CompTIA Network+ N10-009 (N10-009) — Questions 1–75

Incorrect encryption settings would cause authentication failures or inability to connect, not slow or dropping connections with adequate signal strength. The issue is interference from multiple APs on the same channel.

Incorrect SSID configuration would prevent clients from connecting or seeing the network, but the symptoms describe slow and dropping connections with adequate signal strength, which points to interference, not misconfiguration.

Low antenna gain would reduce signal strength, but the site survey indicates adequate signal strength, so antenna gain is not the issue. The problem is interference from multiple APs on the same channel.

A question where users cannot connect to a wireless network despite correct SSID and signal, and the network uses WPA2-Enterprise but the client has WPA2-Personal configured, leading to authentication failure.

A question where users cannot see or connect to a wireless network, even though other networks are visible, and a site survey confirms the SSID is not broadcast or is misspelled on the access point.

In a scenario where users experience weak signal or dead spots despite adequate AP coverage, and the site survey shows low RSSI values, low antenna gain on the APs could be the cause. For example, if APs have omnidirectional antennas with 2 dBi gain in a large open area, upgrading to higher-gain antennas (e.g., 5 dBi) might improve coverage.

Candidates may confuse connectivity issues with performance issues, thinking encryption mismatches cause intermittent drops, but encryption errors typically result in persistent connection failures.

Candidates may confuse connectivity issues with configuration errors, assuming that if the network is slow or dropping, the SSID might be misconfigured, but SSID issues typically cause complete inability to connect, not degraded performance.

Candidates may confuse antenna gain with overall wireless performance, thinking that higher gain always solves connectivity issues, without considering that the problem here is interference, not signal strength.

A replay attack involves capturing and retransmitting valid data, but it does not inherently intercept or modify live communication between two parties; the attacker typically does not position themselves in the middle of the ongoing session.

Phishing is a social engineering attack that tricks users into revealing sensitive information, not an attack that intercepts or modifies communication between two parties.

A replay attack would be correct for a question like: 'Which attack involves capturing network traffic and retransmitting it to impersonate a legitimate user or gain unauthorized access?'

A question asking 'Which attack involves sending fraudulent emails to trick users into revealing credentials?' would have phishing as the correct answer.

Candidates may confuse replay attacks with man-in-the-middle because both involve intercepting data, but they overlook that replay attacks focus on reuse rather than real-time modification or interception of the communication channel.

Candidates may confuse phishing with man-in-the-middle because both involve deception, but phishing targets the user directly rather than the communication channel.

SET is used to modify configuration or write data to a device, not to retrieve information. The question asks for retrieving CPU utilization, which requires a read operation.

TRAP is an unsolicited message sent by an SNMP agent to the manager to notify an event, not a request to retrieve data. The question asks for retrieving current CPU utilization, which requires a GET request from the manager.

INFORM is used for acknowledged SNMP notifications between managers, not for retrieving data like CPU utilization from an agent.

An administrator needs to change the SNMP community string on a router to enhance security. In this case, SET would be the correct operation to apply the change.

A question where the administrator needs to be notified automatically when CPU utilization exceeds a threshold, such as 'Which SNMP operation should be configured on the router to send an alert when CPU usage is high?'

A question asking which SNMP operation ensures reliable delivery of alerts between two NMS systems, where the receiver sends an acknowledgment back to the sender.

Candidates may confuse SNMP operations, thinking SET can be used to 'set up' monitoring or retrieve data, or they may not clearly distinguish between read and write operations.

Candidates may confuse TRAP with a method to obtain data because traps are commonly used for monitoring, but they are event-driven notifications, not on-demand retrieval.

Candidates may confuse INFORM with GET, thinking it involves a request-response exchange, but INFORM is for notifications, not data retrieval.

DHCP starvation floods a DHCP server with fake requests to exhaust its IP address pool, causing denial of service. It does not involve ARP replies or claiming to be a default gateway.

MAC flooding overwhelms a switch's CAM table with fake MAC addresses, causing it to fail open and flood traffic to all ports. The question describes ARP replies from a single IP claiming to be the default gateway, which is characteristic of ARP poisoning, not MAC flooding.

DNS amplification attacks involve sending small queries with a spoofed source IP to open DNS servers, which then send large responses to the victim, causing bandwidth exhaustion. This does not involve ARP replies or high CPU on a switch.

A network administrator notices clients failing to obtain IP addresses and the DHCP server logs show a high volume of DHCPDISCOVER messages from spoofed MAC addresses. This scenario indicates a DHCP starvation attack.

MAC flooding would be correct in a scenario where an attacker sends numerous frames with random source MAC addresses to a switch, aiming to overflow the CAM table and force the switch into hub mode, allowing the attacker to sniff traffic across VLANs.

A question describing a network under DDoS attack with high outbound traffic, where the attacker uses small DNS queries to generate large responses from misconfigured DNS servers, overwhelming the target's bandwidth.

Candidates may confuse DHCP starvation with ARP poisoning because both involve spoofing and can lead to man-in-the-middle attacks, but they target different protocols (DHCP vs. ARP).

Candidates may confuse MAC flooding with ARP poisoning because both involve sending spoofed frames to manipulate network behavior, and both can lead to traffic interception.

Candidates may confuse any attack involving spoofed IPs or high resource utilization with DNS amplification, without recognizing the specific ARP-based mechanism described.

Dynamic ARP Inspection (DAI) validates ARP packets to prevent man-in-the-middle attacks, but it does not prevent unauthorized DHCP servers from offering IP addresses. The issue described is rogue DHCP servers, which DHCP Snooping addresses.

IP Source Guard prevents IP spoofing by filtering traffic based on DHCP snooping bindings, but it does not prevent unauthorized DHCP servers from offering IP addresses.

Port Security limits the number of MAC addresses per port but does not prevent unauthorized DHCP servers from offering IP addresses.

DAI would be correct in a scenario where the network is experiencing ARP spoofing attacks, where an attacker sends forged ARP replies to associate their MAC address with the IP address of a legitimate device, causing traffic interception.

A network administrator notices clients are receiving IP addresses from unknown sources and suspects IP spoofing attacks. Enabling IP Source Guard on access ports would block traffic from unauthorized IP addresses.

A question asking which feature prevents MAC flooding attacks or restricts device access based on MAC addresses on a switch port would make Port Security the correct answer.

Candidates may confuse DAI with DHCP Snooping because both are security features that rely on DHCP Snooping's binding database, and both protect against different types of attacks on the same layer.

Candidates may confuse IP Source Guard with DHCP Snooping because both rely on DHCP snooping bindings, but they address different threats: IP Source Guard filters IP traffic, while DHCP Snooping filters DHCP messages.

Candidates may confuse port-level security with DHCP protection, thinking that restricting MAC addresses also blocks rogue DHCP servers.

UDP is a connectionless protocol that does not provide guaranteed delivery; it offers no acknowledgments or retransmissions, unlike TCP which ensures reliable data transfer.

UDP is a connectionless protocol that does not use sequence numbers; sequence numbers are a feature of TCP for ordered delivery.

UDP is a connectionless protocol that does not establish a session, so it does not support a three-way handshake, which is a TCP mechanism.

In a question asking 'Which of the following is a characteristic of TCP?', 'Provides guaranteed delivery' would be correct because TCP uses acknowledgments and retransmissions to ensure data arrives intact.

In a question asking 'Which of the following is a characteristic of TCP?', option 'Uses sequence numbers' would be correct because TCP uses sequence numbers to ensure ordered data delivery.

In a question asking 'Which of the following is a characteristic of TCP?', option C would be correct because TCP uses a three-way handshake to establish a connection.

Candidates may confuse UDP with TCP, assuming all transport protocols provide reliability, or they may think 'best-effort' delivery implies some guarantee.

Candidates may confuse UDP with TCP, assuming all transport protocols use sequence numbers for reliability, or they may recall that UDP has a checksum but mistakenly think it includes sequence numbers.

Candidates may confuse UDP with TCP, as both are transport layer protocols, and mistakenly attribute TCP features like the three-way handshake to UDP.

The hub creates a single collision domain for its 4 ports, not 4 separate ones. The switch has 8 collision domains (one per port), but the hub's segment adds only 1, totaling 9, not 11. The correct count is 8 collision domains (7 switch ports + 1 hub segment) and 1 broadcast domain.

If the question stated that each hub port was connected to a separate switch port (e.g., a 4-port hub connected to 4 different switch ports), then each hub port would be its own collision domain, giving 7 (switch workstations) + 4 (hub workstations) = 11 collision domains, all in one broadcast domain.

This option would be correct if the network had 5 separate VLANs (each with its own broadcast domain) and the switch ports were configured in access mode for different VLANs, with the hub connecting to a switch port in a trunk mode carrying multiple VLANs, and each hub port assigned to a different VLAN. Then collision domains would be 8 (switch ports) + 4 (hub ports) = 12, and broadcast domains would be 5 (one per VLAN).

This option would be correct if the question stated that the hub's 4 workstations are each directly connected to the switch (i.e., no hub), and the network had 5 VLANs (or 5 separate IP subnets). Then there would be 8 collision domains (one per switch port) and 5 broadcast domains (one per VLAN).

Candidates mistakenly count each hub port as a separate collision domain, forgetting that a hub operates as a single collision domain for all its ports. They also may incorrectly add the hub's 4 ports to the switch's 7 ports without considering the hub's shared nature.

Candidates often mistakenly count each hub port as a separate collision domain (adding 4 instead of 1) and think that a hub creates multiple broadcast domains, confusing collision and broadcast domain concepts.

Candidates often mistakenly count each hub-attached workstation as a separate collision domain, adding 4 to the switch's 8, and may also think that a hub creates multiple broadcast domains or confuse collision and broadcast domains.

A native VLAN mismatch would cause traffic on the native VLAN (typically VLAN 1) to fail, not specifically VLAN 20. Since VLAN 10 works, the native VLAN is likely correct.

In this scenario, VLAN 10 traffic works fine, indicating the trunk is operational. Dynamic desirable mode would not cause selective VLAN failure; it affects trunk negotiation, not per-VLAN traffic filtering.

The question states that the trunk is configured with 802.1Q, so ISL encapsulation is not in use. If ISL were the issue, the trunk would likely not form or would have problems with all VLANs, not just VLAN 20.

If the question described that all VLAN traffic fails or only untagged traffic fails across the trunk, and both switches have the same VLANs configured, then a native VLAN mismatch would be the most likely cause.

A question where two switches fail to form a trunk link entirely, and one switch is set to dynamic desirable while the other is set to dynamic auto or access mode, preventing trunk establishment.

If the question described a scenario where two switches are configured with different trunk encapsulation types (e.g., one using ISL and the other 802.1Q), then the mismatch would prevent trunking and cause traffic issues across all VLANs.

Candidates often confuse native VLAN mismatch with general VLAN traffic issues, assuming any trunk problem is due to native VLAN mismatch without considering allowed VLAN lists.

Candidates may confuse dynamic trunking protocol (DTP) modes with VLAN traffic filtering, assuming that dynamic desirable mode could restrict specific VLANs, when it only controls trunk negotiation.

Candidates may confuse encapsulation mismatches with VLAN-specific issues, or they might think that ISL and 802.1Q incompatibility could selectively affect certain VLANs.

The question states users can access internal servers and the default gateway, which indicates DNS resolution for internal names works and the gateway is reachable. External website access failure with a permissive ACL points to a NAT issue, not DNS.

The question states users can access internal servers and the default gateway, so the DHCP server is providing a default gateway. The issue is external access, not gateway reachability.

The switch port for the router being in the wrong VLAN would prevent all traffic from that VLAN from reaching the router, but users can access internal servers and the default gateway, indicating the router is reachable. Thus, the issue is not at the switch port level.

A question where users cannot access any external resources (including internal servers by name) but can ping external IPs, or where the error message indicates 'server not found' while internal IP access works, would make DNS the correct answer.

This would be correct if users could not reach any external or internal resources, and the question specified that clients receive an APIPA address or cannot ping the gateway, indicating DHCP failure to provide a default gateway.

A scenario where users on a VLAN cannot reach any external resources, including the default gateway, and internal servers are also unreachable. In that case, a misconfigured switch port (e.g., access port in wrong VLAN or trunk issue) could isolate the entire VLAN from the router.

