How should I use these Network Fundamentals practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Network Fundamentals questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Network Fundamentals domain.

Cybersecurity-Apprentice · topic practice

Network Fundamentals practice questions

Practise Certified Cybersecurity Apprentice (Cybersecurity-Apprentice) Network Fundamentals practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Network Fundamentals

Practice 10 questions Browse domain →

What the exam tests

What to know about Network Fundamentals

Network Fundamentals questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Network Fundamentals exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Network Fundamentals questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full NAT/PAT explanation →

An enterprise firewall receives traffic from a subnet that must be translated using Dynamic IP and Port (DIPP) Source NAT. The administrator needs to ensure that port allocation for a specific high-traffic server is predictable and does not get exhausted. Which NAT feature should be configured?

Trap 1: No-NAT rule with Universal translation

A No-NAT rule disables translation completely, which does not provide port management.

Trap 2: Destination NAT with Port Mapping

Destination NAT maps inbound ports to internal servers, whereas the scenario specifies Source NAT outbound traffic.

Trap 3: Static IP Source NAT with bi-directional mapping

Static IP Source NAT maps a 1:1 IP address without port translation, which does not solve port conservation or DIPP management.

Study all Network Fundamentals common traps →

A
No-NAT rule with Universal translation
Why wrong: A No-NAT rule disables translation completely, which does not provide port management.
B
Dynamic IP and Port (DIPP) Source NAT with Port Distribution or Block Allocation
DIPP block allocation reserves specific blocks of ports for individual source IPs, preventing port starvation and ensuring predictable usage.
C
Destination NAT with Port Mapping
Why wrong: Destination NAT maps inbound ports to internal servers, whereas the scenario specifies Source NAT outbound traffic.
D
Static IP Source NAT with bi-directional mapping
Why wrong: Static IP Source NAT maps a 1:1 IP address without port translation, which does not solve port conservation or DIPP management.

Network Fundamentals practice questions

What to know about Network Fundamentals

Common Network Fundamentals exam traps

Network Fundamentals questions

An enterprise firewall receives traffic from a subnet that must be translated using Dynamic IP and Port (DIPP) Source NAT. The administrator needs to ensure that port allocation for a specific high-traffic server is predictable and does not get exhausted. Which NAT feature should be configured?

A network administrator configures a Layer 3 subinterface with DHCP Client enabled. However, the interface fails to receive an IP address from the upstream provider. Which CLI command should the administrator execute to troubleshoot the DHCP client process on the firewall?

An administrator needs to check the operational status and link speed of all physical Ethernet ports on a Palo Alto Networks firewall. Which CLI command should be executed?

A network engineer wants to ensure that ICMP Redirect messages are disabled on all Layer 3 interfaces of a Palo Alto Networks firewall to prevent routing manipulation attacks. Where can this setting be disabled?

An administrator needs to verify the default gateway configured for the firewall's management plane. Which CLI command should be used?

An administrator wants to check the current CPU utilization of the data plane (DP) and management plane (MP) on a Palo Alto Networks firewall. Which CLI command should be used?

A security analyst is examining a packet capture (PCAP) and observes that the TCP window size is dropping to zero during a data transfer between a client and a server through the firewall. What does a zero window size typically indicate in a TCP transmission?

An administrator notices that traffic between two internal subnets connected to the same Palo Alto Networks firewall is not being inspected by security policies. The interfaces for both subnets are configured as Layer 3. What is the most likely reason for this behavior?

An administrator is configuring a new Layer 2 subinterface on a Palo Alto Networks firewall and needs to associate it with an existing VLAN ID. Where is the VLAN tag specified for a Layer 2 subinterface?

A network administrator notices that asymmetric routing is occurring on a multi-path firewall deployment, causing valid TCP sessions to be dropped by the firewall. Which feature should the administrator enable to resolve this issue?

An engineer is configuring a new Layer 3 interface on a Palo Alto Networks firewall and needs to ensure that the interface responds to ICMP echo requests for diagnostic purposes. Where must the administrator enable this setting?

An administrator needs to configure a static route on a Palo Alto Networks firewall so that traffic destined for a remote subnet (192.168.10.0/24) reaches its next-hop router (10.0.0.1). Which menu path must the administrator navigate to configure this?

An administrator has configured BGP on a Palo Alto Networks virtual router, but the BGP peers are stuck in the 'Idle' state. What is the most likely configuration error causing this status?

An administrator needs to verify the MAC address associated with a specific IP address on the local network segment using the firewall CLI. Which command should be executed?

A network engineer configures OSPF on a Palo Alto Networks virtual router. Neighbors are stuck in the EXSTART/EXCHANGE state. What is the most likely cause of this issue?

An administrator wants to view active sessions matching a specific source IP address (192.168.1.50) using the firewall CLI. Which command is correct?

An administrator needs to test DNS resolution from the Palo Alto Networks firewall command line interface (CLI) to ensure the management plane can reach external name servers. Which command should be used?

Track your progress over time

Start a Network Fundamentals only practice session

Related Cybersecurity-Apprentice topic practice pages

Endpoint Security practice questions

Cloud Security practice questions

Network Fundamentals practice questions

Network Security practice questions

Security Operations practice questions

Cybersecurity Fundamentals practice questions

Cybersecurity-Apprentice fundamentals practice questions

Cybersecurity-Apprentice scenario practice questions

Cybersecurity-Apprentice troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid