CompTIA Network+ N10-009 (N10-009) — Questions 376–450

Why this answer

How to eliminate wrong answers

Option A is wrong because multipath interference from reflective surfaces typically causes signal fading or nulls, not intermittent connectivity due to overlapping channels, and the site survey shows strong signal strength, not multipath issues. Option B is wrong because co-channel interference occurs when APs are on the same channel, but the scenario explicitly states 'overlapping channels,' not the same channel, so co-channel interference is not the primary cause here. Option D is wrong because signal attenuation due to distance from the AP would manifest as weak signal strength, but the site survey shows strong signal strength, ruling out distance as the issue.

Why this answer

How to eliminate wrong answers

Option B (Northbound API) is wrong because it is used for communication between the SDN controller and higher-layer applications or orchestration tools, not for installing flow rules on physical switches. Option C (Eastbound API) is wrong because it refers to communication between multiple SDN controllers in a federated or hierarchical deployment, not between a controller and switches. Option D (Westbound API) is wrong because it is not a standard SDN API term; it is sometimes used to describe communication between controllers in different administrative domains, but it does not involve installing flow rules on switches.

Why this answer

How to eliminate wrong answers

Option A is wrong because 802.1X with RADIUS authentication and guest VLAN controls network access at Layer 2 using authentication, but it does not disable the port or provide automatic re-enablement after a timeout; it either grants or denies access based on credentials. Option C is wrong because DHCP snooping and dynamic ARP inspection are security features that prevent DHCP spoofing and ARP poisoning, but they do not disable switch ports upon unauthorized device connection or include an errdisable recovery mechanism. Option D is wrong because storm control and broadcast suppression limit excessive broadcast, multicast, or unknown unicast traffic to prevent network storms, but they do not disable ports based on unauthorized device detection or provide automatic re-enablement.

Why this answer

How to eliminate wrong answers

Option B (Fraggle attack) is wrong because it uses UDP echo traffic to the broadcast address, not ICMP echo requests. Option C (Ping flood) is wrong because it involves sending a high volume of ICMP echo requests directly to the target from a single or multiple sources, not leveraging broadcast amplification with a spoofed source. Option D (ARP poisoning) is wrong because it manipulates ARP tables to intercept traffic on a local network, not using ICMP or broadcast amplification.

Why this answer

How to eliminate wrong answers

Option B is wrong because a VLAN mismatch would cause the switch to drop frames at the ingress or egress due to VLAN tagging mismatches, but it would not produce CRC errors; instead, you would see discards or no connectivity. Option C is wrong because an incorrect MTU setting would cause frames larger than the MTU to be fragmented or dropped, but CRC errors are caused by physical-layer corruption or duplex issues, not by MTU mismatches. Option D is wrong because a broadcast storm from a loop would cause high CPU utilization and excessive broadcast frames, but CRC errors are specific to frame corruption, not to broadcast flooding; loops typically cause interface utilization spikes and STP-related issues.

Why this answer

How to eliminate wrong answers

Option A is wrong because a hub is a Layer 1 device that simply repeats electrical signals out all ports, so it cannot isolate broadcast traffic; all connected devices share the same collision and broadcast domain. Option B is wrong because a bridge is a Layer 2 device that forwards frames based on MAC addresses but still forwards broadcasts out all ports except the receiving port, so it does not create separate broadcast domains. Option C is wrong because a switch is also a Layer 2 device; while it segments collision domains per port, it still floods broadcast frames to all ports within the same VLAN, meaning a single switch (or multiple switches in the same VLAN) constitutes one broadcast domain unless VLANs are configured.

Why this answer

How to eliminate wrong answers

Option A is wrong because a faulty cable typically causes physical layer issues like link flaps, excessive collisions, or alignment errors, not specifically CRC errors; CRC errors are more directly tied to duplex mismatches. Option C is wrong because a VLAN mismatch prevents communication entirely or causes connectivity issues at Layer 2, but does not generate CRC errors on the switch port. Option D is wrong because an incorrect MTU setting causes fragmentation or packet drops, not CRC errors, which are frame-level corruption detected by the FCS.

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because the DHCP server has not exhausted its address pool; other users on the same VLAN can obtain IP addresses successfully, proving the DHCP server is operational. Option B is wrong because a spanning tree blocked state would affect all users on that VLAN, not just one port, and the user's computer would not receive any IP address (or would show a 0.0.0.0 address) rather than a 169.254.x.x APIPA address. Option D is wrong because a faulty cable would typically prevent link establishment entirely (no link light, no carrier) or cause intermittent connectivity, but the user's computer did obtain a link and an APIPA address, indicating Layer 1 is functional.

