Select Two (Multi-Select) Questions

Share a single administrator account among all staff so everyone can fix problems quickly.

Why it fails: Shared administrator accounts destroy accountability because actions cannot be attributed to an individual, and they grant excessive privileges that malware can abuse when any one user is compromised. Least privilege with individual named accounts is the correct approach, so this measure worsens rather than improves the security posture.

Disable automatic operating system updates to prevent unexpected reboots.

Why it fails: Disabling automatic updates leaves known vulnerabilities unpatched, and malicious websites routinely exploit unpatched browsers and plugins to install malware. This measure increases risk rather than reducing it, and the reboot inconvenience is normally handled with maintenance windows instead of turning off patching entirely.

Allow all outbound traffic from the internal network to simplify troubleshooting.

Why it fails: Permitting every outbound connection lets infected hosts contact command-and-control servers and exfiltrate data, and it removes any chance of blocking malicious destinations at the perimeter. This is a permissive posture that enlarges the attack surface instead of protecting against email and web threats.

Encrypting sensitive data traffic

Why it fails: ACLs are purely filtering mechanisms and do not perform any form of data encryption. Encryption requires services like IPsec, SSL, or TLS, which handle the transformation of plaintext data into ciphertext. ACLs only decide whether to permit or drop a packet based on defined criteria.

Automatically updating firmware

Why it fails: Access Control Lists have absolutely no capability to manage or deploy firmware updates. Firmware management is a separate administrative task performed via TFTP, SCP, or management platforms. ACLs deal exclusively with packet filtering and traffic flow regulation, not the maintenance or lifecycle of device software.

Providing hardware redundancy

Why it fails: Hardware redundancy is achieved through physical cabling, power supplies, or protocols like HSRP and VRRP. ACLs are configuration-based traffic policies and contribute nothing to the physical or logical availability of the network hardware itself. They are strictly for traffic filtering, not for maintaining system uptime.

10.51.0.0

Why it fails: This address is outside of the 10.50.0.0/16 range. The /16 prefix means the first two octets (10.50) are fixed for all subnets created from this block. 10.51.0.0 belongs to a completely different /16 summary block and cannot be used as a subnet within the 10.50.0.0 space.

10.50.0.255

Why it fails: In a /24 subnetting scheme, the address ending in .255 is the broadcast address, not the network ID. The network ID must always be the first address in the block, which for this specific subnet would be 10.50.0.0. Using .255 for a network ID is a fundamental misunderstanding of IP boundaries.

10.50.1.1

Why it fails: This is a usable host address, typically assigned to the first device or the router's gateway interface within the 10.50.1.0/24 subnet. A network ID must always end with the host bits set to zero, which in a /24 mask corresponds to a zero in the fourth octet.

Enabling SNMPv1 for remote monitoring

Why it fails: SNMPv1 is highly insecure because it uses clear-text community strings for authentication. Enabling it creates a significant vulnerability, as attackers can easily intercept these strings to gain read or write access to the device management settings. Modern standards require SNMPv3 for its encryption and authentication capabilities.

Disabling the use of SSH for remote management

Why it fails: SSH is the industry-standard protocol for secure remote management, providing encrypted transport for commands. Disabling it would force administrators to use insecure protocols like Telnet, which transmits data in clear text, exposing administrative credentials and device commands to potential interception and compromise by attackers on the network.

Increasing the size of the routing table

Why it fails: Increasing the routing table size does not improve security; in fact, it can lead to memory exhaustion. Proper control plane security focuses on limiting access and managing traffic flow, not expanding the data structures used for packet switching, which could potentially expose the device to additional memory-based stability issues.

Configure port security on all access ports.

Why it fails: Port security restricts which MAC addresses can connect to a switch port, preventing unauthorized devices from accessing the network. While it enhances security, it does not directly isolate management traffic or secure remote management access. The engineer's goal is to protect management access, not to control endpoint devices, so this step is not the best fit.

Configure a default gateway on the switch.

Why it fails: A default gateway allows the switch to communicate with remote networks, which is necessary if management stations are on different subnets. However, it does not isolate management traffic or enforce authorization. While helpful, it is not a security step to restrict access, so it does not meet the requirement as directly as the correct options.

Enable DHCP snooping on the management VLAN.

Why it fails: DHCP snooping prevents rogue DHCP servers from assigning incorrect IP configurations. It is a security feature for client networks, not for isolating management traffic or securing remote access. The engineer's focus is on management access security, so DHCP snooping is irrelevant to this scenario.

Enable Dynamic ARP Inspection on all access ports without DHCP snooping.

