CompTIA Network+ Practice N10-008 2nd edition Flashcards

CompTIA Practice Questions

1
Q

At which layer of the OSI model do the protocols on a typical LAN use MAC addresses to identify other computers on the network?

A

Data Link Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which organisation developed the OSI model?

A

ISO (International Organisation for Standardisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which layer of the OSI layer is responsible for the logical addressing of end systems and the routing of datagrams on a network?

A

Network layer - contains headers that specify logical addresses for end system communication and route diagrams across a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

On a TCP/IP network, which layers of the OSI model contain protocols that are responsible for encapsulating the data generated by an application, creating a payload for a packet that will be transmitted over a network?

A

Data Link, Network, Transport - Before the payload data generated by an application can be transmitted over a TCP/IP network, the system must encapsulate it by applying protocol headers and footers at three layers of the OSI model. The data link layer applies a header and footer to create an Ethernet frame. The network layer applies a header to create an IP datagram. The transport layer applies a TCP or UDP header to create a segment or datagram.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What layer of the Open Systems Interconnection (OSI) model is responsible for translating and formatting information?

A

Presentation Layer - The presentation layer implements functions that provide formatting, translation, and presentation of information. No other layers of the OSI model translate and format application data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which device typically operates at the network layer of the Open Systems Interconnection (OSI) model?

A

A Router - A router connects networks at the network layer of the OSI model. Proxy servers operate at the application layer. Network interface adapters operate at both the data link and the physical layers. Hubs are physical layer devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which layer of the Open Systems Interconnection (OSI) model provides an entrance point to the protocol stack for applications?

A

Application Layer - The application layer provides an entry point for applications to access the protocol stack and prepare information for transmission across a network. All other layers of the OSI model reside below this layer and rely on this entry point.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which layer of the Open Systems Interconnection (OSI) model is responsible for dialogue control between two communicating end systems?

A

Session Layer - The session layer is responsible for creating and maintaining a dialogue between end systems. This dialogue can be a two-way alternate dialogue that requires end systems to take turns transmitting, or it can be a two-way simultaneous dialogue in which either end system can transmit at will. No other layers of the OSI model perform dialogue control between communicating end systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Some switches can perform functions associated with two layers of the Open Systems Interconnection (OSI) model. Which two of the following layers are often associated with network switching?

A

Data Link, Network - The primary function of a switch is to process packets based on their media access control (MAC) addresses, which makes it a data link layer device. However, many switches can also perform routing functions based on IP addresses, which operate at the network layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

At which layer of the Open Systems Interconnection (OSI) model are there TCP/IP protocols than can provide either connectionless or connection-oriented services to applications?

A

Transport Layer - There are two types of transport layer protocols: connection-oriented and connectionless. Connection-oriented protocols guarantee the delivery of data from source to destination by creating a connection between the sender and the receiver before any data is transmitted. Connectionless protocols do not require a connection between end systems in order to pass data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which layers of the Open Systems Interconnection (OSI) model typically have dedicated physical hardware devices associated with them?

A

Physical, Datalink, Network - The physical layer of the OSI model is associated with hubs, cables, and network interface adapters. The data link layer is associated with bridges and switches. The network layer is associated with routers. The transport, session, presentation, and application layers are typically not associated with dedicated hardware devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

At which layer of the Open Systems Interconnection (OSI) model is there a protocol that adds both a header and footer to the information that is passed down from an upper layer, thus creating a frame?

A

Data Link Layer - The only layer with a protocol (such as Ethernet) that adds both a header and a footer is the data link layer. The process of adding the headers and footers is known as data encapsulation. All other protocol layers that encapsulate data add just a header.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Identify the layer of the Open Systems Interconnection (OSI) model that controls the addressing, transmission, and reception of Ethernet frames, and also identify the media access control method that Ethernet uses.

A

Data Link Layer; CSMA/CD - The Ethernet protocol that handles the addressing, transmission, and reception of frames operates at the data link layer. Each frame includes hardware addresses that identify the sending and receiving systems on the local network. Ethernet uses the CSMA/CD media access control method.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

At which layer of the OSI model do you find the protocol responsible for the delivery of data to its ultimate destination on an internetwork?

