Network Fundamentals practice questions

The destination is unreachable

Why wrong: If the destination were truly unreachable, the traceroute command would typically terminate with an "Destination Host Unreachable" message, often accompanied by ICMP Destination Unreachable messages from a router along the path, rather than showing asterisks for intermediate hops and then successfully reaching the final destination. The presence of asterisks for intermediate hops, while still ultimately reaching 8.8.8.8, indicates that the path to the destination exists and is traversable, but specific routers are not responding to the ICMP probes.

The TTL expired at the last hop

Why wrong: If the Time-to-Live (TTL) expired at the last hop *before* reaching the ultimate destination, the traceroute would typically show asterisks for that hop, indicating no response, and subsequent hops would also likely fail to resolve. However, the problem statement implies the `traceroute 8.8.8.8` command was run, and 8.8.8.8 is a reachable destination. If the TTL expired at the *actual* destination, the destination itself would respond with an ICMP Port Unreachable or similar message, not just asterisks, because the packet successfully arrived.

The connection is encrypted

Why wrong: Network connection encryption, such as SSL/TLS or IPsec, operates at higher layers of the OSI model (transport/session/presentation or network layer for IPsec payload). Traceroute, however, relies on the Internet Control Message Protocol (ICMP) and the Time-to-Live (TTL) field within the IP header, which are fundamental network layer (Layer 3) functions. Encryption of the data payload does not interfere with a router's ability to decrement the TTL and send an ICMP Time Exceeded message, making it irrelevant to the appearance of asterisks in traceroute output.

Hub

Why wrong: A hub is a rudimentary Layer 1 device that functions as a multi-port repeater, simply regenerating and transmitting any incoming electrical signal out to all other connected ports. It lacks any intelligence to interpret MAC or IP addresses, meaning all devices connected to a hub share a single collision domain and a single broadcast domain. Consequently, broadcast traffic received on one port is indiscriminately flooded to every other port, making it ineffective for broadcast segmentation.

Bridge

Why wrong: Operating at Layer 2, a bridge learns MAC addresses of devices on connected segments and forwards frames selectively based on destination MACs. While a bridge can segment collision domains by intelligently forwarding unicast traffic, it does not filter or contain broadcast frames. Any broadcast frame received on one port is always flooded out to all other ports, meaning a bridge does not separate broadcast domains.

Switch

Why wrong: A standard Ethernet switch, also a Layer 2 device, builds a MAC address table to intelligently forward unicast frames only to the destination port. However, in the absence of Virtual Local Area Networks (VLANs), a switch treats all connected ports as part of a single broadcast domain. Therefore, any broadcast frame received on one port will be flooded out to all other ports within that same broadcast domain, failing to contain broadcast traffic.

Dynamic ARP Inspection (DAI)

Why wrong: DAI protects against ARP spoofing, not rogue DHCP servers.

IP Source Guard

Why wrong: IP Source Guard prevents IP spoofing by filtering traffic based on DHCP snooping bindings, but does not directly block rogue DHCP servers.

Port Security

Why wrong: Port Security limits the number of MAC addresses on a port but does not filter DHCP messages.

802.1X authentication

Why wrong: 802.1X authentication is a port-based network access control protocol that requires users or devices to authenticate using credentials like usernames/passwords or digital certificates before gaining network access. While it can be configured with MAC Authentication Bypass (MAB) as a fallback for non-802.1X capable devices, its primary function is identity-based authentication, not solely restricting access based on a static list of MAC addresses. Therefore, it doesn't directly address the specific need for simple MAC-based restriction.

VLAN hopping prevention

Why wrong: VLAN hopping prevention techniques are designed to mitigate attacks where an attacker attempts to gain access to VLANs other than the one they are assigned to. This typically involves disabling Dynamic Trunking Protocol (DTP) or ensuring the native VLAN on trunk ports is an unused VLAN. These measures protect against lateral movement between VLANs, but they do not prevent an unauthorized device from initially connecting to a switch port within its assigned VLAN.