Why it fails: Dynamic ARP Inspection depends on the DHCP snooping binding table to validate ARP packets. Enabling DAI without DHCP snooping leaves no binding database, so legitimate ARP traffic may be dropped or the feature will not function as intended. It also addresses ARP spoofing rather than MAC flooding or unauthorized attachment, so it does not fit the stated goal.

Configure the native VLAN on all trunk ports to match VLAN 1.

Why it fails: Leaving the native VLAN as VLAN 1 on trunks is a common misconfiguration that enables VLAN hopping attacks such as double tagging. Best practice is to change the native VLAN to an unused VLAN on both ends of the trunk. Matching VLAN 1 would weaken security rather than harden the switch, so it does not meet the team's objective.

Enable IP source guard on routed uplinks only.

Why it fails: IP Source Guard filters traffic based on DHCP snooping bindings and is typically applied to access ports, not routed uplinks. Applying it only to uplinks would not protect access-layer clients from spoofed source addresses and would not address MAC flooding or unauthorized device attachment. It is the wrong placement and wrong scope for this scenario.

ipconfig /renew

Why it fails: Renewing the IP configuration is a step taken when a technician suspects a DHCP issue or an expired lease. While useful for fixing local IP problems, it does not provide diagnostic information about the path to a specific remote server or help identify where a breakdown in communication is occurring.

netstat -a

Why it fails: The netstat command displays active network connections and listening ports on the local machine. While it can help identify if an application is listening or if a connection is established, it does not test the reachability of a remote IP address or provide details about the network path.

nslookup 192.168.50.10

Why it fails: Nslookup is used to query the Domain Name System to find the IP address associated with a hostname. Using it against an IP address performs a reverse lookup, which might verify the server's identity, but it does not diagnose why the user cannot reach the web server's actual IP address.

The PSE supplies power on the same pairs used for data in 10BASE-T and 100BASE-TX, which is why Gigabit Ethernet cannot support PoE.

Why it fails: PoE can be delivered on the data pairs (Alternative A) or on the spare pairs (Alternative B), and Gigabit Ethernet fully supports PoE using all four pairs for both data and power. The claim that Gigabit Ethernet cannot support PoE is false and contradicts the IEEE 802.3af/at/bt standards. In the VoIP scenario, Gigabit PoE switches are common and fully capable.

The PD must be manually configured with a static power budget on the switch port before it will receive any power.

Why it fails: PoE is designed to be plug-and-play, with automatic detection and classification occurring without manual per-port power configuration. While an administrator can set power limits or disable PoE on a port, manual static power budgeting is not a prerequisite for the PD to receive power. This statement incorrectly describes the negotiation process and would not be required in a standard VoIP deployment.

The PD sends a DHCP request to the PSE to request a specific power class before link negotiation.

Why it fails: Power negotiation occurs at the physical layer using electrical detection and classification pulses, not through DHCP. DHCP operates at Layer 3 and is used for IP address assignment, not for PoE power requests. A PD does not send a DHCP message to the PSE to request power, so this statement misrepresents the PoE negotiation mechanism in the VoIP deployment scenario.

An SFP+ module will always work in a standard SFP slot

Why it fails: Although they are the same size, a standard SFP slot is usually not electronically capable of supporting the 10 Gbps data rate of an SFP+ module. In most cases, plugging an SFP+ module into a legacy SFP slot will result in the port failing to initialize or remaining in a down state.

SFP modules use RJ-45 connectors exclusively

Why it fails: While copper SFP modules exist that provide an RJ-45 interface, the vast majority of SFP transceivers are designed for fiber optic connections using LC connectors. SFPs are media-dependent, meaning they can be purchased for various fiber types (multimode or single-mode) as well as for copper cabling.

SFP+ modules are only compatible with single-mode fiber

Why it fails: SFP+ transceivers are available for many different media types, including both single-mode fiber (for long distances) and multi-mode fiber (for short distances). There are also SFP+ Direct Attach Copper (DAC) cables that use the same form factor for very short, high-speed connections within a server rack.

The switch logs show the port entering the err-disabled state repeatedly.

Why it fails: Err-disabled state results from violations such as BPDU guard, port security, or link-flap detection, not from a duplex mismatch. A duplex-mismatched port continues forwarding frames, just poorly. If the port were err-disabled, users would lose connectivity entirely rather than experience slow file transfers, so this output points to a different class of problem.

The switch port shows the line protocol as down while the physical link remains up.

