Hard Difficulty Questions

Check the IPsec security associations for encryption algorithm mismatch.

Why wrong: If the tunnel is active and both sides can ping tunnel IPs, the IPsec parameters are correctly negotiated. An algorithm mismatch would prevent the tunnel from establishing.

Disable the firewall on the internal interfaces temporarily.

Why wrong: The firewall rules already permit traffic. Disabling firewalls is not a best practice and would not resolve a routing issue.

Regenerate the pre-shared key on both sides.

Why wrong: Regenerating the PSK is unnecessary because the tunnel is already established. The PSK is only used during initial authentication.

The default gateway is down.

Why wrong: If the default gateway were down, the user would not be able to ping any external IP addresses. The fact that pinging 8.8.8.8 works rules this out.

The corporate firewall is blocking UDP port 53.

Why wrong: A firewall block on UDP port 53 would cause DNS failures consistently, not intermittently. The user would never be able to resolve domain names.

The user's machine has a corrupted DNS cache.

Why wrong: A corrupted DNS cache typically causes failures for specific cached entries, but the issue is described as intermittent and affects all domain names. Flushing the cache might resolve it, but the intermittent nature points more to server load.

Totally stubby area

Why wrong: A totally stubby area blocks both Type 5 and Type 3 LSAs, replacing them with a default route. This would prevent learning inter-area routes, which the administrator wants.

Not-so-stubby-area (NSSA)

Why wrong: NSSA blocks Type 5 LSAs but allows Type 7 LSAs for external routes redistributed from within the area. It still allows Type 3 LSAs. However, the question does not mention redistributing external routes into area 1; a stub area is simpler.

Normal area

Why wrong: A normal area does not block any LSA types; it would receive both Type 3 and Type 5 LSAs, which does not meet the requirement to reduce routing table size by blocking Type 5 LSAs.

AS_PATH

Why wrong: AS_PATH influences outbound traffic by affecting path selection for routes advertised.

Next Hop

Why wrong: Next hop is used for reachability, not for inbound traffic influence.

Local Preference

Why wrong: Local preference influences outbound traffic selection from the router's AS.

LLDP

Why wrong: LLDP is used to advertise and discover directly connected neighbors (device ID, port ID, capabilities). It does not provide detailed configuration or status information about non-neighbor devices.

NetFlow

Why wrong: NetFlow is used for traffic flow analysis (IP traffic statistics). It does not provide device configuration or inventory data.

Syslog

Why wrong: Syslog is used for collecting log messages from devices. While it may contain some informational messages, it is not designed for structured inventory or configuration polling.

Configure a load balancer in front of multiple servers

Why wrong: Load balancers distribute traffic but the question specifies a single server with a single NIC.

Implement NIC teaming

Why wrong: NIC teaming requires multiple network interfaces, but the server has only one NIC.

Use DNS round robin

Why wrong: DNS round robin distributes traffic among multiple IPs but does not provide automatic failover for a single server.

SNMPv1

Why wrong: SNMPv1 uses community strings in plaintext and provides no encryption or integrity checks, violating the security policy.

SNMPv2c

Why wrong: SNMPv2c also relies on plaintext community strings and lacks encryption, similar to v1.

SNMPv3 with noAuthNoPriv

Why wrong: This level offers no authentication or encryption. While it uses SNMPv3 message format, it does not meet the encryption requirement.

RADIUS

Why wrong: RADIUS encrypts only the password field in an authentication packet; other fields like the username are sent in cleartext.

LDAP

Why wrong: LDAP is a directory access protocol; while it can be used for authentication, it does not inherently encrypt the entire packet unless used over TLS.

Kerberos

Why wrong: Kerberos uses symmetric key cryptography and tickets but does not encrypt the entire authentication packet; it relies on a different mechanism.

Ping flood; implement rate limiting

Why wrong: Ping floods use ICMP echo requests, not incomplete TCP connections.

Smurf attack; disable IP-directed broadcasts

Why wrong: A Smurf attack sends ICMP echo requests to broadcast addresses with spoofed source IPs, causing amplification, not incomplete TCP handshakes.

ARP poisoning; enable dynamic ARP inspection

Why wrong: ARP poisoning involves sending forged ARP replies to associate IPs with attacker MACs, not exhausting TCP resources.

Electromagnetic interference

Why wrong: Fiber optic cables are immune to EMI.

Incorrect VLAN configuration

Why wrong: VLAN misconfiguration would cause traffic issues but not physical link flapping.

Duplex mismatch

Why wrong: Duplex mismatch is common on copper links, not fiber, and typically causes constant errors, not intermittent flapping.

B) Allow rule with source any, destination 10.0.0.5, port 443

Why wrong: Incorrect. An allow rule alone does not change the destination IP. The incoming packet's destination is 203.0.113.10, not 10.0.0.5, so the server would not receive the traffic without address translation.