Why this answer

How to eliminate wrong answers

Option A is wrong because WPA2-PSK uses a pre-shared key that is shared among all clients, making it vulnerable to offline dictionary attacks and lacking per-user authentication or centralized RADIUS integration. Option B is wrong because WPA3-SAE, while more secure than WPA2-PSK, still relies on a shared password (simultaneous authentication of equals) and does not provide certificate-based mutual authentication or integration with a RADIUS server for individual user credentials. Option D is wrong because 802.1X with PEAP uses a server-side certificate but tunnels the client authentication (typically MSCHAPv2) inside a TLS tunnel, which is susceptible to credential theft if the tunnel is compromised or if the client does not validate the server certificate properly.

Why this answer

How to eliminate wrong answers

Option A is wrong because 169.254.1.1 falls within the 169.254.0.0/16 range, which is reserved for Automatic Private IP Addressing (APIPA) used when a DHCP server is unreachable, not for private addressing per RFC 1918. Option B is wrong because 172.32.1.1 is in the 172.32.0.0/16 range, which is outside the RFC 1918 private block 172.16.0.0/12 (172.16.0.0 – 172.31.255.255); addresses like 172.32.x.x are public or non-private. Option D is wrong because 172.15.1.1 is in the 172.15.0.0/16 range, which is below the RFC 1918 private block 172.16.0.0/12 and is a public IP address.

Why this answer

How to eliminate wrong answers

Option A is wrong because a routing loop would cause packets to be dropped or TTL to expire, resulting in timeouts or unreachable messages, not consistently high latency with varying responses. Option C is wrong because DNS misconfiguration would cause delays in name resolution, not in file transfers that are already using IP addresses or established connections, and traceroute does not rely on DNS for hop latency measurements. Option D is wrong because firewall inspection typically adds a fixed processing delay per packet, not varying queuing delays, and would not cause the latency to be isolated to a single hop with no errors reported on the interface.

Why this answer

How to eliminate wrong answers

Option A is wrong because a star topology connects all nodes to a central hub or switch, not to exactly two other nodes. Option B is wrong because a bus topology uses a single shared backbone cable where each node taps into the line, and nodes are not connected in a closed loop. Option D is wrong because a mesh topology (full or partial) connects nodes with multiple redundant paths, and each node typically has more than two connections, not exactly two.

Why this answer

How to eliminate wrong answers

Option B is wrong because a Network-based Intrusion Detection System (NIDS) monitors network traffic for malicious patterns, not system calls or file integrity on individual endpoints. Option C is wrong because a firewall controls traffic flow based on rules (e.g., IP addresses, ports) and does not monitor system calls or file integrity. Option D is wrong because a Virtual Private Network (VPN) encrypts traffic between endpoints and does not perform intrusion detection or file integrity monitoring.

Why this answer

How to eliminate wrong answers

Option B (::) is wrong because it represents the unspecified address, used during Duplicate Address Detection (DAD) or as a source address before a valid address is assigned, not for loopback. Option C (127.0.0.1) is wrong because it is the IPv4 loopback address, not an IPv6 address. Option D (2000::/3) is wrong because it is the global unicast address prefix for routable IPv6 addresses, not reserved for loopback.

Why this answer

How to eliminate wrong answers

Option A is wrong because port security limits the number of MAC addresses learned on a switch port, but it does not inspect or filter DHCP messages; it cannot prevent a flood of DHCP discovers with spoofed MACs from exhausting the DHCP pool. Option C is wrong because Dynamic ARP Inspection (DAI) validates ARP packets using the DHCP snooping binding table to prevent ARP spoofing, but it does not inspect DHCP discover messages or rate-limit them, so it cannot mitigate a DHCP starvation attack. Option D is wrong because 802.1X provides port-based network access control through authentication (e.g., with RADIUS), but it does not filter or rate-limit DHCP traffic; once a client is authenticated, it can still send a flood of DHCP discovers.

Why this answer

How to eliminate wrong answers

Option B is wrong because moving the printer to the HR VLAN would place it in the same broadcast domain as HR, eliminating the need for routing but failing to keep the printer logically separate from Finance; the printer is a shared resource that should remain accessible to HR without being physically or logically relocated. Option C is wrong because creating a separate VLAN for the printer would require additional routing rules and still allow all traffic from HR to that VLAN unless an ACL is applied, making it an unnecessary extra step that does not by itself block other inter-VLAN traffic. Option D is wrong because a wireless access point bridges at Layer 2, not Layer 3, and would merge the VLANs or create a security bypass, violating the requirement to block all other traffic between VLANs.

Why this answer

How to eliminate wrong answers

Option B is wrong because a ping flood uses ICMP Echo Request packets, not TCP connection requests, and rate limiting is a generic mitigation that does not address the specific TCP state exhaustion. Option C is wrong because a Smurf attack amplifies ICMP traffic using IP-directed broadcasts, not incomplete TCP connections, and disabling directed broadcasts does not prevent SYN floods. Option D is wrong because ARP poisoning manipulates Layer 2 address resolution to intercept traffic, not exhaust TCP resources, and dynamic ARP inspection is a mitigation for ARP spoofing, not SYN floods.

