N10-009 — frequently asked questions

The exhibit shows WAN 2 with better average throughput and less downtime. VoIP needs a stable path, so consistent delivery and uptime outweigh a link that may have a higher headline rate but drops traffic.

206.208.133.9 is Router B's public/WAN address, not an endpoint workstation. The highest internal workstation address is 10.1.90.53, reported at 80.93 GB.

Its ping test shows request timed out and its total traffic is 0 Gbit/s, so it is not answering or passing measurable traffic after the outage.

A threat is a potential source of harm, such as an actor or event; an exploit is the specific application or technique that leverages a software flaw. The malicious app in the stem is doing the leveraging, so it is the exploit.

A vulnerability is the software flaw or weakness itself, while an exploit is the code, application, or technique that takes advantage of it. In this question, “software flaw” is the vulnerability and “malicious application” is the exploit.

Risk combines the likelihood and impact of a threat exploiting a vulnerability. It is an assessment outcome, not the malicious application described in the stem.

Static addresses stay unchanged but require manual configuration on each printer, failing the requirement for automatic assignment; a DHCP reservation provides the same stability automatically.

No. A lease is temporary and can change after expiry, release, or server/pool changes; only a reservation ties a specific address to the printer's MAC.

It forwards DHCP messages between subnets when the server is remote; it does not reserve or permanently fix an address for a printer.

When coverage is weak or fluctuating, the phone's uplink power control increases transmit power to maintain the connection; running the power amplifier near maximum drains the battery faster.

No. WPS is Wi-Fi Protected Setup, used to join devices to a Wi-Fi router or access point; it does not control cellular repeater operation or handset battery drain.

Use the phone's field-test mode to check RSRP or signal bars and compare locations around the repeater; weak or unstable readings support a coverage problem before changing frequency settings.

MTTR is the average time to repair or restore a failed component. RTO is the business-defined maximum outage the organization can accept during an incident, so it matches the question’s “maximum duration” wording.

RTO limits how long technology can be unavailable; RPO limits how much data loss is acceptable, usually measured by the last recoverable backup or replication point. This question asks only about offline duration, so RTO is correct.

BGP is the only path-vector protocol among the options. OSPF supports redundancy and equal-cost load balancing, but it is a link-state interior gateway protocol, so it fails the question's explicit path-vector requirement.

BGP selects a best path by default, but it can install multiple equal-cost paths and use attributes such as AS-path and local preference to influence selection. Multipath load balancing must be supported and configured on the router.

MPLS is a label-switching forwarding technology used by service providers, not a path-vector routing protocol. It can carry branch traffic, but it does not satisfy the protocol-category requirement in the question.

Yes. The client broadcasts from UDP source port 68 to destination port 67, where the DHCP server or relay is listening, because the host has no IP address yet.

The server or relay sends from UDP port 67 back to the client on port 68, either broadcast or unicast depending on the flags and relay configuration.

No. Port 69 is TFTP, which may be used later in a PXE boot to download a boot file after DHCP has supplied an address and boot options.

SSH is the encrypted management protocol used to administer the router or switch itself. A bastion host is a hardened jump server that may carry that SSH session, but it is an access path rather than the management tool asked for.

No. A closed or isolated network has no untrusted external path to protect with a VPN; split tunneling only controls which traffic enters a VPN tunnel during remote access.

No. SSH is a standards-based protocol supported by routers, switches, firewalls, and other network devices for encrypted CLI management, regardless of the underlying operating system.

Traceroute directly reports per-hop round-trip times, so it can locate where latency is introduced along the path. Wireshark can show detailed packet behavior but requires a capture point and is usually a follow-up tool.

NetFlow primarily reports traffic flows, volumes, and conversation details. It does not provide per-hop round-trip timing like traceroute, so it is not the best first tool for locating latency.

SNMP could later check interface counters, errors, utilization, and device health on switches or routers. It helps confirm a suspect device but does not trace the path to the shared drive.

Administrative distance is compared before metric when routes come from different sources. A static route defaults to AD 1 and internal OSPF to AD 110, and lower AD wins, so the static route is installed first.

Configure it as a floating static route by setting its administrative distance higher than OSPF's 110, for example 115. OSPF is then preferred while present, and the static route is used only if the OSPF route disappears.

No. Adding a neighbor can add OSPF routes, but AD is a local value assigned to route sources. The static route's AD 1 versus OSPF's AD 110 comparison remains unchanged.

The initial connection can succeed while intermittent packet loss or high latency breaks a bulk sync. Ping helps the help desk check reachability, loss, and delay during sync attempts.

The application is already resolving and connecting to the server, so DNS is not the first suspect. Nslookup becomes relevant only if the sync process uses a separate hostname that may not resolve.

Nmap scans remote ports and services, which is broader discovery or security testing. Netstat quickly shows local active connections and session states for the application that is already partially working.

URL filtering only sees traffic that passes through the firewall and matches a known destination category. The browser's connection terminates at the external proxy, so the restricted site is fetched on the user's behalf and the firewall may never evaluate the real URL.

It handles a known, stable proxy endpoint, but proxy services can rotate IPs or domains. Combine the ACE with URL-category blocking for proxy avoidance and anonymizers, DNS filtering, and logging for better coverage.

