Cybersecurity-Apprentice Network Fundamentals Practice Test 4 — 15 Questions

Question 1

A cybersecurity apprentice is analyzing traffic captures and notices that a workstation sends a single packet to a server, and the server responds with a packet that is much larger than the original. The apprentice suspects that the network path cannot handle the larger frame size. Which protocol should the apprentice examine to confirm that the path supports the larger frame size without fragmentation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Path MTU Discovery (PMTUD). Path MTU Discovery (PMTUD) is the correct protocol because it actively determines the largest packet size that can traverse the network path without fragmentation. When a host sends a packet larger than the path MTU, PMTUD relies on ICMP 'fragmentation needed' messages to learn the correct size. In this scenario, the server's larger response likely triggered a PMTUD failure, so examining PMTUD is the right approach.

Answer

ICMP

Answer

Dynamic Host Configuration Protocol (DHCP)

Answer

Address Resolution Protocol (ARP)

Question 2

A network administrator is setting up a new branch office firewall. The ISP provides a single public IP address and requires the branch's internal web server (10.1.1.10) to be reachable from the internet on TCP port 443. The administrator configures a destination NAT rule translating the public IP to 10.1.1.10. However, external users still cannot access the web server. What is the most likely missing configuration?

Accepted Answer

A security policy allowing traffic from the untrust zone to the trust zone on port 443.. After configuring destination NAT, the firewall still enforces security policy. The policy must allow the translated traffic from the untrust zone to the trust zone on the correct port. Without it, the packet is dropped. Source NAT, static routes, or application overrides are not needed for basic inbound access to a directly connected server.

Answer

An application override policy to identify HTTPS traffic on port 443.

Answer

A source NAT rule to translate the internal server's IP to the public IP for return traffic.

Answer

A static route pointing to the ISP gateway for the server's subnet.

Question 3

A network administrator is troubleshooting a connectivity issue between two hosts on the same VLAN. The hosts are connected to the same switch, but they cannot ping each other. The administrator suspects a Layer 2 problem. Which command should be used on the switch to verify the MAC address table and confirm that the switch has learned the MAC addresses of both hosts?

Accepted Answer

show mac address-table. To diagnose a Layer 2 connectivity issue between hosts on the same VLAN, the administrator should check the switch's MAC address table using the show mac address-table command. This verifies whether the switch has learned the MAC addresses and on which ports they reside. Other commands like show arp or show ip route operate at Layer 3 and are not relevant for this Layer 2 problem.

Answer

show ip route

Answer

show arp

Answer

show interface status

Question 4

A network engineer is configuring a router interface with the IPv4 address 172.16.10.33 and subnet mask 255.255.255.224. The engineer needs to determine the network address and broadcast address for this subnet. What are the network and broadcast addresses, respectively?

Accepted Answer

172.16.10.32 and 172.16.10.63. With a subnet mask of 255.255.255.224 (/27), the subnet increment is 32. The address 172.16.10.33 falls within the subnet starting at 172.16.10.32. Therefore, the network address is 172.16.10.32 and the broadcast address is 172.16.10.63. The correct answer is 172.16.10.32 and 172.16.10.63.

Answer

172.16.10.0 and 172.16.10.31

Answer

172.16.10.0 and 172.16.10.63

Answer

172.16.10.33 and 172.16.10.62

Question 5

A junior security analyst is reviewing the TCP/IP model as part of onboarding. She needs to identify which layer is responsible for logical addressing and routing of packets between different networks. Which layer of the TCP/IP model performs this function?

Accepted Answer

The Internet layer. The Internet layer of the TCP/IP model is responsible for logical addressing and routing. Protocols like IP assign addresses and determine paths across networks. The Network Access layer deals with physical and link concerns, the Transport layer manages end-to-end delivery, and the Application layer supports user services. Only the Internet layer performs the logical addressing and inter-network routing the scenario describes.

Answer

The Network Access layer

Answer

The Application layer

Answer

The Transport layer

Question 6

A junior administrator is asked to identify the default administrative distance values used by a Palo Alto Networks firewall for routes learned from different sources. Which statement correctly identifies the default administrative distance for OSPF internal routes?

Accepted Answer

30. PAN-OS uses a default administrative distance of 30 for OSPF internal routes, which is lower than values for RIP or eBGP but higher than static or connected routes. This preference order ensures that more trusted or directly configured paths win when multiple sources advertise the same prefix, which is critical for predictable routing behavior on the firewall.

Answer

120

Answer

10

Answer

110

Question 7

A help desk technician is on a support call with a remote user whose workstation cannot reach any resources on the corporate network. The technician asks the user to run a command that will show the workstation's IP address, subnet mask, and default gateway. Which command should the user run?

Accepted Answer

ipconfig /all. When a workstation cannot reach the network, the first thing to verify is its own IP configuration. Running ipconfig /all on Windows shows the IPv4 address, subnet mask, default gateway, DNS servers, and DHCP lease information in one output. That lets the technician confirm whether the host has a valid address on the correct subnet and a gateway it can actually use.

Answer

tracert 8.8.8.8

Answer

netstat -an

Answer

nslookup corp-dc01

Question 8

A help desk technician is diagnosing a user's workstation that can reach a server by IP address but cannot reach it by hostname. The technician confirms the workstation has a valid IP address, default gateway, and can ping the server's IP successfully. Which network service should the technician investigate first?

