Jason Dion - CompTIA Network+ N10-008 Exam Prep #2

Question 1

What port number does LDAP utilize?

A.3389
B.1433
C.389
D.636

Answer 1

C.389

OBJ-1.5: The Lightweight Directory Access Protocol (LDAP) uses port 389 and is an open, vendor-neutral, industry-standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. The Lightweight Directory Access Protocol Secure (LDAPS) uses port 636 and is an open, vendor-neutral, industry-standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network that is encrypted using an SSL connection. Microsoft SQL uses ports 1433 and is a proprietary relational database management system developed by Microsoft that is fully compatible with the structured query language (SQL). Remote Desktop Protocol (RDP) uses port 3389 and is a proprietary protocol developed by Microsoft which provides a user with a graphical interface to connect to another computer over a network connection.

Question 2

A network engineer is conducting an assessment for a customer who wants to implement an 802.11ac wireless network. What should the engineer reference before estimating the number of WAPs (Wireless Access Point) required?

A.Site survey
B.PoE requirements
C.Network topology
D.Network diagram

Answer 2

A.Site survey

OBJ-3.2: Since it is a wireless network, a review of a site survey is necessary to determine any physical advantages and disadvantages. Network topology and network diagrams can be created once the site survey is complete, and the location of the access points is determined based on distance and expected coverage requirements. The purpose of a wireless site survey is to look at the feasibility of each individual wireless link to provide seamless connectivity for a wireless network.

Question 3

You typed IPCONFIG at the command prompt and find out your IP is 192.168.1.24. You then go to Google.com and search for “what is my IP,” and it returns a value of 35.25.52.11. How do you explain why your computer has two different IP addresses?

A.This is caused by how a switch handles IP (Internet Procol) addresses
B.This is caused because your gateway is conducting NAT (Network Address Translation) or PAT (Port Address Translation)
C.This is caused by the way traffic is routed over the Internet
D.This is caused because of the way routers handle IP addresses

Answer 3

B.This is caused because your gateway is conducting NAT (Network Address Translation) or PAT (Port Address Translation)

OBJ-1.4: Your computer network uses a private IP address for machines within the network and assigns a public IP address for traffic being routed over the network using either NAT or PAT. Most small office home office (SOHO) networks utilize a single public IP for all of their devices and use a technique known as PAT to associate the public IP with each internal client’s private IP when needed. Network Address Translation (NAT) and Port Address Translation (PAT) allow multiple devices on a LAN to be mapped to a single public IP address to conserve IP address. In NAT, private IP addresses are translated into public IP addresses. In PAT, private IP addresses are translated into a single public IP address and their traffic is segregated by port numbers.

Question 4

Dion Training has created a guest wireless network for students to use during class. This guest network is separated from the corporate network for security. Which of the following should be implemented to require the least amount of configuration for a student to access the Internet over the guest network?

A.Configure the access point to 802.1x for authentication
B.Enable two-factor authentication on the student’s device
C.Enable SSID (Secure Set IDentifier) broadcast for the guest wireless network
D.Configure WEP (Wired Equivalent Privacy) with a pre-shared key

Answer 4

C.Enable SSID (Secure Set IDentifier) broadcast for the guest wireless network

OBJ-2.4: Since security was not listed as a requirement for the guest wireless network, it would be easiest not to set up any encryption, passwords, or authentication mechanisms on the network. Instead, you should enable the SSID broadcast for the guest network so students can easily find and connect to it. Using two-factor authentication, 802.1x, or WEP would require the students to complete additional configurations prior to connecting to the guest network.

Question 5

A network administrator recently set up a network computer lab and discovered some connectivity issues. The administrator can ping the fiber uplink interface, but none of the new workstations plugged into the switch are responding to the technician’s ICMP requests. Which of the following actions should the technician perform next?

A.Verify the ports on the switch are full-duplex
B.Determine if the link lights are lit for the ports
C.Determine if port security is enabled on the ports
D.Verify that the uplink interface is configured correctly

Answer 5

C.Determine if port security is enabled on the ports

OBJ-5.2: A technician can use the LEDs on the switchports to quickly monitor activity and performance for the interfaces. By determining if the link lights are lit for the ports, the administrator can verify if there is any activity on the network, if the ports are enabled, and if the Layer 1 components are working properly. Additionally, some switches have LEDs to indicate if the switchport is operating in half-duplex or full-duplex, and the speed of the link.

Question 6

A network engineer is designing an 802.11g wireless network that uses three wireless access points for complete coverage. Which of the following channel selections would result in the LEAST amount of interference between each access point?

A.Adjacent access points should be assigned channels 4,8, and 12 with a 40 MHz channel width
B.Adjacent access points should be assigned channels 2,6, and 10 with a 20 MHz channel width
C.Adjacent access points should be assigned channels 7,9, and 11 with a 40 MHz channel width
D.Adjacent access points should be assigned channels 1,6, and 11 with a 20 MHz channel width

Answer 6

D.Adjacent access points should be assigned channels 1,6, and 11 with a 20 MHz channel width

OBJ-5.4: Because the overlapping signals are from access points from unrelated non-overlapping channels, the access points are least likely to interfere with each other. For Wireless B and G networks, you should always use channels 1, 6, and 11 to ensure you are using non-overlapping frequencies.

Question 7

Your network relies on the use of ATM (Asynchronous Transfer Mode) cells. At which layer of the OSI (Open Systems Interconnect) model do ATM cells operate?

A.Data link
B.Transport
C.Session
D.Network

Answer 7

A.Data link

OBJ-1.1: In the data link layer (layer 2) of the OSI model, the basic unit of transfer is called a frame. In an ATM network, though, these frames are called cells and are of a fixed (53 octets or bytes) length that allows for faster switching of the cells across the network.

Question 8

Your company has just finished replacing all of its computers with brand new workstations. Colleen, one of your coworkers, has asked the company’s owner if she can have the old computers that are about to be thrown away. Colleen would like to refurbish the old computers by reinstalling a new operating system and donating them to a local community center for disadvantaged children in the neighborhood. The owner thinks this is a great idea but is concerned that the private and sensitive corporate data on the old computer’s hard drives might be placed at risk of exposure. You have been asked to choose the best solution to sanitize or destroy the data while ensuring the computers will still be usable by the community center. What type of data destruction or sanitization method do you recommend?

A.Shredding
B.Wiping
C.Degaussing
D.Purging

Answer 8

B.Wiping

OBJ-4.5: Data wiping or clearing occurs by using a software tool to overwrite the data on a hard drive to destroy all electronic data on a hard disk or other media. Data wiping may be performed with a 1x, 7x, or 35x overwriting, with a higher number of times being more secure. This allows the hard drive to remain functional and allows for hardware reuse. Degaussing a hard drive involves demagnetizing a hard drive to erase its stored data. You cannot reuse a hard drive once it has been degaussed. Therefore, it is a bad solution for this scenario. Purging involves removing sensitive data from a hard drive using the device’s internal electronics or an outside source such as a degausser, or by using a cryptographic erase function if the drive supports one. Shredding involves the physical destruction of the hard drive. This is a secure method of destruction but doesn’t allow for device reuse.

Question 9

Which of the following authentication protocols was developed by Cisco to provide authentication, authorization, and accounting services?

A.TACACS+ (Terminal Access Controller Access Control System)
B.RADIUS (Remote Authentication Dial-In User Service)
C.Kerberos
D. CHAP (Challenge-Handshake Authentication Protocol)

Answer 9

A.TACACS+ (Terminal Access Controller Access Control System)

OBJ-4.1: TACACS+ is an extension to TACACS (Terminal Access Controller Access Control System) and was developed as a proprietary protocol by Cisco. The Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that operates on port 1812 and provides centralized Authentication, Authorization, and Accounting management for users who connect and use a network service, but Cisco did not develop it. Kerberos is a network authentication protocol designed to provide strong mutual authentication for client/server applications using secret-key cryptography developed by MIT. Challenge-Handshake Authentication Protocol (CHAP) is used to authenticate a user or network host to an authenticating entity. CHAP is an authentication protocol but does not provide authorization or accounting services.

Question 10

Jason has just connected his new AirPods to his iPhone to listen to his music wirelessly. Which of the following types of networks is he using?

A.(Campus Area Network; CAN-2)
B.WAN (Wide Area Network)
C.LAN (Local Area Network)
D.PAN (Personal Area Network)

Answer 10

D.PAN (Personal Area Network)

OBJ-1.2: A personal area network (PAN) is centered around a short distance, usually around a person or up to a few meters. PANs are heavily used with Bluetooth and NFC. A local area network (LAN) connects computers within a small and specific area geographically. A campus area network (CAN) is a computer network that spans a limited geographic area. CANs interconnect multiple local area networks (LAN) within an educational or corporate campus. A wide area network (WAN) will typically cover a larger area geographically, such as a continent, a state, or a country.

Question 11

IPv4 addresses are written using Base 10 numbers, while IPv6 addresses are written in Base 16 numbers. What type of notation does Base16 utilize?

A.Decimal
B.Hexadecimal
C.Binary
D.Octet

Answer 11

B.Hexadecimal

OBJ-1.4: Hexadecimal (or Hex for short) is the system of numbering that uses Base16. This includes the numbers 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, and F. All IPv6 addresses and MAC addresses are written in hexadecimal format.

Question 12

Which of the following provides accounting, authorization, and authentication via a centralized privileged database, as well as challenge/response and password encryption?

A.TACACS+ (Terminal Access Controller Access Control System)
B.Multi-factor authentication
C.Network access control
D.ISAKMP (Internet Security Association and Key Management Protocol)

Answer 12

A.TACACS+ (Terminal Access Controller Access Control System)

OBJ-4.1: TACACS+ is a AAA (accounting, authorization, and authentication) protocol to provide AAA services for access to routers, network access points, and other networking devices. TACACS+ is a remote authentication protocol, which allows a remote access server to communicate with an authentication server to validate user access onto the network. TACACS+ allows a client to accept a username and password, and pass a query to a TACACS+ authentication server. Multifactor authentication is an authentication scheme that works based on something you know, something you have, something you are, something you do, or somewhere you are. These schemes can be made stronger by combining them (for example, protecting the use of a smart card certification [something you have] with a PIN [something you know]). Network Access Control (NAC) is a means of ensuring endpoint security by ensuring that all devices connecting to the network conform to a health policy such as its patch level, antivirus/firewall configuration, and other factors. Internet Security Association and Key Management Protocol (ISAKMP) is used for negotiating, establishing, modification, and deletion of SAs and related parameters in the IPSec protocol.