Candidates often default to DNS as the cause of web browsing failures, overlooking that internal access works and the symptom pattern specifically points to NAT misconfiguration.

Candidates may confuse symptoms of missing default gateway (no external access) with the given scenario, overlooking that internal access and gateway reachability are already working.

Candidates may think that if the router's port is in the wrong VLAN, traffic cannot exit the VLAN, but the symptom of being able to reach the default gateway contradicts this, making the option tempting but incorrect.

802.11b only operates in the 2.4 GHz band and does not support 5 GHz, so it cannot meet the requirement for dual-band support.

802.11g operates only on the 2.4 GHz band and does not support the 5 GHz band, so it cannot meet the requirement for dual-band support.

802.11ac operates only on the 5 GHz band and does not support 2.4 GHz, so it cannot meet the requirement of supporting both bands.

If the question asked for a standard that supports only the 2.4 GHz band and provides the longest range among early Wi-Fi standards, 802.11b would be correct.

This option would be correct if the question asked for a standard that operates solely on the 2.4 GHz band and provides backward compatibility with 802.11b devices, without requiring 5 GHz support.

This option would be correct for a question asking which standard supports higher throughput on the 5 GHz band only, such as 'Which IEEE 802.11 standard supports up to 1.3 Gbps using 5 GHz and MU-MIMO?'

Candidates may confuse 802.11b as a legacy standard that is widely known and assume it supports both bands due to its prevalence in older devices.

Candidates may confuse 802.11g with 802.11n, as both are backward compatible with older devices, but 802.11g lacks the 5 GHz capability specified in the question.

Candidates may confuse 802.11ac as the latest standard and assume it supports both bands, or they may overlook the dual-band requirement and focus only on backward compatibility.

The technician already knows the workstation's IP configuration (IP, subnet mask, gateway) from the initial verification, so running ipconfig /all would provide no new information to isolate the issue.

The user can ping the default gateway, indicating Layer 3 connectivity to the local network. Since other users on the same subnet can access the internet, the issue is likely DNS or routing beyond the gateway. tracert would show the path to 8.8.8.8, but the problem is more likely DNS resolution, not routing.

The user can ping the default gateway, indicating Layer 3 connectivity to the local network. The issue is likely DNS resolution, but the question states other users on the same subnet can access the internet, so DNS is probably working. The technician needs to check the routing table to see if the default route is missing or incorrect, which `netstat -r` does. `nslookup` tests DNS, which is not the immediate next step given the symptoms.

When a user cannot access the internet and the technician needs to verify the workstation's IP address, subnet mask, default gateway, DNS servers, and DHCP lease details to check for misconfiguration or APIPA address.

A user cannot reach a specific external server, but can ping the default gateway. Running tracert to that server would identify where packets are being dropped or delayed, isolating a routing issue beyond the local network.

If the user could not access the internet but could ping the default gateway and other users had the same issue, or if the problem was specifically that domain names were not resolving while IP addresses worked, then `nslookup google.com` would be the correct command to diagnose DNS resolution.

Candidates often default to ipconfig /all as the first troubleshooting step for any network issue, overlooking that the necessary IP details are already known.

Candidates may think tracert is a standard first step for internet connectivity issues, but here the symptom (others can access internet) suggests a local configuration problem, not a routing failure.

Candidates often jump to DNS issues when internet access fails, especially if pinging the gateway works. `nslookup` is a common tool for testing DNS, making it a tempting choice without fully analyzing the scenario.

A native VLAN mismatch would cause issues for untagged traffic on the trunk, but VLAN 20 is a tagged VLAN. Since VLAN 10 works, the trunk is functioning; the problem is specific to VLAN 20, which is likely not present on the second switch.

The trunk uses 802.1Q, not ISL, in modern networks. Even if ISL were used, it would affect all VLANs, not just VLAN 20, so it cannot explain why only VLAN 20 fails.

The issue is that VLAN 20 works on the first switch but not across the trunk, indicating the VLAN is missing on the second switch. A missing default gateway would prevent inter-VLAN routing but not affect Layer 2 communication within the same VLAN across switches.

This would be correct if the question stated that all VLANs fail to communicate across the trunk, or if workstations in the native VLAN (e.g., VLAN 1) cannot communicate while other VLANs work. A native VLAN mismatch disrupts control traffic and untagged frames.

This would be correct if the question stated that the trunk is configured with ISL encapsulation and the switches do not support ISL, or if the question specified that ISL is incompatible with certain VLANs or switch models, causing connectivity issues for specific VLANs.

This option would be correct in a scenario where workstations in VLAN 20 cannot communicate with devices in other VLANs or the internet, but can communicate within VLAN 20 across switches. The question would specify that inter-VLAN routing is failing, and the default gateway is misconfigured or missing.

Candidates often confuse native VLAN mismatch symptoms with VLAN absence, as both can cause connectivity issues. They may assume trunk misconfiguration is the default cause without verifying VLAN existence on both switches.

Candidates may confuse trunking protocol mismatches as a cause for selective VLAN failure, not realizing that a protocol mismatch would affect all VLANs equally, not just one.

Candidates often confuse Layer 2 VLAN issues with Layer 3 routing problems. They may think that because VLAN 20 cannot communicate across switches, it must be a routing issue, especially if they have seen scenarios where a missing default gateway causes connectivity failures.

SNMPv3 does not use community strings; they are only for SNMPv1/v2c. The question specifies SNMPv3, so configuring a community string is irrelevant and will not resolve the trap delivery issue.

The trap destination IP address is a required step, but the question states that the management server is reachable via ping, implying the destination is already set. The issue is likely authentication mismatch, not missing destination.

The SNMP agent is enabled by default on most routers when SNMP is configured, and the question states that SNMPv3 has been configured, implying the agent is active. The issue is likely mismatched authentication and privacy settings, not a disabled agent.

This would be correct in a question about SNMPv1 or v2c where traps are not being received, and the community string on the router does not match the server's expected community string.

This would be correct in a scenario where the administrator configured SNMPv2c traps but forgot to specify the trap receiver's IP address, and no traps are received despite the server being reachable.

In a scenario where a network administrator has configured SNMPv2c with a community string but no traps are received, and the management server is reachable, the missing step could be ensuring the SNMP agent is enabled (e.g., via 'snmp-server enable traps' command).

Candidates often confuse SNMPv3 with earlier versions and default to community string configuration, not realizing SNMPv3 uses usernames and authentication/privacy settings instead.

Candidates often assume that setting the trap destination is the most common missing step, overlooking that SNMPv3 requires matching credentials for communication.

Candidates may think that enabling the SNMP agent is a separate, often overlooked step, especially when moving from SNMPv2c to SNMPv3, but in SNMPv3 configuration, the agent is typically enabled automatically when traps are configured.

The logs show packets with an internal source IP arriving on the external interface, which is a sign of IP spoofing, not a DoS attack. DoS attacks focus on overwhelming resources, not on forging source addresses.

A man-in-the-middle attack involves intercepting and potentially altering communications between two parties, but the specific indicator of packets with an internal source IP on an external interface points to IP spoofing, not MITM.

ARP poisoning operates at Layer 2 and involves corrupting ARP caches within a local network segment, not receiving packets with internal source IPs on an external interface.

A question describing a network device being overwhelmed with traffic from multiple sources, causing service disruption, would make DoS the correct answer. For example: 'A web server becomes unresponsive due to a flood of TCP SYN packets from many different IP addresses.'

A question describing an attacker intercepting traffic between a client and server, possibly using ARP spoofing or a rogue access point, and then modifying or eavesdropping on the communication would make MITM the correct answer.

A question describing an attacker sending forged ARP replies to associate their MAC address with the IP of a legitimate device, causing traffic to be misdirected, would make ARP poisoning the correct answer.

Candidates may associate any malicious traffic with DoS, especially when logs show unusual packets, without recognizing that the specific indicator (internal IP on external interface) points to spoofing rather than resource exhaustion.

Candidates may confuse IP spoofing with MITM because both involve deceptive IP addresses, but MITM focuses on interception and relay, not just falsifying the source address.

Candidates may confuse IP spoofing with ARP poisoning because both involve falsifying addresses, but ARP poisoning is specific to MAC-IP mapping on local networks, not the external interface scenario described.

The IP address 169.254.15.7 is an Automatic Private IP Addressing (APIPA) address, which indicates that the workstation failed to obtain an IP from a DHCP server. A non-responsive DNS server would not cause the workstation to self-assign an APIPA address; it would still have a valid DHCP-assigned IP.

The IP address 169.254.15.7 is an Automatic Private IP Addressing (APIPA) address, which indicates the workstation failed to obtain an IP from a DHCP server. A down default gateway would not cause the workstation to self-assign an APIPA address; instead, the workstation would retain its DHCP-assigned IP but lose connectivity beyond the local subnet.

In a scenario where a workstation has a valid static IP address but cannot resolve hostnames, and other network connectivity (e.g., ping to IP addresses) works, then a non-responsive DNS server would be the most likely cause.

A workstation has a static IP address (e.g., 192.168.1.10) and can communicate with other devices on the same subnet but cannot access the internet or remote networks. In this scenario, the most likely cause is that the default gateway is down or misconfigured.

Candidates often associate network resource access issues with DNS problems, overlooking that APIPA addresses are a clear indicator of DHCP failure rather than DNS failure.

Candidates often associate 'cannot access any network resources' with a gateway issue, overlooking that APIPA addresses result from DHCP failure, not gateway problems. The symptom of no connectivity to any resource (including local) should steer them away from a gateway-only cause.

In a Layer 2 broadcast domain, devices communicate using MAC addresses, but this is not a defining characteristic of the domain itself; it's true for any Ethernet network. The question asks for a characteristic of the broadcast domain, which is that broadcast frames are forwarded to all ports.

A Layer 2 broadcast domain is defined by the reach of broadcast frames, not by IP subnetting. Devices on the same broadcast domain can be on different IP subnets; IP subnetting is a Layer 3 concept.

Routers operate at Layer 3 and are not required for communication within the same Layer 2 broadcast domain; switches or bridges handle Layer 2 forwarding.

This option would be correct for a question like: 'Which of the following is true about communication within a single VLAN?' In that context, devices in the same VLAN can communicate using MAC addresses alone without needing Layer 3 routing.

This option would be correct for a question like: 'Which of the following is a characteristic of devices in the same IP subnet?' In that context, all devices must be on the same IP subnet to communicate without a router.

In a question asking about communication between different broadcast domains (i.e., different subnets), routers are required to forward traffic between them, making this statement correct.

Candidates may confuse a basic feature of Ethernet (MAC-based communication) with the specific property of a broadcast domain, or they may think that MAC-only communication is unique to broadcast domains.

Candidates often confuse broadcast domains with IP subnets because in typical network designs, a broadcast domain is often contained within a single subnet, leading to the mistaken belief that they are equivalent.

Candidates may confuse the role of routers in inter-domain communication with intra-domain communication, assuming routers are needed for any device-to-device communication.

Switches operate at Layer 2 (data link layer), not Layer 3. While some switches can perform Layer 3 routing, the primary difference between a hub and a switch is not speed based on OSI layer; hubs operate at Layer 1 and switches at Layer 2.

A hub does not segment collision domains; it actually extends them. A switch segments collision domains by creating a separate collision domain per port.

Both hubs and switches operate at Layer 2 (Data Link layer) and use the same Ethernet frame types; the statement is factually incorrect.

This option would be correct if the question asked: 'Which of the following best describes the primary difference between a Layer 3 switch and a router?' In that context, a Layer 3 switch can be faster than a router because it uses hardware-based switching at Layer 3.

If the question were 'Which of the following best describes the primary difference between a hub and a switch regarding collision domains?', then the correct answer would be that a switch segments collision domains while a hub does not.

If the question asked about the difference between a router and a switch, then 'operate at the same OSI layer but use different frame types' could be correct if comparing a Layer 3 router (using IP packets) with a Layer 2 switch (using Ethernet frames).

Candidates may confuse switches with routers or assume that 'switch' always implies Layer 3 capabilities, and they may think that operating at a higher layer inherently makes a device faster.

