Network Fundamentals practice questions

The destination is unreachable

Why it fails: If the destination were truly unreachable, the traceroute command would typically terminate with an "Destination Host Unreachable" message, often accompanied by ICMP Destination Unreachable messages from a router along the path, rather than showing asterisks for intermediate hops and then successfully reaching the final destination. The presence of asterisks for intermediate hops, while still ultimately reaching 8.8.8.8, indicates that the path to the destination exists and is traversable, but specific routers are not responding to the ICMP probes.

The TTL expired at the last hop

Why it fails: If the Time-to-Live (TTL) expired at the last hop *before* reaching the ultimate destination, the traceroute would typically show asterisks for that hop, indicating no response, and subsequent hops would also likely fail to resolve. However, the problem statement implies the `traceroute 8.8.8.8` command was run, and 8.8.8.8 is a reachable destination. If the TTL expired at the *actual* destination, the destination itself would respond with an ICMP Port Unreachable or similar message, not just asterisks, because the packet successfully arrived.

The connection is encrypted

Why it fails: Network connection encryption, such as SSL/TLS or IPsec, operates at higher layers of the OSI model (transport/session/presentation or network layer for IPsec payload). Traceroute, however, relies on the Internet Control Message Protocol (ICMP) and the Time-to-Live (TTL) field within the IP header, which are fundamental network layer (Layer 3) functions. Encryption of the data payload does not interfere with a router's ability to decrement the TTL and send an ICMP Time Exceeded message, making it irrelevant to the appearance of asterisks in traceroute output.

Hub

Why it fails: A hub is a rudimentary Layer 1 device that functions as a multi-port repeater, simply regenerating and transmitting any incoming electrical signal out to all other connected ports. It lacks any intelligence to interpret MAC or IP addresses, meaning all devices connected to a hub share a single collision domain and a single broadcast domain. Consequently, broadcast traffic received on one port is indiscriminately flooded to every other port, making it ineffective for broadcast segmentation.

Bridge

Why it fails: Operating at Layer 2, a bridge learns MAC addresses of devices on connected segments and forwards frames selectively based on destination MACs. While a bridge can segment collision domains by intelligently forwarding unicast traffic, it does not filter or contain broadcast frames. Any broadcast frame received on one port is always flooded out to all other ports, meaning a bridge does not separate broadcast domains.

Switch

Why it fails: A standard Ethernet switch, also a Layer 2 device, builds a MAC address table to intelligently forward unicast frames only to the destination port. However, in the absence of Virtual Local Area Networks (VLANs), a switch treats all connected ports as part of a single broadcast domain. Therefore, any broadcast frame received on one port will be flooded out to all other ports within that same broadcast domain, failing to contain broadcast traffic.

The DNS server is down

Why it fails: A DNS failure would not prevent the workstation from obtaining an IP address.

The default gateway is incorrect

Why it fails: A 169.254.x.x address is APIPA, assigned when DHCP fails, so the workstation never obtained a lease and has no gateway at all. An incorrect gateway would still allow a valid DHCP-assigned address and local subnet access. Checking the gateway is a natural step, but the address itself points to DHCP failure.

The subnet mask is mismatched

Why it fails: A mismatched subnet mask would still allow a DHCP-assigned address; the 169.254.1.5 address is an APIPA address generated when DHCP assignment fails. It is tempting because mask errors cause connectivity loss, but they would be correct only if the host held a valid DHCP lease.

802.1X authentication

Why it fails: 802.1X authentication is a port-based network access control protocol that requires users or devices to authenticate using credentials like usernames/passwords or digital certificates before gaining network access. While it can be configured with MAC Authentication Bypass (MAB) as a fallback for non-802.1X capable devices, its primary function is identity-based authentication, not solely restricting access based on a static list of MAC addresses. Therefore, it doesn't directly address the specific need for simple MAC-based restriction.