Why it fails: A duplex mismatch does not bring the line protocol down. The link stays up and passes traffic, which is why the symptom is slow performance rather than a total outage. A down line protocol with an up physical link usually indicates a Layer 2 or Layer 3 negotiation issue, such as a mismatched encapsulation or an authentication failure, not a duplex problem.

The server's NIC reports a negotiated speed of 1000 Mb/s and full duplex.

Why it fails: A correctly negotiated 1000 Mb/s full-duplex link is the expected healthy state, not evidence of a mismatch. Gigabit Ethernet actually requires full duplex and does not support half-duplex operation, so a gigabit link cannot be in a duplex mismatch. Reporting this state would indicate the link is functioning as intended at the physical layer.

UDP uses sequence numbers to reassemble data in the correct order.

Why it fails: Sequencing is a feature exclusive to TCP, which ensures that segments arriving out of order are rearranged correctly before being handed to the application. UDP lacks this mechanism entirely; it delivers packets to the application in whatever order they arrive, placing the burden of reordering on the application layer if necessary.

UDP operates at the Network Layer of the OSI model.

Why it fails: Both UDP and TCP are Transport Layer (Layer 4) protocols. The Network Layer (Layer 3) is responsible for logical addressing and routing, primarily using the Internet Protocol. Confusing the layers is a common mistake; the Transport Layer focuses on end-to-end communication and data integrity rather than the path through the network.

UDP includes a three-way handshake to ensure delivery.

Why it fails: The three-way handshake is a specific synchronization process used by TCP to establish a reliable connection. UDP is designed to be as lightweight as possible, so it omits this process entirely. This absence of a handshake allows UDP to start sending data immediately, which is crucial for reducing initial connection delay.

show ip route

Why it fails: The IP routing table shows the paths to network destinations and is managed by layer 3 protocols. While useful for path selection issues, it does not provide information regarding physical layer errors or interface flapping, making it ineffective for diagnosing physical media or hardware-related intermittent connectivity problems in the network.

show ip arp

Why it fails: The ARP table links IP addresses to MAC addresses within the local network segment. While ARP issues can cause connectivity loss, they are related to layer 2 logical addressing and not physical layer integrity. Therefore, this command will not help identify physical errors or flapping ports on the switch.

show ip protocols

Why it fails: This command provides information about the active dynamic routing protocols and their status. It is used to troubleshoot layer 3 routing logic and neighbor adjacencies. Since it does not report interface-level statistics or physical status changes, it is irrelevant for diagnosing intermittent connectivity caused by layer 1 hardware issues.

An IPv6 address can contain multiple double colon sequences as long as each replaces a different zero run.

Why it fails: The double colon may appear at most once in any IPv6 address. Allowing multiple instances would make the address ambiguous because the parser could not determine how many zero groups each double colon represents. This restriction is enforced by RFC 4291 and is essential for consistent address interpretation across implementations.

The IPv6 prefix length is expressed in dotted-decimal notation following a space, such as 2001:db8::1 255.255.255.0.

Why it fails: IPv6 prefixes are always written with a slash and a decimal number of bits, for example 2001:db8::/32. Dotted-decimal subnet masks belong to IPv4 and have no role in IPv6 notation. Mixing the two formats is a conceptual error that would confuse configuration and documentation.

Trailing zeros at the end of a hextet may be removed to shorten the address, so 2001:0db0::1 can be written as 2001:0db::1.

Why it fails: Only leading zeros within a hextet may be suppressed. Removing trailing zeros changes the value of the group, since 0db0 equals 3504 while 0db equals 219. Such a modification produces a completely different address and is never permitted under IPv6 text representation rules.

Antivirus

Why it fails: Antivirus software is primarily an endpoint security measure installed on individual computers and servers. It scans files and memory for known signatures of malicious software. While critical for a security strategy, it is not considered a network-level perimeter device like a dedicated firewall or an intrusion prevention system.

Honeypot

Why it fails: A honeypot is a decoy system designed to lure attackers and gather information about their methods. It is a passive security tool used for threat intelligence rather than a primary mitigation device. While useful for research, it does not actively prevent or block attacks on the production network in real-time.

Load Balancer

Why it fails: A load balancer is a device that distributes incoming network traffic across multiple servers to ensure high availability and reliability. While it can provide some security benefits, such as hiding server IP addresses, its primary function is performance optimization rather than the active mitigation of security threats or malicious intrusions.

The double-colon (::) can be used multiple times in a single IPv6 address to shorten it.