Question 13

Your company has several small branch offices around the country, but you work as a network administrator at the centralized headquarters building. You need the capability of being able to remotely access any of the remote site’s routers to configure them without having to fly to each location in person. Your company’s CIO (Chief Information Officer) is worried that allowing remote access could allow an attacker to gain administrative access to the company’s network devices. Which of the following is the MOST secure way to prevent this from occurring while still allowing you to access the devices remotely?

A.Install an out-of-band modem
B.Create an out-of-band management network
C.Configure the remote router’s ACL (Access Control List) to only permit Telnet traffic
D.Configure the remote router’s ACL to only permit HTTP (HyperText Transfer Protocol) traffic

Answer 13

B.Create an out-of-band management network

OBJ-4.4: You should create an out-of-band management network and use an SSH (console) connection to reach the routers. Out-of-band (OOB) management is a method of remotely controlling and managing critical IT assets and network equipment using a secure connection through a secondary interface that is physically separate from the primary network connection. Telnet and HTTP are not encrypted channels and should not be used for remote connections. Using a modem is also a bad security practice since these are subject to war dialing and provide slow connectivity speeds.

Question 14

(This is a simulated Performance-Based Question.)
Which of the following is the correct order of the following Fiber Connectors shown?
A.ST, SC, LC (single), LC (duplex), FC
B.SC, ST, FC, LC (single), LC (duplex)
C.LC (single), LC (duplex), FC, ST, SC
D.FC, LC (single), LC (duplex), SC, ST

Answer 14

A.ST, SC, LC (single), LC (duplex), FC

OBJ-1.3: The correct order of the Fiber connections shown is ST, SC, LC (single), LC (duplex), and FC. If this were a real question on the exam, you would have the words provided in a list, and you would drag them below the appropriate fiber connector’s drawing.

Question 15

Which of the following is a connectionless protocol?

A.SSH (Secure SHell)
B.ICMP (Internet Control Message Protocol)
C.SSL (Secure Sockets Layer)
D.TCP (Transmission Control Protocol)

Answer 15

B.ICMP (Internet Control Message Protocol)

OBJ-1.5: A connectionless protocol is a form of data transmission in which data is transmitted automatically without determining whether the receiver is ready or even whether a receiver exists. ICMP, UDP, IP, and IPX are well-known examples of connectionless protocols. TCP, SSH, and SSL are all examples of connection-oriented protocols.

Question 16

Which of the following would require the network administrator to schedule a maintenance window?

A.A minor release upgrade of a production router
B.Rebooting the network administrator’s laptop
C.A company-wide email notification must be sent out
D.A major release upgrade of a core switch in a test lab

Answer 16

A.A minor release upgrade of a production router

OBJ-3.2: During an update of a production router, the router would not route packets, and the network traffic would be affected. Therefore, it would be necessary to announce a maintenance window. A maintenance window is a period of time designated in advance by the technical staff, during which preventive maintenance that could disrupt service is allowed to be performed.

Question 17

Your company has two office buildings which are connected via a copper network cable that is buried underground. There is some construction being performed near the buildings. Now, the second building discovers they have suffered a network outage that doesn’t appear to be temporary. What is the MOST likely cause of the outage?

A.Signal attenuation on the cable
B.Electromagnetic interference on the cable
C.Cross-talk on the cable
D.An open circuit has been created

Answer 17

D.An open circuit has been created

OBJ-5.2: Since the issue started after construction began, it is most likely that the construction crew broke the cable during digging operations. This can cause an open circuit or short circuit, depending on how the cable was cut or broken by the construction workers. This can be verified using a Time-Domain Reflectometer to determine exactly where in the cable the break has occurred. Once the location is identified, the cable can be repaired or spliced to return it to normal operations.

Question 18

Your router has been turning itself off and on again for a few weeks. You begin to think back to when these issues began to occur and remember that each time it happened the lights also dimmed momentarily. You hook up a device to monitor the power being supplied to the router and identify that brownouts are frequently occurring, resulting in the router’s power cycling. What should you (a network technician) do to solve this problem?

A.Install a UPS (Uninterruptable Power Supply)
B.Install a surge protector
C.Install a new electrical outlet
D.Install an upgraded router

Answer 18

A.Install a UPS (Uninterruptable Power Supply)

OBJ-3.3: The best solution would be to install a UPS. Since you are a network technician and not an electrician, you should not install a new electrical circuit. The primary function of UPS is to provide battery backup when the electrical power fails or drops to an unacceptable voltage level. It ensures that your electrical equipment gets a consistent current so damage and device power cycling do not occur. A surge protector defends against possible voltage spikes that could damage your electronics, appliances, or equipment. A network technician is not qualified to install a new electrical outlet since that is a job for an electrician. The scenario presents issues that focus on the power levels, therefore installing an upgraded router would not solve these issues.

Question 19

You have been asked by your supervisor, Tamera, to ensure that you enable 802.3af on a managed switch. Which of the following features does she want you to enable?

A.VLAN (Virtual Local Area Network)
B.Trunking
C.PoE (Power over Ethernet)
D.Port bonding

Answer 19

C.PoE (Power over Ethernet)

15.4W of DC power to each device. The IEEE 802.3at standard defines PoE+ and supports 25.5W of DC power to each device. Power over Ethernet or PoE technology describes a system to safely transfer electrical power, along with data, to remote devices over standard data cables in an Ethernet network. Port bonding, or link aggregation, is part of the 802.3ad standard. Port bonding is the combining of multiple network connections in parallel by any of several methods, in order to increase throughput beyond what a single connection could sustain, to provide redundancy in case one of the links should fail, or both. VLANs are part of the 802.1q standard. A virtual LAN (VLAN) is any broadcast domain that is partitioned and isolated in a computer network at the data link layer (OSI layer 2). Trunking is also covered by the 802.1q protocol and supports VLANs.

Question 20

Which of the following layers within software-defined networking focuses on resource requests or information about the network?

A.Infrastructure layer
B.Application layer
C.Management plane
D.Control layer

Answer 20

B.Application layer

OBJ-1.7: The application layer focuses on the communication resource requests or information about the network. The control layer uses the information from applications to decide how to route a data packet on the network and to make decisions about how traffic should be prioritized, how it should be secured, and where it should be forwarded to. The infrastructure layer contains the physical networking devices that receive information from the control layer about where to move the data and then perform those movements. The management plane is used to monitor traffic conditions, the status of the network, and allows network administrators to oversee the network and gain insight into its operations.

Question 21

You have just received an email regarding a security issue detected on the company’s standard web browser. Which of the following should you do to fix the issue?

A.Firmware update
B.Vulnerability patch
C.OS update (Operating System)
D.Driver update

Answer 21

B.Vulnerability patch

OBJ-4.3: Since there is a security issue with the current web browser, it most likely needs to be updated with a manufacturer’s vulnerability patch. A vulnerability patch is a piece of software that fixes security issues.

Question 22

A customer is trying to configure an 802.11b wireless card in an old laptop to connect to an 802.11g wireless router. When the customer scans for the wireless network’s SSID (Secure Set IDentifier) (Dion-Corp), it is not displayed within Windows. What is the MOST likely reason that the SSID is not being displayed?

A.The broadcast is disabled on the wireless router
B.The wireless router is not configured for DHCP (Dynamic Host Configuration Protocol) support
C.802.11g and 802.11b use different frequencies
D.The wireless router is configured with WPA2 (Wi-Fi Protected Access 2) encryption

Answer 22

A.The broadcast is disabled on the wireless router

OBJ-5.4: If the SSID (Secure Set Identifier) is disabled, then the wireless network name will not be broadcast to any available devices within range. Both Wireless B and G use the same frequency band (2.4 GHz) and would not cause this issue. Similarly, encryption that is enabled or disabled would not affect the SSID broadcast since the SSID is sent out in cleartext. DHCP support is used once a device connects to the network. Therefore it would not affect the SSID broadcast.

Question 23

A network administrator needs to allow employees to upload files to a remote server securely. What port must be allowed through the firewall?

A.25
B.21
C.22
D.161

Answer 23

C.22

OBJ-1.5: To securely upload a file, the employees could use SFTP (Secure FTP) or SCP (Secure Copy). Both SFTP and SCP operate over port 22, therefore port 22 must be opened by the firewall so that the employees can reach the file servers. Port 21 is used by the File Transfer Protocol, but it is not a secure method of sending files. There is a more secure version of FTP known as FTPS, but that uses port 990. Port 25 is reserved for the simple mail transfer protocol (SMTP), which is an internet standard communication protocol for electronic mail transmission. Port 161 is reserved for simple network management protocol (SNMP), which is a networking protocol used for the management and monitoring of network-connected devices in Internet Protocol networks.

Question 24

What remediation strategies are the MOST effective in reducing the risk to an embedded ICS (Internet Connection Sharing) from a network-based compromise? (Select TWO)

A.Patching
B.Segmentation
C.NIDS (Network-based Intrusion Detection System)
D.Disabling unused services

Answer 24

B.Segmentation
D.Disabling unused services

OBJ-2.1: Segmentation is the best method to reduce the risk to an embedded ICS system from a network-based compromise. Additionally, you could disable unused services to reduce the footprint of the embedded ICS. Many of these embedded ICS systems have a large number of default services running. So, by disabling the unused services, we can better secure these devices. By segmenting the devices off the main portion of the network, we can also better protect them. A NIDS might detect an attack or compromise, but it would not reduce the risk of the attack succeeding since it can only detect it. Patching is difficult for embedded ICS devices since they usually rely on customized software applications that rarely provide updates.

Question 25

A disgruntled employee executes an on-path attack on the company's network. Layer 2 traffic destined for the gateway is now being redirected to the employee’s computer. What type of attack is this an example of? A.ARP (Address Resolution Protocol) Spoofing B.Evil twin C.Reflective DNS (Domain Name System) D.IP (Internet Protocol) spoofing

Answer 25

A.ARP (Address Resolution Protocol) Spoofing OBJ-4.2: ARP spoofing (also known as ARP poisoning) is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker's MAC address with the IP address of a legitimate computer, server, or gateway on the network. A reflective DNS attack is a two-step attack used in DDoS attacks. The attacker sends a large number of requests to one or more legitimate DNS servers while using a spoofed source IP of the targeted victim. The DNS server then replies to the spoofed IP and unknowingly floods the targeted victim with responses to DNS requests that it never sent. An evil twin is a rogue wireless access point that masquerades as a legitimate Wi-Fi access point so that an attacker can gather personal or corporate information without the user's knowledge. IP spoofing is the creation of Internet Protocol (IP) packets that have a modified source address to either hide the identity of the sender, impersonate another computer system, or both.