A hosts-file entry only affects the local computer, can be changed by a local administrator or malware, and does not stop users from reaching the proxy by IP or another hostname. The firewall ACE enforces policy centrally.

BGP is dynamic but path-vector, not link-state; it selects routes using AS-path and policy attributes rather than building an SPF topology database.

OSPF routers advertise link states, build a topology database for the area, and run Dijkstra's shortest path first algorithm to choose routes.

No. A static route is a manually configured route; it has no neighbor exchanges, topology database, or routing algorithm.

It has only three non-overlapping channels (1, 6, and 11), so many clients and neighboring APs compete for the same airtime; without band steering, dual-band devices stay on this crowded band.

No. Band steering is a steering and load-balancing feature; without it, capable clients may still associate on 2.4 GHz, which is why the symptom is slowness rather than a total connection failure.

If devices did not support 5 GHz, they would fail to associate with a 5 GHz-only AP or need 2.4 GHz; the reported high latency and airtime contention show clients are connected and competing for airtime.

For the same destination prefix, yes: static AD is 1 and eBGP is 20; iBGP is 200. But longest prefix match happens first, so a more specific BGP route beats a less specific static route.

A default route is 0.0.0.0/0, so it is used only when no more specific route matches; its AD depends on how it was learned. It does not automatically outrank OSPF, BGP, or static routes for a specific prefix.

If two static routes match the same prefix, the router uses the lower metric; if metrics tie, it may install both for equal-cost load balancing.

LDAP clients authenticate with a bind request that sends a distinguished name and password to the directory server. A successful bind response confirms the user's identity, after which authorization can be evaluated.

HTTPS protects the browser-to-server session, but the port itself is generic web transport; any authentication is performed by the application or identity service behind it. In a port-to-role question, LDAP 389 is the more direct authentication service.

123 is NTP for time synchronization, which does not authenticate users. 587 is SMTP submission, which can support SMTP AUTH for sending mail but is not a directory user-authentication port.

nslookup queries DNS records and can show whether name resolution works, but it does not prove that a host is reachable or that the routed path between hosts is functioning.

Only indirectly on the local subnet. ARP resolves an IPv4 address to a MAC address; it does not test end-to-end IP reachability across routers, so traceroute is the better path test.

Ping confirms whether a destination responds; traceroute shows each hop along the path, helping locate where connectivity stops after the outage.

Port security limits the MAC addresses allowed on a switch port, while NAC works with 802.1X to authenticate users or devices and enforce posture and authorization policy before trusted wireless access.

If the requirement were to restrict a single wired switch port to a known MAC address or small set of MACs, port security would fit; that is narrower than BYOD admission control on a trusted WLAN.

An ACL permits or denies traffic after a device reaches the network, whereas NAC decides whether the device should be admitted and what access it receives based on identity and posture.

SC uses a push-pull latch with a square body; it clicks into place rather than rotating. Only ST uses a bayonet push-and-twist lock, so B does not fit the question.

ST stands for Straight Tip and uses a bayonet-style coupling that must be pushed in and twisted to lock. That twist-lock action is the key differentiator from SC, LC and MPO connectors.

ARP spoofing mainly enables man-in-the-middle interception on a local network and threatens confidentiality or integrity. It does not directly exhaust the portal's service resources the way a DoS attack does.

It can degrade a local switch segment by exhausting the CAM table and causing flooding, but the question asks about directly impacting the portal's availability. That aligns with a DoS attack on the service, not a Layer 2 forwarding attack.

A rogue device is unauthorized hardware such as an access point or endpoint, creating access-control and policy risk. A DoS attack deliberately consumes resources to deny service to legitimate users.

It indicates that the device failed to contact a DHCP server and assigned itself a link-local address in the 169.254.0.0/16 range.

No. A short lease causes frequent renewals but does not prevent the client from getting an address if the server is reachable.

A honeypot is a decoy system designed to attract malicious actors, allowing administrators to study attack methods and gain threat intelligence without risking production assets.

By analyzing traffic and exploits directed at the honeypot, admins can identify emerging vulnerabilities and attack trends, prioritizing patches and defenses for the most active threats.

APIPA (Automatic Private IP Addressing) assigns 169.254.x.x addresses when a DHCP client cannot reach a server. It happens when the DHCP pool is exhausted or the server is down.

Yes, if they are on the same physical subnet. APIPA allows link-local communication but prevents routing beyond the local segment, which explains why they can't reach company resources.

DNS issues typically affect all clients trying to resolve the same name. Since other users can access the server, the global DNS service is functioning correctly.

After checking the firewall, the next steps would include verifying the client's IP configuration, testing physical connectivity, and reviewing the user's account permissions.

Yes, both switches must support link aggregation (LACP or static) and be configured consistently. Most modern enterprise switches support this.

Yes, but link aggregation should be used on the uplinks to reduce the number of STP domains and avoid unnecessary blocking.

A honeypot is a single decoy system, while a honey net is a collection of interconnected decoy systems forming a fake network. Both are used to capture TTPs.

An IDS detects and alerts on suspicious activity but does not actively lure attackers or provide a safe environment to observe their full methodology without risking production systems.

Ping checks if a destination is reachable and measures round-trip time. Traceroute maps the entire path packets take, showing each hop and identifying where packets are dropped or delayed.