A

Network Layer - On a TCP/IP network, the Internet Protocol (IP) at the network layer is the protocol responsible for the delivery of data to its final destination. Data link layer protocols are only concerned with communication between devices on a Local Area Network (LAN) or between two points connected by a Wide Area Network (WAN) link. The session and application layers are not involved in the actual delivery of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which of the following is not a protocol operating at the network layer of the OSI model? IP, ICMP, IGMP, IMAP

A

IMAP - Internet Protocol (IP), Internet Control Message Protocol (ICMP), and Internet Group Message Protocol (IGMP) are all network layer protocols. Internet Message Access Protocol (IMAP) is a mail protocol that operates at the application layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Ed is a software developer who has been given the task of creating an application that requires guaranteed delivery of information between end systems. At which layer of the Open Systems Interconnection (OSI) model does the protocol that provides the guaranteed delivery run, and what type of protocol must Ed use?

A

Transport Layer, Connection-oriented - A connection-oriented transport layer protocol, such as Transmission Control Protocol (TCP), provides guaranteed delivery of data for upper layer applications. Connectionless protocols do not guarantee delivery of information and therefore are not a good choice.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which device operates only at the physical layer of the Open Systems Interconnection (OSI) model?

A

Hub - A hub functions only at the physical layer by forwarding all incoming signals out through all of its ports. Bridges and switches operate at the data link layer by selectively propagating incoming data. Routers operate at the network layer by connecting local area networks (LANs) and propagating only the traffic intended for another network, based on IP addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Alice is a network administrator designing a new Local Area Network (LAN). She needs to determine the type of cabling and the network topology to implement. Which layers of the Open Systems Interconnection (OSI) model apply to cabling and topology elements?

A

Physical Layer - The physical layer defines the mechanical and electrical characteristics of the cables used to build a network. The data link layer defines specific network (LAN or WAN) topologies and their characteristics. The physical layer standard that Alice will implement is dependent on the data link layer protocol she selects. The network, transport, and application layers are not concerned with cables and topologies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which layers of the Open Systems Interconnection (OSI) model do not have protocols in the TCP/IP suite exclusively dedicated to them?

A

Session, Presentation - In the TCP/IP suite, the functions of the session layer are primarily implemented in the transport layer protocols: Transmission Control Protocol (TCP) and User Datagram Protocol (UDP). The presentation layer functions are often implemented in application layer protocols, although some functions, such as encryption, can also be performed by transport or network layer protocols.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

The protocols at which layer of the Open Systems Interconnection (OSI) model use port numbers to identify the applications that are the source and the destination of the data in the packets?

A

Transport Layer - Transport layer protocols, such as Transmission Control Protocol (TCP) and User Datagram Protocol (UDP), have header fields that contain the port numbers of the applications that generated the data in the packet and which will receive it. The application, presentation, and network layers do not use port numbers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

At which of the Open Systems Interconnection (OSI) model layers do switches and bridges perform their basic functions?

A

Data Link Layer - Switches and bridges are involved in Local Area Network (LAN) communications only and therefore primarily at the data link layer. They are not primarily associated with the physical, network, or transport layers, although some switches include network layer routing capabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

On a TCP/IP network, flow control is a function implemented in protocols operating at which layer of the Open Systems Interconnection (OSI) model?

A

Transport Layer - Flow control is a process that adjusts the transmission rate of a protocol based on the capability of the receiver. If the receiving system becomes overwhelmed by incoming data, the sender dynamically reduces the transmission rate. In the TCP/IP protocol suite, Transmission Control Protocol (TCP) is responsible for implementing flow control. TCP runs at the transport layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which layer of the Open Systems Interconnection (OSI) model defines the medium, network interfaces, connecting hardware, and signaling methods used on a network?

A

Physical Layer - The physical layer of the OSI model defines the standards for the physical and mechanical characteristics of a network, such as cabling (copper and fiber), connecting hardware (hubs and switches), and signaling methods (analog and digital).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which of the OSI model layers is responsible for syntax translation and compression or encryption?