Question 26

You work for a bank interested in moving some of its operations to the cloud, but it is worried about security. You recently discovered an organization called CloudBank that was formed by 15 local banks as a way for them to build a secure cloud-based environment that can be accessed by the 15 member banks. Which cloud model BEST describes the cloud created by CloudBank? A.Public cloud B.Community cloud C.Hybrid cloud D.Private cloud

Answer 26

B.Community cloud OBJ-1.8: Community Cloud is another type of cloud computing in which the cloud setup is shared manually among different organizations that belong to the same community or area. A multi-tenant setup is developed using the cloud among different organizations belonging to a particular community or group with similar computing concerns. For joint business organizations, ventures, research organizations, and tenders, a community cloud is an appropriate solution. Based on the description of 15 member banks coming together to create the CloudBank organization and its cloud computing environment, a community cloud model is most likely described. A public cloud contains services offered by third-party providers over the public Internet and is available to anyone who wants to use or purchase them. They may be free or sold on-demand, allowing customers to pay only per usage for the CPU cycles, storage, or bandwidth they consume. A private cloud contains services offered either over the Internet or a private internal network and only to select users instead of the general public. A hybrid cloud is a cloud computing environment that uses a mix of on-premises, private cloud, and third-party public cloud services with orchestration between these platforms. This typically involves a connection from an on-premises data center to a public cloud.

Question 27

You opened your web browser and attempted to visit DionTraining.com, but you appear to have been redirected to a malicious website instead. What type of attack is being conducted? A.Rogue DHCP (Dynamic Host Configuration Protocol) B.ARP (Address Resolution Protocol) spoofing C.VLAN (Virtual Local Area Network) hopping D.DNS (Domain Name System; phone book of the internet) poisoning

Answer 27

D.DNS (Domain Name System; phone book of the internet) poisoning OBJ-4.2: DNS spoofing or DNS poisoning is an attack that corrupts the Domain Name System data in the DNS resolver's cache and causes the name server to return an incorrect result record, such as an attacker’s IP address instead of the IP of the legitimate server. VLAN Hopping is an attack where the attacker is able to send traffic from one VLAN into another by either double tagging the traffic or conducting switch spoofing. ARP spoofing is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker's MAC address with the IP address of a legitimate computer, server, or gateway on the network. A rogue DHCP server is a DHCP server set up on a network by an attacker, or by an unaware user, and is not under the control of network administrators. Rogue DHCP servers are also commonly used by attackers for the purpose of network attacks such as an on-path or man-in-the-middle attack.

Question 28

A network technician is selecting the best way to protect a branch office from as many different threats from the Internet as possible using a single device. Which of the following should meet these requirements? A.Configure a UTM (Unified Threat Management) device B.Configure a host-based firewall C.Configure a network-based firewall D.Configure a NIDS (Network-based Intrusion Detection System) device

Answer 28

A.Configure a UTM (Unified Threat Management) device OBJ-2.1: Since this is a branch office and you want to protect it from as many threats as possible, using a Unified Threat Management (UTM) device would be best. A UTM will protect you from most things using a single device. A network-based firewall would provide basic protection, but a UTM will include anti-virus and other protections beyond just a firewall's capabilities. Host-based firewalls are great, but the network-based firewall or UTM device is configured to protect all devices on a network whereas a host-based firewall only protects the single host device. A network-based intrusion detection system (NIDS) can detect threats, but it cannot stop or prevent them.

Question 29

Which of the following network performance metrics is used to represent the theoretical maximum rate of data transfer from a source to a destination in a given amount of time under ideal conditions? A.Throughput B.Latency C.Jitter D.Bandwidth

Answer 29

D.Bandwidth OBJ-3.2: Bandwidth is the maximum rate of data transfer across a given network. Now, bandwidth is more of a theoretical concept that measures how much data could be transferred from a source to a destination under ideal conditions. Throughput is an actual measure of how much data is successfully transferred from the source to a destination. Therefore, we often measure throughput, instead of bandwidth, to monitor our network performance. Latency is the measure of time that it takes for data to reach its destination across a network. Usually, we measure network latency as the round-trip time from a workstation to the distant end and back. Jitter is a network condition that occurs when a time delay in the sending of data packets over a network connection occurs. Jitter is a big problem for any real-time applications you may be supporting on your networks, like video conferences, voice-over IP, and virtual desktop infrastructure clients.

Question 30

The administrator modifies a rule on the firewall, and now all the FTP users cannot access the server any longer. The manager calls the administrator and asks what caused the extreme downtime for the server. In regards to the manager's inquiry, what did the administrator forget to do first? A.Schedule a maintenance window B.Provide notification of change to users C.Document the changes D.Submit a change request

Answer 30

D.Submit a change request OBJ-3.2: A change request should be submitted through the change management process prior to any changes being made. Change management is a systematic approach to dealing with the transition or transformation of an organization's goals, processes, or technologies.

Question 31

Which of the following types of fire suppression systems utilizes a sprinkler system with water to extinguish a fire but requires both an actuator and the sprinklers to be tripped prior to water being released? A.Pre-action system B.Clean agent system C.Wet pipe system D.HVAC (Heating, Vacuum, Air Conditioning) system

Answer 31

A.Pre-action system OBJ-3.3: A fire suppression system is an engineered set of components that are designed to extinguish an accidental fire in a workplace or datacenter. A pre-action system minimizes the risk of accidental release from a wet pipe system. With a pre-action system, both a detector actuation like a smoke detector and a sprinkler must be tripped prior to water being released. A wet pipe system is the most basic type of fire suppression system, and it involved using a sprinkler system and pipes that always contain water in the pipes. Special suppression systems, like a clean agent system, use either a halocarbon agent or inert gas. When releases, the agents will displace the oxygen in the room with the inert gas and suffocates the fire. Heating Ventilation and Air Conditioning (HVAC) units are responsible for maintaining the proper temperature and humidity within a datacenter.

Question 32

Dion Training's remote office is experiencing poor network performance. You have been asked to look at the traffic patterns for the remote office and compare them to the network performance baselines. Which of the following tools should you utilize? A.Terminal emulator B.Spectrum analyzer C.NetFlow analyzer D.IP scanner

Answer 32

C.NetFlow analyzer OBJ-5.3: A NetFlow analyzer is used to perform monitoring, troubleshooting, inspection, interpretation, and synthesis of network traffic flow data. A NetFlow analyzer can help you quickly identify traffic patterns and the different applications/protocols in use on the network. A terminal emulator is used by a network administrator to make a given computer appear like an actual terminal or client computer networked to a server or mainframe. An IP scanner is used to monitor a network's IP address space in real-time and identify any devices connected to the network. A spectrum analyzer is used to measure the magnitude of an input signal's frequency.

Question 33

Which of the following components is used by an agent to send a complete set of key-pair values about a significant event or condition that is occurring in real-time by providing a full list of variables and values for a given device to a manager? A.OID (Object IDentifier) B.MIB (Management Information Base) C.Granular trap D.Verbose trap

Answer 33

D.Verbose trap OBJ-3.1: The Simple Network Management Protocol (SNMP) uses ports 161 and 162, and it is a networking protocol used for the management and monitoring of network-connected devices in Internet Protocol networks. A trap is an asynchronous notification from the agent to the manager. A trap is sent by the agent to notify the management of a significant event that is occurring in real-time, such as an alarming condition. A verbose trap may contain all the information about a given alert or event as its payload. A granular trap contains a unique object identifier (OID) number and a value for that OID. A verbose trap contains more information and data than a granular trap, and therefore requires more bandwidth to send the verbose trap over the network. A unique objective identifier (OID) identifies a variable that can be read or set using the SNMP protocol. The management information base (MIB) is a translation file that is used to describe the structure of the management data of a device subsystem using a hierarchical namespace containing object identifiers (OID).

Question 34

Which of the following communication types are used in IPv6 to send a packet to the nearest interface that shares a common address in a routing table? A.Broadcast B.Multicast C.Unicast D.Anycast

Answer 34

D.Anycast OBJ-1.4: An IPv6 anycast address is an address that can be assigned to more than one interface (typically different devices). In other words, multiple devices can have the same anycast address. A packet sent to an anycast address is routed to the “nearest” interface having that address, according to the router’s routing table. Anycast communications are sent to the nearest receiver in a group of receivers with the same IP. Anycast only works with IPv6. Multicasting is a technique used for one-to-many communication over an IP network. Multicast can be used with both IPv4 and IPv6. Broadcast communication has one sender, but it sends the traffic to every device on the network. Broadcast only works with IPv4. Unicast communication only has one sender and one receiver. Unicast works with IPv4 or IPv6.

Question 35

An end-user receives a new computer and now is unable to connect to the MySQL database over the Dion Training local area network. Other users can successfully connect. The network technician can successfully ping the database server but still is unable to connect. Which of the following is the most likely reason for this issue? A.The database server is configured with the wrong default gateway address B.A host-based firewall on the user's computer is blocking port 3306 C.The router to the database server's subnet is missing D.The end user's network interface card is defective

Answer 35

B.A host-based firewall on the user's computer is blocking port 3306 OBJ-5.5: MySQL uses ports 3306, and is an open-source relational database management system that is fully compatible with the structured query language (SQL). Since the network technician can pin the MySQL server, it indicates that the route is not missing, the database server is configured with the proper gateway, and the network interface card is not defective. Instead, it is likely that the end user's computer has a host-based firewall installed, like Windows Defender, and it is blocking outbound requests over port 3306 (MySQL). A change in the firewall settings to allow access to the specified ports will fix the problem. It appears the default firewall on this new computer is blocking the port used to communicate with the database server.

Question 36

While troubleshooting, a technician notices that some clients using FTP still work and that pings to the local routers and servers are working. The technician tries to ping all known nodes on the network, and they reply positively, except for one of the servers. The technician notices that ping works only when the hostname is used but not when FQDN is used. What server is MOST likely offline? A.DNS (Domain Name System; phone book of the internet) server B.Domain controller C.DHCP (Dynamic Host Configuration Protocol) server D.WINS (Windows Internet Name Service) server

Answer 36

A.DNS (Domain Name System; phone book of the internet) server OBJ-5.5: The DNS Server translates Fully Qualified Domain Names (FQDN) to IP addresses. The Domain Name System (DNS) uses port 53 and is a hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network. The Dynamic Host Configuration Protocol (DHCP) uses port 67 and is a network management protocol used on Internet Protocol (IP) networks for automatically assigning IP addresses and other communication parameters to devices connected to the network using a client-server architecture. A WINS server is a Microsoft Windows-based server running the Windows Internet Name Service (WINS) that can accept NetBIOS name registrations and queries. WINS servers maintain a database of NetBIOS name to IP address mappings for WINS clients on the network and speed up NetBIOS name resolution by eliminating broadcasts. Since the technician can ping the server using its hostname, the WINS server is working properly. Since the technician cannot ping the server using its fully qualified domain name (FQDN), the DNS server is likely offline.