Nmap is primarily for port scanning and service discovery. While it can detect open/closed ports, it does not trace the network path to show which intermediate routers are restricting traffic.

No. 802.11ax (Wi-Fi 6/6E) supports up to 160 MHz channel widths. The 320 MHz width was introduced later with 802.11be.

The 6 GHz band provides more contiguous spectrum than the crowded 2.4 GHz and 5 GHz bands, allowing for the implementation of wider 320 MHz channels with less interference.

Collisions should not occur in true full-duplex mode. If you see collisions, it indicates the link is effectively operating in half-duplex due to a mismatch or auto-negotiation failure.

It causes severe latency and packet loss because the half-duplex side constantly backs off and retransmits due to false collision detection, while the full-duplex side continues sending uninterrupted.

The MDF is the main room where external lines enter. IDFs are secondary rooms on different floors that connect back to the MDF via backbone cabling.

No, MIB stands for Management Information Base. It is a database used by SNMP for monitoring network devices, not a security feature itself.

SSH encrypts all communication, including login credentials, ensuring security over untrusted networks. Telnet sends all data in plaintext, making it vulnerable to interception.

No, RDP is designed for graphical remote desktop connections to Windows operating systems. Network appliances typically require CLI access via SSH.

No, FTPS is used for secure file transfers. While it secures data in transit, it does not provide a command-line interface for configuring network devices.

RPO (Recovery Point Objective) is the maximum acceptable data loss measured in time. RTO (Recovery Time Objective) is the maximum acceptable downtime before services must be restored.

A shorter RPO requires more frequent backups to ensure less data is lost. For example, an 8-hour RPO means backups must occur at least every 8 hours.

ARP spoofing operates within a single Layer 2 broadcast domain (VLAN). It allows an attacker to impersonate a gateway but cannot transmit packets from a guest VLAN to an internal server VLAN without a routing device or a vulnerability like VLAN hopping.

Double-tagging is a common method where an attacker sends a frame with two 802.1Q tags. The first switch strips the outer tag and forwards the frame based on the inner tag, potentially allowing it to enter a trunk port destined for a different VLAN.

Remote users connect from outside the local network, bypassing the congested local edge link. Their traffic does not compete with the local burst of simultaneous VoIP, video, and web usage that saturates the office's internet connection.

While QoS misconfiguration could cause similar symptoms, the question implies the link itself is overwhelmed. Insufficient bandwidth is the primary constraint; even perfect QoS cannot fix a pipe that is physically too small for the total traffic volume.

Yes, an IDS does not add latency to the data path because it does not inspect and potentially block packets in real-time like an IPS.

No, by definition, an IPS must be inline to prevent malicious traffic. Out-of-band monitoring is the domain of IDS or RSPAN/TAP setups.

A /18 mask would only allow 2^14 - 2 = 16,382 hosts total across the network, but specifically 2^14 addresses per subnet? No, /18 leaves 14 host bits. 2^14 = 16,384. Wait, /18 borrows 2 bits from /16. Remaining host bits = 14. 2^14 - 2 = 16,382 hosts. Why is B better? Actually, /18 supports MORE hosts. But /18 is not an option. Among the options, only /22 supports 1,000 hosts.

It represents a /22 prefix. The third octet 252 is 11111100 in binary, meaning 6 bits are borrowed from the third octet plus the full first two octets (16 bits), totaling 22 network bits.

Tagging usually refers to 802.1Q VLAN tagging, which adds metadata to Ethernet frames to identify which VLAN the traffic belongs to. This allows multiple VLANs to traverse a single physical link.

While firewalls can filter traffic between VLANs, they do not create or manage the tags themselves. Issues specifically related to the implementation of tagging and logical segmentation are primarily switch responsibilities.

The 'shutdown' command on a Cisco switch interface causes the port to enter the administratively down state.

Enter the interface configuration mode and issue the 'no shutdown' command to bring the port back up.

Fiber is immune to EMI but is significantly more expensive than copper cabling. The question explicitly requires keeping costs low, making STP the more appropriate economic choice.

Twisting helps cancel out some crosstalk and mild interference, but it is insufficient against high-intensity EMI sources like microwave ovens operating nearby.

You cannot establish a valid theory without sufficient data. The methodology requires you to first identify the problem by gathering information from the user to understand the scope and symptoms accurately.

No. Divide and Conquer is a testing strategy used during the 'Test the Theory' phase to isolate components. It is not an initial information-gathering technique.

A hot site is fully configured with live data and ready for immediate use, while a warm site has hardware installed but requires time to configure and restore data before operations can resume.

No. Replication is a data process, not a recovery location. A hot site provides immediate operational capacity, whereas replication alone still requires a target site to be activated and configured.

It can work, but DHCP reservations are preferred because they centralize management in the DHCP server, making it easier to track and modify assignments without touching each device.

Functionally similar for the client, but reservations keep IP management within the DHCP scope, simplifying documentation and reducing configuration errors on endpoints.

Dual Stack runs both IPv4 and IPv6 simultaneously on devices. NAT64 allows IPv6-only devices to communicate with IPv4-only resources by translating the packets at the network boundary, requiring no IPv4 stack on the client.

No. GRE encapsulates packets but does not translate the IP header version. An IPv6-only client sending a GRE tunnel still needs an IPv6 path, and the endpoint would need to handle the translation separately.