A

Presentation Layer - The presentation layer provides a syntax translation service that enables two computers to communicate, despite their use of different bit-encoding methods. This translation service also enables systems using compressed or encrypted data to communicate with each other.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which layer of the Open Systems Interconnection (OSI) model is responsible for transmitting signals over the network medium?

A

Physical Layer - The physical layer of the OSI model defines the functions specific to the network medium and the transmission and reception of signals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Specify the layer of the Open Systems Interconnection (OSI) model at which the Internet Protocol (IP) operates and whether it is connection-oriented or connectionless.

A

Network, Connectionless - IP is a connectionless protocol that operates at the network layer of the OSI model. There are no connection-oriented protocols at this layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

An Ethernet network interface adapter provides functions that span which two layers of the Open Systems Interconnection (OSI) model?

A

Physical and Data Link Layers - An Ethernet network interface adapter functions at the data link layer by encapsulating network layer data for transmission over the network. It provides physical layer functions by providing the connection to the network medium and generating the appropriate signals for transmission. Network interface adapters do not operate at the network, transport, or application layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which of the following protocols operate at the application layer of the Open Systems Interconnection (OSI) model? HTTP, SNMP, ICMP, IGMP, UDP?

A

HTTP, SNMP - Hypertext Transfer Protocol (HTTP) and Simple Network Management Protocol (SNMP) operate at the application layer. Internet Control Message Protocol (ICMP) and Internet Group Management Protocol (IGMP) both operate at the network layer. User Datagram Protocol (UDP) operates at the transport layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Which layer of the Open Systems Interconnection (OSI) model would be responsible for converting a text file encoded using EBCDIC on the sending system into ASCII code, when required by the receiving system?

A

Presentation Layer - The presentation layer of the OSI model is responsible for translating different kinds of syntax, including text-encoding systems, such as EBCDIC and ASCII.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which of the following protocols operates at the network layer of the OSI model, but does not encapsulate data generated by an upper layer protocol for transmission over the network? IP, UDP, ARP, ICMP, TCP?

A

ICMP - Internet Control Message Protocol (ICMP) operates at the network layer by sending operational and error messages. It does not encapsulate upper layer protocol data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

A client on a TCP/IP network is attempting to establish a session with a server. List the order of the TCP flags raised in the Transmission Control Protocol (TCP) session establishment messages?

A

SYN, SYN/ACK, ACK - The TCP connection establishment exchange is a three-way handshake that uses TCP flags to specify the message type for each frame. The first frame contains a SYN flag from the client; the second frame contains the SYN and ACK flags from the server; and the last frame contains an ACK flag from the client.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which of the following is the Maximum Transmission Unit (MTU) size for an Ethernet frame? 512, 1024, 1500, 1518?

A

1500 - The MTU is the largest amount of data (in bytes) that a protocol operating at a given layer of the OSI model can transmit in one packet. The MTU does not include any header and footer fields supplied by that protocol. For Ethernet, the maximum frame size is 1518 bytes, which includes 18 bytes of header and footer fields. Therefore, the MTU for Ethernet is 1500 bytes. Protocols operating at other OSI model layers can have different MTUs. For example, the typical MTU for an Internet Protocol (IPv4) implementation is smaller than that of Ethernet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which Transmission Control Protocol (TCP) control bits is set to 1 to initiate the termination of a session?

A

FIN - The termination phase of a TCP connection begins when either the client or the server sends a message containing the FIN control bit with a value of 1.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

An electrician installing a new light fixture accidentally severs one of the LAN cables running through the dropped ceiling space. With which topology would the severed cable cause the greatest amount of disturbance to the network?

A

BUS - A cable break in a bus topology would split the network into two halves, preventing the nodes on one side of the break from communicating with those on the other. In addition, both halves of the network would be left with one unterminated end, which would prevent the computers on each side of the break from communicating effectively.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Which type of network is typically confined to a small area, such as a single room, floor, or building?

A

LAN - A Local Area Network (LAN), as the name implies, is a group of computers contained within a small geographic area. WANs (Wide Area Networks) connect LANs that are geographically distant. MANs (Metropolitan Area Networks) are not confined to a small area; they are typically larger than a LAN but smaller than a WAN. A Campus Area Network (CAN) typically includes a group of adjacent buildings, such as those of a corporation or university.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Which type of network connects Local Area Networks (LANs) in distant locations?