DHCP snooping

Why wrong: DHCP snooping is a security feature that filters untrusted DHCP messages and builds a DHCP snooping binding table, mapping MAC addresses to IP addresses, lease times, and VLANs. Its primary purpose is to prevent rogue DHCP servers from issuing IP addresses and to mitigate DHCP starvation attacks. While it uses MAC addresses in its operation, it does not directly restrict which specific MAC addresses are allowed to connect to a switch port in the first place, making it unsuitable for preventing unauthorized device connections based on MAC.

Spanning Tree Protocol (STP)

Why wrong: Spanning Tree Protocol (STP), defined by IEEE 802.1D, is designed to prevent network loops in redundant Ethernet topologies by selectively blocking redundant paths. Its primary function is to ensure a loop-free logical topology, which is critical for stable network operation by preventing broadcast storms and MAC table instability. However, by blocking redundant links to achieve this, STP actively prevents the utilization of those links for increased bandwidth, making it unsuitable for aggregating throughput.

VLAN trunking (802.1Q)

Why wrong: IEEE 802.1Q, commonly known as VLAN trunking, is a standard for tagging Ethernet frames with VLAN identification, enabling a single physical link to carry traffic for multiple virtual local area networks. While essential for inter-VLAN communication across switches, it does not increase the aggregate bandwidth of the physical link itself. Instead, it multiplexes different VLAN traffic flows over that single link, which can become a bottleneck if not properly sized, rather than combining multiple links for higher throughput.

Power over Ethernet (PoE)

Why wrong: Power over Ethernet (PoE) is an IEEE 802.3af/at/bt standard that allows electrical power to be transmitted along with data on standard Ethernet cabling. Its purpose is to power devices like IP phones, wireless access points, or security cameras without requiring a separate power outlet. PoE is solely concerned with power delivery and has absolutely no mechanism or function related to increasing network bandwidth, aggregating links, or providing network redundancy between switches.

Use static routes instead of OSPF

Why wrong: Using static routes instead of a dynamic routing protocol like OSPF fundamentally prevents the network from adapting to topology changes automatically. Static routes are manually configured and remain fixed, offering no inherent mechanism for detecting link failures or automatically rerouting traffic. If a link fails along a statically defined path, traffic will be black-holed until manual intervention, which is the opposite of improving convergence and network resilience.

Increase OSPF hello and dead timers

Why wrong: Increasing OSPF hello and dead timers directly lengthens the time it takes for OSPF to detect a neighbor or link failure. The hello timer dictates how frequently a router sends hello packets to its neighbors, while the dead timer specifies how long a router waits to receive a hello packet before declaring a neighbor down. By extending these intervals, OSPF will wait longer to identify a problem, delaying the initiation of the SPF algorithm and consequently slowing down the network's overall convergence time after an event.

Configure all routers in a single OSPF area

Why wrong: Configuring all routers within a single OSPF area, especially in a large network, creates a monolithic routing domain where every router must maintain a complete Link-State Database (LSDB) for the entire network. Any topology change, such as a link failure or a new router, triggers a re-calculation of the Shortest Path First (SPF) algorithm on every router in that area. This extensive computation consumes significant CPU resources and increases the time required for the network to converge, directly impeding the goal of faster convergence.

Cat6a twisted pair

Why wrong: Cat6a (Augmented Category 6) twisted pair cable is designed to support 10 Gigabit Ethernet (10GBASE-T) but is strictly limited to a maximum distance of 100 meters. Attempting to deploy Cat6a for a 150-meter link would result in excessive signal attenuation and crosstalk, making reliable 10 Gbps communication impossible. Therefore, while capable of the desired bandwidth, its inherent distance limitation makes it an inappropriate choice for connecting switches over 150 meters.

Cat7 twisted pair

Why wrong: Cat7 twisted pair cabling is unsuitable for connecting switches across a 150-meter distance, despite its enhanced shielding and support for higher frequencies. While Cat7 is designed for 10 Gigabit Ethernet (10GBASE-T) and beyond, its maximum reliable transmission distance for standard Ethernet applications is limited to 100 meters. Exceeding this 100-meter limit would lead to significant signal degradation and potential loss of data integrity, rendering it impractical for the 150-meter requirement.