Question 37

Barbara has connected her personal wireless router to a network jack inside her office. The router cannot get a DHCP (Dynamic Host Configuration Protocol) address even though her corporate laptop can get a DHCP address when connected to the same jack. Barbara checked the router's configuration to ensure it is set up to obtain a DHCP address. Which of the following is the MOST likely reason that the router is not getting a DHCP address? A.DHCP (Dynamic Host Configuration Protocol) requests that originate from access points are blocked B.The wireless router's MAC (Media Access Control) address is blocklist by the network C.DHCP snooping is enabled on the network D.Only allow listed MAC addresses can connect to the network

Answer 37

D.Only allow listed MAC addresses can connect to the network OBJ-4.3: Allow lists specify MAC addresses as a security measure implemented by the administrator to only grant access to a specific user. It avoids a person with malicious intentions to access the corporate network. Since the router has a different MAC address, it is blocked from connecting to the wired network. Allow listed MAC addresses can be implemented automatically using different forms of port security on a network switch.

Question 38

(This is a simulated Performance-Based Question. if this was the real certification exam, you would have to click on each device on the network diagram to open it and view/edit its configuration.) Wireless network users recently began experiencing speed and performance issues on your network after Access Point 2 (AP2) was replaced last night due to a recent hardware failure. The original wireless network was installed according to a wireless consultant's specifications and has always worked properly without any past issues. Now that you are at the client's office, you logged into each of the devices and saw the following configuration settings. Wireless AP 1 Settings Basic Configuration AP Name:AP1 IP Address:192.168.10.151 /24 Gateway:192.168.10.1 SSID:CorporateNet SSID Broadcast: Y or N? Y Wireless Network Mode:G Channel:1 Speed:Auto/100/1000 (100) Duplex:Auto/Half/Full (Full) Basic Configuration Security Settings: None/WEP/WPA (WPA) Key or Passphrase:P@$$w0rd RESET OR SUBMIT Wireless AP 2 Settings Basic Configuration AP Name:AP2 IP Address:192.168.10.152 /24 Gateway:192.168.10.1 SSID:CorporateNet SSID Broadcast: Y or N? Y Wireless Network Mode:B Channel:1 Speed:Auto/100/1000 (Auto) Duplex:Auto/Half/Full (Auto) Basic Configuration Security Settings: None/WEP/WPA (WPA) Key or Passphrase:P@$$w0rd RESET OR SUBMIT Wireless AP 3 Settings Basic Configuration AP Name:AP3 IP Address:192.168.10.153 /24 Gateway:192.168.10.1 SSID:CorporateNet SSID Broadcast: Y or N? Y Wireless Network Mode:G Channel:11 Speed:Auto/100/1000 (100) Duplex:Auto/Half/Full (Full) Basic Configuration Security Settings: None/WEP/WPA (WPA) Key or Passphrase:P@$$w0rd RESET OR SUBMIT Based on the configurations shown, which of the following settings should you change to bring the wireless network back to optimal performance? (Please select any or all options that apply) A.Change AP1's Channel from 1 to 6 B.Change AP2's Channel from 1 to 6 C.Change AP1's and AP3's Mode from G to B D.Change AP2's Mode from B to G E.Change AP1 and AP3 from 100/Full to Auto/Auto F. Change AP2 from Auto/Auto to 100/Full

Answer 38

B.Change AP2's Channel from 1 to 6 D.Change AP2's Mode from B to G F. Change AP2 from Auto/Auto to 100/Full OBJ-5.4: By comparing the configurations on the three different APs, we can see that AP1 and AP3 are set on channels 1 and 11, but AP2 is set to channel 1. This will cause interference between AP1 and AP2 since they are both on the same channel and can have overlapping coverage zones based on the floorplan of this office. Therefore, you should change AP2 to channel 6 to avoid interference. Also, AP1 and AP3 are using Wireless G (which supports 54 Mbps), but AP2 is set to Wireless B (which only supports 11 Mbps). This is causing the performance issue and lower speeds for the wireless users, so AP2 should be set to Wireless G to match the rest of the network. Finally, AP2 is set to Auto/Auto, but AP1 and AP3 are set to 100/Full. For best performance, AP2 should be set to 100/Full to match AP1 and AP3. AP2 has likely been unable to properly negotiate its switch port speed, so by setting it to 100/Full you can ensure the fastest possible connection between the switch port and AP2.

Question 39

Jason, a network technician, is troubleshooting a single-mode fiber that provides network connectivity to a remote site. He sees that the link light is off on the router's network interface, and suspects that the fiber may have a break somewhere between his router and the remote site. Single-mode fiber is not providing network connectivity to a remote site. Which of the following tools could be used to identify the location of the break in the fiber? A.OTDR (Optical Time Domain Reflectometer) B.Media converter C.Tone generator D.Light meter

Answer 39

A.OTDR (Optical Time Domain Reflectometer) OBJ-5.2: An Optical Time Domain Reflectometer (OTDR) is used by organizations to certify the performance of new fiber optics links and detect problems with existing fiber links. An OTDR can identify if a fiber cable is broken and provide an approximate location for the break in meters or feet. A fiber light meter, also known as an optical power meter, is used to measure the power in an optical signal over a fiber optic cable. A fiber light meter could be used to test if the cable is broken, but it would not be able to determine where the break in the fiber cable is located. A tone generator is used with a toner probe to accurately identify the location of a cable pair or conductor within a wiring bundle, cross-connection point, or at the remote end. A tone generator is used with copper cables, not fiber optic cables. A media converter is a layer 1 networking device that connects two different media types, such as a copper twisted pair cable and a fiber optic cable.

Question 40

Which of the following ports does SIP (Session Initiation Protocol) use? A.80/443 B.389/636 C.139/445 D.5060/5061

Answer 40

D.5060/5061 OBJ-1.5: Session Initiation Protocol (SIP) uses ports 5060 and 5061, and is a signaling protocol for initiating, maintaining, and terminating real-time sessions that include voice, video, and messaging applications. The Hypertext Transfer Protocol (HTTP) uses port 80 and is an application layer protocol for distributed, collaborative, hypermedia information systems using unencrypted data transfer. HTTPS, the secured version of HTTP, uses port 443. The Lightweight Directory Access Protocol (LDAP) uses port 389 and is an open, vendor-neutral, industry-standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. LDAPS, the secured version of LDAP, uses port 636. Server Message Block (SMB) uses ports 139 and 445 and is a network file sharing protocol that runs on top of the NetBIOS architecture in Windows environments

Question 41

Dion Training wants to implement a technology that will automatically test any wireless device that connects to their network before allowing the device full access to the corporate network and its resources. Which of the following should be implemented? A.NAC (Network Access Control) B.VPN (Virtual Private Network) C.DMZ (DeMilitarized Zone) D.PSK (Pre-Shared Key)

Answer 41

A.NAC (Network Access Control) OBJ-4.1: Network Access Control is an approach to computer security that attempts to unify endpoint security technology, user or system authentication, and network security enforcement. Effective network access control restricts access to only those devices that are authorized and compliant with security policies, meaning they have all the required security patches and anti-intrusion software. When a device connects to the network, it is placed into a automated testing area. If it passes the compliance testing, it is placed into the full corporate network. If it fails the compliance testing, it is placed into quarantine where it remains until it has been remediated or upgraded to meet the compliance requirements. A virtual private network extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. A pre-shared key (PSK) is a shared secret which was previously shared between the two parties using some secure channel before it needs to be used. A pre-shared key is used to encrypt data traversing over a WEP, WPA, or WPA2 wireless network. A DMZ or demilitarized zone is a physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted, usually larger, network such as the Internet.

Question 42

Dion Training is concerned with the threat of an attacker modifying the MAC address to IP bindings within the local area network. Which of the following could be enabled on the company’s network to prevent this from occurring? A.Router Advertisement Guard B.DHCP (Dynamic Host Configuration Protocol) snooping C.Dynamic ARP (Address Resolution Protocol) Inspection D.Private VLAN (Virtual Local Area Network)

Answer 42

C.Dynamic ARP (Address Resolution Protocol) Inspection OBJ-4.3: Dynamic ARP Inspection (DAI) is a security feature that validates Address Resolution Protocol (ARP) packets in a network. DAI allows a network administrator to intercept, log, and discard ARP packets with invalid MAC address to IP address bindings. A virtual LAN (VLAN) is any broadcast domain that is partitioned and isolated in a computer network at the data link layer (OSI layer 2). Port mirroring, ARP inspection, and VLANs do not add any redundancy to the network. DHCP snooping is a series of techniques applied to improve the security of a DHCP infrastructure. When DHCP servers are allocating IP addresses to the LAN clients, DHCP snooping can be configured on LAN switches to prevent malicious or malformed DHCP traffic or rogue DHCP servers. The IPv6 Router Advertisement Guard feature provides support for allowing the network administrator to block or reject unwanted or rogue router advertisement guard messages that arrive at the network device platform.

Question 43

A network technician responds to a customer reporting that a workstation continually loses the connection to the network. The user explains that it occurs randomly, and it happens several times throughout the day. Which step of the troubleshooting method should the technician perform NEXT? A.Establish a theory of probable cause B.Establish a plan of action to resolve the problem C.Test the theory to determine the cause D.Verify full system functionality

Answer 43

A.Establish a theory of probable cause OBJ-5.1: The scenario described in the question is best classified as "identify the problem", so the next step would be to "establish a theory of probable cause". The troubleshooting steps are to (1) Identify the problem, (2) Establish a theory of probable cause, (3) Test the theory to determine the cause, (4) Establish a plan of action to resolve the problem and identify potential effects, (5) Implement the solution or escalate as necessary, (6) Verify full system functionality and if applicable implement preventative measures, and (7) Document findings, actions, outcomes, and lessons learned.

Question 44

(This is a simulated Performance-Based Question.) You are testing a cable you found in your network closet. You connect a cable tester to both sides of the cable to verify the pinout of the Ethernet cable. After testing each pin, your cable tester gives you the following output: A.Rollover cable B.Patch cable C.RG-6 cable D.Crossover cable

Answer 44

B.Patch cable OBJ-5.2: This is a patch cable (also known as a straight-through cable), as indicated by the matching of the Tx and Rx pins (pins 1, 2, 3, and 6) on both sides of the cable. Additionally, you may have noticed that there is an open on this cable on pin 4 since it is not sending a signal from pin 4 to pin 4 in the diagram. A crossover cable would have pins crossing from one side to the other, such as pin 1 going to pin 6. A rollover cable has opposite pin assignments on each end of the cable, such as pin 1 going to pin 8, pin 2 going to pin 7, etc. An RG-6 cable only has one internal copper wire, not 8 as shown in this diagram for a twisted-pair copper cable.