A

WAN - WANs (Wide Area Networks) connect LANs that are geographically distant.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Which topologies require the installation of terminating resistors at two locations?

A

Bus - A bus topology requires terminating resistors at each end of the bus, to remove signals as they reach the end of the cable and prevent them from reflecting back in the other direction and interfering with newly transmitted signals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Which topology is used by the majority of new Ethernet networks installed today?

A

Hierarchical Star - Virtually all of the new Ethernet networks installed today use the star or the hierarchical star topology, with one or more switches functioning as a cabling nexus.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Alice has constructed a five-node failover cluster in which all five servers are connected to a hard disk array using a dedicated Fibre Channel network. Which term describes this network arrangement?

A

SAN - A storage area network (SAN) is a network that is dedicated to carrying traffic between servers and storage devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Which of the following is not a technology typically used for a personal area network (PAN)? Bluetooth, Z-wave, NFC, SDWAN?

A

SDWAN - A Software-Defined Wide Area Network (SDWAN) is a technology that automates the configuration of WAN routers based on the current mix of traffic. It is therefore not suitable for use on a PAN. Bluetooth, Z-Wave, and near-field communication (NFC) are all short-range wireless technologies that are capable of providing communications between PAN devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Which of the following network topologies are used by Wireless Local Area Networks (WLANs)? Ad hoc, bus, Infrastructure, Star?

A

Ad hoc, Infrastructure - WLANs can use the ad hoc topology, in which devices communicate directly with each other, or the infrastructure topology, in which the wireless devices connect to an access point.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Which of the following Ethernet physical layer options does not use the star topology? 10Base2, 10Base-T, 100Base-TX, 1000Base-T?

A

10Base2 - 10Base2 is the physical layer specification for Thin Ethernet, which uses coaxial cable in a bus topology. 10Base-T, 100Base-TX, and 1000Base-T all use twisted pair cable in a star topology.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Which of the following network types are typically wireless? WAN, PAN, SAN, WLAN?

A

PAN, WLAN - Personal area networks (PANs) connect devices associated with a single person, such as smartphones, and are nearly always wireless. Wireless Local Area Networks (WLANs) are wireless by definition. Wide Area Networks (WANs) typically span long distances and are typically wired, at least in part. Storage area networks (SANs) require high performance levels and are nearly always wired.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Dense Wave Division Multiplexing (DWDM) is a signaling technology that has become a popular choice in the construction of which of the following types of provider links? DSL, Metro-optical, Satelite, Cable?

A

Metro-optical - DWDM has become a popular technology in the construction of metro-optical networks because it addresses some of the scalability and cost restrictions of other optical technologies, such as Synchronous Optical Networks (SONETs). DSL, satellite, and cable providers do not typically use DWDM.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

On peer-to-peer networks, every workstation is capable of authenticating users. T/F

A

True - A peer-to-peer network calls for each workstation to maintain accounts for authenticating users that access their shared resources. On a client-server network, authentication is centralized. Peer-to-peer networks can be more difficult to administer than client-server networks, but they are not inherently less secure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Why does DSL (Digital Subscriber Line) technology support faster data transmissions than a standard Public Switched Telephone Network (PSTN) modem connection?

A

DSL technology provides higher data rates because it uses frequency ranges that are higher than the standard voice spectrum. DSL connections use 10 kHz and above, whereas the standard voice spectrum uses 300 Hz to 4 kHz. DSL does not use separate control circuits and does not perform CRC functions. Also, DSL technology is strictly digital and does not require an analog-to-digital conversion.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Which DSL (Digital Subscriber Line) technology can adjust its transmission speed based on line conditions?

A

RADSL - Rate-Adaptive Digital Subscriber Line (RADSL) technology can adjust its rate of transmission based on line conditions. High-bit-rate Digital Subscriber Line (HDSL), Very high-rate Digital Subscriber Line (VDSL), and Internet Digital Subscriber Line (IDSL) do not use rate adaptive transmission.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Which Wide Area Network (WAN) technologies uses broadband signaling?