Single-mode fiber optic

Why wrong: Single-mode fiber optic cable, while capable of transmitting 10 Gigabit Ethernet over extremely long distances (e.g., 10GBASE-LR for 10 km), represents an unnecessary and cost-prohibitive solution for a mere 150-meter connection. Its smaller core requires more precise and expensive laser transceivers, and the overall deployment cost is significantly higher than multi-mode fiber. For this relatively short inter-building link, single-mode fiber offers no practical advantage over multi-mode fiber that would justify the increased expense and complexity.

Ping flood

Why wrong: A ping flood is a basic denial-of-service (DoS) attack where an attacker directly sends an overwhelming number of ICMP echo request packets to a target server. The goal is to consume the target's bandwidth and processing resources by forcing it to respond to each request, thereby making it unavailable to legitimate users. Crucially, this attack involves the victim receiving requests directly from the attacker, not a flood of replies from numerous intermediary sources.

ICMP tunneling

Why wrong: ICMP tunneling is a technique used for covert communication, where data is encapsulated within the payload of ICMP echo request and reply packets. This method allows attackers to establish a hidden communication channel, often for data exfiltration or command and control, bypassing some firewall rules that permit ICMP traffic. Unlike a flood attack, ICMP tunneling focuses on discreet data transfer rather than overwhelming a target with a high volume of traffic.

Fraggle attack

Why wrong: A Fraggle attack is a denial-of-service (DoS) attack that operates on principles similar to a Smurf attack but utilizes UDP echo packets instead of ICMP. The attacker sends UDP packets to a broadcast address, spoofing the victim's IP address as the source. Devices on the broadcast network then send UDP echo replies to the victim, creating a flood of UDP traffic that can overwhelm the target server's network capacity and processing capabilities.

Network baseline

Why wrong: A network baseline establishes a reference point for normal network performance metrics, such as bandwidth utilization, latency, error rates, and CPU load on devices. While critical for performance monitoring and troubleshooting, it is a collection of data points over time, not a visual representation of network structure or logical connectivity. It does not provide the architectural details needed to plan or document VLAN trunking and assignments.

Wiring diagram

Why wrong: A wiring diagram, often more detailed than a general physical topology, specifically focuses on the intricate details of cable runs, termination points, and connections within a structured cabling system. It might show individual wire pairs, connector types, and patch panel layouts. While vital for installation and troubleshooting physical layer issues, it provides no information about the logical configuration of network services, IP addressing, or VLAN trunking.

Physical topology diagram

Why wrong: A physical topology diagram illustrates the actual geographical or spatial arrangement of network devices, including their physical locations within a building, rack positions, and the physical cabling connections between them. It details cable types, lengths, and termination points, such as patch panels. However, it does not depict logical constructs like IP addresses, VLAN assignments, or the virtual pathways of trunk links, which are independent of physical placement.

The router is not configured with a routing protocol.

Why wrong: Routing protocols, such as OSPF or EIGRP, are used by routers to dynamically learn about remote networks that are not directly connected to their interfaces. For directly connected networks, a router automatically adds these routes to its routing table upon interface configuration and activation, requiring no additional routing protocol. Since the hosts can successfully ping the router's local interface, the router already knows about its directly connected subnet, making a routing protocol irrelevant for this specific communication failure.

The hosts in subnet A have the wrong default gateway.

Why wrong: The default gateway is the IP address of the router interface on the local subnet, serving as the exit point for traffic destined outside that subnet. The ability of hosts in subnet A to successfully ping the router's interface (e.g., 10.0.1.1) conclusively demonstrates that their default gateway is correctly configured. If the default gateway were incorrect, these hosts would be unable to establish any Layer 3 communication with the router, even within their own subnet.

The switch in subnet A is blocking ICMP traffic.

Why wrong: Switches operate primarily at Layer 2 of the OSI model, forwarding frames based on MAC addresses, and do not inherently block Layer 3 ICMP traffic. Blocking ICMP would require a Layer 3 switch with an Access Control List (ACL) configured, which is not a default behavior and typically beyond the scope of a basic small office network setup. Furthermore, if hosts can ping the router interface, basic Layer 2 connectivity and ICMP are already functional within the local subnet.