Candidates may confuse the concept of collision domains with broadcast domains, or mistakenly think that hubs provide segmentation because they are older devices that physically separate ports.

Candidates may confuse the OSI layers of hubs and switches, or think that switches use different frame types due to VLAN tagging, but standard Ethernet frames are identical for both devices.

ARP spoofing operates at Layer 2 and targets local network communications, not a web server receiving HTTP requests from thousands of global IP addresses.

A SYN flood targets the TCP handshake by sending many SYN packets without completing the handshake, but this question specifies HTTP GET requests, which are application-layer and fully formed, not incomplete TCP connections.

DNS amplification attacks use reflection off open DNS resolvers to flood a target with amplified responses, not direct HTTP GET requests from many IPs. The question describes well-formed HTTP requests from diverse IPs, which is a classic DDoS, not a DNS-based attack.

A question describing a scenario where an attacker on the same subnet intercepts traffic between a client and server by sending forged ARP messages, causing the server to receive unexpected traffic or become unresponsive.

A SYN flood would be correct if the question described a server overwhelmed by a high volume of incomplete TCP connection requests (SYN packets) from spoofed IPs, causing the connection table to fill and legitimate connections to be refused.

A question describing a server receiving a high volume of large DNS response packets from many different IPs, where the attacker spoofs the victim's IP as the source of small DNS queries to open resolvers, would make DNS amplification the correct answer.

Candidates may confuse any network-based attack with ARP spoofing, or mistakenly think that overwhelming a server can be achieved via ARP manipulation.

Candidates often confuse any network-based denial-of-service attack with a SYN flood because SYN floods are a common DoS technique, but they overlook that the attack here uses complete HTTP requests, not half-open TCP connections.

Candidates may confuse any large-scale distributed attack with DNS amplification because both involve many sources, but they overlook that DNS amplification relies on UDP reflection and amplified responses, not direct HTTP requests.

When comparing routes from different routing protocols, the router uses administrative distance (AD) first, not metric. OSPF has AD 110, EIGRP has AD 90, so EIGRP is preferred regardless of metric values.

Routers install only the route with the lowest administrative distance (AD) when multiple routes to the same destination exist from different routing protocols. Here, EIGRP has AD 90 vs OSPF's 110, so only the EIGRP route is installed; load balancing requires equal AD and equal metric.

OSPF being a link-state protocol does not automatically make its route preferred; route selection is based on administrative distance, not protocol type. Here, EIGRP has a lower AD (90 vs 110), so it wins regardless of OSPF's link-state nature.

If both routes were learned via the same routing protocol (e.g., both OSPF), then the route with the lower metric would be installed. For example, two OSPF routes to the same destination with metrics 10 and 20.

If both routes had the same administrative distance (e.g., both from OSPF) and equal metrics, or if both were from protocols with equal AD (e.g., two EIGRP routes with equal composite metrics), then both routes would be installed for load balancing.

This option would be correct if the question asked which routing protocol is more scalable or converges faster in a large network, where link-state protocols like OSPF are generally superior to distance-vector protocols like EIGRP.

Candidates often confuse metric and administrative distance, assuming the lower metric always wins, but metric only applies within the same protocol.

Candidates may think that multiple routes to the same network always result in load balancing, ignoring the role of administrative distance in selecting which routing protocol's route is preferred.

Candidates may incorrectly assume that link-state protocols are always preferred over distance-vector protocols, or they confuse protocol characteristics with route selection criteria.

The prefix 2001:db8::/32 includes addresses where the first 32 bits are 2001:0db8. Option B, 2001:db9::1, has the third quartet as 0db9, which differs in the 33rd bit, so it is not within the /32 prefix.

The prefix 2001:db8::/32 includes addresses where the first 32 bits are 2001:0db8. Option C (2001:db7::1) has the third hextet as db7, which differs from db8 in the 33rd bit, so it does not match the /32 prefix.

The prefix 2001:db8::/32 specifies that the first 32 bits must be 2001:0db8. Option D (fe80::1) starts with fe80, which is a link-local address prefix, not matching the required prefix.

If the question specified a prefix of 2001:db8::/28, then 2001:db9::1 would be within the same prefix because the first 28 bits (2001:0db) match, and the next nibble (8 vs 9) is part of the host portion.

If the question specified a prefix of 2001:db7::/32, then 2001:db7::1 would be a correct address belonging to that prefix.

In a question asking for a link-local IPv6 address, fe80::1 would be correct. For example, 'Which of the following is a valid link-local unicast address?'

Candidates may mistakenly think that only the first two quartets (2001:db8) define the prefix, ignoring that the /32 prefix includes the entire third quartet, so any change in the third quartet (like db9) is outside the prefix.

Candidates may confuse the prefix length and think that only the first two hextets matter, or they may misread db7 as db8 due to visual similarity.

Candidates may confuse different IPv6 address types (global unicast vs. link-local) or misremember the prefix ranges, thinking fe80 falls within the 2001::/16 range.

DNS resolves domain names to IP addresses, not MAC addresses. The question asks for the protocol that maps IP addresses (Layer 3) to MAC addresses (Layer 2), which is ARP.

DHCP is used for dynamically assigning IP addresses and other network configuration parameters to hosts, not for resolving Layer 2 MAC addresses from Layer 3 IP addresses.

ICMP is used for error reporting and diagnostics (e.g., ping), not for resolving Layer 2 addresses from Layer 3 addresses.

DNS would be correct in a question like: 'Which protocol is used to resolve a fully qualified domain name (FQDN) to an IP address?'

A question asking which protocol automatically assigns IP addresses, subnet masks, default gateways, and DNS server addresses to hosts on a network would have DHCP as the correct answer.

A question asking which protocol is used to test reachability between hosts or to report network errors (e.g., 'Which protocol does ping use?') would have ICMP as the correct answer.

Candidates may confuse 'address resolution' with DNS's name resolution, or think that DNS handles all types of address mapping on a network.

Candidates may confuse DHCP with ARP because both operate at the network layer and involve address assignment or resolution, leading them to think DHCP handles MAC-to-IP mapping.

Candidates may confuse ICMP's role in network troubleshooting with address resolution, or think that ICMP's use in ping involves MAC address discovery.

The Physical layer (Layer 1) handles raw bit transmission over a physical medium and does not perform any sequencing or reassembly of data segments.

The Data Link layer handles node-to-node delivery and framing, not end-to-end segment sequencing. Sequencing of segments is a Transport layer function (e.g., TCP sequence numbers).

The Network layer (Layer 3) handles routing and logical addressing, but not segmentation or sequencing of data segments. Sequencing is a function of the Transport layer (Layer 4), which manages end-to-end communication and reassembly.

A question asking which layer defines the electrical, mechanical, and procedural specifications for activating, maintaining, and deactivating the physical link between end systems.

A question about which layer adds a header with MAC addresses for local delivery or performs error detection on a frame would make the Data Link layer correct.

A question asking which layer is responsible for routing packets between different networks, such as 'Which OSI layer uses IP addresses to determine the best path for data?' would have the Network layer as the correct answer.

Candidates may confuse the physical transmission of bits with the process of data ordering, or they might think that physical layer issues (like signal interference) could cause out-of-order delivery.

Candidates may confuse the Data Link layer's role in ordering frames (e.g., in some protocols like HDLC) with the Transport layer's segment sequencing, or think that any 'sequencing' must happen at a lower layer.

Candidates may confuse the Network layer's role in packet fragmentation with the Transport layer's segmentation and sequencing, or mistakenly think that 'sequencing' relates to packet order in routing.

The user can ping the default gateway but not a public IP like 8.8.8.8, indicating IP routing works locally but fails beyond the local network. DNS is not involved because the test uses an IP address, not a hostname.

The user can ping the default gateway but not a public IP, indicating layer 3 routing failure. A duplicate IP address would cause intermittent connectivity or inability to ping the gateway, not a specific failure to reach external IPs.

A faulty NIC would prevent successful pings to the default gateway, but the technician can ping the gateway, indicating the NIC is working.

In a scenario where a user reports 'cannot access the internet' and the technician can ping 8.8.8.8 but cannot browse by name (e.g., www.google.com), incorrect DNS server configuration would be the likely cause.

A user reports intermittent connectivity and IP conflicts. The technician finds two devices with the same IP via ARP table. The correct answer would be 'Duplicate IP address on the network'.

A user cannot access any network resources, and the technician cannot ping the default gateway or any other device. The NIC driver shows errors in Device Manager.

Candidates often associate internet access problems with DNS, but the question explicitly tests with a public IP address, bypassing DNS. They may overlook that DNS is only needed for name resolution, not IP connectivity.

Candidates may confuse symptoms of DNS failure (which affects name resolution, not IP pings) with IP conflicts, or assume any connectivity issue could be caused by duplicate addresses.

Candidates may associate internet access issues with hardware failure, overlooking that successful gateway pings rule out a faulty NIC.

AS_PATH is used for loop prevention and path selection, but it primarily influences outbound traffic by affecting how routes are advertised, not inbound traffic to a particular AS.

The Next Hop attribute specifies the IP address of the next router to reach a destination, but it does not influence inbound traffic decisions; it is used for routing path selection, not traffic engineering into an AS.

Local Preference is used to influence outbound traffic from an AS, not inbound traffic. It is a well-known discretionary attribute that is exchanged within an AS to affect the exit path for routes learned from EBGP peers.

A question asking 'Which BGP attribute is used to prevent routing loops and influence path selection by prepending AS numbers?' would make AS_PATH correct.

In a BGP question asking which attribute is used to determine the next router for forwarding packets toward a destination network, Next Hop would be the correct answer.

A network administrator wants to ensure that traffic from within the AS leaves via a specific EBGP peer when multiple paths exist to the same destination. In this case, Local Preference is the correct attribute to set a higher value on the preferred path.

Candidates may confuse AS_PATH with MED because both can influence path selection, but AS_PATH affects outbound traffic while MED affects inbound traffic.

Candidates may confuse Next Hop with a tool for traffic control because it is a mandatory BGP attribute involved in path selection, but they overlook that it does not affect inbound traffic preference.

Candidates may confuse Local Preference with MED because both are used for path selection, but they operate in opposite directions: Local Preference influences outbound traffic, while MED influences inbound traffic.

Option A is not defined, but if it were a common distractor like 'incorrect subnet mask,' the subnet mask 255.255.255.0 is correct for the given IPs on the same subnet, so it would not cause connectivity issues between them.

The workstation can ping the gateway (192.168.1.1) but not the file server (192.168.1.50) on the same subnet. Since both are on the same subnet, the default gateway is not needed for local communication; the issue is likely with the file server itself or a local firewall, not the gateway.

Option D is not provided in the question, so it cannot be evaluated. The correct answer is C, which is undefined in the given context.

If the question described a scenario where the workstation's subnet mask was mismatched (e.g., 255.255.255.0 vs 255.255.0.0) and the file server was on a different subnet, then an incorrect subnet mask would be the correct answer.

In a scenario where a workstation cannot reach any external networks (e.g., internet) but can ping local devices, the default gateway being misconfigured or down would be the correct answer. For example, if the workstation had IP 192.168.1.10/24 and could ping 192.168.1.50 but not 8.8.8.8, a wrong default gateway would be the cause.

In a scenario where the workstation has an APIPA address (169.254.x.x) due to DHCP failure, and the question asks for the most likely cause, 'DHCP server unavailable' would be correct.

Candidates may incorrectly assume that any connectivity problem is due to subnet mask misconfiguration, especially when they see IPs in the same range but overlook that the mask is actually correct.

Candidates may assume that since the gateway is reachable, it must be correct, and then incorrectly attribute the problem to the gateway when the real issue is local connectivity. They might also confuse the role of the gateway in local vs. remote communication.

Candidates might choose an undefined option out of confusion or misreading, especially if they expect a specific answer like 'firewall blocking' or 'incorrect subnet mask'.

The subnet mask 255.255.255.240 (/28) provides 16 total addresses per subnet, but the network address and broadcast address are reserved, leaving only 14 usable host addresses.

A /28 subnet (255.255.255.240) provides 16 total addresses, but the network and broadcast addresses are reserved, leaving 14 usable hosts. Option C (30) corresponds to a /27 subnet (255.255.255.224), not /28.