VLAN hopping prevention

Why it fails: VLAN hopping prevention techniques are designed to mitigate attacks where an attacker attempts to gain access to VLANs other than the one they are assigned to. This typically involves disabling Dynamic Trunking Protocol (DTP) or ensuring the native VLAN on trunk ports is an unused VLAN. These measures protect against lateral movement between VLANs, but they do not prevent an unauthorized device from initially connecting to a switch port within its assigned VLAN.

DHCP snooping

Why it fails: DHCP snooping is a security feature that filters untrusted DHCP messages and builds a DHCP snooping binding table, mapping MAC addresses to IP addresses, lease times, and VLANs. Its primary purpose is to prevent rogue DHCP servers from issuing IP addresses and to mitigate DHCP starvation attacks. While it uses MAC addresses in its operation, it does not directly restrict which specific MAC addresses are allowed to connect to a switch port in the first place, making it unsuitable for preventing unauthorized device connections based on MAC.

Spanning Tree Protocol (STP)

Why it fails: Spanning Tree Protocol (STP), defined by IEEE 802.1D, is designed to prevent network loops in redundant Ethernet topologies by selectively blocking redundant paths. Its primary function is to ensure a loop-free logical topology, which is critical for stable network operation by preventing broadcast storms and MAC table instability. However, by blocking redundant links to achieve this, STP actively prevents the utilization of those links for increased bandwidth, making it unsuitable for aggregating throughput.

VLAN trunking (802.1Q)

Why it fails: IEEE 802.1Q, commonly known as VLAN trunking, is a standard for tagging Ethernet frames with VLAN identification, enabling a single physical link to carry traffic for multiple virtual local area networks. While essential for inter-VLAN communication across switches, it does not increase the aggregate bandwidth of the physical link itself. Instead, it multiplexes different VLAN traffic flows over that single link, which can become a bottleneck if not properly sized, rather than combining multiple links for higher throughput.

Power over Ethernet (PoE)

Why it fails: Power over Ethernet (PoE) is an IEEE 802.3af/at/bt standard that allows electrical power to be transmitted along with data on standard Ethernet cabling. Its purpose is to power devices like IP phones, wireless access points, or security cameras without requiring a separate power outlet. PoE is solely concerned with power delivery and has absolutely no mechanism or function related to increasing network bandwidth, aggregating links, or providing network redundancy between switches.

Use static routes instead of OSPF

Why it fails: Using static routes instead of a dynamic routing protocol like OSPF fundamentally prevents the network from adapting to topology changes automatically. Static routes are manually configured and remain fixed, offering no inherent mechanism for detecting link failures or automatically rerouting traffic. If a link fails along a statically defined path, traffic will be black-holed until manual intervention, which is the opposite of improving convergence and network resilience.

Increase OSPF hello and dead timers

Why it fails: Increasing OSPF hello and dead timers directly lengthens the time it takes for OSPF to detect a neighbor or link failure. The hello timer dictates how frequently a router sends hello packets to its neighbors, while the dead timer specifies how long a router waits to receive a hello packet before declaring a neighbor down. By extending these intervals, OSPF will wait longer to identify a problem, delaying the initiation of the SPF algorithm and consequently slowing down the network's overall convergence time after an event.

Configure all routers in a single OSPF area

Why it fails: Configuring all routers within a single OSPF area, especially in a large network, creates a monolithic routing domain where every router must maintain a complete Link-State Database (LSDB) for the entire network. Any topology change, such as a link failure or a new router, triggers a re-calculation of the Shortest Path First (SPF) algorithm on every router in that area. This extensive computation consumes significant CPU resources and increases the time required for the network to converge, directly impeding the goal of faster convergence.

Cat6a twisted pair

Why it fails: Cat6a (Augmented Category 6) twisted pair cable is designed to support 10 Gigabit Ethernet (10GBASE-T) but is strictly limited to a maximum distance of 100 meters. Attempting to deploy Cat6a for a 150-meter link would result in excessive signal attenuation and crosstalk, making reliable 10 Gbps communication impossible. Therefore, while capable of the desired bandwidth, its inherent distance limitation makes it an inappropriate choice for connecting switches over 150 meters.