Technically yes, but routers forward packets based on IP routes to different networks, not specifically to balance load across a pool of identical servers. That is the specialized function of a load balancer.

A switch connects devices within a local network using MAC addresses. A load balancer sits in front of servers and distributes incoming network traffic across multiple backend targets to ensure no single server becomes overwhelmed.

LDAP (Lightweight Directory Access Protocol) typically uses port 389 and sends data in cleartext. LDAPS (LDAP over SSL/TLS) uses port 636 and encrypts the communication channel, providing confidentiality and integrity.

Port 389 is the default for unencrypted LDAP. While StartTLS can be used on 389 to upgrade to encryption, LDAPS on port 636 establishes an encrypted connection from the start, making it the direct answer for 'secure LDAP' configurations.

The most common approaches are Top-Down (starting at Layer 7), Bottom-Up (starting at Layer 1), and Divide-and-Conquer (splitting layers based on symptoms).

No, but it significantly increases the likelihood of finding the root cause faster by eliminating irrelevant tests and focusing efforts where they are most needed.

An Exclusion removes an IP from the pool so DHCP never assigns it. A Reservation tells DHCP to always assign a specific IP to a specific MAC address. Exclusions are for static/manual config; Reservations are for DHCP-managed static-like config.

Technically yes, if you want the printer to get its IP from DHCP. But if you want to configure the IP manually on the printer itself, you MUST use an Exclusion first, otherwise DHCP might lease that IP to another device.

No, DHCP is an application-layer protocol (Layer 7) that uses UDP ports 67 and 68. However, it delivers IP configurations to the Network layer.

MAC addresses are physical addresses handled by the Data Link layer, while IP addresses are logical addresses handled by the Network layer.

Active-Passive has one site handling traffic and another standing by for failover, while Active-Active distributes traffic across multiple sites simultaneously for higher load balancing and redundancy.

No. Replication keeps data current, but you also need a defined strategy (like active-passive) and the infrastructure to execute the failover quickly when a disaster strikes.

ACLs are typically implemented on routers or firewalls. Configuring them to control wireless client access often requires additional complexity like VLANs or RADIUS, making MAC filtering on the AP itself simpler.

MAC filtering is easy to spoof and is not considered a strong security measure. However, the question asks for the 'simplest' way to limit access, not the most secure.

iBGP routes are assigned a higher AD (200) because they originate within the same autonomous system, whereas eBGP (20) is considered more trustworthy as it comes from outside.

OSPF (Open Shortest Path First) has an administrative distance of 110, making it more trusted than iBGP but less than eBGP and IS-IS.

Standard 2.4 GHz Wi-Fi uses 20 MHz channel widths. To avoid spectral overlap, channels must be spaced 5 units apart (e.g., 1, 6, 11). Adjacent channels like 1 and 2 share significant frequency bands, causing interference.

IoT devices often use simpler, cheaper radios with lower sensitivity and slower processing. They struggle more than modern smartphones to recover from packet collisions and noise caused by co-channel interference, leading to noticeable drops.

ESP can authenticate the payload and the outer header, but AH (Authentication Header) is specifically designed for full header authentication including the IP header itself.

No, GRE is a tunneling protocol that encapsulates packets but does not provide encryption or authentication by default; it must be paired with IPSec or similar for security.

Authentication verifies who you are (e.g., password, MFA), while authorization determines what resources you can access after being verified (e.g., ACLs, RBAC).

No. Least Privilege is an authorization principle that limits user access rights to the minimum necessary for their job function.

While it helps recycle IPs, excessively short lease times can increase DHCP traffic overhead and may cause connection drops if clients move between access points before renewing. A balanced time (e.g., 15-60 mins) is ideal for guest networks.

The question specifies a 'fixed pool' constraint, implying technical limitations like NAT boundaries, ISP restrictions, or IPv4 scarcity. The engineer must optimize existing resources rather than expand them.

Yes. Both the source device and the receiving switch/router must support and have Jumbo frames enabled with matching MTU sizes. Mismatched MTUs will lead to dropped packets or fragmentation.

It can reduce latency for large file transfers by decreasing the number of packets processed. However, for small packets, the larger frame size might add slight transmission delay, though this is negligible in modern hardware.

While RJ45 dominates modern Ethernet, BNC is critical for understanding legacy networks (like 10Base2), video surveillance (CCTV), and RF equipment, all of which appear on the exam.

RJ11 typically has 2-4 pins and is used for telephone lines. RJ45 has 8 pins and is used for Ethernet data. Both use twisted pair, unlike coaxial.

You technically can, but it is not a best practice. Extended warranties often only cover hardware failure, not security patches. Using unsupported devices leaves your network vulnerable to exploits that will never be fixed.

Decommissioning involves securely erasing all data from the device, removing it from network monitoring and access controls, and updating inventory records to reflect that the device is no longer in active service.

Run 'arp -a' in the command prompt or terminal. Look for the IP address causing the conflict and note the corresponding MAC address listed next to it.

While tcpdump can capture packets showing duplicate IP announcements, it requires parsing large amounts of data. The ARP cache already contains the resolved mapping, making it much faster.

VoIP phones typically use IEEE 802.1Q tagging. They tag their own voice packets with a specific Voice VLAN ID and pass untagged data packets from the connected laptop to the switch's native Data VLAN.