C) Access control list on the internal interface

Why wrong: Incorrect. An ACL on the internal interface could be used to control traffic within the LAN, but it does not enable external traffic to reach the internal server.

D) VPN rule to require remote access VPN

Why wrong: Incorrect. While a VPN would provide secure access, the scenario does not mention a VPN. The goal is to allow access directly via the internet without requiring a VPN.

DNS poisoning

Why wrong: DNS poisoning corrupts the DNS cache to redirect users to malicious sites; it does not involve covert channels using encrypted DNS.

DNS amplification

Why wrong: DNS amplification is a DDoS attack that uses open resolvers to flood a target; it does not create covert channels.

DNS zone transfer

Why wrong: DNS zone transfer is a legitimate mechanism to replicate DNS records between authoritative servers; not used for covert communication.

B) Check the DNS resolution for the file server

Why wrong: Incorrect. The user can ping the gateway, so IP connectivity exists. If the user is pinging by IP, DNS is not involved. If by name, DNS failure would cause a different error.

C) Check the VPN encryption settings

Why wrong: Incorrect. Since the VPN tunnel is active and the user can ping the remote gateway, the encryption settings are likely correct for the tunnel. A mismatch would prevent any traffic through the tunnel.

D) Check the file server's antivirus software

Why wrong: Incorrect. Antivirus software on the file server could block certain traffic, but it would not cause a 'cannot connect' issue at the network level if routing is correct. It is less likely to be the first step.

The router is configured with an ACL that blocks traffic from VLAN 10 to VLAN 20

Why wrong: While possible, an ACL is not mentioned. The more basic issue is that no inter-VLAN routing configuration exists at all.

The switch port connecting the user to the network is configured with port security limiting MAC addresses

Why wrong: Port security would affect connectivity to all devices, not just those in another VLAN. The user can already communicate within VLAN 10.

The file server has a firewall blocking ICMP ping requests

Why wrong: Even if ping fails, the user might still be able to access services. The question implies total communication failure, likely due to routing.

2001:db9::1

Why wrong: The first 32 bits are 2001:0db9, which differs from 2001:0db8, so it is not in the same /32 prefix.

2001:db7::1

Why wrong: The first 32 bits are 2001:0db7, which differs from 2001:0db8.

fe80::1

Why wrong: fe80::1 is a link-local address and belongs to the fe80::/10 prefix, not 2001:db8::/32.

STP reconvergence due to topology change

Why wrong: Incorrect. STP reconvergence causes temporary loss of connectivity but does not produce CRC errors.

Broadcast storm caused by a loop

Why wrong: Incorrect. A broadcast storm would cause high traffic and latency, but CRC errors are not characteristic.

Faulty SFP transceiver on the core switch

Why wrong: Incorrect. While a faulty SFP can cause errors, a cable test that passes suggests the physical layer is functional; duplex mismatch is a more likely cause of CRC errors.

Single sign-on

Why wrong: Single sign-on allows users to authenticate once and access multiple systems; it does not inherently involve multiple factors.

Biometric authentication

Why wrong: Biometric authentication uses physical characteristics (e.g., fingerprint, face) and is not based on a password and a code.

Multifactor authentication with three factors

Why wrong: Only two factors (password and one-time code) are used, not three.

SNMP GET

Why wrong: SNMP GET requests the value of a specific OID. Polling frequently would generate significant overhead, as the NMS must send requests repeatedly.

SNMP GETNEXT

Why wrong: SNMP GETNEXT is used to walk through a MIB tree sequentially. It also requires polling and would increase network traffic if used for continuous monitoring.

SNMP WALK

Why wrong: SNMP WALK is an extended GETNEXT that retrieves a whole subtree. It is even more resource-intensive than simple GET requests, making it unsuitable for low-overhead monitoring.

Transport mode

Why wrong: Transport mode encrypts only the payload, not the original IP header, so it is not suitable for site-to-site VPNs where the entire packet must be hidden.

AH only

Why wrong: AH provides authentication but no encryption, so it does not meet the encryption requirement.

ESP only

Why wrong: ESP provides encryption but can be used in either transport or tunnel mode. The question asks which mode encrypts the entire packet including the header; that is tunnel mode, not just using ESP.

Global unicast address

Why wrong: Global unicast addresses are routable on the internet and require assignment from an address range or DHCPv6, they are not automatically generated without configuration.

Unique local address

Why wrong: Unique local addresses (fc00::/7) are analogous to IPv4 private addresses and require administrative assignment, not automatic generation on interface initialization.

Multicast address

Why wrong: Multicast addresses (ff00::/8) are not assigned to interfaces as unicast addresses; they are used for group communication.