Question 45

You are troubleshooting a cable modem for a home user's network. The connection speeds are much lower than you expected. You suspect the coaxial cable between the wall jack and the cable modem is faulty. Based on your research, a coaxial cable used in data networks should have an impedance of 50 ohms. Which of the following tools should you use to measure the resistance of the coaxial cable? A.Cable certifier B.Multimeter C.Cable tester D.Spectrum analyzer

Answer 45

B.Multimeter OBJ-5.2: A multimeter is a measuring instrument that can measure the voltage, resistance, and amperage of a cable or conduit. To test this cable, you should set the multimeter to resistance and connect one of the multimeter's leads to each end of the coaxial cable to determine the resistance as measured in ohms. A cable tester is used to verify the electrical connections in a twisted pair or coaxial cable. A cable certifier is used to test the continuity of a cable and verify that a cable meets its specifications such as the bandwidth, frequency, and length. A spectrum analyzer is used to measure the magnitude of an input signal's frequency.

Question 46

Which mitigation provides the best return on investment by mitigating the most vulnerable attack vector in an enterprise network? A.Provide end-user awareness training for office staff B.Enable biometrics and SSO (Single Sign-On) for authentication C.Remove unneeded services running on the servers D.Update all antivirus definitions on workstations and server

Answer 46

A.Provide end-user awareness training for office staff OBJ-4.5: An enterprise network's end users are the most vulnerable attack vector. Studies have shown that an investment in end-user cybersecurity awareness training has the best return on investment of any risk mitigation strategy. While all of the options presented are valid security mitigations, only end-user awareness training mitigates the biggest network vulnerability we have: our users.

Question 47

Which of the following IEEE specifications describes the use of VLANs? A.802.1q B.802.1x C.802.3af D.802.1d

Answer 47

A.802.1q OBJ-2.3: 802.1Q is the networking standard that supports virtual LANs on an IEEE 802.3 Ethernet network. The standard defines a system of VLAN tagging for Ethernet frames and the accompanying procedures to be used by bridges and switches in handling such frames. Power over Ethernet (POE) is a technology that lets network cables carry electrical power. POE is defined in the IEEE 802.3af. The IEEE 802.1x standard is a network authentication protocol that opens ports for network access when an organization authenticates a user's identity and authorizes them for access to the network. This defines port security. The user's identity is determined based on their credentials or certificate, which is confirmed by the RADIUS server. The Spanning Tree Protocol (STP) is a network protocol that builds a loop-free logical topology for Ethernet networks to prevent bridge loops and the broadcast storms that results from them. STP is defined in the IEEE 802.1d standard.

Question 48

A network administrator, Tamera, follows the best practices to implement firewalls, patch management, and security policies on his network. Which of the following should be performed to verify that the security controls are in place? A.Disaster recovery testing B.Penetration testing C.AAA authentication testing D.Single point of failure testing

Answer 48

B.Penetration testing OBJ-4.1: Penetration testing or pentesting is the practice of testing a computer system, network, or web application in order to find vulnerabilities that an attacker could exploit. It can be used to ensure all security controls are properly configured and in place. Authentication, authorization, and accounting (AAA) is a term for a framework for intelligently controlling access to computer resources, enforcing policies, auditing usage, and providing the information necessary to bill for services. Testing AAA might be a part of a larger penetration test, but by itself it would not test the firewalls and patch management systems sufficiently. A disaster recovery test (DR test) is the examination of each step in a disaster recovery plan as outlined in an organization's business continuity/disaster recovery planning process. A disaster recovery test would not test the firewalls, patch management, or security policies. A single point of failure (SPOF) is a part of a system that, if it fails, will stop the entire system from working. A single point of failure test is used to identify a single point of failure in the network or system, and it is not designed to test the network's firewalls, patch management, or security policies.

Question 49

A network technician has downloaded the latest operating system of a particular vendor's switch. This update includes new features and enhancements. What should the technician perform FIRST when updating the switch's operating systems? A.Power cycle the company's border router B.Install during non-business hours to test the system C.Test the O/S on one of the production switches D.Backup the current configuration for each switch

Answer 49

D.Backup the current configuration for each switch OBJ-4.3: A preventive method is always to back up the current configuration to the NVRAM (SW# copy run start) in case the newly downloaded operating system doesn't work properly. This would allow the technician to restore the switch from the previous backup. It is a good idea to install the operating system during non-business hours, as well, but you should first always make a backup of the current configuration.

Question 50

Which of the following technologies deliver multiple voice calls over a copper wire if you have an ISDN or T-1 connection? A.Time-division multiplexing B.Analog circuit switching C.Time-division spread spectrum D.CSMA/CD (Carrier-sense multiple access with collision detection)

Answer 50

A.Time-division multiplexing OBJ-1.2: Time-division multiplexing allows for two or more signals or bitstreams to be transferred in what appears to be simultaneous sub-channels in one communication channel but is physically taking turns on the channel. This is the technology used in a single PRI (ISDN or T-1) service to essentially share a single cable but pass multiple voice calls over it. Analog circuit switching is used by telephone providers on the Public Switched Telephone Network (PSTN), not with ISDN or T-1 connections. Time-division spread spectrum is not a real thing, spread spectrum is used in Wi-Fi, but it is based on frequency and not time. CSMA/CD is the carrier sense multiple access collision detection that is used for ethernet access at layer 2 of the OSI model. CSMA/CD is not used with ISDN or T-1 connections.

Question 51

A technician is troubleshooting a workstation connectivity issue. The technician believes a static ARP (Address Resolution Protocol) may be causing the problem. What should the technician do NEXT according to the network troubleshooting methodology? A.Duplicate the issue in a lab by adding a static ARP (Address Resolution Protocol) entry B.Remove the ARP entry on the user's workstation C.Document the findings and provide a plan of action D.Identify a suitable time to resolve the connectivity issue

Answer 51

B.Remove the ARP entry on the user's workstation OBJ-5.1: Based on the network troubleshooting methodology, you should try to test your theory to determine the cause once you have established a theory of probable cause. In this scenario, the technician has a theory that the static ARP entry is the cause of the problem. Since this issue has already caused the workstation not to communicate, the best way to test your theory would be to remove the static ARP entry and see if the issue is resolved. If this doesn't fix the issue, you would need to develop a new hypothesis to test. The troubleshooting steps are to (1) Identify the problem, (2) Establish a theory of probable cause, (3) Test the theory to determine the cause, (4) Establish a plan of action to resolve the problem and identify potential effects, (5) Implement the solution or escalate as necessary, (6) Verify full system functionality and if applicable implement preventative measures, and (7) Document findings, actions, outcomes, and lessons learned.

Question 52

The network administrator noticed that the border router has high network capacity loading during non-working hours. This excessive load is causing outages for the company's web servers. Which of the following is the MOST likely cause of the issue? A.Session hijacking B.Evil twin C.Distributed DoS (Denial of Service) D.ARP (Address Resolution Protocol) spoofing

Answer 52

C.Distributed DoS (Denial of Service) OBJ-4.2: A distributed denial-of-service (DDoS) attack occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. A denial-of-service attack is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting the services of a host connected to the Internet. ARP spoofing is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker's MAC address with the IP address of a legitimate computer or server on the network. Session hijacking, also known as TCP session hijacking, is a method of taking over a web user session by surreptitiously obtaining the session ID and masquerading as the authorized user. An evil twin is a rogue wireless access point that masquerades as a legitimate Wi-Fi access point so that an attacker can gather personal or corporate information without the user's knowledge.

Question 53

Max is a network technician who just terminated the ends on a new copper cable used between two legacy switches. When he connects the two switches using the cable, they fail to establish a connection. What is MOST likely the issue? A.The cable is a crossover cable B.The cable has exceeded bend radius limitations C.The cable is a straight-through cable D.The cable has a RJ-11 connectors instead of RJ-45

Answer 53

C.The cable is a straight-through cable OBJ-2.3: There are two types of cable, Straight-through and Crossover. In this instance, a crossover cable would need to be used to communicate with legacy switches since they won't support MDIX. A medium dependent interface crossover (MDIX) is a version of the medium dependent interface (MDI) enabling a connection between corresponding devices, such as a switch to another switch. If the switch doesn't MDIX, then you must use a crossover cable to connect them. Bend radius cannot be the correct answer to this question since copper cables are being used and not fiber cables. Bend radius is a concern when using fiber cables as it leads to increase reflections and a decrease in signal strength. An RJ-11 connector only has 6 pins and is smaller than an RJ-45 connector. The technician would visually be able to see the difference as the RJ-11 connector would not fit properly in the switchports.

Question 54

Which of the following IEEE specifications describes the use of network authentication? A.802.3ad B.802.1x C.802.1d D.802.3af

Answer 54

B.802.1x OBJ-2.3: The IEEE 802.1x standard is a network authentication protocol that opens ports for network access when an organization authenticates a user's identity and authorizes them for access to the network. This defines port security. The user's identity is determined based on their credentials or certificate, which is confirmed by the RADIUS server. The Spanning Tree Protocol (STP) is a network protocol that builds a loop-free logical topology for Ethernet networks to prevent bridge loops and the broadcast storms that result from them. STP is defined in the IEEE 802.1d standard. Link Aggregation Control Protocol or LACP is one element of an IEEE specification (802.3ad) that provides guidance on the practice of link aggregation for data connections. Power over Ethernet (POE) is a technology that lets network cables carry electrical power. POE is defined in the IEEE 802.3af.

Question 55

A network technician needs to monitor the network to find a user who is browsing websites that go against the company's acceptable use policy. What should the technician use to view the website and find the user browsing it? A. SNMP (Simple Network Management Protocol) GET B.Top listener tool C.Packet sniffer D.Intrusion detection system

Answer 55

C.Packet sniffer OBJ-5.3: Packet Sniffers can capture and analyze network user traffic. This information can be queried to view website addresses, contents, and sometimes even password information. This differs from an intrusion detection system in that IDS’s wait to receive implicitly malicious data in a network before logging the event.