Laptops on the Voice VLAN may lose access to local data resources like printers and file servers, as these VLANs are often restricted via ACLs or lack proper routing for data services.

In-band management uses the same network infrastructure (production network) as regular traffic (e.g., SSH, HTTP). Out-of-band management uses a separate, dedicated channel (e.g., cellular, serial console server) that operates independently of the production network, ensuring access even during major network outages.

No. A console cable provides direct, local physical access to the device's CLI. It does not transmit data over the network, so it cannot be used from a remote location unless paired with a remote terminal server or KVM-over-IP solution, which would then fall under out-of-band management.

MFA typically verifies human users through multiple factors like passwords and OTPs. It does not inherently verify the hardware identity of a device unless combined with other mechanisms like certificate-based auth.

PKI issues digital certificates to devices. Protocols like 802.1X use these certificates to prove the device's identity to the network before granting access, ensuring only trusted hardware connects.

A static route has an administrative distance of 1, making it the most trusted routing source by default.

BGP has a high AD (200 for iBGP) because it is designed for policy-based routing across different autonomous systems, where manual configuration and policy are prioritized over automatic preference.

It typically indicates a DNS resolution problem. The network path is valid, but the browser cannot translate the domain name into an IP address.

nslookup queries a DNS server directly to check if a hostname resolves to an IP address. It helps isolate whether the issue is with the client's cache, the DNS server, or the record itself.

In RBAC, access is granted based on predefined job roles (e.g., Admin). In DAC (Discretionary Access Control), the resource owner decides who gets access (e.g., a manager approving a request).

Option C describes Multifactor Authentication (MFA), which is an authentication mechanism, not an authorization model like RBAC.

Telnet transmits all data, including passwords, in plaintext, making it vulnerable to sniffing. SSH encrypts the session, providing security.

Generally no. RDP is for graphical remote control of Windows PCs. Network devices typically use CLI via SSH or web GUIs via HTTPS.

No. The first octet still determines the address class, so a Class B address remains Class B. The /17 mask only changes the subnet boundary and creates two /17 subnets from the original /16 block.

CompTIA uses VLSM for using a non-default mask to divide address space. Here the Class B default /16 is replaced by /17, borrowing one host bit; the same principle supports different subnet sizes across a network.

Borrowing 1 bit creates 2^1 = 2 subnets. Each /17 subnet has 2^15 - 2 = 32,766 usable host addresses.

SR means short reach and is the standard designation for short-wavelength multimode optics. An SFP provides the duplex LC interface that an LC/LC cable expects, so B matches both the fiber type and connector.

Usually not for this scenario. Common QSFP SR4 optics use MPO/MTP connectors and four lanes, while an LC/LC cable is a duplex LC pair; choosing QSFP adds a form-factor mismatch and unnecessary complexity.

SR optics are designed for short-reach multimode fiber, while LR optics are designed for long-reach single-mode fiber. The labels describe reach and fiber compatibility, not just the connector type.

An NSG can be associated with a single VM's network interface, so its rules affect only that server. A network ACL is applied at the subnet boundary and therefore affects every resource in the subnet.

No. A NAT gateway provides outbound source address translation for private resources and does not act as a per-server inbound firewall.

No. A VPC is the overarching virtual network; resources in the same subnet still share that subnet boundary. Per-server isolation requires a NIC-level NSG/security group or host firewall.

SNMPv1/v2c agents authenticate managers with community strings, and a read-only community string lets the NMS retrieve OIDs without changing device configuration.

Yes, some SIEMs are open source and have dashboards, but they typically collect logs and events rather than using SNMP community strings, so they miss a stated requirement.

LLDP advertises neighbor and port information at Layer 2, but it does not provide read-only users, community-string authentication, or the polling data model expected by an SNMP-based dashboard.

Modern SMB uses TCP port 445 directly for Windows file and printer sharing. Port 445 is the transport endpoint for the SMB protocol, so the protocol name and its port form the matching pair.

Yes, if an FTP service is installed, but FTP is a separate file-transfer service and not the native Windows network-share mechanism described in the question.

No. HTTPS can download files from web servers over TCP 443, but it does not provide SMB-style access to shared folders on a Windows network.

DHCP DISCOVER is sent as a local Layer 2 broadcast to 255.255.255.255, and routers do not forward broadcasts between subnets by default. An IP helper address on the new segment's default gateway relays the request as unicast to the remote DHCP server.

Configure it on the Layer 3 interface or SVI that serves the clients' VLAN, pointing to the DHCP server's address. Configuring it only on the server-facing link does not relay requests from the new client subnet.

No. Lease time controls how long an assigned address remains valid; it does not make the initial DISCOVER cross a router. If the server never receives the request, check the IP helper, routing, and the server scope for the new subnet.

An MDF is the main entrance cross-connect where carrier facilities meet the building's internal cabling; an IDF is a subordinate distribution frame that fans out to end-user areas, often on each floor.

No. A connection between a Layer 2 switch and a patch panel is a horizontal distribution or patching point in an equipment room, not the main service-provider demarcation represented by an MDF.

An MDF does not sit between two service providers; it terminates the provider's demarcation and distributes service into the customer's LAN/backbone, so the provider-to-customer boundary is the relevant location.