A /28 subnet (255.255.255.240) provides 16 total addresses, but 2 are reserved for network and broadcast, leaving 14 usable. Option D (62) corresponds to a /26 subnet (255.255.255.192), which is not the mask in this question.

If the question asked for the total number of addresses in the subnet (including network and broadcast), then 16 would be correct. For example: 'How many IP addresses are in a subnet with mask 255.255.255.240?'

This option would be correct if the subnet mask were 255.255.255.224 (/27), which provides 32 total addresses and 30 usable hosts. For example, a question asking for usable hosts on 192.168.1.0/27 would have answer 30.

If the subnet mask were 255.255.255.192 (/26) instead of 255.255.255.240, the network would have 64 total addresses, yielding 62 usable hosts. This would be the correct answer for a question with that mask.

Candidates often forget to subtract the network and broadcast addresses, mistakenly counting all 16 addresses as usable.

Candidates often confuse the number of total addresses (32) with usable addresses, forgetting to subtract 2 for network and broadcast. They may also misapply the formula 2^(32 - prefix) - 2, mistakenly using 2^5 = 32 instead of 2^4 = 16.

Candidates may mistakenly calculate 2^(32-26) = 64 and forget to subtract 2, or confuse the mask with a /26, which is a common subnet size.

WPA2 is a wireless security protocol for Wi-Fi networks, not for port-based authentication on wired networks. The question specifically asks about wired network access control.

MAC filtering authenticates based on MAC address, not user or device credentials, and does not provide port-based authentication as defined by 802.1X. It can be bypassed by MAC spoofing.

VPN provides encrypted remote access over an untrusted network, not port-based authentication for wired LAN access. It does not control access at the switch port level.

A question asking 'Which technology provides encryption and authentication for wireless networks?' would make WPA2 the correct answer, as it secures Wi-Fi communications.

A question asking for a simple, low-security method to restrict network access to known devices based on hardware addresses, without requiring authentication credentials or a RADIUS server.

A question asks: 'Which technology allows remote employees to securely access the corporate network over the internet?' In that context, VPN is the correct answer.

Candidates may confuse WPA2 with 802.1X because both involve authentication, but WPA2 is wireless-specific and does not perform port-based access control on wired switches.

Candidates confuse MAC filtering with port security because both involve controlling access at the switch port level, but MAC filtering lacks the authentication mechanism required by the question.

Candidates may confuse network access control with remote access security, thinking VPN authenticates users before granting network access.

A network topology diagram shows the physical or logical layout of devices and connections, not a record of configuration changes with timestamps and administrator details.

A baseline configuration report documents the initial or standard configuration of network devices, not a historical record of changes with dates and administrators.

An incident report documents unplanned events or security breaches, not routine configuration changes. The question asks for a record of all configuration changes, which is the purpose of a change management log.

When a question asks for a document that visually represents the arrangement of network devices and their interconnections, such as 'Which document should be used to understand the physical layout of the network?'

When an exam question asks for a document that captures the standard or expected configuration of network devices for comparison purposes, such as verifying compliance or detecting unauthorized changes.

An incident report would be correct if the question asked: 'Which document should be used to record details of a security breach or network outage, including the date, time, and administrator who responded?'

Candidates may confuse documentation of changes with documentation of the network structure, thinking that a topology diagram would include change history.

Candidates may confuse 'baseline' with a log of changes, thinking it records deviations from the baseline, but it is a snapshot, not a change history.

Candidates may confuse incident reports with change logs because both involve recording dates, times, and personnel, but incident reports are for reactive events, not proactive changes.

The user can ping the main office's default gateway, indicating the VPN tunnel is working and routing is functional at the network layer. DNS resolution is not the issue because connectivity to the file server fails at the IP level, not due to name resolution.

The VPN tunnel is active and the user can ping the main office's default gateway, indicating the VPN is established and encryption settings are likely correct. The issue is connectivity to a specific server beyond the gateway, pointing to routing or firewall rules rather than encryption.

The file server's antivirus software is unlikely to cause connectivity issues from a remote branch office when the VPN tunnel is active and the user can ping the main office's default gateway. The problem is more likely related to routing or network segmentation within the main office.

A user can connect to a server by IP address but not by hostname. The technician should check DNS resolution to ensure the hostname resolves correctly.

A technician finds that a site-to-site VPN tunnel is down or intermittently dropping, and the logs show encryption mismatches (e.g., AES vs. 3DES, or incorrect pre-shared keys). In that case, checking VPN encryption settings would be the next step to resolve the tunnel failure.

A technician would check the file server's antivirus software if users at the main office report they cannot connect to the file server locally, and other network connectivity is working. The antivirus might be blocking file-sharing ports or quarantining the server's network service.

Candidates often assume that connectivity issues are due to DNS, especially when users refer to servers by name, but here the problem persists at the IP layer (ping fails).

Candidates may assume that any VPN issue involves encryption settings, especially when the problem is connectivity across a VPN. They overlook that an active tunnel with successful pings to the gateway implies encryption is working.

Candidates may think antivirus software could block network traffic, but in this scenario the issue is specific to remote access via VPN, making routing or firewall rules more relevant.

Other users on the same subnet can ping 8.8.8.8, which proves the router has a default route to the internet. The issue is isolated to this user's computer.

The user can ping the default gateway but not 8.8.8.8, and DNS is not involved in ICMP ping to an IP address. DNS resolution is only needed when pinging a hostname, not an IP.

The user can ping the default gateway, indicating the network cable is functional. A loose or faulty cable would prevent all network communication, including pinging the gateway.

If the question stated that no users on the subnet can ping external IPs, and the router's routing table shows no default route, then a missing default route would be the likely cause.

In a scenario where a user cannot ping a hostname (e.g., www.google.com) but can ping its IP address (e.g., 8.8.8.8), and other users can ping the hostname, the most likely cause is DNS server misconfiguration or failure.

In a scenario where a user cannot ping any IP address (neither gateway nor external), and link lights are off or intermittent, a loose or faulty network cable would be the likely cause.

Candidates may assume that any inability to reach the internet is due to a router misconfiguration, overlooking that the problem is isolated to a single host.

Candidates often confuse DNS with general internet connectivity issues, assuming that if you can't reach an external IP, DNS must be the problem, even though the ping command uses an IP address directly.

Candidates may associate connectivity issues with physical layer problems, overlooking that successful gateway ping rules out cable faults.

Switches operate at Layer 2 and forward frames based on MAC addresses, not IP addresses. IP address-based forwarding is the function of a router (Layer 3).

A switch operates at Layer 2 and forwards frames based on MAC addresses, not IP addresses. Connecting different networks and performing routing is the function of a router, not a switch.

A switch does not amplify and repeat signals to all ports; that describes a hub. Switches forward frames only to the specific port based on MAC addresses.

This option would be correct if the question asked about the primary function of a router or a Layer 3 switch in a network, where forwarding decisions are made based on IP addresses.

This option would be correct for a question like: 'Which device connects different networks and makes forwarding decisions based on IP addresses?' In that context, describing a router's function would be accurate.

In a question about the function of a hub or repeater, such as 'Which device regenerates and broadcasts signals to all ports?'

Candidates may confuse the roles of switches and routers, especially since many modern switches support Layer 3 routing, leading them to think IP forwarding is a primary switch function.

Candidates may confuse the roles of switches and routers, especially when thinking about network segmentation or inter-VLAN routing, which involves both devices.

Candidates may confuse switches with hubs, especially if they recall that switches 'repeat' signals but forget they do so selectively.

A DNS amplification attack uses UDP, not TCP, and involves sending small queries that generate large responses to a victim, not to an external IP from a server. The server here is the source, not the target.

DNS zone transfer is used to replicate DNS databases between authoritative servers, not for data exfiltration. The scenario involves a non-DNS server sending queries to an external IP, which is characteristic of tunneling, not zone transfer.

DNS cache poisoning involves corrupting a DNS resolver's cache with false records, not exfiltrating data via large DNS responses. The scenario describes data exfiltration, not cache manipulation.

A DNS amplification attack would be correct if the question described a server sending small DNS queries to open resolvers with a spoofed source IP (the victim), resulting in large responses flooding the victim.

A question describing a secondary DNS server failing to synchronize with a primary server, with large zone data transfers occurring over TCP port 53, would make DNS zone transfer the correct answer.

A question describing a user being redirected to a malicious site after a DNS resolver returns incorrect IP addresses, with no mention of data exfiltration or large responses, would make DNS cache poisoning correct.

Candidates may confuse 'unusually large DNS responses' with amplification, but they overlook the TCP port 53 and the server initiating queries to an external IP, which points to tunneling instead.

Candidates may confuse large DNS responses with zone transfers, or think that any unusual DNS traffic on TCP port 53 indicates a zone transfer, overlooking the data exfiltration context.

Candidates may confuse DNS cache poisoning with DNS tunneling because both involve DNS abuse, but cache poisoning focuses on redirection, not data exfiltration via response size.

A star topology uses a central switch or hub; if that central device fails, the entire network goes down, so it does not provide the highest level of redundancy and fault tolerance compared to a mesh topology.

A bus topology uses a single backbone cable; if the cable fails, the entire network goes down, offering no redundancy or fault tolerance.

In a ring topology, each device is connected to exactly two neighbors, forming a single path for data. A break in the ring or a device failure disrupts the entire network, offering minimal fault tolerance compared to mesh.

A star topology would be correct if the question asked for the topology that is easiest to manage and troubleshoot, or the most cost-effective for a small network with a single point of failure acceptable.

In a question asking for the most cost-effective topology for a small, temporary network with minimal devices and low reliability requirements, bus topology would be correct due to its simple cabling and low cost.

A question asking 'Which topology uses a token passing mechanism to prevent collisions?' would have ring as correct, as token ring networks rely on this method to control data transmission.

Candidates often think star is highly redundant because it isolates each device's failure, but they overlook the single point of failure at the central device.

Candidates may confuse 'simplicity' with 'reliability', assuming fewer components mean fewer failure points, but in a bus, the single cable is a critical single point of failure.

Candidates may think that because ring topologies can use dual rings for redundancy, they offer high fault tolerance, but standard single-ring topologies do not; the dual-ring variant is less common and not implied.

The laptop has a valid IP address (192.168.1.25/24) and other users can access the internet, so DHCP lease exhaustion is unlikely. The issue is isolated to one device, pointing to a client-side problem like DNS.

The issue is isolated to a single laptop with a valid IP and gateway, so channel utilization affecting all users is not the cause.

The issue is isolated to one laptop with a valid IP and gateway, so the switch port on the distribution switch is unlikely to be the cause; a port problem would affect multiple users or cause complete connectivity loss.

A technician finds that multiple users in the same area cannot obtain IP addresses or receive APIPA addresses. The DHCP server logs show no available leases. In this scenario, DHCP server lease exhaustion is the correct next check.

When multiple users in the same area report slow or intermittent connectivity, and the technician suspects RF interference or congestion on the access point's channel.

A technician would check switch port status on the distribution switch when multiple users in the same area cannot access the network or internet, and the access point shows no issues, suggesting a downstream switch failure or misconfiguration.

Candidates may think that any network connectivity issue could be due to DHCP problems, but the valid IP address and other users' connectivity rule out DHCP exhaustion here.

Candidates may think Wi-Fi issues are always related to radio frequency problems, overlooking client-specific configuration errors like DNS.

Candidates may think that since the laptop is connected via Wi-Fi, the switch port is still part of the path and could be faulty, overlooking that the problem is isolated to one device with correct IP settings.

The application layer in SDN contains business logic and network applications, but it does not make centralized forwarding decisions or communicate with switches via southbound APIs; that is the role of the control layer.

The data plane is responsible for forwarding packets based on decisions made by the control plane, not for making centralized forwarding decisions itself. In SDN, the control layer makes those decisions and communicates them via southbound APIs.

East-west interfaces are used for communication between controllers in a distributed SDN control plane, not for making centralized forwarding decisions or communicating with physical switches via southbound APIs.

In an SDN architecture question asking which layer hosts network applications such as load balancers, firewalls, or monitoring tools, the application layer would be the correct answer.

A question asking which component forwards packets according to flow tables populated by the controller would have the data plane as the correct answer. For example: 'Which SDN layer is responsible for actual packet forwarding based on rules installed by the controller?'