Question 56

Which of the following types of agreements is used to protect an organization's intellectual property and is considered legally binding between the signatories? A.SLA (Service-Level Agreement) B.NDA (Non-Disclosure Agreement) C.AUP (Acceptable Use Policy) D.MOU (Memorandum Of Understanding)

Answer 56

B.NDA (Non-Disclosure Agreement) OBJ-3.2: A non-disclosure agreement (NDA) is a documented agreement between two parties that define what data is considered confidential and cannot be shared outside of that relationship. An NDA is used to protect an organization’s intellectual property. An acceptable use policy (AUP) is a set of rules applied by the owner, creator, or administrator of a network, website, or service, that restrict how the network, website, or system may be used and sets guidelines as to how it should be used. A memorandum of understanding (MOU) is a non-binding agreement between two or more organizations to detail what common actions they intend to take. A service level agreement (SLA) is a documented commitment between a service provider and a client, where the quality, availability, and responsibilities are agreed upon by both parties.

Question 57

Which of the following layers is NOT used in a three-tiered data center network architecture? A.Distribution/aggregation layer B.Access/edge layer C.Core layer D.Control layer

Answer 57

D.Control layer OBJ-1.7: The control layer is used in software-defined networking (SDN), not the three-tiered data center network architecture. The Core Layer is considered the backbone of our network and is used to merge geographically separated networks back into one logical and cohesive unit. In general, you will have at least two routers at the core level, operating in a redundant configuration. The distribution or aggregation layer is located under the core layer and it provides boundary definition by implementing access lists and filters to define the policies for the network at large. The access or edge layer is located beneath the distribution or aggregation layer and is used to connect all the endpoint devices like computers, laptops, servers, printers, wireless access points, and others.

Question 58

A wireless networking technician has completed an assessment of a wireless network and documented the detected signal strengths in various locations. Which of the following best describes this document? A.Network baseline B.Site survey report C.Logical network diagram D.Audit report

Answer 58

B.Site survey report OBJ-3.2: A wireless site survey report will usually take the form of a floorplan with a color-coded series of rings on it to show the signal strengths of wireless network signals in various locations. This is often referred to as a "heat map" by technicians. The technician performing the survey will document this information and use it as a tool during troubleshooting and optimization efforts concerning the wireless coverage in a specific office or building. A logical network diagram illustrates the flow of information through a network and shows how devices communicate with each other. It typically includes elements like subnets, network objects and devices, routing protocols and domains, voice gateways, traffic flow, and network segments. Network baselining is the act of measuring and rating the performance of a network in real-time situations. Providing a network baseline requires testing and reporting of the physical connectivity, normal network utilization, protocol usage, peak network utilization, and average throughput of the network usage. A network audit entails collecting data, identifying threats and areas of weakness, and compiling a formal audit report. This report is then sent on to network administrators and other relevant parties.

Question 59

When you arrived at work today, you saw a message on your computer screen stating that your hard drive has been encrypted and you must pay 1 ETH to get the decryption key. What type of attack has occurred against your workstation? A.Brute-force B.Phishing C.Malware D.Ransomware

Answer 59

D.Ransomware OBJ-4.2: Ransomware is a type of malware from cryptovirology that threatens to publish the victim's personal data or perpetually block access to it unless a ransom is paid. Malware is any software intentionally designed to cause damage to a computer, server, client, or computer network. By contrast, software that causes unintentional harm due to some deficiency is typically described as a software bug. Malware includes viruses, worms, logic bombs, and many other malicious types of code. Phishing is a type of social engineering where an attacker sends a fraudulent email designed to trick a human victim into revealing sensitive information to the attacker or to deploy malicious software on the victim's infrastructure like ransomware. A brute-force attack consists of an attacker submitting many passwords or passphrases with the hope of eventually guessing correctly. A brute-force attack consists of an attacker submitting many passwords or passphrases with the hope of eventually guessing correctly.

Question 60

The Security Operations Center is trying to determine if there are any network anomalies currently being observed. To assist them, you gather information about the current performance of the network. Which of the following should you also gather to compare the current information against? A.Logs B.Baseline C.PCAP (Packet CAPture) D.NetFlow

Answer 60

B.Baseline OBJ-3.1: While all of the network artifacts, such as logs, pcap files, and NetFlow data, are useful, the general terms for the historical network performance data is a baseline. A baseline may be created from these other types of data, but the baseline is the MOST correct answer based on the question. A baseline is a process for studying the network at regular intervals to ensure that the network is working as designed.

Question 61

An organization has hired you to upgrade its wired computer network. The network currently uses static routing for the internal network, but the organization wants to reconfigure it to use a dynamic routing protocol. The new dynamic routing protocol must support both IPv4 and VLSM. Based on the requirements provided, which of the following routing protocols should you enable and configure? A.HSRP (Hot Standby Router Protocol) B.RIPv1 (Routing Information Protocol version 1) C.OSPF (Open Shortest Path First) D.VRRP (The Virtual Router Redundancy Protocol)

Answer 61

C.OSPF (Open Shortest Path First) OBJ-2.2: Only OSPF supports IPv4 and VLSM (Variable Length Subnet Mask) from the options provided in this question. Open Shortest Path First (OSPF) is a link-state routing protocol that was developed for IP networks and is based on the Shortest Path First (SPF) algorithm. OSPF is an Interior Gateway Protocol (IGP). VRRP, RIPv1, and HSRP do not support VLSM. The Virtual Router Redundancy Protocol is a computer networking protocol that provides for automatic assignment of available Internet Protocol routers to participating hosts. This increases the availability and reliability of routing paths via automatic default gateway selections on an IP subnetwork. The Hot Standby Router Protocol is a Cisco proprietary redundancy protocol for establishing a fault-tolerant default gateway. The Routing Information Protocol (RIP) is one of the oldest distance-vector routing protocols which employs the hop count as a routing metric. RIP prevents routing loops by implementing a limit on the number of hops allowed in a path from source to destination. While RIPv1 does not support VLSM, RIPv2 does support VLSM but was not an option in this question.

Question 62

Dion Training allows its visiting business partners from CompTIA to use an available Ethernet port in their conference room to establish a VPN connection back to the CompTIA internal network. The CompTIA employees should obtain internet access from the Ethernet port in the conference room, but nowhere else in the building. Additionally, if any of the Dion Training employees use the same Ethernet port in the conference room, they should access Dion Training's secure internal network. Which of the following technologies would allow you to configure this port and support both requirements? A.MAC (Media Access Control) Filtering B.Configure a SIEM (Security Information and Event Management) C.Implement NAC (Network Access Control) D.Create an ACL (Access Control List) to allow access

Answer 62

C.Implement NAC (Network Access Control) OBJ-4.3: Network Access Control (NAC) uses a set of protocols to define and implement a policy that describes how to secure access to network nodes whenever a device initially attempts to access the network. NAC can utilize an automatic remediation process by fixing non-compliant hosts before allowing network access. Network Access Control can control access to a network with policies, including pre-admission endpoint security policy checks and post-admission controls over where users and devices can go on a network and what they can do. In this scenario, implementing NAC can identify which machines are known and trusted Dion Training assets and provide them with access to the secure internal network. NAC could also determine unknown machines (assumed to be those of CompTIA employees) and provide them with direct internet access only by placing them onto a guest network or VLAN. While MAC filtering could be used to allow or deny access to the network, it cannot by itself control which set of network resources could be utilized from a single ethernet port. A security information and event management (SIEM) system provides real-time analysis of security alerts generated by applications and network hardware. An access control list could define what ports, protocols, or IP addresses the ethernet port could be utilized. Still, it would be unable to distinguish between a Dion Training employee's laptop and a CompTIA employee's laptop like a NAC implementation could.

Question 63

Which type of antenna broadcasts an RF (Radio Frequency) signal in a specific direction with a narrow path? A.Bidirectional B.Unidirectional C.Omnidirectional D.Patch

Answer 63

B.Unidirectional OBJ-2.4: Directional antennas broadcast radio frequencies in a single direction (unidirectional) or two directions (bidirectional) to create a zone or area of coverage. Unidirectional antennas focus the broadcast signal in a single direction instead of all directions, focusing the transmission and making the signal stronger. A specific type of unidirectional antenna is known as a Yagi antenna. Omnidirectional antennas broadcast radio frequencies in all directions creating a large sphere of coverage. The antenna has the capability to send and receive signals in a circumference around the antenna. A patch antenna is a type of antenna with a low profile that can be mounted on a surface. A patch antenna can be omnidirectional, bidirectional, or unidirectional, therefore it is not the best answer to this question and unidirectional should be chosen instead.

Question 64

You have installed and configured a new wireless router. The clients and hosts can ping each other. The network uses a fiber optic WAN connection with 1 Gbps throughput. The wired clients have fast connections, but the wireless clients are displaying high latency when a ping is performed. The wireless clients are also only receiving 300 Mbps when downloading files from the Internet. Which of the following is MOST likely the cause of the slow speeds experienced by the wireless clients? A.A high signal-to-noise ratio on the wireless network B.A fiber connection does not support wireless C.The network should use 802.11g WAPs to increase throughput D.The wireless access point is experiencing RF (Radio Frequency) interference

Answer 64

D.The wireless access point is experiencing RF (Radio Frequency) interference OBJ-5.4: If interference in the wireless spectrum occurs, more retransmissions will be needed (and thereby slowing speeds experienced and increasing latency). A high signal-to-noise ratio is a good thing on wireless networks and leads to faster speeds and lower retransmissions. The fiber connection itself is only used for the WAN connection, therefore you can use wired or wireless infrastructure for your internal LAN and connect the LAN to the WAN connection at the router. The wireless network is already getting throughputs of 300 Mbps, so it must be using 802.11n, 802.11ac, or 802.11ax for its wireless access points. If you switched to 802.11g, you would slow down the wireless network more since it has a maximum throughput of 54 Mbps.

Question 65

You suspect that your server has been the victim of a web-based attack. Which of the following ports would most likely be seen in the logs to indicate the attack's target? A.443 B.3389 C.21 D.389

Answer 65

A.443 OBJ-1.5: Web-based attacks would likely appear on port 80 (HTTP) or port 443 (HTTPS). An attack against Active Directory is likely to be observed on port 389 LDAP. An attack on an FTP server is likely to be observed on port 21 (FTP). An attack using the remote desktop protocol would be observed on port 3389 (RDP).

Question 66

You are currently troubleshooting a workstation in the office and determined that it is an issue with the cabling somewhere between the workstation and the switch. You have tested the patch cable from the workstation to the wall jack and it is not faulty. You want to check the port on the switch next. Which of the following would BEST help you identify which switch port is associated with the workstation's wall jack? A.Network baseline B.Proper labeling C.Inventory management D.Standard procedures

Answer 66

B.Proper labeling OBJ-3.2: You should always use proper labeling of your cables, wall jacks, and patch panels to make it easy to locate which switchport is associated with each portion of the cable distribution plant. Ensuring everything is properly labeled will help when you need to troubleshoot a network connection in your interior cable distribution plant. A standard procedure is a set of step-by-step instructions compiled by an organization to help workers carry out routine operations. A baseline is a process for studying the network at regular intervals to ensure that the network is working as designed. Inventory management refers to the process of ordering, storing, and using a company's inventory.