Why this answer

How to eliminate wrong answers

Option A is wrong because site-to-site IPsec VPN with static IPs requires both endpoints to have static public IP addresses; the branch office has a dynamic IP, so this configuration would fail when the IP changes. Option B is wrong because remote access VPN using SSL is designed for individual client-to-site connections (e.g., a single user connecting from a laptop), not for connecting an entire branch office network to the main office network. Option D is wrong because policy-based VPNs (which define traffic selectors based on source/destination subnets) still require static IP addresses or a dynamic IP resolution mechanism; they do not inherently handle dynamic spoke IPs like DMVPN does.

Why this answer

How to eliminate wrong answers

Option A is wrong because ARP is used only to resolve the MAC address of a destination on the same local subnet; since the server is on a different subnet, the workstation will not send an ARP request for the server's IP. Option C is wrong because DNS resolution translates hostnames to IP addresses, but the workstation already knows the server's IP address (10.0.2.10) and does not need DNS for forwarding decisions. Option D is wrong because routers (including the default gateway) are designed to forward packets between different subnets; the workstation does not drop packets destined for a different network—it sends them to the gateway.

Why this answer

How to eliminate wrong answers

Option A is wrong because SNMP traps are asynchronous alerts triggered by specific events (e.g., threshold crossings), not a method for collecting continuous historical data; they lack the regular interval sampling needed for trend analysis. Option C is wrong because running a continuous ping test and manually logging timestamps is inefficient, error-prone, and does not scale for a week-long analysis; it also lacks automated storage and retrieval. Option D is wrong because traceroute measures per-hop latency at a single point in time and does not provide a continuous historical trend; it is a diagnostic tool for path discovery, not for long-term latency monitoring.

Why this answer

How to eliminate wrong answers

Option A is wrong because a hub operates at Layer 1 (Physical layer) and simply repeats electrical signals to all ports, with no ability to forward traffic based on IP addresses. Option B is wrong because a switch operates primarily at Layer 2 (Data Link layer) and forwards frames based on MAC addresses, not IP addresses; while some switches support Layer 3 routing, a standard switch does not perform IP-based forwarding between different networks. Option D is wrong because a bridge operates at Layer 2 (Data Link layer) and connects two network segments by forwarding frames based on MAC addresses, not IP addresses.

Why this answer

How to eliminate wrong answers

Option A is wrong because DNS poisoning (also known as DNS cache poisoning) involves corrupting a DNS resolver's cache with forged records to redirect users to malicious sites, not establishing a covert channel over encrypted DNS. Option C is wrong because DNS amplification is a volumetric DDoS attack that exploits open resolvers to flood a target with large DNS responses, not a technique for covert communication. Option D is wrong because DNS zone transfer is a legitimate administrative mechanism for replicating DNS zone data between authoritative servers, typically over TCP port 53, and is not used for covert channels.

Why this answer

How to eliminate wrong answers

Option A is wrong because connecting two different VLANs requires a Layer 3 device (router or multilayer switch) with an interface in each VLAN or using a router-on-a-stick configuration, not a default gateway; the default gateway is a single next-hop address, not a VLAN interconnect. Option B is wrong because DHCP services are provided by a DHCP server (often a dedicated server or a router with DHCP service enabled), not by the default gateway; the default gateway's role is routing, not address assignment. Option D is wrong because translating private IP addresses to public IP addresses is the function of NAT (Network Address Translation), typically performed by a router or firewall, not the default gateway itself; the default gateway is simply the next-hop router for outbound traffic, regardless of whether NAT is applied.

Why this answer

How to eliminate wrong answers

Option A is wrong because a hub operates at Layer 1 (Physical layer) and simply repeats electrical signals out all ports, with no MAC address awareness or forwarding logic. Option C is wrong because a router operates at Layer 3 (Network layer) and forwards packets based on IP addresses, not MAC addresses. Option D is wrong because a firewall operates at Layers 3-7 (typically inspecting IP addresses, ports, and application data) and does not forward traffic using MAC addresses as its primary function.

Why this answer

How to eliminate wrong answers

Option A (DNS) is wrong because the Domain Name System resolves human-readable domain names (e.g., www.example.com) to IP addresses; it does not assign IP addresses to devices. Option C (ARP) is wrong because the Address Resolution Protocol maps a known IP address to a MAC address on a local network; it is used for layer 2 communication, not for IP address assignment. Option D (ICMP) is wrong because the Internet Control Message Protocol is used for error reporting and diagnostic functions (e.g., ping, traceroute); it has no role in dynamically assigning IP addresses.