In a question about SDN controller clustering or high availability, east-west interfaces would be the correct answer for synchronizing state and forwarding decisions between multiple controllers.

Candidates may confuse the application layer with the control layer because both are part of the SDN architecture, and the term 'application' can be misinterpreted as the controlling entity.

Candidates may confuse the data plane with the control plane, thinking that because switches forward packets, they also make forwarding decisions. They overlook the separation of control and data planes in SDN.

Candidates may confuse east-west interfaces with southbound APIs because both involve communication between layers, but east-west is horizontal (controller-to-controller) while southbound is vertical (controller-to-switch).

HTTP does not provide encryption or authentication, making it insecure for transferring sensitive router configuration files. The question specifies a need for secure transfer, and HTTP lacks the security features required.

FTP transmits data and credentials in cleartext, lacking encryption, which makes it insecure for transferring sensitive router configuration files. The question specifies a need for secure transfer, and SCP provides encryption via SSH, while FTP does not.

When the question asks for a protocol to transfer configuration files to a web server for remote access via a browser, and security is not a concern (e.g., in a lab environment).

A question that asks for a protocol to transfer large files quickly over a trusted internal network where security is not a concern, and the backup server supports FTP but not SCP or SFTP.

Candidates may confuse HTTP with HTTPS, assuming HTTP provides security, or they might think HTTP is commonly used for file transfers in network management contexts.

Candidates may know FTP is commonly used for file transfers and overlook the security requirement, or they may confuse FTP with SFTP (which is secure) due to similar names.

RADIUS encrypts only the password in the authentication packet, not the entire session, and does not support per-command authorization; it is designed for network access control, not device administration.

Kerberos is designed for authentication and single sign-on in a trusted network, but it does not provide per-command authorization or session encryption for network device administration.

When the requirement is to authenticate users for network access (e.g., VPN or 802.1X) and optionally authorize network services, but does not require per-command authorization or full-session encryption.

An organization needs to implement single sign-on for users accessing multiple services within a Windows domain, with mutual authentication and ticket-based access control.

Candidates often confuse RADIUS with TACACS+ because both are AAA protocols, and they may assume RADIUS also provides command authorization and encryption, not realizing its limitations in device administration contexts.

Candidates may associate Kerberos with strong authentication and encryption, mistakenly believing it can also handle granular command authorization for network devices.

BPDU guard prevents bridge loops by disabling ports receiving BPDUs, but it does not protect against MAC address table overflow attacks, which are mitigated by limiting the number of MAC addresses learned per port via port security.

BPDU guard is correct when the question asks how to prevent a rogue switch from being connected to an access port and causing a spanning tree topology change (e.g., 'A network administrator wants to ensure that no unauthorized switches are connected to access ports. Which feature should be enabled?').

Candidates may confuse BPDU guard with port security because both are common switch security features, and the term 'guard' sounds like it could prevent attacks, leading them to incorrectly associate it with MAC flooding.

Frames and MAC addresses are data link layer (Layer 2) concepts; Layer 1 handles raw bit transmission without framing or addressing.

Layer 3 (Network) handles logical addressing (e.g., IP addresses) and routing, not frame encapsulation or MAC addresses. Frames and MAC addresses are specific to Layer 2 (Data Link).

Layer 4 (Transport) handles end-to-end communication, segmentation, and reassembly, not frame encapsulation or MAC addressing. Frames and MAC addresses are specific to Layer 2 (Data Link).

A question asking which layer defines electrical signals, cable types, or bit rates (e.g., 'At which layer are voltage levels and connector types defined?') would have Layer 1 as the correct answer.

A question asking 'At which OSI layer does a router operate based on IP addresses?' or 'Which layer adds source and destination IP addresses to packets?' would have Layer 3 as the correct answer.

A question asking: 'At which layer does TCP segment data and add port numbers?' would make Layer 4 correct, as TCP operates at the Transport layer.

Candidates may confuse physical transmission of bits with the framing and addressing that occurs at Layer 2, or they may think MAC addresses are part of the physical hardware.

Candidates may confuse MAC addresses with IP addresses or think that network devices like switches (Layer 2) and routers (Layer 3) both deal with addressing, leading them to incorrectly select Layer 3.

Candidates may confuse the encapsulation process, thinking that adding headers (like TCP headers) is similar to adding MAC addresses, or they may not clearly distinguish between layers.

DNS resolves domain names to IP addresses, but does not automate IP address assignment for client devices.

ARP (Address Resolution Protocol) is used to map IP addresses to MAC addresses on a local network, not to automate IP address assignment for client devices.

ICMP is used for network diagnostics and error reporting (e.g., ping, traceroute), not for automating IP address assignment. DHCP is the correct protocol for dynamic IP allocation.

When a question asks which protocol translates a domain name like 'example.com' into an IP address, DNS is the correct answer.

When a question asks which protocol is used to resolve a known IP address to its corresponding MAC address on a local network segment, ARP is the correct answer.

A question asking which protocol is used to test network connectivity or report errors, such as 'Which protocol does the ping command use?' would make ICMP the correct answer.

Candidates may confuse DNS with DHCP because both involve IP addresses and are commonly used in network configuration.

Candidates may confuse ARP with DHCP because both involve IP addresses, but ARP deals with mapping, not assignment.

Candidates may confuse ICMP with a protocol that manages network addresses because both involve IP communication, or they might think ICMP can assign addresses due to its role in network layer operations.

The user can access internal servers and the default gateway, indicating that DNS resolution is working for internal resources. The issue is with external websites, which points to a NAT problem, not DNS.

The user can access internal servers and the default gateway, which indicates the default gateway is correctly configured. An incorrect default gateway would prevent access to both internal servers and external websites.

The user can access internal servers and the default gateway, which indicates that DNS resolution is working for internal resources. However, the inability to reach external websites points to a NAT issue, not a proxy misconfiguration, as the ACL permits all outbound traffic.

A user cannot access any websites (internal or external) but can ping IP addresses. The technician checks DNS settings and finds the DNS server address is incorrect or unreachable. In that scenario, DNS resolution failure is the most likely cause.

A user cannot access any network resources, including internal servers and the default gateway. The technician verifies that the IP configuration shows a gateway IP that is not on the same subnet as the host.

A proxy server misconfiguration would be correct if users could access internal resources but external websites required proxy settings, and the proxy was incorrectly configured or unreachable. For example, if the browser is set to use a proxy that is down or misconfigured, external access fails while internal access works.

Candidates often associate inability to reach external websites with DNS issues, overlooking that internal access works, which rules out DNS failure.

Candidates may confuse symptoms of a default gateway issue (no external access) with the fact that internal access is still working, overlooking that the gateway is reachable.

Candidates may confuse proxy server issues with NAT problems because both can cause external access failures. They might assume that a proxy is needed for internet access, overlooking that the scenario's symptoms (internal access works) and the ACL rule point to a NAT issue instead.

The question states the server cannot communicate with other devices in the same VLAN. A trunk to a router is irrelevant for intra-VLAN communication, which occurs at Layer 2 within the switch. The issue is local to the switch port configuration.

The server has a correct static IP address in the same subnet, and other devices in VLAN 20 are working, so communication within the VLAN does not require a default gateway. The issue is at Layer 2, not Layer 3.

The question states the server cannot communicate with other devices in the same VLAN, but other devices in VLAN 20 are working. If the port were administratively down, no devices on that port would work, and the server would not have link. The issue is specific to this server, not a port status problem.

This option would be correct if the server needed to communicate with devices in a different VLAN or access the internet, and the trunk port connecting the switch to the router did not have VLAN 20 allowed, preventing inter-VLAN routing.

A server in VLAN 20 cannot communicate with devices in a different VLAN or subnet, and the question specifies that inter-VLAN routing is required. In that case, a missing default gateway would prevent traffic from leaving the local subnet.

A network administrator reports that a newly connected device has no network connectivity at all, and the switch port shows 'administratively down' in the interface status. The most likely cause is that the port was manually disabled (shutdown) and needs to be enabled with 'no shutdown'.

Candidates may confuse intra-VLAN communication with inter-VLAN routing, assuming that a missing VLAN on a trunk would affect all communication, including local traffic within the same VLAN.

Candidates often associate network connectivity issues with missing default gateways, but they overlook that intra-VLAN communication does not need a gateway.

Candidates may think 'administratively down' is a common misconfiguration, but the question's symptom (server can't communicate with same VLAN) points to a VLAN mismatch, not a disabled port. They overlook that other devices in VLAN 20 work, ruling out a global VLAN issue.

DNS resolution failure would prevent the user from resolving a hostname to an IP address, but the user can ping the server's IP address (10.0.1.200) directly, indicating that name resolution is not the issue.

A duplicate IP address would cause intermittent connectivity or complete failure for both devices, but the user can ping the server successfully, ruling out an IP conflict.

A user reports they cannot access a website by its domain name (e.g., www.example.com) but can access it by IP address. Other users on the same subnet can access the site by name. DNS resolution failure would be the most likely cause.

A user reports intermittent connectivity to a server; pinging the server sometimes fails and sometimes succeeds, and other users on the same subnet also experience similar issues. This scenario suggests an IP address conflict.

Candidates often associate web access issues with DNS problems, overlooking that the user can successfully ping the IP address, which eliminates DNS as the cause.

Candidates may confuse symptoms of IP conflicts with application-layer issues, or assume that any connectivity problem could be due to duplicate IPs without considering that ping success eliminates that possibility.

Hubs operate at Layer 1 (physical layer) and do not process MAC addresses, while switches operate at Layer 2 (data link layer) and use MAC addresses for forwarding. This option reverses the OSI layers for hubs and switches.

Hubs operate at Layer 1 and do not use MAC addresses; switches use MAC addresses at Layer 2. This option reverses the roles: hubs do not use MAC addresses, and switches do not use IP addresses for forwarding.

A hub creates a single collision domain for all ports, while a switch creates a separate collision domain per port. The statement reverses these facts.

This option would be correct if the question asked: 'Which statement incorrectly describes the difference between a hub and a switch?' or if the question was about a device that operates at Layer 2 (like a switch) versus a device that operates at Layer 1 (like a hub), but with the layers swapped.

This option would be correct in a question comparing a router and a switch, where the router uses IP addresses (Layer 3) and the switch uses MAC addresses (Layer 2).

If the question asked 'Which statement correctly describes a key difference between a hub and a switch regarding collision domains?' and the options were reversed (e.g., 'A hub creates a single collision domain, a switch creates separate collision domains'), then this option would be correct.

Candidates may confuse the OSI layers, thinking hubs are more intelligent than they are, or they may misremember that switches operate at Layer 2 and hubs at Layer 1, leading to a reversal of the correct layer assignments.

Candidates may confuse the layers of operation, thinking hubs use MAC addresses because they deal with frames, or they may mix up the functions of hubs and switches with those of routers.

Candidates may confuse the concepts of collision and broadcast domains, or mistakenly think that hubs segment collision domains because they are older devices, while switches are more advanced.

1000BASE-T uses twisted-pair copper cabling with a maximum distance of 100 meters, far short of the 2 km requirement. Single-mode fiber requires a different transceiver type.

1000BASE-SX uses multimode fiber and has a maximum reach of about 550 meters, insufficient for a 2 km link.

10GBASE-SR is designed for multimode fiber and supports distances up to 300 meters, insufficient for 2 km over single-mode fiber.

A question asking for a transceiver to connect two switches within the same data center, less than 100 meters apart, using existing Cat6a cabling. 1000BASE-T would be correct for that scenario.

A question specifying a link distance under 550 meters (e.g., within a data center) using multimode fiber would make 1000BASE-SX the correct choice.

When connecting devices within a data center using multimode fiber at distances up to 300 meters, 10GBASE-SR is the correct choice for 10 Gbps Ethernet.

Candidates may confuse transceiver types or assume 'T' stands for fiber, or they might overlook the distance limitation and focus only on the speed requirement.

Candidates may confuse SX with LX or assume 'S' stands for single-mode, not short wavelength, leading to incorrect selection for longer distances.

Candidates may confuse SR with LX, assuming both support long distances, or overlook the fiber type requirement (multimode vs. single-mode).