Accepted Answer

DNS resolution. Reaching a server by IP but failing by hostname is a classic symptom of DNS failure. DNS resolves hostnames to IP addresses, so when it is unavailable or misconfigured, name-based connections fail while direct IP connections succeed. DHCP already worked because the workstation has valid configuration, ARP works because pinging succeeds, and routing works for the same reason. DNS is the correct focus.

Answer

DHCP lease renewal

Answer

Routing table corruption

Answer

ARP cache poisoning

Question 9

A company is deploying a new VoIP phone system. The network administrator needs to ensure that voice traffic is prioritized over regular data traffic on the LAN. Which technology should be implemented on the switches to achieve this?

Accepted Answer

Quality of Service (QoS). To prioritize voice traffic over data on a LAN, Quality of Service (QoS) must be implemented. QoS classifies packets and places voice traffic in a higher-priority queue, ensuring timely delivery. VLAN tagging, port mirroring, and link aggregation do not provide prioritization, so they are not suitable for this requirement.

Answer

Link aggregation

Answer

Port mirroring

Answer

VLAN tagging

Question 10

A network administrator is configuring a Layer 3 interface on a Palo Alto Networks firewall to participate in a broadcast domain. The interface must obtain its IP address automatically from a DHCP server on the same subnet. Which interface configuration setting must be enabled to allow the firewall to act as a DHCP client?

Accepted Answer

DHCP Client. To have the firewall obtain an address automatically from a DHCP server on the same subnet, the Layer 3 interface must be configured with DHCP Client enabled. This mode allows the interface to request and renew a lease, dynamically receiving an IP address, subnet mask, default gateway, and DNS settings, which simplifies deployment in environments where centralized address management is used.

Answer

Static IP

Answer

DHCP Server

Answer

PPPoE

Question 11

A security analyst is reviewing captured traffic and needs to identify which protocol resolves a known IPv4 address to its corresponding MAC address on the local segment. Which protocol performs this function?

Accepted Answer

ARP. ARP is the protocol that maps a known IPv4 address to a MAC address on a local network. A host broadcasts an ARP request asking who owns the address, and the owner responds with its hardware address. This mapping is required because Ethernet frames must carry a destination MAC address, so without ARP a host could not deliver traffic to another device on the same segment.

Answer

DHCP

Answer

DNS

Answer

ICMP

Question 12

A network engineer is analyzing a packet capture and observes that a workstation sends a TCP segment with the SYN flag and a destination port of 443 to a web server. The server responds with SYN-ACK, and the workstation completes the handshake with ACK. Shortly after, the workstation sends a segment with the RST flag. Which statement best describes what the RST segment indicates in this scenario?

Accepted Answer

The workstation is abruptly terminating the TCP connection or rejecting further data.. The RST flag in TCP signals an abrupt reset, terminating a connection or rejecting traffic. After a successful three-way handshake, a RST from the workstation means it is closing the session immediately or refusing further segments, often due to an application crash or a packet arriving at a closed port. FIN, by contrast, indicates graceful closure, and retransmissions or TLS negotiation use different mechanisms entirely.

Answer

The workstation is retransmitting a lost segment to the server.

Answer

The workstation is requesting a graceful, orderly shutdown of the session.

Answer

The workstation is negotiating encryption parameters for the session.

Question 13

A network security analyst is investigating a suspected ARP spoofing attack on the local network. The analyst needs to verify the ARP cache on a Windows workstation to identify any duplicate IP addresses mapped to different MAC addresses. Which TWO commands can be used to display the ARP cache on the workstation? (Choose two.)

Accepted Answer

arp -a. To inspect the ARP cache on a Windows workstation, the analyst can use either arp -a or netsh interface ip show arp. Both commands list IP-to-MAC address mappings, enabling detection of duplicate IPs with different MACs, which is a sign of ARP spoofing. The other commands provide different network information and do not show ARP entries.

Answer

route print

Answer

netstat -ano

Answer

ipconfig /all

Question 14

A security administrator is planning a network segmentation design and needs to understand how devices communicate at Layer 2. Which TWO statements accurately describe Ethernet MAC address behavior in a switched network? (Choose two.)

Accepted Answer

A broadcast frame is forwarded out all ports except the port on which it was received.. Switches learn MAC addresses from source addresses of received frames and flood broadcast frames to all ports in the same VLAN except the ingress port. These two behaviors enable efficient unicast forwarding after learning and ensure broadcast-based protocols reach all hosts. Understanding them is key to predicting traffic flow and troubleshooting Layer 2 connectivity issues.

Answer

A unicast frame with an unknown destination MAC address is dropped by the switch.

Answer

A switch forwards a frame with a destination MAC address of FF:FF:FF:FF:FF:FF only to the default gateway.

Answer

MAC addresses are logical addresses assigned by the network administrator and can be changed per subnet.

Question 15

A junior administrator is documenting the corporate network and must list services that operate at the transport layer of the TCP/IP model. Which TWO protocols operate at the transport layer? (Choose two.)

Accepted Answer

UDP. The transport layer is responsible for end-to-end delivery between applications, using port numbers to identify processes and offering different service levels. TCP provides reliable, connection-oriented delivery, while UDP provides lightweight, connectionless delivery. Both are transport-layer protocols. IP belongs to the network layer, Ethernet to the link layer, and HTTP to the application layer.

Answer

IP

Answer

Ethernet

Answer

HTTP