Why this answer

How to eliminate wrong answers

Option A is wrong because a Layer 2 switch forwards frames based on MAC addresses within the same VLAN and cannot route between VLANs; it would require a Layer 3 switch or an external router to perform inter-VLAN routing. Option C is wrong because a bridge operates at Layer 2 to connect two network segments and does not perform IP routing; it would simply forward broadcast traffic between VLANs if they were on the same bridge domain, defeating the isolation requirement. Option D is wrong because a firewall is a security appliance that filters traffic based on rules and can route in some cases, but it is not the primary device designed for efficient inter-VLAN routing; using a firewall for this purpose would introduce unnecessary latency and complexity compared to a dedicated router or Layer 3 switch.

Why this answer

How to eliminate wrong answers

Option A is wrong because placing the IDS inline between the firewall and core switch forces all traffic to pass through the device, which introduces latency and creates a single point of failure — if the IDS fails, traffic stops. Option C is wrong because connecting the IDS directly to the internet router would only capture traffic to/from that specific interface, not all network traffic, and it would still be inline if placed in the forwarding path. Option D is wrong because the management network carries only out-of-band administrative traffic, not the production data flows that the IDS needs to analyze.

Why this answer

How to eliminate wrong answers

Option A is wrong because 802.1X is a port-based authentication protocol that requires a RADIUS server to authenticate users or devices via credentials or certificates, not a static list of MAC addresses. Option B is wrong because MAC address filtering is a general term often used in wireless networks or router ACLs, not a specific Cisco switch feature; on a switch port, the correct implementation is port security, which includes MAC address filtering as a sub-function. Option D is wrong because VLAN hopping prevention (e.g., disabling DTP, setting native VLAN to an unused ID) is a security measure to prevent attackers from jumping between VLANs, not a mechanism to restrict which MAC addresses can access a specific port.

Why this order

Why this answer

How to eliminate wrong answers

Option A is wrong because a man-in-the-middle attack involves intercepting and potentially altering communications between two parties, not flooding a target with incomplete TCP handshakes. Option C is wrong because a DDoS amplification attack relies on sending small queries to a vulnerable service (e.g., DNS, NTP) with a spoofed source IP, causing the service to send large responses to the victim; this does not involve TCP SYN packets or incomplete handshakes. Option D is wrong because a Smurf attack uses ICMP echo requests sent to a broadcast address with a spoofed source IP, causing all hosts on the network to reply to the victim; it does not use TCP SYN packets.

Why this answer

How to eliminate wrong answers

Option B (Syslog server) is wrong because it collects and stores log messages from network devices, not traffic flow data or bandwidth usage statistics. Option C (SNMP trap) is wrong because it sends asynchronous alerts for specific events (e.g., link up/down) and does not provide continuous traffic flow analysis or per-host bandwidth consumption. Option D (Traceroute) is wrong because it maps the path packets take between hosts using ICMP or UDP probes, but it does not measure bandwidth usage or identify which hosts are consuming the most traffic.

Why this answer

How to eliminate wrong answers

Option A is wrong because MAC flooding floods the switch's CAM table with fake MAC addresses to force it into fail-open mode, causing unicast flooding, not ARP reply manipulation; port security limits the number of MAC addresses per port but does not validate ARP mappings. Option C is wrong because DHCP starvation exhausts the DHCP server's IP address pool by sending many fake DHCP requests, preventing legitimate clients from obtaining IPs, not by sending forged ARP replies; DHCP snooping filters untrusted DHCP messages but does not directly inspect ARP packets. Option D is wrong because DNS poisoning corrupts DNS resolver caches to redirect domain names to malicious IPs, not by manipulating ARP replies at Layer 2; DNSSEC adds cryptographic signatures to DNS records but does not operate at the ARP level.

Why this answer

How to eliminate wrong answers

Option A is wrong because port security limits the number of MAC addresses per port or restricts specific MAC addresses, but it does not inspect the content of ARP messages or prevent ARP spoofing. Option B is wrong because DHCP snooping builds a trusted binding table of IP-to-MAC mappings, but it alone does not filter ARP traffic; it is a prerequisite for DAI, not the direct defense against forged ARP replies. Option D is wrong because BPDU guard is a Spanning Tree Protocol (STP) feature that disables a port if a BPDU is received, protecting against bridge loops, not ARP spoofing attacks.

Why this answer

How to eliminate wrong answers

Option A is wrong because the management VLAN not being allowed on the trunk would prevent all VLAN traffic, including the management VLAN, from reaching the distribution switch, but the question states the distribution switch has routing to 10.1.2.0/24, implying the trunk is functional; the issue is specifically about the switch's ability to route return traffic. Option C is wrong because if the port were in access mode, it would only carry a single VLAN, but the question states it is a trunk, and even if it were access, the switch could still be reachable if the management IP were on that VLAN and a default gateway existed. Option D is wrong because while the management IP could be on the wrong VLAN, the most direct and common cause given the scenario is the missing default gateway; the management IP being on the wrong VLAN would still require a default gateway for inter-subnet communication, and the question does not provide evidence of a VLAN mismatch.