A native VLAN mismatch would cause issues with untagged traffic, but the problem is that hosts on VLAN 10 cannot communicate. Since both switches have the same allowed VLAN list and the trunk is up/up, a native VLAN mismatch would not prevent tagged VLAN 10 traffic from passing.

The trunk is operational and shows up/up, indicating that the encapsulation is correctly negotiated or configured. If there were an encapsulation mismatch, the trunk would not come up, or at least show errors. The problem is specific to VLAN 10, not all VLANs.

STP blocking VLAN 10 traffic on the trunk would prevent communication, but the question states the trunk is operational and up/up, and STP typically blocks redundant paths, not a single trunk unless it's a loop. The issue is more likely that VLAN 10 doesn't exist on the new switch.

This would be correct if the question stated that hosts on the native VLAN (e.g., VLAN 1) cannot communicate, or if there were symptoms like CDP/LLDP not working or management access issues across the trunk, indicating a native VLAN mismatch.

This option would be correct in a scenario where a trunk link between two switches is down or not passing any traffic, and the switches use different trunking protocols (e.g., one switch is Cisco using ISL and the other is a non-Cisco switch using 802.1Q). The encapsulation mismatch would prevent the trunk from forming.

In a scenario where two switches are connected via redundant trunk links, and one link is blocked by STP to prevent loops, causing VLAN 10 traffic to be blocked on that specific trunk. The question would indicate multiple connections between switches and that the trunk is up but not forwarding traffic.

Candidates often confuse native VLAN mismatch with general VLAN communication issues, as it is a common trunk misconfiguration that can cause connectivity problems, but it specifically affects untagged traffic, not tagged VLANs like VLAN 10.

Candidates may confuse trunk encapsulation issues with VLAN-specific problems, especially if they have encountered encapsulation mismatches in the past that caused connectivity issues. They might assume that any trunk problem is due to encapsulation mismatch without considering that the trunk is up.

Candidates may think STP is a common cause for VLAN traffic issues on trunks, especially if they've seen STP blocking ports in loop prevention scenarios, and they might overlook the simpler VLAN creation requirement.

A stateful firewall tracks connection states and filters traffic based on state and port/protocol, but it does not perform deep packet inspection or block application-layer attacks in real time.

A proxy server primarily acts as an intermediary for client requests, often caching content or filtering URLs, but it does not perform deep packet inspection or block application-layer attacks in real time like an IPS does.

A VPN concentrator is designed to manage VPN tunnels and encrypt/decrypt traffic, not to perform deep packet inspection or block application-layer attacks in real time.

A stateful firewall would be correct when the requirement is to filter traffic based on connection state (e.g., allowing return traffic for established connections) and enforce basic access control policies without needing deep packet inspection or application-layer attack blocking.

A proxy server would be correct if the question asked for a device that provides anonymous web browsing, content caching, or URL filtering to enforce acceptable use policies, without requiring real-time attack blocking.

A question asking for a device that securely connects remote users to a corporate network over the internet, with emphasis on encryption and tunnel management, would make a VPN concentrator the correct answer.

Candidates may confuse stateful firewalls with next-generation firewalls (NGFWs) that do include DPI and application-layer filtering, or they may overestimate the capabilities of standard stateful firewalls.

Candidates may confuse proxy servers with security devices because proxies can filter web traffic and block certain content, leading them to overestimate the proxy's ability to inspect and block application-layer attacks.

Candidates may confuse VPN concentrators with security devices because they handle encrypted traffic, but they lack the inspection and blocking capabilities required for application-layer attack prevention.

The issue is that the user can access the website by IP address but not by domain name, which points to a name resolution problem, not a routing issue. An incorrect default gateway would prevent access to any external IP addresses, not just domain names.

A duplicate IP address would cause intermittent connectivity or complete loss of network access, but it would not specifically prevent domain name resolution while allowing access by IP address.

A corrupted TCP/IP stack would cause connectivity issues regardless of whether the destination is accessed by IP or domain name, but the user can access the website by IP, so the stack is functioning correctly.

A user reports they cannot access any external websites or services, but can access local network resources. In this scenario, an incorrect default gateway would be the most likely issue because it prevents traffic from leaving the local subnet.

A user reports that they cannot access any network resources, and an IP conflict is detected in the logs. The correct answer would be 'Duplicate IP address' because the conflict disrupts all IP communication.

A user cannot access any network resources, and ipconfig /all shows an invalid IP address (e.g., 169.254.x.x). In that scenario, a corrupted TCP/IP stack could prevent proper IP configuration.

Candidates may confuse network connectivity issues with DNS issues, assuming that if a website is unreachable, it must be a gateway problem. They might not realize that successful access via IP address rules out gateway and routing problems.

Candidates may confuse symptoms of IP conflicts with DNS issues, thinking that a duplicate IP could cause name resolution failures, but DNS operates independently of IP uniqueness.

Candidates may think that any network problem could be due to a corrupted TCP/IP stack, especially when they cannot immediately identify the DNS issue, leading them to choose a more generic 'system-level' cause.

A /52 prefix provides 16 subnets (2^(52-48)=16), which is insufficient for the requirement of up to 250 subnets.

A /64 subnet provides 2^64 addresses per subnet, which is far more than needed for 250 subnets. Using /64 would waste a huge number of addresses and does not minimize waste given the /48 prefix.

A /60 subnet provides only 2^(60-48)=4096 subnets, which is far more than the required 250, but it wastes more addresses than a /56 (which gives 256 subnets). The question asks to minimize waste, so /56 is optimal.

If the requirement were to support up to 16 subnets, a /52 would be the correct choice to minimize waste.

If the question required each subnet to support SLAAC (Stateless Address Autoconfiguration) or needed a standard subnet size for end-user networks, /64 is the correct choice because IPv6 standards mandate /64 for SLAAC.

If the requirement were to support up to 4000 subnets, a /60 would be correct because it provides 4096 subnets, meeting the need with minimal waste compared to larger subnet sizes like /64.

Candidates may mistakenly think that a /52 offers more subnets than a /56 because it has a larger subnet portion, but they forget that the number of subnets is 2^(subnet bits), and /52 gives only 16 subnets, far fewer than needed.

Candidates often default to /64 because it is the most common IPv6 subnet size and is required for SLAAC, forgetting that the question emphasizes minimizing waste for a specific number of subnets.

Candidates may think a larger subnet prefix (like /60) is more efficient because it provides more subnets, but they overlook that the requirement is only 250 subnets, so a /56 wastes fewer addresses overall.

Intermittent call drops are typically caused by network congestion or QoS misconfiguration, not by physical cabling issues. Patch cable faults usually cause complete loss of connectivity or persistent problems, not intermittent drops.

Intermittent call drops are typically caused by network congestion or QoS misconfiguration, not DHCP lease time. Increasing DHCP lease time would not address the root cause of packet loss or jitter affecting voice traffic.

A question describing a scenario where IP phones intermittently lose connectivity entirely (not just call drops) and other devices on the same switch port work fine. The correct answer would be to replace patch cables after verifying link lights and cable tester results.

A question where IP phones are losing their IP addresses and re-registering frequently, causing call drops. For example: 'Users report that VoIP phones disconnect and reconnect every few hours. Which setting should be adjusted?'

Candidates may default to physical layer troubleshooting (cables) when faced with intermittent issues, overlooking that VoIP call drops are more often due to QoS or network congestion problems.

Candidates may think that DHCP lease expiration causes phones to lose connectivity, but intermittent call drops during active calls are rarely due to lease time—phones renew leases well before expiration.

A cable tester is used to verify physical cabling (e.g., continuity, wiring faults) and cannot measure wireless signal interference or dead zones, which are the issues described in the question.

A multimeter measures electrical properties like voltage, current, and resistance, not wireless signal interference or dead zones. It cannot analyze RF spectrum or identify sources of Wi-Fi interference.

A protocol analyzer captures and decodes network traffic, but it does not measure signal strength or identify physical-layer interference and dead zones, which are the issues described in the question.

A cable tester would be correct when troubleshooting a wired connectivity issue, such as a user reporting intermittent network drops on a desktop PC connected via Ethernet, where you suspect a faulty cable or improper termination.

A technician is troubleshooting a PoE device that intermittently loses power. Using a multimeter to check voltage at the switch port and at the device can confirm if the power supply is within spec.

A protocol analyzer would be correct when the question involves analyzing packet-level issues, such as identifying excessive retransmissions, protocol errors, or application-layer problems, rather than physical-layer signal issues.

Candidates may confuse cable testers with network troubleshooting tools, or assume that intermittent connectivity always involves cabling, overlooking that the problem is wireless (laptop moving between floors).

Candidates may confuse a multimeter with a spectrum analyzer, thinking it can measure signal strength, or they may overestimate its capabilities in wireless troubleshooting.

Candidates may confuse 'analyzer' with tools that diagnose network problems, assuming a protocol analyzer can also detect interference, or they may think it can analyze wireless signals at a low level.

STP prevents loops in a network topology but does not segment a switch into multiple broadcast domains; it operates at Layer 2 to manage redundant paths, not to create separate broadcast domains.

ACLs filter traffic based on IP addresses or protocols but do not segment a switch into multiple broadcast domains; they operate at Layer 3/4, not Layer 2.

A question asking which protocol prevents bridging loops in a redundant switched network would have STP as the correct answer, e.g., 'Which technology ensures a loop-free topology in a network with redundant switches?'

A question asking 'Which technology can be used to restrict traffic between two subnets on a router?' would make ACLs correct, as they filter packets based on rules.

Candidates may confuse STP's role in managing network traffic with segmentation, or think that breaking a network into segments involves loop prevention.

Candidates may confuse traffic filtering (ACLs) with traffic isolation (VLANs), thinking that controlling traffic flow achieves segmentation.

VLANs segment network traffic into separate broadcast domains but do not prioritize voice packets over data; they only isolate traffic, not provide quality of service.

STP prevents loops in redundant network topologies but does not prioritize voice traffic over data; it has no mechanism for traffic classification or queuing.

PoE provides power to devices like VoIP phones over Ethernet cables but does not prioritize voice packets over data packets. The question specifically asks for packet prioritization, which is handled by QoS, not PoE.

A question asking how to separate voice and data traffic on the same physical network to improve security or reduce broadcast traffic would make VLAN the correct answer.

A question asking which protocol prevents bridging loops in a switched network with redundant links would have STP as the correct answer.

PoE would be correct if the question asked about powering VoIP phones without needing separate power adapters, e.g., 'A company is deploying VoIP phones and wants to avoid running separate power cables. Which technology should be implemented?'

Candidates may confuse traffic isolation with traffic prioritization, thinking that separating voice into its own VLAN inherently gives it priority.

Candidates may confuse STP with QoS because both involve network performance, but STP is about loop prevention, not traffic prioritization.

Candidates may confuse PoE with QoS because both are commonly associated with VoIP deployments, leading them to think PoE also handles traffic prioritization.

The IP address 169.254.100.25 is an Automatic Private IP Addressing (APIPA) address, which is assigned when DHCP fails. A non-responsive DNS server would not cause this; it would result in name resolution failures but the workstation would still have a valid DHCP-assigned IP and default gateway.

A static IP address would not result in an APIPA address (169.254.x.x). If a static IP were configured, the workstation would use that address, not self-assign an APIPA address.

An unplugged network cable would result in no IP address or a disconnected status, not an Automatic Private IP Addressing (APIPA) address like 169.254.100.25. The workstation would show 'Media disconnected' in ipconfig.

A user reports they can access internal resources by IP address but not by hostname. The technician checks the workstation's IP configuration and finds a valid DHCP address and default gateway. In this scenario, a non-responsive DNS server is the most likely cause.

This option would be correct in a scenario where a user reports no network access, and ipconfig shows a manually configured IP address (e.g., 192.168.1.100) that is not in the correct subnet or conflicts with another device, causing connectivity issues.

If a user reports no network access and ipconfig shows 'Media disconnected' with no IP address, the most likely cause is an unplugged or faulty network cable.

Candidates often associate any network connectivity issue with DNS, especially when the symptom is 'cannot access resources.' They may overlook the APIPA address and default gateway being blank, which clearly points to DHCP failure rather than DNS.