It lists IP-to-MAC mappings cached on the host. After clearing the cache and pinging the duplicate address, the MAC shown can be matched against switch MAC tables to find the physical port.

No. Ping only shows that the address is reachable; it does not reveal the MAC address. Ping can provoke an ARP resolution that populates the cache, but arp reads the mapping.

Search the switch MAC address table for that MAC to identify the port, then trace the cable or use authentication logs to find the host.

A VFL only confirms continuity and visible termination quality. If TX and RX are swapped, or the transceiver pairing is wrong, light may still pass but the link cannot come up.

Check the patch-panel and connector labeling, then swap the transmit and receive strands at one end. Confirm that link lights and interface status change before replacing hardware.

Yes, an SFP with the wrong wavelength, reach, or media type can prevent a link. However, with one failed run and a VFL-verified termination, transposed TX/RX is the more likely first check.

VoIP is real-time and cannot tolerate variable delay; QoS puts voice in a priority or low-latency queue so downloads and web traffic do not cause jitter, latency, or packet loss.

No. A VPN encrypts and tunnels traffic but does not classify or schedule voice packets ahead of other traffic; QoS is still needed on the voice path.

Users may report choppy audio, delay, or dropped words during congestion; those symptoms point to jitter, latency, and packet loss that QoS is designed to control.

The Network layer, Layer 3, is associated with packets. Routers and Layer 3 switches operate at this layer and make forwarding decisions based on IP addresses.

The Data link layer, Layer 2, uses frames and MAC addressing. Packets are Layer 3 protocol data units, so packet troubleshooting points to Network layer devices rather than Layer 2 switches.

Routers and Layer 3 switches are the primary devices because they inspect IP addressing and route packets between networks or subnets.

A firewall rule conflict usually causes a hard failure such as blocked registration or one-way audio, not uniform latency alongside healthy web, file transfer, and speed-test results. QoS misconfiguration directly explains impaired real-time voice while data traffic remains normal.

Dropped calls, audio latency, and jitter after calls connect, with normal data transfers and web traffic, suggest queueing or prioritization issues. An incorrect voice VLAN or spanning-tree loop more often breaks registration, addressing, or general connectivity.

Confirm voice traffic is marked with the intended DSCP value, the switch and router trust the phone or boundary markings, and voice queues are enabled on WAN and uplink interfaces.

No. A PDU distributes utility power to outlets; unless it is backed by a UPS or generator, it does not keep switches running when the building loses power.

Separate circuits reduce the chance that one breaker trip takes down both switches, but they do not protect against a site-wide power outage; both circuits still depend on utility power.

It provides battery runtime for both, but the UPS is a single point of failure; maximum uptime uses separate UPSs on separate circuits where possible.

STP uses shielding and twisting to reduce crosstalk in electrical copper signals, so interference can still couple. Multimode fiber carries light, so it is immune to crosstalk and EMI rather than merely resistant.

802.11ax is a wireless LAN standard, not a cable or fiber medium. It also shares radio spectrum, so it cannot provide the crosstalk immunity and deterministic high throughput described.

No; single-mode fiber can exceed it over longer distances. Here, multimode is the only fiber option and cost/distance limits are removed, so it still beats STP, Cat 6 and 802.11ax on the stated criteria.

On-demand scalability is a general cloud characteristic; public cloud usually provides greater elasticity and less commitment, so it does not distinguish private from public deployment.

No. A private cloud can be hosted by a third party or built on-premises, as long as the infrastructure is dedicated to a single organization and governed by that organization.

Control over hardware configuration, network segmentation, security policies, data residency, performance tuning and compliance evidence.

Limiting TCP 3389 to the jump host reduces exposed RDP surface; administrators connect to that controlled host and then manage other systems from it rather than opening RDP to every server.

636 is LDAPS for directory queries over TLS, 1433 is the default Microsoft SQL Server database port, and 5061 is SIP over TLS for voice signaling; none is the default RDP port.

Prefer VPN, zero-trust access, or a bastion with MFA; if RDP must be reachable, restrict source IPs and monitor logons because internet-exposed RDP is a common attack target.

Backups are a recovery control: after a security incident corrupts or encrypts production data, the organization can restore a clean copy. Scans, antivirus, and IDS may reduce or detect attacks but do not replace that restoration capability.

They can belong in the broader incident response or security program, but they are not the must-have DR step asked about here. DR specifically needs restoration capabilities such as backups, tested restores, and recovery procedures.

Include restore testing, backup frequency and retention, offline or immutable copies, recovery time objectives, and documented restoration procedures. Backups are only effective if the organization can restore them within the required timeframe.

Class D covers 224.0.0.0 through 239.255.255.255 (224.0.0.0/4). Addresses in this range are used as multicast group destinations, not as normal host unicast addresses.

Anycast assigns the same unicast address to multiple nodes and routes each client to the nearest instance. Multicast uses a Class D group address and delivers one stream to all subscribed receivers.

No. Class D addresses are reserved for multicast destinations. A host sending multicast traffic uses its normal unicast source address and a Class D destination address.

A static route only tells a device where a remote subnet is reachable; it does not create a Layer 3 gateway for each VLAN. Inter-VLAN routing requires an interface or SVI per VLAN with an IP address.

If the switch is Layer 2 only, a router with 802.1Q subinterfaces on a single physical routed interface can provide per-VLAN gateways. The options here list SVI, the switch-side equivalent.