The router is not configured with a router ID

Why wrong: The OSPF router ID is a fundamental identifier used in the neighbor discovery and adjacency formation process. Without a unique router ID, OSPF processes would fail to initialize, and routers would be unable to exchange Hello packets or establish any neighbor adjacencies whatsoever. Since the problem states that neighbors are already in a FULL state, indicating successful adjacency formation, the absence of a router ID cannot be the cause of missing inter-area routes.

The router is configured as an ABR but does not have a virtual-link configured

Why wrong: A virtual link in OSPF is specifically used to connect a non-backbone area to Area 0 when it doesn't have a direct physical connection, or to connect a disconnected Area 0 segment. If a router is an Area Border Router (ABR) and its non-backbone areas are already directly connected to Area 0, a virtual link is not necessary for inter-area routing. The absence of a virtual link would only be problematic if the network topology explicitly required it, which is not implied by the problem statement, and it wouldn't inherently prevent all inter-area routes if the ABR itself is properly connected to Area 0.

The link-state database is corrupted

Why wrong: A corrupted Link-State Database (LSDB) would typically manifest as severe OSPF instability, potentially leading to repeated neighbor flapping, inconsistent routing information, or even a complete failure to form adjacencies. While a corrupted LSDB could result in missing routes, the fact that neighbors are explicitly stated to be in a FULL state suggests a more specific issue than general database corruption. A healthy LSDB is crucial for maintaining stable adjacencies and accurate route calculation, making widespread corruption inconsistent with stable FULL adjacencies.

DNS

Why wrong: DNS translates domain names to IP addresses, not assign IPs.

ARP

Why wrong: ARP resolves IP addresses to MAC addresses on a local network.

ICMP

Why wrong: ICMP is used for error reporting and diagnostics like ping.

syslog

Why wrong: Syslog is used for collecting log messages, not for performance metrics or alert thresholds.

NetFlow

Why wrong: NetFlow provides traffic flow statistics but is not typically used for threshold-based alerts.

ICMP

Why wrong: ICMP is used for ping and traceroute, not for continuous monitoring and alerts.

Transport mode

Why wrong: Transport mode encrypts only the payload of the original IP packet, leaving the original IP header unencrypted and visible. This means that the source and destination IP addresses of the communicating hosts are exposed to anyone monitoring the network traffic. While suitable for end-to-end host-to-host encryption, Transport mode is inappropriate for site-to-site VPNs, as it fails to conceal the network topology and internal addressing of the connected branches.

AH only

Why wrong: The Authentication Header (AH) protocol within IPsec provides data integrity, data origin authentication, and anti-replay services by hashing the packet and adding an integrity check value. However, AH explicitly does not offer any encryption or confidentiality for the packet's contents. Therefore, using AH only would not encrypt the sensitive data traversing the VPN tunnel, failing to meet the fundamental requirement of a secure site-to-site VPN to protect information from eavesdropping.

ESP only

Why wrong: Encapsulating Security Payload (ESP) is an IPsec protocol that provides confidentiality (encryption), data origin authentication, data integrity, and anti-replay services. However, simply selecting 'ESP only' does not specify the crucial encapsulation method required for a site-to-site VPN. ESP can operate in either transport or tunnel mode, and for a site-to-site connection, the entire original packet, including its header, must be encapsulated and encrypted, which is a function of tunnel mode, not solely the ESP protocol itself.

Data Link layer

Why wrong: The Data Link layer (Layer 2) manages the physical addressing of devices within a single local network segment using MAC addresses, ensuring reliable data transfer between directly connected nodes. It is responsible for framing data into discrete units and handling error detection within that specific link. Unlike the Network layer, it does not concern itself with routing packets across multiple networks or global logical addressing.

Transport layer

Why wrong: The Transport layer (Layer 4) focuses on reliable end-to-end communication between processes running on different hosts, managing data segmentation, reassembly, and flow control. Protocols like TCP ensure data integrity and ordered delivery, while UDP offers a faster, connectionless alternative. Its primary concern is the delivery of data between applications, not the logical addressing or routing of packets across network boundaries.