Candidates may think that a static IP could cause misconfiguration, but they overlook that APIPA addresses are only assigned when DHCP fails, not when a static IP is set.

Candidates may associate any connectivity issue with a physical layer problem like an unplugged cable, overlooking the specific APIPA address which indicates DHCP failure.

A firewall controls traffic based on rules but does not create encrypted tunnels; it lacks the encryption and encapsulation capabilities needed for secure remote access over the internet.

A DMZ is a network segment that exposes external-facing services to the internet while isolating the internal network, but it does not create encrypted tunnels for individual remote user access.

An intrusion detection system (IDS) monitors network traffic for suspicious activity but does not create encrypted tunnels or provide remote access connectivity.

A firewall would be the correct answer for a question asking which device should be placed at the network perimeter to filter incoming and outgoing traffic based on security policies, such as blocking unauthorized access from the internet.

A company wants to host a public web server that must be accessible from the internet while protecting the internal network. Which network architecture should be used?

A company needs to monitor its internal network for malicious activity and receive alerts when potential intrusions are detected, but does not require active prevention or encrypted remote access.

Candidates may think a firewall provides security for remote access because it is a common security device, but they overlook that it does not establish encrypted connections or tunnels.

Candidates may confuse DMZ with a secure remote access method because DMZs are often used in conjunction with VPNs or firewalls, leading them to think DMZ alone provides encrypted remote access.

Candidates may confuse IDS with VPN because both involve network security, or mistakenly think IDS provides secure remote access due to its role in protecting network boundaries.

Dynamic ARP Inspection (DAI) validates ARP packets to prevent ARP spoofing attacks, not DHCP starvation. DHCP starvation is mitigated by rate limiting DHCP packets to prevent an attacker from exhausting the DHCP pool.

IP Source Guard (IPSG) prevents IP spoofing by filtering traffic based on DHCP snooping bindings, but it does not limit the rate of DHCP packets, which is required to mitigate DHCP starvation attacks.

Port Security limits the number of MAC addresses per port but does not control the rate of DHCP packets, so it cannot prevent DHCP starvation attacks that exhaust the DHCP pool by flooding DHCP requests.

A question asks: 'A network administrator wants to prevent a man-in-the-middle attack where an attacker sends fake ARP replies to associate their MAC address with the default gateway's IP. Which feature should be enabled?' In that scenario, DAI is the correct answer.

IP Source Guard would be correct in a question asking: 'Which feature prevents a host from using a statically assigned IP address that conflicts with a DHCP lease?' or 'Which feature blocks traffic from unauthorized IP addresses on a switch port?'

Port Security would be correct in a question asking how to prevent unauthorized devices from connecting to the network by limiting the number of MAC addresses allowed on a switch port, such as in a scenario to stop MAC flooding attacks.

Candidates may confuse DHCP snooping with DAI because both are often enabled together as part of DHCP security, leading them to think DAI also addresses DHCP starvation.

Candidates often confuse IPSG with DHCP rate limiting because both are related to DHCP snooping, and they may think IPSG's filtering capability can also prevent excessive DHCP requests.

Candidates may confuse DHCP starvation with MAC flooding or think that limiting MAC addresses per port can also limit DHCP requests, not realizing that DHCP starvation is a rate-based attack requiring rate limiting.

LSA throttling controls the rate of LSA generation and flooding, which can reduce CPU load during instability but does not speed up failure detection or convergence; it may actually delay convergence.

OSPF fast hello timers reduce the time to detect a neighbor failure, but they do not speed up the overall reconvergence process after a core router failure, which involves LSA flooding, SPF calculation, and routing table updates. BFD provides faster failure detection than fast hello timers and integrates with OSPF to trigger quicker reconvergence.

In a scenario where OSPF routers are experiencing excessive LSA flooding causing CPU spikes and instability, LSA throttling would be correct to stabilize the network by limiting LSA generation rates.

A question asks: 'An organization wants to reduce OSPF neighbor dead timer detection from 40 seconds to 10 seconds without changing the hello interval. Which feature should be configured?' In this scenario, enabling OSPF fast hello timers (or adjusting hello/dead intervals) would be correct.

Candidates may confuse throttling with optimization, thinking that reducing LSA overhead will speed up convergence, but throttling primarily prevents router overload, not faster detection.

Candidates may think that faster hello timers directly speed up convergence, but they only improve failure detection time; the overall reconvergence still depends on OSPF's LSA propagation and SPF calculation, which BFD addresses more effectively.

TACACS+ is used for device administration authentication (e.g., router/switch login), not for 802.1X port-based network access control. 802.1X requires a RADIUS server to authenticate users and devices connecting to the network.

NTP (Network Time Protocol) servers synchronize clocks across network devices, but they do not perform authentication of users or devices. 802.1X requires a RADIUS server to validate credentials and authorize access.

A question asks: 'Which server is used to authenticate network administrators when they log into routers and switches?' In that context, TACACS+ would be the correct answer because it separates authentication, authorization, and accounting for device administration.

A question asking which server ensures accurate timestamps for logs or certificate validation in a PKI environment would have NTP as the correct answer. For example: 'A company needs to synchronize clocks for log correlation and certificate validity checks. Which server is required?'

Candidates confuse TACACS+ with RADIUS because both are AAA protocols. They may think TACACS+ can also handle network access authentication, but 802.1X specifically requires RADIUS.

Candidates may confuse NTP with authentication servers because time synchronization is critical for Kerberos and certificate-based authentication, leading them to incorrectly assume NTP is part of the 802.1X authentication process.

MAC filtering only controls which devices can connect based on their MAC address, but it does not authenticate users or prevent an infected laptop from spreading malware once connected. It also does not enforce endpoint compliance.

VLAN segmentation separates network traffic into logical groups but does not authenticate devices; it would not prevent an unauthenticated personal laptop from connecting to the network and spreading malware.

Access control lists on the router control traffic between subnets but do not prevent an unauthorized device from connecting to the network jack in the first place. They cannot block the initial infection or lateral spread within the same VLAN.

MAC filtering would be correct in a scenario where the goal is to prevent unauthorized devices from connecting to a network by allowing only pre-approved MAC addresses, such as in a small office with a static device inventory and no need for user authentication.

A question asks which control limits broadcast traffic or isolates sensitive systems from general user traffic to reduce attack surface, e.g., 'Which security control separates guest Wi-Fi from corporate devices?'

An ACL on the router would be correct in a scenario where the question asks how to restrict traffic between different network segments (e.g., preventing a compromised device in the guest VLAN from accessing the corporate server subnet).

Candidates may think MAC filtering provides strong access control because it restricts devices by hardware address, but they overlook that it can be bypassed via MAC spoofing and does not address malware propagation from an already connected device.

Candidates know VLANs improve security by isolating traffic, so they mistakenly believe VLANs can block unauthorized devices, confusing network segmentation with access control.

Candidates may think ACLs can block malicious traffic at the network perimeter, but they overlook that the malware spreads locally before reaching the router, and ACLs do not enforce device authentication at the access layer.

The user can access the internet, indicating general connectivity works. The technician can ping the server from the router, so the router has a route. A workstation firewall blocking port 80 would not explain why the server is unreachable from the user's perspective if the server itself is reachable via ping from the router.

The technician can ping the server's IP from the router, which means the router has a route to the server's network. A missing route would prevent the router from reaching the server, contradicting the given information.

An incorrect subnet mask on the server would prevent it from communicating with devices on other subnets, but the technician can ping the server from the router, indicating the server's IP configuration is reachable. The issue is that the user cannot access the web server, which suggests the server cannot reply to the user because its default gateway is misconfigured, not its subnet mask.

A user reports they cannot access a specific website (e.g., https://example.com) but can access other websites. The technician verifies the user's firewall is enabled and blocking outbound port 443. In this case, the workstation firewall blocking the port would be the most likely cause.

This option would be correct if the technician could not ping the server from the router, indicating that the router lacks a route to the server's subnet, or if the server is on a different network segment not directly connected to the router.

In a scenario where a user cannot reach a server at all (no ping, no access), and the technician finds that the server's IP address is in a different subnet than expected due to a subnet mask error, then an incorrect subnet mask would be the cause. For example, if the server is configured with /24 instead of /16, it may not communicate with hosts outside its perceived subnet.

Candidates often assume client-side firewall issues are common and may overlook that the problem is server-side, especially when symptoms involve a single inaccessible server.

Candidates may assume that any connectivity issue between different subnets is due to a missing route, overlooking that the router's successful ping proves the route exists.

Candidates may confuse subnet mask issues with default gateway issues, thinking that an incorrect subnet mask could prevent the server from sending replies to the user, but in this case the server is reachable from the router, ruling out a subnet mask problem.

A backbone router must have at least one interface in Area 0, but the question states the router has interfaces in only one area, which is not necessarily Area 0.

An Area Border Router (ABR) connects multiple OSPF areas, but the question states the router has interfaces in only one area, so it cannot be an ABR.

An ASBR is a router that redistributes routes from other routing protocols or autonomous systems into OSPF. The question states the router does not perform route redistribution, so it cannot be an ASBR.

If the question specified that the router has at least one interface in Area 0, even if it also has interfaces in other areas, then it would be a backbone router.

This option would be correct in a question where a router has interfaces in at least two different OSPF areas and is responsible for routing between them, summarizing routes from one area to another.

A router that redistributes external routes (e.g., from EIGRP or BGP) into OSPF, regardless of its interfaces being in one or multiple areas, would be correctly identified as an ASBR.

Candidates often assume that any OSPF router in a single-area network must be a backbone router, forgetting that the backbone is specifically Area 0.

Candidates may confuse the term 'area border' with any router that is at the edge of an area, not realizing that ABR specifically requires multiple area connections.

Candidates may confuse the term 'Autonomous System Boundary Router' with any router that connects to external networks, or they may mistakenly think that any router with multiple interfaces is an ASBR.

A /28 subnet provides only 14 usable IP addresses (2^4 - 2 = 14), which is insufficient for 20 devices.

A /29 subnet provides only 6 usable IP addresses (2^(32-29)-2 = 6), which is insufficient for 20 devices.

A /26 subnet provides 62 usable addresses, which is excessive for 20 devices and wastes IP space. The question asks for the most efficient subnet with minimal waste, so /27 (30 usable addresses) is better.

This subnet mask would be correct for a VLAN that needs exactly 14 usable IP addresses, such as a small management or printer VLAN with 14 devices.

This subnet mask would be correct for a VLAN requiring exactly 6 usable addresses, such as a point-to-point link or a small management network with only a few devices.

This subnet mask would be correct if the VLAN needed to support 50 devices, as a /26 provides 62 usable addresses, which is the smallest subnet that can accommodate 50 hosts.

Candidates may mistakenly think 16 total addresses (2^4) are enough for 20 devices, or they may confuse usable addresses with total addresses.

Candidates may mistakenly think a /29 is sufficient because they forget to subtract the network and broadcast addresses, or they misapply the formula for usable hosts.

Candidates may mistakenly think a larger subnet is safer or fail to calculate the exact number of usable addresses needed, leading them to choose a subnet with more capacity than necessary.

The user can ping the default gateway and tracert shows the first hop succeeds, indicating outbound traffic is not blocked by the local firewall. The issue is beyond the gateway, at the second hop, which points to a routing problem.

The user can ping the default gateway and tracert shows the first hop succeeds, indicating local network connectivity is fine. DNS issues would prevent name resolution, but the question states the user cannot access external websites, and tracert to an IP address (8.8.8.8) shows a timeout at the second hop, which points to a routing problem beyond the gateway, not DNS.

The user can ping the default gateway, and tracert shows the first hop (gateway) succeeds, indicating local connectivity is fine. The second hop timeout suggests the issue is beyond the gateway, likely a missing or incorrect default route on the router, not the ISP's DNS server being unreachable.

A user cannot access external websites but can ping internal IPs and the default gateway. Tracert shows the first hop succeeds but subsequent hops time out, and the firewall logs show outbound HTTP/HTTPS traffic being dropped. In that case, the local firewall blocking outbound web traffic would be correct.

In a scenario where a user can obtain an IP address from DHCP, ping the default gateway, but cannot access external websites by name, and 'nslookup' fails to resolve domain names while pinging external IP addresses succeeds, then the DNS server being unreachable or misconfigured would be the correct answer.