Why this answer

How to eliminate wrong answers

Option A is wrong because immediately notifying users of an outage before the change is approved violates change management procedures; notification should occur after the change is scheduled and approved. Option B is wrong because ordering the replacement switch before assessing compatibility, configuration requirements, and obtaining change approval can lead to procurement of incorrect hardware or unnecessary delays. Option C is wrong because physically installing the new switch without prior change approval, testing, and rollback planning bypasses the mandatory review and authorization steps, risking unplanned outages.

Why this answer

How to eliminate wrong answers

Option A is wrong because the route table on the default gateway affects Layer 3 path selection, not the physical or data-link layer issues causing intermittent connectivity and slow transfers on a local link. Option C is wrong because DNS server configuration impacts name resolution, not throughput or link stability; slow file transfers and intermittent connectivity are symptoms of Layer 1 or Layer 2 problems. Option D is wrong because MAC address filtering on the switch would either block or allow traffic entirely, not cause intermittent connectivity or slow transfers; it does not affect negotiated speed or duplex.

Why this answer

How to eliminate wrong answers

Option B (noAuthNoPriv) is wrong because it provides neither authentication nor encryption, which violates the requirement for both. Option C (authNoPriv) is wrong because it provides authentication but no encryption, failing the data encryption requirement. Option D (noAuthPriv) is wrong because it is not a valid SNMPv3 security level; SNMPv3 does not define a level with encryption without authentication.

Why this answer

How to eliminate wrong answers

Option A is wrong because a static IP address would be manually configured, not an APIPA address; APIPA is only used when no static or DHCP-assigned address is available. Option C is wrong because a DNS server being down would not cause the workstation to obtain an APIPA address; DNS failure would result in name resolution errors, but the workstation would still have a valid IP from DHCP or static configuration. Option D is wrong because a misconfigured default gateway would not trigger APIPA; the workstation would still have a valid DHCP-assigned or static IP, but traffic would fail to route beyond the local subnet.

Why this answer

How to eliminate wrong answers

Option B (SNMP) is wrong because it provides aggregate interface statistics (e.g., total bytes in/out) and cannot reveal per-flow details like source/destination IP, ports, or protocol. Option C (Syslog) is wrong because it is used for logging system events and error messages, not for capturing network flow data or bandwidth usage by application. Option D (ICMP) is wrong because it is a diagnostic protocol used for error reporting and reachability testing (e.g., ping), and it does not provide any flow-level traffic analysis capabilities.

Why this answer

How to eliminate wrong answers

Option A (SNMP) is wrong because SNMP is used for polling device statistics (e.g., interface utilization) and does not export flow-level data; it lacks the ability to report per-flow conversations. Option C (ICMP) is wrong because ICMP is a network-layer protocol for error reporting and diagnostics (e.g., ping/traceroute), not for exporting traffic flow records. Option D (LLDP) is wrong because LLDP is a link-layer discovery protocol used to advertise device identity and capabilities to neighbors, not to export flow data to a collector.

Why this answer

How to eliminate wrong answers

Option A is wrong because an omni-directional antenna radiates signal in all directions equally, resulting in low gain and significant signal loss over 2 km, making it unsuitable for long-distance point-to-point links. Option B is wrong because a Yagi antenna, while directional, typically offers moderate gain (e.g., 10-15 dBi) and a wider beamwidth than a parabolic dish, which may not provide sufficient signal strength and focus for a reliable 2 km link. Option C is wrong because a patch antenna (panel antenna) has a broader beamwidth (e.g., 30-90 degrees) and lower gain (e.g., 8-12 dBi) compared to a parabolic dish, making it better suited for shorter distances or sector coverage rather than long-distance point-to-point.

Why this answer

How to eliminate wrong answers

Option A (SNMP) is wrong because it is used for monitoring and managing network devices, not for time synchronization. Option C (SMTP) is wrong because it is a protocol for email transmission, not for clock synchronization. Option D (RIP) is wrong because it is a distance-vector routing protocol used to exchange routing information, not for time synchronization.

Why this answer

How to eliminate wrong answers

Option A is wrong because STP prevents loops in a redundant switched network by blocking specific ports, but it does not create broadcast domains or segment traffic logically. Option C is wrong because subnetting is a Layer 3 technique used to divide IP address ranges into smaller networks, but it does not segment a single physical switch at Layer 2; VLANs are required for that. Option D is wrong because QoS prioritizes network traffic based on policies (e.g., DSCP or CoS values) but does not isolate broadcast domains or segment the switch.