No. NAT translates addresses and full duplex affects link operation; neither provides Layer 3 routing or a per-VLAN default gateway.

Dual stack lets clients use native IPv4 or IPv6 without translation, while NAT64 is for IPv6-only networks reaching IPv4 and adds translation complexity. The requirement is to serve both protocols, not to translate between them.

No. SLAAC only configures IPv6 addresses on hosts; it does not run an IPv4 stack or make a CDN answer IPv4 and IPv6 clients.

QoS prioritizes and manages traffic; it does not provide IPv6 connectivity or dual-stack delivery. It is unrelated to this requirement unless a separate performance policy is needed.

Port mirroring only duplicates selected traffic to a monitoring port. A packet capture tool still must record and analyze that traffic, so mirroring enables capture but does not itself identify the cause in real time.

It can show retransmissions, out-of-order packets, TCP window changes, resets, dropped packets, and latency between the user and the specific server, helping pinpoint the performance cause.

No. Syslog provides event logs and baseline metrics show normal trends or thresholds; they indicate that something changed but do not dissect the live packet exchange causing the current issue.

Because the port's allowed MAC list is tied to that interface; when the same MAC appears on a different port or an unapproved MAC appears, the configured violation action is triggered.

No. An ACL filters IP or Layer 4 traffic after the device is connected and does not bind an endpoint identity to a physical switch port.

Shutdown is the strictest: it err-disables the port when an unapproved MAC appears, requiring IT intervention to restore service.

MX records tell sending servers where to deliver mail for a domain; they do not map the relay's IP address to a hostname. Reverse DNS lookups query PTR records, so an MX record cannot satisfy the check.

It should map the relay's public IP address to the relay's canonical FQDN. The matching forward A or AAAA record should resolve that FQDN back to the same IP for forward-confirmed reverse DNS.

No. DNSSEC signs and validates existing DNS data; it does not add the missing reverse-zone PTR entry. You still need to create the PTR record for the relay's IP.

WPA2 uses a pre-shared key and is supported by most IoT devices. 802.1X requires a RADIUS/AAA server and device supplicant configuration, which is costly and often unsupported in homes.

It lets one SSID steer dual-band phones and laptops to 5 GHz, reducing contention on 2.4 GHz where most smart home IoT devices operate.

No. WEP is deprecated and easily cracked; use WPA2 and replace devices that only support WEP, or isolate them if unavoidable.

Utilization is a quick link-level metric from monitoring or SNMP and can immediately show saturation. A speed/duplex mismatch is a specific root cause that should be tested after the scope is narrowed.

Jitter measures variation in delay and is often a symptom of congestion or queuing, but it does not by itself identify the faulty link or configuration. Utilization and error counters do that faster.

Check CRC and frame errors, discards, buffer overflows, and drop counters on the upgraded links. Rising counters point to a physical, duplex, or device-processing problem.

A classic DoS flood consumes the network path’s capacity so legitimate traffic cannot get through. Storage becomes the main issue only in attacks that specifically fill disks or logs, not in a generic traffic flood.

It can in specific cases where many connections exhaust NAT translation entries, but that is a secondary or scenario-specific effect. The question asks for the most likely resource affected by a successful DoS, which is bandwidth.

No. A single source flooding a target is still a DoS; DDoS specifically involves many distributed sources. Both can saturate bandwidth and deny service to legitimate users.

It places the receiving port into the err-disabled state, which blocks traffic until the port is manually recovered or err-disable recovery is configured. BPDU Guard is meant for ports connected to end devices, not other switches.

Line protocol down means Layer 1 is up but Layer 2 is not operational. BPDU Guard responds to a valid BPDU by err-disabling the port, so the operational status is error disabled rather than just line protocol down.

Remove the condition that caused it—here, disconnect the switch or remove BPDU Guard from that access port—then shut and no shut the interface, or enable errdisable recovery. Verify the cause with show interfaces status err-disabled.

Two bits still leave 62 usable hosts, but the standard exam interpretation asks for the minimum host bits that meet the 20-host requirement. Five host bits, or three borrowed bits, satisfy it while maximizing subnets.

Borrowing three bits leaves five host bits, so each subnet has 2^5 − 2 = 30 usable host addresses. The three borrowed bits create eight subnets.

No. Each subnet reserves one address for the network identifier and one for broadcast, so use 2^h − 2 when checking usable hosts.

It sends the remote client's default route into the VPN tunnel, so both corporate and internet-bound traffic go to the corporate edge for inspection instead of directly to the internet.

Yes. Clientless VPN uses a browser portal and does not install or start a VPN client on the laptop; the startup bullet points toward remote-access client software.

Site-to-site connects entire networks, such as a branch to headquarters; it does not provide a per-laptop client that starts at boot or route each remote user's traffic through the corporate firewall.

MAC filtering can restrict hardware addresses, but on a switched wired network that control is typically implemented through port security. Port security also provides per-port MAC limits, sticky learning, and violation actions that immediately restrict or disable the port when an unknown device appears.

It applies the configured violation mode, such as shutdown, restrict, or protect. Shutdown places the port in an error-disabled state, restrict drops unauthorized traffic and can generate notifications, and protect silently drops unauthorized traffic.