A

Cable Television (CATV) - CATV networks use broadband signaling, which enables many signals to occupy the same channel. DSL and ISDN do not use broadband signaling.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Ed has been hired by a private company to connect two remote sites with a Wide Area Network (WAN). Each of these sites has more than 200 users, and they all need to constantly transfer files across the WAN. One of the sites has a customer database that is accessed by both sites at all hours of the day. Access to the database and other information is time sensitive and constant. The company estimates that their aggregate bandwidth needs to be approximately 40 Mbps. Management says that they need to guarantee access to this information and that money is not a factor in the WAN implementation. Which WAN technology should Ed recommend for this scenario?

A

A T-3 dedicated leased line - This is because the bandwidth requirements are constant, and the data transfer rates are high. To support the 40 Mbps data rate, Ed should recommend a T-3 dedicated leased line, running at 44.735 Mbps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Ralph is an employee of a company that offers the option to telecommute from home. As a telecommuting employee, he needs to connect to the company network to access client information, transfer files, and send email through a Virtual Private Network (VPN) connection. Ralph is investigating the different Wide Area Network (WAN) services available for the remote connection before he implements one. His home is over 30 years old; the existing telephone wiring was not run through conduit, and the wiring seems to be deteriorating. Ralph has cable television (CATV) service, and his home is also approximately 20,000 feet from the nearest telephone central office. He wants to implement the fastest remote connection service possible, but cost is a factor in the decision. Which WAN technology should Ralph implement?

A

A broadband CATV connection - In this scenario, the best solution is for Ralph to use his existing CATV service for the remote connection. CATV offers faster data rates than standard modem-to-modem service and supports VPN connections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Which of the following Wide Area Network (WAN) connection technologies uses analog signaling? PSTN, CATV, DSL, SONET?

A

PSTN is an analog, circuit-switched network. CATV, DSL, and SONET are all digital networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

If you want to allow both voice and data traffic to be transmitted across the same Digital Subscriber Line (DSL) connection, what type of device is required at the customer site?

A

A splitter - In a DSL connection, a signal splitter is needed at the customer site to separate the lower frequency voice range from the higher frequencies used by data traffic. The higher frequency signals are handled at the central office by a DSLAM device. Lower frequency signals carrying voice traffic are handled at the central office by a CODEC device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What are the two main factors that affect DSL (Digital Subscriber Line) transmission rates?

A

Distance to the nearest central office, Line Conditions - There are two factors that affect DSL transmission rates. The first is the distance to the nearest central office, and the second is the condition and quality of the line. For DSL to achieve higher data rates, the site must be close to the central office and use good-quality lines for signal transmission.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Describe the function of a demarcation point or demarc?

A

The place where an outside service enters the building - A demarcation point, or demarc, is the place where an outside telecommunications service meets a customer’s private network, which is typically where the service enters the building. The demarc is also the place where the responsibility of the network administrator ends. If a problem occurs outside the demarc, it is up to the service provider to fix it. Inside the demarc, it is the network administrator’s problem.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Which of the following broadband WAN services provides equal amounts of upstream and downstream bandwidth? ADSL, SDSL, Satelite, Cable?

A

SDSL - The word symmetric in Symmetric Digital Subscriber Line (SDSL) means that the service provides equal amounts of bandwidth in both directions. The asymmetric in Asymmetric Digital Subscriber Line (ADSL) means that the service provides more downstream bandwidth than upstream. Cable and satellite services are also asymmetric, providing more bandwidth downstream than upstream.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Which of the following remote access connection technologies can support the simultaneous transmission of voice and data traffic over the Public Switched Telephone Network (PSTN)? (Choose all that apply.)

Dial-up modem connection

Integrated Services Digital Network (ISDN)

Digital Subscriber Line (DSL)

Synchronous Optical Network (SONET)

Cable television (CATV) network

A

ISDN and DSL are both remote access technologies that enable users to transmit voice and data simultaneously. To do this, DSL splits the lower analog frequency (voice) range from the higher digital frequency (data) range, whereas ISDN provides multiple data channels (called B channels) that allow for both voice and data transmissions. Broadband cable television networks can often support simultaneous voice and data communications, but they use Voice over Internet Protocol (VoIP) to carry voice traffic over the Internet, not the PSTN. Dial-up connections and SONET do not support the simultaneous transmission of voice and data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

A T-3 leased line connection runs at 44.736 megabits per second (Mbps). How many separate channels does a T-3 provide?