Why this answer

How to eliminate wrong answers

Option B (802.3af) is wrong because it defines Power over Ethernet (PoE) standards for delivering power over twisted-pair cabling, not authentication. Option C (802.11i) is wrong because it specifies security mechanisms for wireless networks (WPA2/AES-CCMP), not wired network access control. Option D (802.1Q) is wrong because it is the standard for VLAN tagging and trunking, not for authenticating users before granting network access.

Why this answer

How to eliminate wrong answers

Option A is wrong because a Smurf attack uses ICMP echo requests sent to a broadcast address with a spoofed victim source IP, causing all hosts on the network to reply to the victim; it does not specifically impersonate a DNS server. Option C is wrong because a man-in-the-middle attack involves intercepting and potentially altering communications between two parties, not flooding the network with packets from a spoofed source IP. Option D is wrong because ARP poisoning manipulates ARP tables to associate a malicious MAC address with a legitimate IP address, enabling traffic interception, but it does not involve flooding with packets having a spoofed source IP.

Why this answer

How to eliminate wrong answers

Option A is wrong because replacing the switch is an extreme and premature action; the issue is isolated to a single port, not the entire switch, and a known good cable and active device rule out a global switch failure. Option C is wrong because VLAN configuration affects traffic forwarding (Layer 2), not the physical link state; a misconfigured VLAN would not prevent the link light from lighting up, as link negotiation occurs at Layer 1 independently of VLAN settings.

Why this answer

How to eliminate wrong answers

Option A (802.11ac) is wrong because it uses OFDM only, lacks OFDMA and TWT, and does not handle high-density IoT sensor traffic or RF interference as efficiently as Wi-Fi 6. Option C (802.11n) is wrong because it relies on older MIMO and channel bonding without the advanced interference mitigation and scheduling features of Wi-Fi 6, making it unsuitable for dense IoT deployments in high-interference environments. Option D (802.11g) is wrong because it operates only in the 2.4 GHz band with a maximum data rate of 54 Mbps, lacks MIMO, OFDMA, and any interference-avoidance mechanisms, and cannot support the required density or reliability.

Why this answer

How to eliminate wrong answers

Option A is wrong because a Layer 3 switch performs routing at Layer 3 (IP forwarding), which is not required and violates the 'must not perform any routing' constraint. Option B is wrong because a media converter only translates physical layer signals (e.g., copper to fiber) without forwarding frames based on MAC addresses or providing Layer 2 segmentation. Option D is wrong because a router operates at Layer 3, forwarding packets based on IP addresses and performing routing, which is explicitly not allowed.

Why this answer

How to eliminate wrong answers

Option B is wrong because cable length exceeding 100 meters typically causes attenuation and late collisions or CRC errors, not a high number of standard collisions on a half-duplex link. Option C is wrong because an incorrect VLAN assignment would cause connectivity issues or traffic isolation problems, not physical-layer collisions on the port.

Why this answer

How to eliminate wrong answers

Option A is wrong because SNMPv2c uses community strings transmitted in plaintext and provides no authentication or encryption. Option B is wrong because SNMPv3 with authNoPriv authenticates packets but does not encrypt them, failing the encryption requirement. Option D is wrong because SNMPv1 uses community strings in plaintext with no security mechanisms at all.

Why this answer

How to eliminate wrong answers

Option A (noAuthNoPriv) is wrong because it provides neither authentication nor encryption, relying only on a community string for trivial access control. Option B (authNoPriv) is wrong because it provides authentication but no encryption, leaving the SNMP payload in cleartext and vulnerable to eavesdropping. Option D (noAuthPriv) is wrong because it is not a valid SNMPv3 security level; encryption without authentication is not defined in RFC 3414, as it would be insecure.

Why this answer

How to eliminate wrong answers

Option A is wrong because STP (Spanning Tree Protocol) is used to prevent loops in a network topology by blocking redundant links, not for tagging frames with VLAN information. Option C is wrong because VTP (VLAN Trunking Protocol) is a Cisco proprietary protocol for synchronizing VLAN databases across switches, but it does not tag frames; it relies on 802.1Q or ISL for actual tagging. Option D is wrong because LACP (Link Aggregation Control Protocol) is used to bundle multiple physical links into a single logical link for increased bandwidth and redundancy, not for VLAN tagging.

Why this answer

How to eliminate wrong answers

Option A is wrong because port security limits the number of MAC addresses on a port or restricts specific MACs, but it does not inspect or validate the content of ARP messages. Option B is wrong because DHCP snooping builds a binding table of trusted DHCP assignments and filters rogue DHCP servers, but it does not validate ARP packets on its own. Option D is wrong because STP BPDU guard protects against rogue bridge protocol data units that could cause spanning tree topology changes, not against forged ARP replies.