Cat7 twisted pair

Why it fails: Cat7 twisted pair cabling is unsuitable for connecting switches across a 150-meter distance, despite its enhanced shielding and support for higher frequencies. While Cat7 is designed for 10 Gigabit Ethernet (10GBASE-T) and beyond, its maximum reliable transmission distance for standard Ethernet applications is limited to 100 meters. Exceeding this 100-meter limit would lead to significant signal degradation and potential loss of data integrity, rendering it impractical for the 150-meter requirement.

Single-mode fiber optic

Why it fails: Single-mode fiber optic cable, while capable of transmitting 10 Gigabit Ethernet over extremely long distances (e.g., 10GBASE-LR for 10 km), represents an unnecessary and cost-prohibitive solution for a mere 150-meter connection. Its smaller core requires more precise and expensive laser transceivers, and the overall deployment cost is significantly higher than multi-mode fiber. For this relatively short inter-building link, single-mode fiber offers no practical advantage over multi-mode fiber that would justify the increased expense and complexity.

Ping flood

Why it fails: A ping flood is a basic denial-of-service (DoS) attack where an attacker directly sends an overwhelming number of ICMP echo request packets to a target server. The goal is to consume the target's bandwidth and processing resources by forcing it to respond to each request, thereby making it unavailable to legitimate users. Crucially, this attack involves the victim receiving requests directly from the attacker, not a flood of replies from numerous intermediary sources.

ICMP tunneling

Why it fails: ICMP tunneling is a technique used for covert communication, where data is encapsulated within the payload of ICMP echo request and reply packets. This method allows attackers to establish a hidden communication channel, often for data exfiltration or command and control, bypassing some firewall rules that permit ICMP traffic. Unlike a flood attack, ICMP tunneling focuses on discreet data transfer rather than overwhelming a target with a high volume of traffic.

Fraggle attack

Why it fails: A Fraggle attack is a denial-of-service (DoS) attack that operates on principles similar to a Smurf attack but utilizes UDP echo packets instead of ICMP. The attacker sends UDP packets to a broadcast address, spoofing the victim's IP address as the source. Devices on the broadcast network then send UDP echo replies to the victim, creating a flood of UDP traffic that can overwhelm the target server's network capacity and processing capabilities.

Network baseline

Why it fails: A network baseline establishes a reference point for normal network performance metrics, such as bandwidth utilization, latency, error rates, and CPU load on devices. While critical for performance monitoring and troubleshooting, it is a collection of data points over time, not a visual representation of network structure or logical connectivity. It does not provide the architectural details needed to plan or document VLAN trunking and assignments.

Wiring diagram

Why it fails: A wiring diagram, often more detailed than a general physical topology, specifically focuses on the intricate details of cable runs, termination points, and connections within a structured cabling system. It might show individual wire pairs, connector types, and patch panel layouts. While vital for installation and troubleshooting physical layer issues, it provides no information about the logical configuration of network services, IP addressing, or VLAN trunking.

Physical topology diagram

Why it fails: A physical topology diagram illustrates the actual geographical or spatial arrangement of network devices, including their physical locations within a building, rack positions, and the physical cabling connections between them. It details cable types, lengths, and termination points, such as patch panels. However, it does not depict logical constructs like IP addresses, VLAN assignments, or the virtual pathways of trunk links, which are independent of physical placement.

The router is not configured with a routing protocol.

Why it fails: Routing protocols, such as OSPF or EIGRP, are used by routers to dynamically learn about remote networks that are not directly connected to their interfaces. For directly connected networks, a router automatically adds these routes to its routing table upon interface configuration and activation, requiring no additional routing protocol. Since the hosts can successfully ping the router's local interface, the router already knows about its directly connected subnet, making a routing protocol irrelevant for this specific communication failure.