A

672 - A T-3 leased line connection is the equivalent of 28 T-1 connections. Each T-1 consists of 24 channels, so a T-3 has a total of 672 channels (28 × 24).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

A T-3 leased line connection is the equivalent of how many T-1 connections?

A

28 - A T-3 leased line connection is the equivalent of 28 T-1 connections. Each T-1 consists of 24 channels, so a T-3 has a total of 672 channels (28 × 24), for an overall transfer rate of 44.736 Mbps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Which of the following is the U.S. standard for synchronous data transmissions that defines data rates designated by optical carrier levels, such as OC-3, OC-12, OC-48, and OC-192?

A

SONET - The Synchronous Optical Networking (SONET) standard defines a base data transfer rate of 51.84 Mbps, which is multiplied at the various optical carrier levels. An OC-3 connection therefore runs at 155.52 Mbps, an OC-12 at 622.08 Mbps and so forth. The Synchronous Digital Hierarchy (SDH) is the European equivalent of SONET.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Which is a wide area networking mechanism that assigns labels to packets and forwards them based on those labels, rather than addresses?

A

MPLS - Multiprotocol Label Switching (MPLS) is a data transfer mechanism that assigns labels to individual packets, and then routes the packets based on those labels.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Which two of the following constructs provide roughly the same function? (Choose two that apply.)

SIP trunk

CSU/DSU

VoIP gateway

Smartjack

VPN concentrator

A

A Session Initiation Protocol (SIP) trunk provides a connection between the private and public domains of a unified communications network. A Voice over Internet Protocol (VoIP) gateway provides a connection between an IP network and the Public Switched Telephone Network (PSTN). Both of these provide a conduit between a subscriber’s private network and the network furnished by a service provider.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Which is the device that provides the interface between a Local Area Network (LAN) and a Wide Area Network (WAN)?

A

CSU/DSU - A Channel Service Unit/Data Service Unit (CSU/DSU) is a device that provides a LAN router on a private network with access to a leased line WAN connection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Which term describes a leased line subscription that provides access to only part of a T-1?

A

Fractional T-1 - A subscription to part of the T-1 leased line is called a fractional T-1 service. This service enables you to purchase some of the 24 DS0 channels in a T-1 connection. An E-1 is the European version of a T-1.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Multiprotocol Label Switching (MPLS) is sometimes said to operate between two layers of the Open Systems Interconnection (OSI) model. Between which two layers is it usually said to function?

A

Data Link and Network - MPLS is a data-carrying service that is often said to operate between the data link layer and the network layer. It is therefore sometimes called a layer 2.5 protocol. MPLS can be used to carry IP datagrams as well as Ethernet, Asynchronous Transfer Mode (ATM), and Synchronous Optical Network (SONET) traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Which of the following Wide Area Network (WAN) services provides the fastest transfer rate?

T-1

E-1

T-3

OC-1

A

OC-1 - An OC-1 connection provides the fastest transfer rate at 51.84 Mbps. An E-1 connection is 2.048 Mbps. A T-3 is 44.736 Mbps, and a T-1 is 1.544 Mbps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

To which Internet connection types does a specification called DOCSIS apply?

A

Cable Broadband - The Data Over Cable Service Interface Specification (DOCSIS) is a telecommunications standard that defines the manner in which data is to be transmitted over a cable television system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Which of the following are types of circuits offered by frame relay services? (Choose all that apply.)

SRV

PVC

SVC

UPC

A

PVC, SVC - Frame relay services offer permanent virtual circuits (PVCs) and switched virtual circuits (SVCs). SRV is a resource record type in the Domain Name System (DNS), and an Ultra-Physical Contact (UPC) is a type of fiber-optic cable connector.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Which types of Wide Area Network (WAN) connections commonly use Point-to-Point Protocol over Ethernet (PPPoE)?