Why this answer

How to eliminate wrong answers

Option B is wrong because notifying users of a planned outage is a communication step that should occur after the change is approved and scheduled, not before testing the firmware. Option C is wrong because creating a backup of the current switch configuration is a critical safety step, but it should be performed after testing the firmware in the lab and before applying the upgrade to production; testing first ensures the firmware itself is safe to use. Option D is wrong because submitting a change request for approval is part of the change management process, but the administrator must first validate the firmware in a lab to provide accurate risk assessment and technical details for the request.

Why this answer

How to eliminate wrong answers

Option A is wrong because an incorrect default gateway would prevent all traffic from leaving the local subnet, including both IP-based and URL-based access, but the user can access the server by IP, so the gateway is functioning. Option C is wrong because a firewall blocking port 80 would affect both IP-based and URL-based HTTP access, yet the user can reach the server by IP, so the firewall is not the issue. Option D is wrong because an IP conflict on the user's workstation would cause intermittent connectivity or complete loss of network access, not a selective failure where only URL-based access fails.

Why this answer

How to eliminate wrong answers

Option B (/25, 255.255.255.128) is wrong because it provides 126 usable host addresses per subnet (2^7 - 2 = 126), which is far more than the required 50, and only yields two subnets from a /24 network, not enough for four departments. Option C (/27, 255.255.255.224) is wrong because it provides only 30 usable host addresses per subnet (2^5 - 2 = 30), which fails to meet the minimum requirement of 50 hosts per department.

Why this answer

How to eliminate wrong answers

Option A is wrong because a load balancer distributes traffic across multiple servers, but the question specifies a single server with a single NIC; load balancing does not provide a single IP address for that one server if its NIC fails. Option B is wrong because NIC teaming requires multiple physical NICs in the server to aggregate or fail over, but the server has only one NIC, making teaming impossible.

Why this answer

How to eliminate wrong answers

Option A is wrong because WPA2-Personal uses a pre-shared key (PSK) and does not require a RADIUS server, failing the requirement for RADIUS-based authentication. Option C is wrong because while WPA2-Enterprise does use a RADIUS server, it relies on the older 4-way handshake with TKIP or AES-CCMP and lacks the stronger cryptographic protections of WPA3, such as perfect forward secrecy and mandatory 192-bit security, making it less secure than WPA3-Enterprise.

Why this answer

How to eliminate wrong answers

Option B (RADIUS) is wrong because it encrypts only the password in the Access-Request packet, leaving the username, accounting data, and other attributes in cleartext, which does not satisfy the requirement for encrypting the entire authentication process. Option C (LDAP) is wrong because it is a directory access protocol used for querying and modifying directory services (e.g., user attributes) and does not natively provide AAA functionality or encrypt the entire authentication process; while LDAPS can encrypt the session, it lacks the accounting and authorization separation required for network device access management.

Why this answer

How to eliminate wrong answers

Option A is wrong because downloading firmware before testing it in a lab could lead to applying untested code directly to production switches, increasing the risk of unexpected failures. Option B is wrong while backing up configuration and firmware is critical, it should be performed after testing the new firmware to ensure the backup is taken from a stable, known-good state before the upgrade. Option C is wrong because notifying users is an operational step that should occur after the technical validation and planning are complete, not as the first step.

Why this answer

How to eliminate wrong answers

Option B is wrong because 2001:db8::1 is a documentation prefix (2001:db8::/32) used for examples in RFC 3849, not a link-local address. Option C is wrong because ff02::1 is the all-nodes multicast address (prefix ff00::/8), not a unicast link-local address. Option D is wrong because 10.0.0.1 is an IPv4 private address (RFC 1918), not an IPv6 address at all.

Why this answer

How to eliminate wrong answers

Option B is wrong because firewall rules affect traffic based on IP addresses and ports, not hostnames; since the user can already access the server by IP, firewall rules are not blocking connectivity. Option C is wrong because flushing the DNS cache (ipconfig /flushdns) only clears locally cached entries, but if the DNS server itself lacks the correct A record, flushing the cache will not resolve the issue.

Why this answer

How to eliminate wrong answers

Option A is wrong because connectionless communication with minimal overhead is a characteristic of UDP, not TCP; TCP is connection-oriented and adds overhead for reliability. Option B is wrong because multicast and broadcast transmissions are supported by UDP, while TCP is unicast-only and cannot deliver to multiple destinations simultaneously. Option D is wrong because real-time applications like VoIP and video streaming typically use UDP due to its low latency and tolerance for packet loss, not TCP which would introduce retransmission delays.

Why this answer

How to eliminate wrong answers

Option A is wrong because Cat6a twisted-pair copper is limited to 100 meters for 1 Gbps (per TIA/EIA-568 standards), so it cannot reach 150 meters. Option C is wrong because single-mode fiber optic can easily cover 150 meters but is overkill and more expensive than multimode for this distance, making it unsuitable for a limited budget. Option D is wrong because Cat5e twisted-pair copper is also limited to 100 meters for 1 Gbps (per IEEE 802.3ab) and cannot support the 150-meter distance.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'show vlan brief' displays all VLANs and their assigned access ports, but it does not show which VLANs are allowed on a trunk port. Option C is wrong because 'show running-config interface' shows the static configuration of the interface, but it may not reflect dynamic changes like VLAN pruning or the actual allowed VLAN list after DTP negotiations; it also does not show the operational trunking status or the list of active VLANs on the trunk.