Why it fails: Using a double-colon more than once in an IPv6 address creates ambiguity regarding how many zero bits are being suppressed. The rule strictly dictates that the shorthand may be used exactly once per address to ensure that the total bit count remains fixed at 128 bits.

An IPv6 address must always be written in full 32-character hexadecimal format.

Why it fails: Requiring a full 32-character representation ignores the standard compression rules designed for human readability. Cisco IOS accepts compressed formats, and forcing a full representation is unnecessary and prone to manual input errors during device configuration, which could result in connectivity issues across the network infrastructure.

Trailing zeros in a 16-bit field can be omitted.

Why it fails: Only leading zeros in a 16-bit field can be omitted. Trailing zeros are significant because they represent the numerical value of the field. Omitting them would change the value of the address, resulting in an incorrect logical identifier that prevents communication between the intended network devices.

The use of Category 6a cabling for the backhaul

Why it fails: Category 6a cabling provides the data and power path to the access point but does not affect the wireless signal propagation itself. As long as the cable is within the 100-meter limit, it will provide a high-speed, stable connection that supports the maximum throughput of the wireless endpoint.

Configuring the access point for PoE+ (802.3at)

Why it fails: Power over Ethernet Plus is a standard for delivering electrical power over the data cable and does not interfere with the radio frequencies used for wireless communication. In fact, PoE+ is necessary for modern high-performance access points to ensure they have enough power to operate all their internal radios.

Using an LC-to-LC fiber patch cord

Why it fails: Fiber optic patch cords are used for high-speed data transmission and are completely immune to radio frequency interference. While they might be used to connect a switch to a media converter near an access point, they have no impact on the wireless signal's ability to reach mobile endpoints.

Check the switch interface status.

Why it fails: The switch interface status tells you if the physical link is up or down. While this is important, it does not tell you if the workstation has been assigned a valid IP address by DHCP or static configuration. It only confirms that the physical layer is connected.

Perform a traceroute to the local gateway.

Why it fails: A traceroute to the local gateway is meant to test path reliability. If the PC does not have a valid IP address, it will not be able to generate the packets necessary for a traceroute, making this test useless until the basic IP addressing has been verified first.

Reset the switch configuration.

Why it fails: Resetting a switch is a destructive action that will cause significant network downtime. It is never the correct step for troubleshooting a single workstation's IP addressing issue. This would impact every other device connected to the switch and is completely disproportionate to the problem of a single host.

The MAC address of the DHCP server.

Why it fails: While the client learns the server's MAC address through the Ethernet header of the DHCP messages, it is not a 'parameter' provided within the DHCP ACK payload for the client's configuration. The client does not store the server's MAC address as part of its permanent networking configuration settings.

The SSH private key for the management console.

Why it fails: DHCP is used for basic network provisioning and does not handle the distribution of sensitive security credentials like SSH private keys. Security features like SSH require separate configuration or specialized deployment tools. Including such information in a DHCP broadcast would be a significant security risk to the entire network environment.

RJ-45

Why it fails: The RJ-45 connector is the standard interface used for copper Ethernet connections, such as UTP or STP cables. It uses eight pins to make electrical contact and is physically incompatible with fiber optic ports, which require optical alignment rather than electrical contact to transmit data successfully.

BNC

Why it fails: BNC connectors are typically used with coaxial cables for older thinnet networks or for professional video equipment. They use a bayonet-style twist-lock mechanism and are not used for modern fiber optic networking, as they are designed for electrical signals carried over a copper conductor and shield.

F-type

Why it fails: F-type connectors are threaded connectors primarily used with coaxial cables for cable television and broadband internet modems. They are not designed for data networking endpoints like switches or fiber patch panels and do not possess the precision alignment required for successful fiber optic light transmission.

Private IP addresses can be routed directly across the public internet.

Why it fails: Private IP addresses (RFC 1918) are blocked by internet service providers at the edge, as they are not unique globally. Attempting to route private traffic directly across the internet will result in failure because the global routing infrastructure is configured to ignore these ranges, necessitating the use of NAT.

The 127.0.0.0/8 range is used for private internal communication.

Why it fails: The 127.0.0.0/8 range is reserved specifically for loopback testing. It is only accessible on the local host and cannot be used for communication between different devices. Using it for internal networking would isolate the host, as no traffic sent to this range leaves the local network stack.

All IPv4 addresses are assigned automatically by the ISP.

Why it fails: While many hosts receive addresses via DHCP from an ISP or local server, static assignment is a common requirement for servers, routers, and network infrastructure. The statement is too broad because it ignores the necessity of manual configuration for critical network components that require permanent, unchanging IP identities within the network.