Question 67

Which network device operates at Layer 3? A.Repeater B.Router C.Hub D.Bridge

Answer 67

B.Router OBJ-1.1: A router is a layer 3 device. A router is a networking device that forwards data packets between computer networks. Routers perform the traffic directing functions on the Internet. Routers make the Internet work by forwarding data using a unified addressing system. In our TCP/IP networks, routers forward their traffic based upon the IP address of the packets. A hub and repeater are both layer 1 devices (physical layer). A bridge is a layer 2 device (data link layer).

Question 68

Mark is setting up a DHCP (Dynamic Host Configuration Protocol) server on a segment of the corporate LAN (Local Area Network). Which of the following options is NOT required in the DHCP scope to allow hosts on that LAN segment to be assigned a dynamic IP (Internet Protocol) address and still be able to access the Internet and internal company servers? A.Reservations B.Default gateway C.Subnet mask D.DNS (Domain Name System) servers

Answer 68

A.Reservations OBJ-1.6: The DHCP must provide an IP address, subnet mask, default gateway, and DNS server to each client to effectively access the Internet. Using DHCP reservations is not required to be configured to meet the requirements provided in the question. DHCP reservations allow the DHCP server to pre-set an IP address to a specific client based on its MAC address. This ensures that the client will always get the same IP address from the DHCP server when it connects to the network. DHCP reservations are usually used with servers or printers on your internal network and are rarely used with end-user or client devices.

Question 69

Which of the following encryption types was used by WPA to better secure wireless networks than WEP? A.CCMP (Counter Mode Cipher Block Chaining Message Authentication Code Protocol) B.TKIP (Temporal Key Integrity Protocol) C.AES (Advanced Encryption Standard) D.IV (Initialization Vector)

Answer 69

B.TKIP (Temporal Key Integrity Protocol) OBJ-2.4: Wi-Fi protected access (WPA) is an improved encryption scheme for protecting Wi-Fi communications designed to replace WEP. WPA uses the RC4 cipher and a temporal key integrity protocol (TKIP) to overcome the vulnerabilities in the older WEP protection scheme. Wired equivalent privacy (WEP) is an older mechanism for encrypting data sent over a wireless connection. WEP is considered vulnerable to attacks that can break its encryption. WEP relies on the use of a 24-bit initialization vector to secure its preshared key. Wi-Fi protected access version 2 (WPA2) replaced the original version of WPA after the completion of the 802.11i security standard. WPA2 features an improved method of key distribution and authentication for enterprise networks, though the pre-shared key method is still available for home and small office networks. WPA2 uses the improved AES cipher with counter mode with cipher-block chaining message authentication protocol (CCMP) for encryption.

Question 70

Tamera is troubleshooting a mail server connectivity issue and needs to review the MX (Mail eXchange) records for DionTraining.com. Which of the following tools should she utilize? A.arp B.telnet C.nslookup D.route

Answer 70

C.nslookup OBJ-5.3: The nslookup command is used to query the domain name system (DNS) to obtain information about host addresses, mail exchanges, nameservers, and related information. The nslookup command has an interactive and non-interactive mode. The arp command is used to view and modify the local address resolution protocol (ARP) cache of a device, which contains recently resolved MAC addresses of IP hosts on the network. The route command is used to create, view, or modify manual entries in the network routing tables of a computer or server. The telnet command is used to open a command-line interface on a remote computer or server. Telnet operates in plain text mode and should never be used over an untrusted or public network.

Question 71

You are currently troubleshooting a network connection error. When you ping the default gateway, you receive no reply. You checked the default gateway, and it is functioning properly, but the gateway cannot connect to any of the workstations on the network. Which of the following layers could be causing this issue? A.Presentation B.Session C.Transport D.Physical

Answer 71

D.Physical OBJ-1.1: Ping requests occur at layer 3 (Network Layer). Therefore, the problem could exist in layer 1 (physical), layer 2 (data link), or layer 3 (network). Since Physical (layer 1) is the only choice from layers 1-3 given, it must be the correct answer. Also, since the gateway cannot reach any of the other devices on the network, it is most likely a cable (physical) issue between the gateway and the network switch.

Question 72

The network administrator is troubleshooting the switchports for a file server with dual NICs. The file server needs to be configured for redundancy, and the dual NICs need to be combined for maximum throughput. What feature on the switch should the network administrator ensure is enabled for best results? A.BPDU (Bridge Protocol Data Unit) B.Load balancing C.Spanning tree D.LACP ( Link Aggregation Control Protocol)

Answer 72

D.LACP ( Link Aggregation Control Protocol) OBJ-2.3: The Link Aggregation Control Protocol (LACP) is the 802.3ad protocol is used to group numerous physical ports to make one high bandwidth path. This method can increase bandwidth and therefore, throughput. LACP can also provide network redundancy and load balancing. The Spanning Tree Protocol (STP) is a network protocol that builds a loop-free logical topology for Ethernet networks to prevent bridge loops and the broadcast storms that result from them. STP is defined in the IEEE 802.1d standard. A Bridge Protocol Data Unit (BPDU) is used by STP to prevent the bridge loops. Load balancing refers to the process of distributing a set of tasks over a set of resources, with the aim of making their overall processing more efficient. Load balancing can optimize the response time and avoid unevenly overloading some compute nodes while other compute nodes are left idle.

Question 73

You are troubleshooting a point-to-point microwave link between two buildings that is supposed to operate at 1800 MHz. You suspect there is an issue with the frequency as it is transmitted or received. Which of the following tools would you use to observe the frequency as it is transmitted or received? A.Tone generator B.Wi-Fi analyzer C.Spectrum analyzer D.TDR (Time-domain reflectometer)

Answer 73

C.Spectrum analyzer OBJ-5.2: A spectrum analyzer is used to measure the magnitude of an input signal's frequency. A WiFi analyzer is used to gather information about the available wireless networks, troubleshoot wireless networking issues, ensure optimal router placement, and identify existing coverage areas. A tone generator is used with a toner probe to accurately identify the location of a cable pair or conductor within a wiring bundle, cross-connection point, or at the remote end. A tone generator is used with copper cables, not fiber optic cables. A time-domain reflectometer (TDR) is used to determine the characteristics of electrical lines by observing reflected waveforms to characterize and locate faults in copper cables.

Question 74

A user's smartphone is displaying text in other languages in their web browser when accessing the company's main website. Which of the following is the MOST likely cause of the issue? A.Denial-of-service attack B.Reflective DNS attacks DNS (Domain Name System; phone book of the internet) C.On-path attack D.Deauthenatication attack

Answer 74

C.On-path attack OBJ-4.2: An on-path attack (previously known as a man-in-the-middle attack) is a general term when a perpetrator positions himself in a conversation between a user and an application, either to eavesdrop or impersonate one of the parties, making it appear as if a normal exchange of information is occurring. For example, if your user and server are both in the United States (English language), but the attacker is performing the on-path attack from Russia, then the server will utilize the Russian language in the text since it sees the connection coming from a Russian IP address. A denial-of-service attack is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet. A reflective DNS attack is a two-step attack used in DDoS attacks. The attacker sends a large number of requests to one or more legitimate DNS servers while using a spoofed source IP of the targeted victim. The DNS server then replies to the spoofed IP and unknowingly floods the targeted victim with responses to DNS requests that it never sent. A Wi-Fi deauthentication attack is a type of denial-of-service attack that targets communication between a user and a Wi-Fi wireless access point by sending a deauthentication frame to the victim's machine.

Question 75

You have been asked to connect three 802.11a devices to an 802.11g access point configured with WEP (Wired Equivalent Privacy). The devices are within 20 feet of the access point, but they still cannot associate with the access point. Which of the following is the MOST likely cause of the devices not associating with the WAP (Wireless Access Point)? A.Signal loss B.Interference C.Frequency mismatch D.Mismatched encryption

Answer 75

C.Frequency mismatch OBJ-2.4: 802.11a operates in the 5 GHz band, while 802.11g operates in the 2.4 GHz band. Therefore, 802.11a devices will be unable to communicate with 802.11b or 802.11g access points. Wireless networks utilize three different frequency bands: 2.4 GHz, 5 GHz, and 6 GHz. The 2.4 GHz frequency band is used by 802.11b, 802.11g, and 802.11n. The 5 GHz frequency band is used by 802.11a, 802.11n, 802.11ac, and 802.11ax. The 6 GHz frequency band is used by Wi-Fi 6E under the 802.11ax standard.

Question 76

An outside organization has completed a penetration test for a company. One of the report items states that an attacker may have the ability to read TLS (Transport Layer Security) traffic from the webserver due to a software bug. What is the MOST likely mitigation for this reported item? A.Configure the firewall to block traffic on port 443 B.Implement a VPN (Virtual Private Network) for employees C.Ensure patches are deployed D.Install an IDS (Intrusion Detection System) on the network

Answer 76

C.Ensure patches are deployed OBJ-4.3: A patch is designed to correct a known bug or fix a known vulnerability. Since the server is allowing an attacker to read TLS traffic, which should be encrypted and unreadable, this is a software bug in the webserver's code that must be fixed using a patch. An intrusion detection system is a device or software application that monitors and reports on any malicious activity or policy violations on a network or system. An IDS would not mitigate or stop the attacker from reading the TLS traffic, it would only report that it is occurring. A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules to establish a barrier between a trusted and untrusted network. If you configured the firewall to block traffic on port 443 (HTTPS/SSL/TLS), it would block all of the webserver's legitimate users, as well. A virtual private network extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. A VPN would not stop an attacker from being able to read the TLS traffic from the webserver.

Question 77

What is the broadcast address associated with the host located at 201.58.12.245/28? A.201.58.12.240 B.201.58.12.241 C.201.58.12.254 D.201.58.12.255

Answer 77

D.201.58.12.255 OBJ-1.4: In classless subnets using variable-length subnet mask (VLSM), the broadcast address is the last IP address associated within an assigned range. In this example, the CIDR notation is /28, so each subnet will contain 16 IP addresses. Since the IP address provided is 201.58.12.245, the broadcast address will be 201.58.12.255.

Question 78

Which of the following network devices would be considered a perimeter device and installed at the outermost part of the network? A.Switch B.Firewall C.Bridge D.Wireless access point

Answer 78

B.Firewall OBJ-2.1: A firewall is considered a perimeter security device. It should be installed at the perimeter or boundary of a network to provide maximum security. Switches, bridges, and wireless access points are all considered internal network devices and should not be installed at the network's outermost perimeter.

