is the correct answer.
Play from 1:57:58 Question 89. Management notices heavy use of gambling websites from work computers and wants to restrict it. What should the company most likely deploy? Here are the options. Option A. Screened subnet. Option B. Port security. Option C. Content filter. Option D. ACLs. Pause the video now if you want time to think about the answer.
The correct answer is C. Content filter. A content filter blocks categories of websites, such as gambling, based on policy. Now, why are the other options incorrect? Option A is incorrect. A screened subnet isolates public-facing servers and does not restrict web browsing. Option B is incorrect. Port security controls which devices can use a switch port, not the sites visited. Option D is incorrect. ACLs filter by address and port, which is not practical for blocking a whole category of websites. Therefore, C, Content filter, is the correct answer.
Play from 1:59:14 Question 90. Which table is consulted with the longest prefix match to choose the exit interface for a packet? Here are the options. Option A. Routing table. Option B. ARP table. Option C. Netstat table. Option D. MAC address table. Pause the video now if you want time to think about the answer.
The correct answer is A. Routing table. A router compares the destination address with its route entries and picks the most specific match, which determines the outgoing interface. Now, why are the other options incorrect? Option B is incorrect. The ARP table maps IP addresses to MAC addresses and is not used for prefix matching. Option C is incorrect. Netstat output lists connections and statistics and is not a forwarding table. Option D is incorrect. The MAC address table is used by switches to forward frames and does not involve prefixes. Therefore, A, Routing table, is the correct answer.
Play from 2:00:30 Question 91. In a data center laid out with hot and cold aisles, which side of rack-mounted equipment should its exhaust vents face? Here are the options. Option A. Front. Option B. Rear. Option C. Top. Option D. Sides. Pause the video now if you want time to think about the answer.
The correct answer is B. Rear. Equipment draws cool air in at the front and exhausts hot air at the rear, into the hot aisle. Now, why are the other options incorrect? Option A is incorrect. The front is the intake side, facing the cold aisle. Option C is incorrect. Venting upward breaks the hot and cold aisle separation. Option D is incorrect. Venting out the sides would blow hot air into neighboring equipment. Therefore, B, Rear, is the correct answer.
Play from 2:01:34 Question 92. A system requires multifactor authentication. In addition to a password, which item could it ask the user to provide? Here are the options. Option A. Mother's birth surname. Option B. Hard token. Option C. PIN. Option D. Favorite color. Pause the video now if you want time to think about the answer.
The correct answer is B. Hard token. A hardware token is something the user has, which is a different factor from the password, something the user knows. Now, why are the other options incorrect? Option A is incorrect. A mother's birth surname is another piece of knowledge, the same factor as a password, and is easy to discover. Option C is incorrect. A PIN is also something a user knows, so it would not add a second factor. Option D is incorrect. A favorite color is a guessable piece of knowledge and is not a separate factor. Therefore, B, Hard token, is the correct answer.
Play from 2:02:47 Question 93. A company wants to prevent personal devices from joining its wireless network. Which method best enforces that rule? Here are the options. Option A. ACL. Option B. Port security. Option C. 802.1X. Option D. MAC filtering. Pause the video now if you want time to think about the answer.
The correct answer is C. 802.1X. 802.1X requires every device to authenticate with credentials or a certificate, so unapproved personal devices are refused. Now, why are the other options incorrect? Option A is incorrect. An ACL filters traffic after a device has connected and does not stop it from joining. Option B is incorrect. Port security applies to wired switch ports, not a wireless network. Option D is incorrect. MAC filtering can be bypassed by copying an approved address, so it is a weak control. Therefore, C, 802.1X, is the correct answer.
Play from 2:04:08 Question 94. A directory service must be reached over an encrypted channel. Which port should clients use? Here are the options. Option A. 389. Option B. 636. Option C. 22. Option D. 445. Pause the video now if you want time to think about the answer.
The correct answer is B. 636. LDAP over TLS uses port 636, whereas standard LDAP on 389 is unencrypted. Now, why are the other options incorrect? Option A is incorrect. Port 389 is standard LDAP, which is not encrypted by default. Option C is incorrect. Port 22 is SSH and is not a directory service port. Option D is incorrect. Port 445 is SMB file sharing. Therefore, B, 636, is the correct answer.