The hosts in subnet A have the wrong default gateway.

Why it fails: The default gateway is the IP address of the router interface on the local subnet, serving as the exit point for traffic destined outside that subnet. The ability of hosts in subnet A to successfully ping the router's interface (e.g., 10.0.1.1) conclusively demonstrates that their default gateway is correctly configured. If the default gateway were incorrect, these hosts would be unable to establish any Layer 3 communication with the router, even within their own subnet.

The switch in subnet A is blocking ICMP traffic.

Why it fails: Switches operate primarily at Layer 2 of the OSI model, forwarding frames based on MAC addresses, and do not inherently block Layer 3 ICMP traffic. Blocking ICMP would require a Layer 3 switch with an Access Control List (ACL) configured, which is not a default behavior and typically beyond the scope of a basic small office network setup. Furthermore, if hosts can ping the router interface, basic Layer 2 connectivity and ICMP are already functional within the local subnet.

The router is not configured with a router ID

Why it fails: The OSPF router ID is a fundamental identifier used in the neighbor discovery and adjacency formation process. Without a unique router ID, OSPF processes would fail to initialize, and routers would be unable to exchange Hello packets or establish any neighbor adjacencies whatsoever. Since the problem states that neighbors are already in a FULL state, indicating successful adjacency formation, the absence of a router ID cannot be the cause of missing inter-area routes.

The router is configured as an ABR but does not have a virtual-link configured

Why it fails: A virtual link in OSPF is specifically used to connect a non-backbone area to Area 0 when it doesn't have a direct physical connection, or to connect a disconnected Area 0 segment. If a router is an Area Border Router (ABR) and its non-backbone areas are already directly connected to Area 0, a virtual link is not necessary for inter-area routing. The absence of a virtual link would only be problematic if the network topology explicitly required it, which is not implied by the problem statement, and it wouldn't inherently prevent all inter-area routes if the ABR itself is properly connected to Area 0.

The link-state database is corrupted

Why it fails: A corrupted Link-State Database (LSDB) would typically manifest as severe OSPF instability, potentially leading to repeated neighbor flapping, inconsistent routing information, or even a complete failure to form adjacencies. While a corrupted LSDB could result in missing routes, the fact that neighbors are explicitly stated to be in a FULL state suggests a more specific issue than general database corruption. A healthy LSDB is crucial for maintaining stable adjacencies and accurate route calculation, making widespread corruption inconsistent with stable FULL adjacencies.

SSL VPN with client certificate authentication

Why it fails: Client certificate authentication supplies only one factor — something the user has — so it cannot satisfy the two-factor requirement, and it performs no patch-level posture check. It is tempting because certificate-based SSL VPNs are strong for device authentication, but the scenario demands a second factor plus compliance verification.

IPsec VPN using preshared keys

Why it fails: IPsec preshared keys authenticate the tunnel itself, providing neither per-user two-factor authentication nor endpoint patch compliance checks. It is tempting because IPsec is a legitimate remote-access VPN, but it would fit a site-to-site tunnel where device identity, not user MFA and posture, is the requirement.

NAC integrated with a reverse proxy

Why it fails: NAC enforces endpoint posture, but pairing it with a reverse proxy provides no VPN tunnel and no two-factor authentication mechanism for remote users. It is tempting because NAC genuinely delivers patch-compliance checking, yet the reverse proxy cannot terminate remote-access VPN sessions or verify a second factor.

172.16.0.1

Why it fails: 172.16.0.1 sits in the 172.16.0.0/12 block, which RFC 1918 reserves for private use, but that range is the Class B private space, not Class A. It is tempting because it is genuinely private and commonly deployed, and it would be correct if the question asked for any RFC 1918 address rather than specifically the Class A range.

192.168.1.1

Why it fails: 192.168.1.1 falls within 192.168.0.0/16, the RFC 1918 block historically associated with Class C, not the Class A private range. It is tempting because it is the default gateway on countless home and small-office networks, making it the most familiar private address, and it would be correct if the question asked for Class C space.