Question 79

Which of the following levels would an emergency condition generate? A.6 B.7 C.1 D.0

Answer 79

D.0 OBJ-3.1: The severity levels range from zero to seven, with zero being the most severe and seven being the least severe. Level 0 is used for an emergency and is considered the most severe condition because the system has become unstable. Level 1 is used for an alert condition and means that there is a condition that should be corrected immediately. Level 2 is used for a critical condition, and it means that there is a failure in the system’s primary application and it requires immediate attention. Level 3 is used for an error condition, and it means that something is happening to the system that is preventing the proper function. Level 4 is used for warning conditions and it may indicate that an error will occur if action is not taken soon. Level 5 is used for notice conditions and it means that the events are unusual, but they are not error conditions. Level 6 is used for information conditions and it is a normal operational message that requires no action. Level 7 is used for debugging conditions and is just information that is useful to developers as they are debugging their networks and applications.

Question 80

Which of the following is the BEST way to regularly prevent different security threats from occurring within your network? A.Business continuity training B.Disaster recovery planning C.User training and awareness D.Penetration testing

Answer 80

C.User training and awareness OBJ-4.5: An enterprise network's end users are the most vulnerable attack vector. Studies have shown that an investment in end-user cybersecurity awareness training has the best return on investment of any risk mitigation strategy. While a penetration test might detect various threats and vulnerabilities in your network, it does not prevent them from occurring. Disaster recovery planning creates a disaster recovery plan, which is a documented, structured approach that describes how an organization can quickly resume work after an unplanned incident. Business continuity training will teach employees what to do in the case of a business continuity plan execution. A business continuity plan defines how an organization will continue the delivery of products or services at pre-defined acceptable levels following a disruptive incident. Only end-user awareness training mitigates the biggest network vulnerability we have: our users.

Question 81

You have just finished installing a new web application and need to connect it to your SQLnet database server. Which port must be allowed to enable communications through your firewall between the web application and your database server? A.1433 B.1521 C.3389 D.3306

Answer 81

B.1521 OBJ-1.5: SQLnet uses ports 1521, and is a relational database management system developed by Oracle that is fully compatible with the structured query language (SQL). Microsoft SQL uses ports 1433 and is a proprietary relational database management system developed by Microsoft that is fully compatible with the structured query language (SQL). MySQL uses ports 3306 and is an open-source relational database management system that is fully compatible with the structured query language (SQL). Remote Desktop Protocol (RDP) uses port 3389 and is a proprietary protocol developed by Microsoft which provides a user with a graphical interface to connect to another computer over a network connection.

Question 82

A technician is tasked with troubleshooting a network’s slowness. While troubleshooting, the technician is unable to ping any external websites. Users report they can access the sites using the web browsers. What is the MOST likely cause of the failed pings? A.TACACS+ (Terminal Access Controller Access Control Server) is misconfigured on this network B.A VLAN (Virtual Local Area Network) hopping attack is being conducted C.Jumbo frames are not enabled on the network D.ICMP (Internet Control Message Protocol) traffic being blocked by the firewall

Answer 82

D.ICMP (Internet Control Message Protocol) traffic being blocked by the firewall OBJ-5.3: Many companies block ICMP at the firewall, causing ping to fail since it relies on ICMP. If the user can access the site in the web browser but cannot when using ping, then ICMP is most likely being blocked by the firewall. Jumbo frames are any frames larger than 1500 bytes, which is the default MTU size on most networks. VLANs are logical segments of the local area network. TACACS+ is used for remote authentication.

Question 83

Which of the following components is used to identify a variable that may be set or read using SNMP? A.Granular trap B.Verbose C.MIB (Management Information Base) D.OID (Object IDentifier)

Answer 83

D.OID (Object IDentifier) OBJ-3.1: The Simple Network Management Protocol (SNMP) uses ports 161 and 162, and it is a networking protocol used for the management and monitoring of network-connected devices in Internet Protocol networks. A unique objective identifier (OID) identifies a variable that can be read or set using the SNMP protocol. The management information base (MIB) is a translation file that is used to describe the structure of the management data of a device subsystem using a hierarchical namespace containing object identifiers (OID). A trap is an asynchronous notification from the agent to the manager. A trap is sent by the agent to notify the management of a significant event that is occurring in real-time, such as an alarming condition. A granular trap contains a unique object identifier (OID) number and a value for that OID. A verbose trap may contain all the information about a given alert or event as its payload. A verbose trap contains more information and data than a granular trap, and therefore requires more bandwidth to send the verbose trap over the network.

Question 84

The network install is failing redundancy testing at the MDF. The traffic being transported is a mixture of multicast and unicast signals. Which of the following devices would BEST handle the rerouting caused by the disruption of service? A.Layer 2 switch B.Proxy server C.Layer 3 switch D.Smart hub

Answer 84

C.Layer 3 switch OBJ-2.1: A layer 3 switch is the best option because, in addition to its capability of broadcast traffic reduction, it provides fault isolation and simplified security management. This is achieved through the use of IP address information to make routing decisions when managing traffic between LANs. Multicast and unicast are layer 3 messaging flows, so you need a router or layer 3 switch to route them across the network. A smart hub is a layer 1 device. A proxy server operates at layer 4, but would still require a router or layer 3 switch to route the traffic.

Question 85

Which of the following network devices is used to separate broadcast domains? A.Router B.Hub C.Bridge D.Switch

Answer 85

A.Router OBJ-2.1: A router is networking hardware that connects computer networks and forwards data packets between those networks. A router operates at the network layer (Layer 3) of the OSI model and makes routing decisions based upon IP addresses. Each switchport on a router is a separate collision domain and a separate broadcast domain. A hub is a network hardware device for connecting multiple Ethernet devices together and making them act as a single network segment. A hub operates at the physical layer (Layer 1) of the OSI model. All devices connected by a hub are in a single collision domain and a single broadcast domain, therefore they must use half-duplex for communication and CSMA/CD. A switch is networking hardware that connects devices on a computer network by using packet switching to receive and forward data to the destination device. A switch operates at the data link layer (Layer 2) of the OSI model and makes switching decisions based upon MAC addresses. Each switchport on a switch is a separate collision domain, but all switchports are in a common broadcast domain. A bridge is networking hardware that forwards traffic between network segments at the data link layer (Layer 2) of the OSI model using MAC addresses. Each switchport on a bridge is a separate collision domain, but all switchports are in a common broadcast domain.

Question 86

Dion Training installed a new router 183 days ago and it stopped working today due to a faulty power supply. The network technicians replaced the power supply and the router was returned to service within 4 hours. Which of the following terms would BEST represent the 183 days in this scenario? A.RPO (Recovery Point Objective) B.MTTR (Mean Time To Repair) C.RTO (Recovery Time Objective) D.MTBF (Mean Time Between Failures)

Answer 86

D.MTBF (Mean Time Between Failures) OBJ-3.3: The mean time between failures (MTBF) measures the average time between when failures occur on a device. The mean time to repair (MTTR) measures the average time it takes to repair a network device when it breaks. The recovery time objective (RTO) is the duration of time and a service level within which a business process must be restored after a disaster to avoid unacceptable consequences associated with a break in continuity. The recovery point objective (RPO) is the interval of time that might pass during a disruption before the quantity of data lost during that period exceeds the Business Continuity Plan’s maximum allowable threshold or tolerance.

Question 87

You have been asked to install a media converter that connects a newly installed RG-6 cable to the existing Cat 6a infrastructure. Which type of media converter should you use? A.Coaxial to ethernet B.Fiber to coaxial C.Fiber to ethernet D.Multimode to single-mode

Answer 87

A.Coaxial to ethernet OBJ-1.3: A media converter is a Layer 1 device that changes one type of physical network connection to another. In this case, we are converting coaxial (RG-6) cable to Cat 6a (ethernet) cable.

Question 88

A network administrator needs to install a centrally located firewall that needs to block specific incoming and outgoing IP addresses without denying legitimate return traffic. Which type of firewall should the administrator install? A.A stateless network-based firewall B.A stateful network-based firewall C.A host-based stateless firewall D.A host-based stateful firewall

Answer 88

B.A stateful network-based firewall OBJ-2.1: A stateful firewall enhances security through packet filtering, and these types of firewalls also keep track of outbound requests and open the port for the returning traffic to enter the network. Since a centrally located firewall was required by the question, a network-based firewall should be chosen instead of a host-based firewall.

Question 89

It has been determined by network operations that there is a severe bottleneck on its mesh topology network. The field technician has chosen to use log management and found that one router makes routing decisions slower than the others on the network. Which of the following types of issues would you classify this as? A.Storage area network issues B.Network device power issues C.Delayed RADIUS (Remote Authentication Dial-In User Service) responses D.Network device CPU (Central Processing Unit) issues

Answer 89

D.Network device CPU (Central Processing Unit) issues OBJ-5.5: Routing decisions are processed by the router and rely on the networking device's central processing unit (CPU). The CPU performance can become a severe bottleneck in the network performance if you have an underpowered router for a large enterprise environment. Network device power issues would cause network outages, not network slowdowns as this scenario presented. The scenario did not state that this mesh network is a storage area network, therefore it is not a SAN issue. Similarly, the scenario did not mention authentication issues, therefore the network performance issue is not caused by delayed RADIUS responses.

Question 90

Which type of network device operates at layer 2 of the OSI model and allows connected devices to operate at full-duplex since each port is in their own collision domain? A.Access point B.Hub C.Router D.Switch

Answer 90

D.Switch OBJ-2.1: A switch is networking hardware that connects devices on a computer network by using packet switching to receive and forward data to the destination device. A switch operates at the data link layer (Layer 2) of the OSI model and makes switching decisions based upon MAC addresses. Each switchport on a switch is a separate collision domain, but all switchports are in a common broadcast domain. A router is networking hardware that connects computer networks and forwards data packets between those networks. A router operates at the network layer (Layer 3) of the OSI model and makes routing decisions based upon IP addresses. Each switchport on a router is a separate collision domain and a separate broadcast domain. A hub is a network hardware device for connecting multiple Ethernet devices together and making them act as a single network segment. A hub operates at the physical layer (Layer 1) of the OSI model. All devices connected by a hub are in a single collision domain and a single broadcast domain, therefore they must use half-duplex for communication and CSMA/CD. A wireless access point is a networking device that allows other Wi-Fi devices to connect to a wired network. A wireless access point operates at the physical layer (Layer 1) of the OSI model to extend the wired network into the wireless domain.