Play from 2:05:18 Question 95. An organization wants the control that most directly safeguards sensitive information carried across its network. Which should it prioritize? Here are the options. Option A. Multifactor authentication. Option B. Role-based access controls. Option C. Data-in-transit encryption. Option D. Least privilege. Pause the video now if you want time to think about the answer.
The correct answer is C. Data-in-transit encryption. Encrypting data as it travels keeps it unreadable to anyone who intercepts it on the network. Now, why are the other options incorrect? Option A is incorrect. Multifactor authentication protects logins and does not encrypt the traffic. Option B is incorrect. Role-based access controls limit who can use data but do not protect it in transit. Option D is incorrect. Least privilege restricts access rights and does not protect data crossing the network. Therefore, C, Data-in-transit encryption, is the correct answer.
Play from 2:06:33 Question 96. An IP phone is connected to a switch port but cannot take calls. What must be done on that port? Here are the options. Option A. Turn off VLAN support on the port. Option B. Change the native VLAN setting. Option C. Allow every VLAN across the port as a trunk. Option D. Tag the phone's traffic into the voice VLAN. Pause the video now if you want time to think about the answer.
The correct answer is D. Tag the phone's traffic into the voice VLAN. Phones normally send their traffic in a dedicated voice VLAN, so the port must tag that traffic accordingly for calls to work. Now, why are the other options incorrect? Option A is incorrect. Disabling VLANs would remove the separation and would not fix the voice traffic. Option B is incorrect. Changing the native VLAN affects untagged frames and does not set up the voice VLAN. Option C is incorrect. Trunking every VLAN is unnecessary and insecure, and it still does not tag the voice traffic. Therefore, D, Tag the phone's traffic into the voice VLAN, is the correct answer.
Play from 2:07:56 Question 97. Which device keeps equipment running through a power outage? Here are the options. Option A. Voltage. Option B. UPS. Option C. PDU. Option D. Power load. Pause the video now if you want time to think about the answer.
The correct answer is B. UPS. An uninterruptible power supply holds a battery that supplies power immediately when the mains fails. Now, why are the other options incorrect? Option A is incorrect. Voltage is an electrical measurement, not a device. Option C is incorrect. A PDU distributes power to equipment but has no battery to ride out an outage. Option D is incorrect. Power load describes how much power is consumed, not a backup source. Therefore, B, UPS, is the correct answer.
Play from 2:09:03 Question 98. Traffic arriving at a firewall on TCP port 80 is delivered to an internal host listening on port 88. Which technology makes this work? Here are the options. Option A. PAT. Option B. SSL. Option C. TLS. Option D. FHRP. Pause the video now if you want time to think about the answer.
The correct answer is A. PAT. Port address translation can rewrite the port number as traffic passes through, so a public port maps to a different internal port. Now, why are the other options incorrect? Option B is incorrect. SSL encrypts sessions and does not change ports. Option C is incorrect. TLS also provides encryption and does not translate ports. Option D is incorrect. FHRP provides gateway redundancy and has no role in changing port numbers. Therefore, A, PAT, is the correct answer.
Play from 2:10:16 Question 99. Which service should be configured so employees can join the Wi-Fi network with their company logins? Here are the options. Option A. SAML. Option B. SSO. Option C. RADIUS. Option D. MFA. Pause the video now if you want time to think about the answer.
The correct answer is C. RADIUS. A RADIUS server validates user credentials for network access requests, which is how enterprise Wi-Fi checks company logins. Now, why are the other options incorrect? Option A is incorrect. SAML exchanges authentication data between web applications and is not used for Wi-Fi network access. Option B is incorrect. SSO lets users sign in once to multiple applications and is not itself the Wi-Fi authentication service. Option D is incorrect. MFA adds more verification factors, but a server is still needed to validate the credentials. Therefore, C, RADIUS, is the correct answer.
Play from 2:11:32 Question 100. What is the name for the data unit at the transport layer when the communication is connectionless? Here are the options. Option A. Frames. Option B. Packets. Option C. Segment. Option D. Datagram. Pause the video now if you want time to think about the answer.
The correct answer is D. Datagram. Connectionless transport such as UDP sends self-contained units called datagrams. Now, why are the other options incorrect? Option A is incorrect. Frames are the units of the data link layer. Option B is incorrect. Packets are the units of the network layer. Option C is incorrect. Segments are the units of connection-oriented TCP communication. Therefore, D, Datagram, is the correct answer.