172.32.0.1

Why it fails: 172.32.0.1 lies outside 172.16.0.0/12; the private block ends at 172.31.255.255, so this address is publicly routable and not RFC 1918 at all. It is tempting because it sits adjacent to the private 172.16 range and shares the same leading octet, and it would be correct if the block extended one increment further.

Transport mode

Why it fails: Transport mode encrypts only the payload of the original IP packet, leaving the original IP header unencrypted and visible. This means that the source and destination IP addresses of the communicating hosts are exposed to anyone monitoring the network traffic. While suitable for end-to-end host-to-host encryption, Transport mode is inappropriate for site-to-site VPNs, as it fails to conceal the network topology and internal addressing of the connected branches.

AH only

Why it fails: The Authentication Header (AH) protocol within IPsec provides data integrity, data origin authentication, and anti-replay services by hashing the packet and adding an integrity check value. However, AH explicitly does not offer any encryption or confidentiality for the packet's contents. Therefore, using AH only would not encrypt the sensitive data traversing the VPN tunnel, failing to meet the fundamental requirement of a secure site-to-site VPN to protect information from eavesdropping.

ESP only

Why it fails: Encapsulating Security Payload (ESP) is an IPsec protocol that provides confidentiality (encryption), data origin authentication, data integrity, and anti-replay services. However, simply selecting 'ESP only' does not specify the crucial encapsulation method required for a site-to-site VPN. ESP can operate in either transport or tunnel mode, and for a site-to-site connection, the entire original packet, including its header, must be encapsulated and encrypted, which is a function of tunnel mode, not solely the ESP protocol itself.

11 collision domains, 1 broadcast domain

Why it fails: Incorrect. This answer incorrectly counts each workstation on the hub as a separate collision domain. Hubs do not segment collision domains; they operate at Layer 1 and forward all signals, so all hub-attached devices belong to the same collision domain as the switch port.

12 collision domains, 5 broadcast domains

Why it fails: Incorrect. There are not 12 collision domains; the total is 8 (one per switch port). Also, a broadcast domain is not determined by the number of devices. All devices share the same broadcast domain because they are on the same VLAN and no router is involved.

8 collision domains, 5 broadcast domains

Why it fails: Incorrect. While 8 collision domains is correct, 5 broadcast domains is wrong. Broadcast domains are separated by Layer 3 devices (routers), or by VLANs if trunked. Since all devices are on the same VLAN and subnet without a router, there is only one broadcast domain.

Port security

Why it fails: Port security limits the number of MAC addresses learned on a switch port, but the attacking workstation uses one MAC, so ARP spoofing proceeds. It suits blocking rogue switches or MAC flooding, not forged ARP replies from a legitimate port.

DHCP snooping

Why it fails: DHCP snooping builds a trusted-port binding table of MAC-to-IP pairs to block rogue DHCP servers and DHCP starvation; it does not inspect ARP traffic. Dynamic ARP Inspection, which validates ARP packets against that binding table, is the mechanism that stops ARP spoofing. DHCP snooping is tempting because DAI depends on its database.

MAC address filtering

Why it fails: MAC address filtering permits or denies specific hardware addresses but cannot stop a host already allowed on the port from flooding forged ARP replies; the attack continues. It suits restricting which known devices may attach, not containing an insider already connected.

Port security

Why it fails: Port security restricts which MAC addresses may appear on a switch port, binding access to physical interfaces rather than authenticating identities. It is tempting because it does control network admission, and it would suit limiting devices on specific access ports where port identity is the intended control.

VLAN hopping

Why it fails: VLAN hopping is an attack technique that exploits trunking to reach traffic on other VLANs; it grants no authentication of users or devices and cannot enforce port-independent access control. It is tempting because it manipulates VLAN membership, but 802.1X is the technology that authenticates endpoints before granting network access.