Why this answer

How to eliminate wrong answers

Option A is wrong because 802.1X is the port-based authentication framework that handles initial client authentication (e.g., EAP exchange with a RADIUS server), but it does not provide fast roaming mechanisms; without 802.11r, a client must perform a full 802.1X re-authentication at each AP transition. Option C is wrong because 802.11i (WPA2) defines security protocols like CCMP/AES and 4-way handshake key management, but it does not include the fast roaming handshake optimization that 802.11r adds.

Why this answer

How to eliminate wrong answers

Option A is wrong because single-mode fiber with 1000BASE-LX transceivers can easily reach 400 meters, but it is not the most cost-effective choice for this distance; single-mode optics and fiber are more expensive than multimode alternatives, and LX transceivers are typically used for longer distances (up to 5–10 km). Option C is wrong because 10GBASE-SR transceivers over multimode fiber can also reach 400 meters (especially with OM3/OM4), but the question specifies a cost-effective solution for a 1 Gbps link, and 10GBASE-SR optics and supporting hardware are significantly more expensive than 1000BASE-SX, making it overkill for the required bandwidth.

Why this answer

How to eliminate wrong answers

Option B (/27) is wrong because it provides only 2^(32-27) = 32 total addresses, yielding 30 usable hosts, which is insufficient for 50 hosts. Option C (/28) is wrong because it provides only 2^(32-28) = 16 total addresses, yielding 14 usable hosts, far below the requirement. Option D (/25) is wrong because it provides 2^(32-25) = 128 total addresses, yielding 126 usable hosts, which exceeds the requirement and is not the minimum subnet that accommodates 50 hosts.

Why this answer

How to eliminate wrong answers

Option B (IP address) is wrong because IP addresses are used by routers (Layer 3 devices) for packet forwarding, not by switches; switches do not examine IP headers unless they are multilayer switches with routing enabled. Option C (Port number) is wrong because port numbers are used by transport layer protocols (TCP/UDP) to identify specific applications or services, and switches do not inspect Layer 4 headers. Option D (Domain name) is wrong because domain names are resolved to IP addresses by DNS (Application Layer) and are never used by switches for frame forwarding.

Why this answer

How to eliminate wrong answers

Option B is wrong because electromagnetic interference (EMI) does not affect fiber optic cables, as they transmit light, not electrical signals; fiber is immune to EMI. Option C is wrong because incorrect termination would typically cause a complete loss of signal or high reflectance (e.g., due to poor polishing or misalignment), not a weak but present signal; the symptom described points to distance-related attenuation, not a termination fault.

Why this answer

How to eliminate wrong answers

Option A is wrong because immediately blocking the port violates the principle of least disruption and could interrupt legitimate business-critical traffic without any analysis; a better approach is to first identify the traffic and then apply ACLs or QoS if needed. Option C is wrong because rebooting the switch is a drastic, non-targeted action that clears all port statistics and active sessions, potentially losing forensic data and causing unnecessary downtime; the alert is about bandwidth utilization, not a hardware or software error that a reboot would fix.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Physical layer (Layer 1) deals with raw bit transmission over physical media, such as electrical signals, light pulses, or radio waves, and does not interpret MAC addresses or frames. Option C is wrong because the Network layer (Layer 3) uses logical addressing (e.g., IP addresses) for routing packets between networks, not MAC addresses for frame forwarding within a local network.

Why this answer

How to eliminate wrong answers

Option A is wrong because the router can ping the DHCP server IP, proving the server is reachable at Layer 3, so the DHCP server is not unreachable. Option C is wrong because the ip helper-address is correctly configured on the VLAN 10 interface and points to the DHCP server, as evidenced by the router forwarding DHCP broadcasts; if it were misconfigured, DHCP requests would not reach the server at all. Option D is wrong because switch ports not being configured for VLAN 10 would prevent users from communicating with the router or any network device, but users are obtaining APIPA addresses, indicating they are connected to the network and attempting DHCP, so the ports are correctly assigned.

Why this answer

How to eliminate wrong answers

Option A is wrong because setting a threshold of 0 (emergency) would only capture messages at level 0, missing critical (2) and alert (1) messages. Option B is wrong because setting a threshold of 1 (alert) would capture levels 0 and 1 but exclude level 2 (critical). Option D is wrong because setting a threshold of 3 (error) would capture levels 0–3, which includes less severe messages (error) than desired, and the question specifically requires only critical and higher.