Application layer

Why wrong: The Application layer (Layer 7) provides the interface for network services directly to user applications, facilitating communication for specific tasks such as web browsing, email, or file transfer. While applications utilize logical addresses to connect to remote services, this layer itself does not define or manage the logical addressing scheme. Instead, it focuses on protocol-specific functions like HTTP, FTP, and SMTP that enable user-facing network interactions.

DNS amplification attack

Why wrong: A DNS amplification attack is a type of distributed denial-of-service (DDoS) attack that leverages open DNS resolvers to flood a target with large volumes of UDP response traffic. Attackers send small DNS queries with a spoofed source IP (the victim's) to numerous DNS servers, which then reply with much larger responses to the victim. Firewall logs would primarily show a high volume of incoming UDP DNS responses, not a flood of TCP SYN packets, as the attack vector is entirely different.

ARP spoofing attack

Why wrong: ARP spoofing is a Layer 2 attack where an attacker sends forged Address Resolution Protocol (ARP) messages to a local area network. This manipulates the MAC address-to-IP address mappings in device ARP caches, redirecting traffic through the attacker's machine. Such an attack would primarily generate ARP traffic, not a flood of TCP SYN packets visible in firewall logs, as its goal is traffic interception, not connection exhaustion.

Man-in-the-middle attack

Why wrong: A Man-in-the-Middle (MITM) attack involves an attacker secretly relaying and possibly altering the communication between two parties who believe they are directly communicating. While a MITM attacker intercepts network traffic, the primary objective is eavesdropping, data manipulation, or session hijacking, not overwhelming a server with connection requests. Therefore, firewall logs would not typically show a massive influx of SYN packets originating from many different sources as a characteristic signature of this type of attack.

Port security

Why wrong: Port security restricts the number of MAC addresses per port but does not inspect ARP packets.

DHCP snooping

Why wrong: DHCP snooping filters rogue DHCP servers and builds a binding table, but does not directly validate ARP traffic.

MAC address filtering

Why wrong: MAC filtering controls which MAC addresses are allowed, but does not prevent ARP spoofing.

Throughput tester

Why wrong: NetFlow provides flow-level statistics but does not capture full packet contents for detailed analysis.

Spectrum analyzer

Why wrong: SNMP is used for monitoring device status and collecting metrics, not for packet-level analysis.

NetFlow analyzer

Why wrong: Syslog collects log messages from devices but does not capture network traffic.

Incorrect subnet mask on the workstation

Why wrong: Incorrect subnet mask would cause the workstation to incorrectly determine whether the server is on the same subnet; however, since the workstation can ping the gateway, the subnet mask is likely correct. If it were incorrect, pinging the gateway might still work if the gateway is on the same network as perceived by the workstation.

Incorrect default gateway on the workstation

Why wrong: The default gateway is correctly configured because the workstation can ping it.

A firewall on the workstation is blocking traffic to the server

Why wrong: A firewall on the workstation could block ICMP (ping) traffic to the server while allowing other traffic, but this is less likely than the server being offline or disconnected, especially since the user cannot connect to the file server (not just ping).

SNMP

Why wrong: SNMP (Simple Network Management Protocol) is primarily utilized for monitoring and managing network devices, such as routers, switches, and servers, by collecting data and sending alerts. It allows network administrators to query device status, modify configurations, and receive traps about significant events through Management Information Bases (MIBs). While essential for network operations and diagnostics, SNMP does not possess any inherent functionality to synchronize the internal clocks of these managed devices.

FTP

Why wrong: FTP (File Transfer Protocol) is a foundational application-layer protocol specifically engineered for the transfer of files between a client and a server on a computer network. It operates by establishing separate control and data connections to facilitate uploading, downloading, and managing files in a structured manner. This protocol's sole purpose is data transfer, making it entirely unrelated to the process of synchronizing time across network infrastructure or device clocks.

HTTP

Why wrong: HTTP (Hypertext Transfer Protocol) is the fundamental protocol for transferring hypertext documents, such as web pages, and other web content over the internet. It operates on a client-server model, where clients send requests and servers return responses, primarily for displaying information in web browsers or facilitating API communication. Although web content might display timestamps, HTTP itself does not provide mechanisms for synchronizing the system clocks of the devices involved in the communication.