DHCP snooping

Why it fails: DHCP snooping filters rogue DHCP server offers and builds a binding table; it never authenticates users or devices. It is tempting because it is a Layer 2 access-control feature often deployed alongside admission control, and it would be correct for stopping unauthorised DHCP servers on untrusted ports.

Data Link layer

Why it fails: The Data Link layer (Layer 2) manages the physical addressing of devices within a single local network segment using MAC addresses, ensuring reliable data transfer between directly connected nodes. It is responsible for framing data into discrete units and handling error detection within that specific link. Unlike the Network layer, it does not concern itself with routing packets across multiple networks or global logical addressing.

Transport layer

Why it fails: The Transport layer (Layer 4) focuses on reliable end-to-end communication between processes running on different hosts, managing data segmentation, reassembly, and flow control. Protocols like TCP ensure data integrity and ordered delivery, while UDP offers a faster, connectionless alternative. Its primary concern is the delivery of data between applications, not the logical addressing or routing of packets across network boundaries.

Application layer

Why it fails: The Application layer (Layer 7) provides the interface for network services directly to user applications, facilitating communication for specific tasks such as web browsing, email, or file transfer. While applications utilize logical addresses to connect to remote services, this layer itself does not define or manage the logical addressing scheme. Instead, it focuses on protocol-specific functions like HTTP, FTP, and SMTP that enable user-facing network interactions.

DNS amplification attack

Why it fails: A DNS amplification attack is a type of distributed denial-of-service (DDoS) attack that leverages open DNS resolvers to flood a target with large volumes of UDP response traffic. Attackers send small DNS queries with a spoofed source IP (the victim's) to numerous DNS servers, which then reply with much larger responses to the victim. Firewall logs would primarily show a high volume of incoming UDP DNS responses, not a flood of TCP SYN packets, as the attack vector is entirely different.

ARP spoofing attack

Why it fails: ARP spoofing is a Layer 2 attack where an attacker sends forged Address Resolution Protocol (ARP) messages to a local area network. This manipulates the MAC address-to-IP address mappings in device ARP caches, redirecting traffic through the attacker's machine. Such an attack would primarily generate ARP traffic, not a flood of TCP SYN packets visible in firewall logs, as its goal is traffic interception, not connection exhaustion.

Man-in-the-middle attack

Why it fails: A Man-in-the-Middle (MITM) attack involves an attacker secretly relaying and possibly altering the communication between two parties who believe they are directly communicating. While a MITM attacker intercepts network traffic, the primary objective is eavesdropping, data manipulation, or session hijacking, not overwhelming a server with connection requests. Therefore, firewall logs would not typically show a massive influx of SYN packets originating from many different sources as a characteristic signature of this type of attack.

SNMP

Why it fails: SNMP (Simple Network Management Protocol) is primarily utilized for monitoring and managing network devices, such as routers, switches, and servers, by collecting data and sending alerts. It allows network administrators to query device status, modify configurations, and receive traps about significant events through Management Information Bases (MIBs). While essential for network operations and diagnostics, SNMP does not possess any inherent functionality to synchronize the internal clocks of these managed devices.

FTP

Why it fails: FTP (File Transfer Protocol) is a foundational application-layer protocol specifically engineered for the transfer of files between a client and a server on a computer network. It operates by establishing separate control and data connections to facilitate uploading, downloading, and managing files in a structured manner. This protocol's sole purpose is data transfer, making it entirely unrelated to the process of synchronizing time across network infrastructure or device clocks.

HTTP

Why it fails: HTTP (Hypertext Transfer Protocol) is the fundamental protocol for transferring hypertext documents, such as web pages, and other web content over the internet. It operates on a client-server model, where clients send requests and servers return responses, primarily for displaying information in web browsers or facilitating API communication. Although web content might display timestamps, HTTP itself does not provide mechanisms for synchronizing the system clocks of the devices involved in the communication.