In a scenario where a user can access external websites by IP address (e.g., pinging 8.8.8.8 works) but cannot resolve domain names, and the DNS server is configured on the ISP's side, then an unreachable ISP DNS server would be the correct answer.

Candidates may assume that inability to access websites is always due to firewall rules, overlooking that the tracert result localizes the problem to the router's upstream routing, not the local host.

Candidates often confuse inability to access websites with DNS failure, especially when they see that pinging an IP works but browsing fails. They may overlook the tracert output showing a routing issue at the second hop, which clearly indicates the problem is beyond DNS.

Candidates often confuse DNS resolution issues with routing problems, and since external websites are unreachable, they may incorrectly attribute it to DNS, especially when the ISP provides DNS services.

A logical diagram shows the flow of data and logical relationships (e.g., IP subnets, VLANs) but does not include physical details like cable types or patch panel ports.

A network topology map shows the logical or physical layout of devices and links, but it does not provide detailed information about cable types, patch panel ports, or specific wiring connections.

An asset management database tracks inventory details like device serial numbers, warranties, and software licenses, but it does not document physical cabling connections, cable types, or patch panel port mappings.

When the question asks for documentation that illustrates the high-level network architecture, such as IP addressing, routing protocols, and VLAN assignments, without physical connection details.

When the question asks for a high-level overview of device interconnections and network structure without requiring cable-level details, such as 'Which document best illustrates the arrangement of routers, switches, and firewalls in the network?'

When the question asks for a tool that records device ownership, location, purchase date, and configuration history for auditing hardware assets, the asset management database is the correct answer.

Candidates may confuse 'logical' with 'physical' or think that a diagram of the network inherently includes all connection details, overlooking the specific focus on physical cabling.

Candidates may confuse 'topology map' with 'wiring schematic' because both can show physical connections, but they overlook that a topology map typically lacks the granularity of cable types and patch panel port assignments.

Candidates may confuse asset management with network documentation because both involve tracking network components, but asset management focuses on inventory and lifecycle, not physical connectivity details.

SNMP walk is used to retrieve a sequence of OID values from a MIB tree, not to send unsolicited notifications. The requirement is for immediate notification when CPU exceeds 90%, which requires an event-driven alert, not a polling mechanism.

SNMP set is used to modify configuration parameters on a managed device, not to receive unsolicited notifications. The question requires immediate notification when CPU exceeds 90%, which is a trap condition, not a set operation.

An SNMP walk would be correct when an administrator needs to retrieve all values from a MIB subtree, such as when performing a full inventory of interface statistics or system parameters on a device for baseline monitoring.

An SNMP set would be correct if the question asked: 'A network administrator needs to change the SNMP community string on a router remotely. Which SNMP mechanism should be used?'

Candidates may confuse SNMP walk with trap because both involve data retrieval, but walk is a polling operation that requires the manager to initiate the request, whereas trap is a push notification from the agent.

Candidates may confuse SNMP set with trap because both involve sending data from the agent, but set is for writing values, not for alerting on threshold events.

TCP is a connection-oriented protocol at the transport layer, meaning it establishes a reliable connection before data transfer, which is the opposite of connectionless.

ICMP operates at the network layer (Layer 3), not the transport layer. The question specifically asks for a connectionless protocol at the transport layer, which is UDP.

ARP operates at the Data Link layer (Layer 2) and resolves IP addresses to MAC addresses; it is not a transport layer protocol and does not provide connectionless transport services.

If the question asked 'Which of the following is a connection-oriented protocol at the transport layer?', then TCP would be the correct answer.

A question asking 'Which protocol is used for error reporting and diagnostic functions at the network layer?' would make ICMP the correct answer.

A question asking which protocol is used to map an IP address to a MAC address on a local network, or which protocol operates at Layer 2 and is essential for Ethernet communication.

Candidates may confuse TCP with UDP due to both operating at the transport layer, or they might think TCP's reliability implies it is connectionless because it can handle packet loss.

Candidates may confuse ICMP as connectionless because it does not establish a connection before sending messages, but they overlook that it belongs to the network layer, not the transport layer.

Candidates may confuse ARP's lack of connection establishment with connectionless transport, or mistakenly think ARP operates at the transport layer because it works with IP addresses.

SMTP is designed for email transmission, not for network management or retrieving system information like OS and uptime from network devices.

HTTP is a web protocol for transferring hypertext, not designed for network management or monitoring. It cannot retrieve OS or uptime information from network devices like routers.

FTP (File Transfer Protocol) is designed for transferring files between systems, not for retrieving network management data like OS and uptime from routers.

A question asking which protocol is used to send alert notifications from a network monitoring system to an administrator's email would have SMTP as the correct answer.

A question asking which protocol is used to access a router's web-based configuration interface for manual settings would make HTTP correct, as many routers provide a web GUI over HTTP/HTTPS.

A question asking which protocol is used to transfer firmware or configuration files to a router would make FTP correct, as it is commonly used for such file transfers in network device management.

Candidates may confuse SMTP with SNMP due to similar acronyms, or mistakenly think email protocols are used for device monitoring.

Candidates may confuse HTTP with SNMP because both can be used to interact with network devices, but HTTP is for web interfaces, not standardized management data retrieval.

Candidates may confuse FTP with SNMP because both are used in network management contexts, but FTP handles file transfers while SNMP handles monitoring and data retrieval.

MAC filtering only checks device MAC addresses, not user credentials, so it cannot authenticate users with domain credentials.

WPA2-PSK is a wireless security protocol, not suitable for wired network authentication. It uses a pre-shared key rather than individual domain credentials, failing to meet the requirement for per-user authentication with domain credentials.

Port security limits access by MAC address, not by user authentication with domain credentials. It does not require per-user authentication via 802.1X, so it fails to meet the requirement of authenticating each user individually.

A question asking for a simple method to restrict network access to a list of known devices without user authentication, such as in a small office with static devices.

In a scenario where a small office needs to secure a wireless network for guest access with a simple shared password, and there is no requirement for individual user authentication or integration with domain credentials, WPA2-PSK would be the correct choice.

A network administrator needs to prevent unauthorized devices from plugging into switch ports by limiting the number of MAC addresses per port or by allowing only specific MAC addresses. The question would not mention user authentication or domain credentials.

Candidates may confuse device-based access control with user authentication, assuming MAC filtering can enforce per-user security.

Candidates may confuse wireless security protocols with wired authentication methods, or mistakenly think that WPA2-PSK can be adapted for wired networks, especially if they overlook the 'wired network' specification in the question.

Candidates may confuse port security with network access control, thinking it can authenticate users, but it only controls devices based on MAC addresses, not user identity.

An expired web server certificate would cause browser security warnings but would not prevent hostname resolution; the user can access by IP, indicating DNS resolution is working, but the browser fails to resolve the hostname, pointing to a client-side DNS caching issue.

An overloaded file server would not prevent DNS resolution of a hostname; the user can access the intranet via IP, indicating network connectivity and web server functionality are intact.

This option would be correct in a scenario where a user reports being unable to access a secure website (HTTPS) and receives a certificate error, while other users can access the same site without issues, and the certificate is confirmed expired.

A user reports slow access to shared files on a file server, and other users experience similar issues. The technician finds high CPU and disk usage on the file server. In that scenario, an overloaded file server would be the likely cause.

Candidates may confuse certificate errors with name resolution failures, assuming that an expired certificate blocks all access, or they may think the browser's inability to load the site is due to a security certificate issue rather than DNS.

Candidates may confuse file server and web server roles, or assume any server overload could cause name resolution failures, overlooking that DNS is a separate service.

The question states all VLANs are configured on the same Layer 3 switch with SVIs, so inter-VLAN routing occurs within the switch. A trunk port is not involved in this scenario, making VLAN 30 not allowed on a trunk irrelevant.

The question states that hosts in VLAN 10 can communicate with VLAN 20 but not VLAN 30, indicating inter-VLAN routing is partially working. If the default gateway on VLAN 10 hosts were incorrect, they would not be able to reach any other VLAN, including VLAN 20.

The routing table not having a route to VLAN 30 would cause inter-VLAN routing failure for all VLANs, but hosts in VLAN 10 can already communicate with VLAN 20, indicating routing is functional. The issue is specific to VLAN 30, suggesting a missing SVI IP rather than a missing route.

This would be correct if the Layer 3 switch were connected to a separate Layer 2 switch via a trunk, and hosts in VLAN 10 and 20 could reach VLAN 30 through that trunk, but the trunk port on the Layer 2 switch did not have VLAN 30 allowed.

In a scenario where hosts in VLAN 10 cannot communicate with any other VLAN (e.g., VLAN 20 and VLAN 30), but hosts within VLAN 10 can communicate, the first thing to verify would be the default gateway configuration on the hosts in VLAN 10.

This option would be correct in a scenario where a Layer 3 switch has SVIs for all VLANs with correct IPs, but static or dynamic routing is not configured to reach a remote VLAN (e.g., VLAN 30 is on a different router). The technician must verify the routing table for a route to that subnet.

Candidates may confuse inter-VLAN routing on a single switch with a multi-switch topology where trunk ports are critical for VLAN propagation, leading them to incorrectly suspect a trunk misconfiguration.

Candidates often default to checking client-side configuration (default gateway) as a common cause of connectivity issues, without considering that partial connectivity (working with VLAN 20) rules out a global default gateway problem.

Candidates may assume that inter-VLAN routing failures are always due to missing routes, overlooking that SVIs must have IP addresses to enable routing. The symptom of partial connectivity (VLAN 10 to 20 works) suggests routing is active, making a missing route seem plausible.

OFDM is a modulation scheme that divides a channel into multiple subcarriers, but it does not use multiple antennas to transmit multiple spatial streams. The question specifically asks for technology enabling multiple antennas and spatial streams, which is MIMO.

DSSS is a spread spectrum technique used in older 802.11b networks to reduce interference, but it does not use multiple antennas or spatial streams to increase throughput.

CSMA/CA is a media access control method used to avoid collisions on shared wireless channels, not a technology that uses multiple antennas to transmit multiple spatial streams for increased throughput.

OFDM would be correct if the question asked: 'Which technology divides a wireless channel into multiple orthogonal subcarriers to improve spectral efficiency and reduce interference?'

A question asking: 'Which spread spectrum technique uses a chipping code to spread the signal over a wider frequency band, providing resistance to interference in 802.11b networks?'

A question asking 'Which mechanism does 802.11 use to reduce the probability of collisions on a shared wireless medium?' would make CSMA/CA the correct answer.

Candidates often confuse OFDM with MIMO because both are used in modern Wi-Fi (e.g., 802.11n/ac/ax) to increase throughput, but they serve different purposes: OFDM handles subcarrier modulation, while MIMO handles spatial streams.

Candidates may confuse DSSS with MIMO because both are associated with wireless throughput improvements, but DSSS is an older technology unrelated to spatial multiplexing.

Candidates may confuse CSMA/CA with MIMO because both are associated with wireless performance improvements, but CSMA/CA deals with access control rather than spatial multiplexing.

The issue is DNS resolution on a single workstation, not network connectivity. The default gateway is irrelevant because the user can already reach the web server by IP, indicating routing works.

The issue is DNS resolution failure on a single workstation, not IP configuration. Renewing the DHCP lease would not fix a DNS cache problem, as the workstation already has a valid IP and can reach the server by IP.

Disabling the Windows Firewall is not the next step because the user can access the web server by IP address, indicating that the firewall is not blocking the traffic. The issue is name resolution, not connectivity.

A user cannot access any external websites or resources by IP or name, but internal resources work. The technician should verify the default gateway configuration to ensure the workstation can reach external networks.

A user cannot access any network resources after a network change. The technician finds the workstation has an APIPA address (169.254.x.x). Renewing the DHCP lease would obtain a valid IP from the DHCP server.

A user cannot access any websites or network resources, and pinging by IP address fails. After verifying that the network cable is connected and the IP configuration is correct, the technician should check if the Windows Firewall is blocking all traffic.

Candidates may confuse DNS resolution failure with a general network connectivity problem, assuming the default gateway is misconfigured when the symptom is name resolution only.