Disable unused ports, use 802.1X or network access control where practical, and monitor port-security violations. These controls reduce the chance that a lobby or meeting-room port becomes an unmanaged entry point.

Verification happens after a solution is implemented and confirms full system functionality. Before a fix exists, OSI-layer checks are used to isolate where communication fails and form a theory of probable cause.

They are ordered approaches to the layered model: start at Application and move down, or start at Physical and move up. CompTIA lists both under establishing a theory for layered technologies such as networks.

No. It means using the identified symptoms, questioning the obvious, and considering structured approaches such as OSI layer checks to narrow down the most likely cause before testing it.

Enterprise authentication can validate users, but it normally requires pre-provisioned accounts, certificates, or 802.1X infrastructure and is aimed at managed employees and devices. A captive portal provides a self-service guest login or terms-acceptance step without that permanent identity setup.

No. WPA3 secures and authenticates the wireless link, but it does not present a per-guest login, registration page, or terms-acceptance step; those are captive portal functions.

It intercepts a new client's web traffic and redirects the browser to a page requiring credentials, registration, or terms acceptance before normal network access is granted. Access can then be time-limited or scoped to a guest network.

The hosts file is local to each computer, so an incorrect mapping overrides DNS only for that host; shared nameserver records would affect every client using the resolver.

If multiple users—or every client using the same DNS server—resolve the site to a wrong or missing address, suspect the nameserver record or zone data rather than one client's hosts file.

No. It causes browser certificate warnings after the client connects, not an incorrect IP address mapping during name resolution.

Multitenancy requires a shared application instance or infrastructure with isolated tenant data. The stem only describes making the application available to two user groups, not sharing one instance or isolating customer data.

No. SaaS is a delivery model; a provider can offer SaaS as a single-tenant or multitenant service. Multitenancy is an implementation choice, not the definition of SaaS.

A VPC is an isolated virtual network inside a cloud provider, used for subnets, routing, and security boundaries. It would fit a question about network isolation, not about delivering an application to users.

SSH is in-band; it needs the appliance OS, network stack, and management IP to be running. If the device is unbootable, SSH has no service to connect to, so out-of-band management is required.

Usually no. A jump box is a hardened host used to reach managed devices over the production network; if the appliance is down or the network path is broken, it cannot help.

A crash cart is for on-site physical access, such as connecting a monitor and keyboard to a failed appliance. It can fix local boot issues but is not a remote access solution.

Netstat reports local and remote socket details on the host. On a workstation behind NAT or a dual-WAN router, those addresses do not identify the router's chosen WAN egress link; tracert's hop sequence does.

It records the first responding router after the default gateway and later ISP hops. If each internet link uses a distinct gateway or ISP path, the trace shows which path the probes follow.

Ping can show reachability and round-trip latency but not the route, and nslookup resolves DNS names only. Neither exposes which WAN link is carrying the application flow.

An ACL filters routed or switched traffic by IP address, port, or protocol, but it does not bind the switch access port to a specific device MAC address. Port security enforces that Layer 2 admission rule.

It compares the source MAC address in frames arriving on the port with a static or sticky secure MAC list configured for that interface. A different MAC address triggers the configured violation action.

No. It only controls which MAC addresses may use the port; traffic from an allowed device still needs VLAN segmentation, ACLs, monitoring, and other security controls.

When two devices answer for 192.168.1.10, ARP entries can point to either MAC address, so traffic sometimes goes to the wrong host and the user sees intermittent drops.

A VLAN mismatch can block traffic on a port, but it does not explain why the ARP table lists 192.168.1.10 with two different MAC addresses on eth4 and eth6.

Trace the second MAC address to its switch port, locate that device, and change its static address or remove it so only the legitimate host uses 192.168.1.10.

TCP 53 is used for zone transfers and for retrying queries when a UDP response is truncated. Blocking only TCP 53 can leave small queries working while larger responses or zone transfers fail.

The extra FTP, SSH, SNMP, and LDAP/LDAPS listeners are hardening findings, not the cause of the DNS reachability problem. Closing them would not explain or fix a TCP 53 block.

Usually no. 802.1X is port-based access control and normally blocks all IP access until authentication, rather than leaving UDP 53 open and closing only TCP 53.

Evil twin requires a rogue wireless access point impersonating a legitimate SSID, and the stem never describes one. The VPN changing the page shows interception or redirection, so the directly supported answer is D, on-path attack.

You would need signs of manipulated IP-to-MAC mappings, such as a duplicate MAC or poisoned ARP cache, causing local redirection. The scenario gives no ARP evidence, only a VPN fixing the bank page.

The VPN encrypts traffic from the executive to the VPN endpoint, so a hotel-side attacker cannot read or alter the bank session. When the real page and login work through the tunnel, the interference was on the local path.

An inline IDS must fully inspect each packet before forwarding it. Under heavy rule sets or high throughput, the accumulated processing delay pushes exchanges past protocol timers, so the sender declares a timeout and the traffic is lost.

Yes, but through a different mechanism: congested queues are trimmed or policed traffic is discarded. That is queue-based loss under congestion, not loss caused by exceeding a timeout, so it does not satisfy this question.

A CDN shortens the client-to-content path with edge caching, reducing timeout risk. A load balancer adds a hop but forwards at line rate, so its typical failures are resets or unhealthy pool members rather than timeout-driven packet loss.