A

Cable Broadband, DSL - Cable broadband and DSL subscribers typically connect to ISP networks that run Ethernet, but Ethernet has no built-in authentication or encryption mechanisms. PPP has the ability to use external authentication and encryption protocols, so by encapsulating PPP within Ethernet frames, users are able to log on to the ISP network securely.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Which of the Wide Area Network (WAN) services typically uses a switched fabric that was called a cloud long before the term came into general use?

A

Frame Relay - Frame relay is a packet switching service that uses a single leased line to replace multiple leased lines by multiplexing traffic through a cloud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Ralph has been contracted to consult for a company that wants to update its legacy Ethernet network to Gigabit Ethernet. On examining the site, he discovers that the network is still using coaxial-based Thin Ethernet. What change in network topology must occur to upgrade the existing network to Gigabit Ethernet using Unshielded Twisted Pair (UTP) cable?

A

Bus to Star - All coaxial-based Ethernet networks, including Thin Ethernet, use a bus topology. All UTP-based Gigabit Ethernet networks use a star topology. Therefore, an upgrade from coaxial to UTP cable must include a change in topology from bus to star.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

A vSwitch enables virtual machines (VMs) running on the same hypervisor to communicate with each other internally.
T/F

A

True - In most virtualization products, when you create multiple virtual machines on one host computer, they can communicate with each other internally using a built-in virtual switching capability. A computer with multiple network adapters can function as a router, but not as a switch. Layer 3 switches can provide virtual routers that connect VLANs together, but not virtual switches. The function that enables VLANs on different switches to communicate is called trunking, not virtual switching.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Describe the difference between Type I and Type II virtualisation

A

In Type I virtualization, the hypervisor runs directly on the physical computer hardware, whereas in Type II virtualization, a host operating system runs on the computer hardware and the hypervisor runs on top of the host OS. - Type I virtualization does not require a host OS, whereas Type II virtualization does. Both Type I and Type II virtualization can use processors with hardware virtualization assistance, but only Type I requires it. The type of virtualization does not impose any limit on the number of virtual machines supported; any limitations are left to the individual implementation. Both Type I and Type II virtualization can share a single processor among virtual machines.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

On which virtual networking components can you create VLANs?

A

Virtual Switch - You can create Virtual Local Area Networks (VLANs) on a virtual switch, just as you can create them on many physical switches. In most cases, virtual components function just like their physical counterparts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

On an unmanaged network, which virtual networking components have media access control (MAC) addresses assigned to them?

A

Virtual NICs - Just like physical network interface cards (NICs), virtual NICs have 6 byte MAC addresses assigned to them, which enable them to be identified by data link layer protocols. Unlike physical NICs, however, it is typically an easy matter to modify a MAC address on a virtual NIC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Which component is responsible for providing a virtualized hardware environment and running virtual machines?

A

Hypervisor - The hypervisor is the hardware or software component responsible for managing virtual machines and providing the virtualized hardware environment on which they run.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What is the proper term for a computer with a hypervisor on which you can create virtual machines and other virtual components?

A

Host - A computer with a hypervisor, on which you can create virtual machines, is referred to as a host. The virtual machines themselves are called guests.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

In which way does a vSwitch (virtual switch) differ from a physical switch?

A

Virtual switches have an unlimited number of ports, whereas physical switches have a specific number.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

Which technology can replace leased lines, such as T-1s, by multiplexing signals as packets switched through virtual circuits in a cloud?

A

Frame Relay - Frame relay is a packet switching service that uses a single leased line to replace multiple leased lines by multiplexing traffic through a cloud. The service can create virtual circuits connecting the subscriber’s network to multiple destinations, eliminating the need for a dedicated leased line to each remote site.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Which of the following is not a protocol that uses tunneling to establish secured links between TCP/IP systems?
L2TP
IPsec
MGRE
NAT

A

NAT - Network Address Translation (NAT) enables workstations on private networks to access the Internet by substituting a public IP address in packets generated with private addresses. Layer 2 Tunneling Protocol (L2TP), IPsec, and Multipoint Generic Routing Encapsulation (MGRE) are all protocols that encapsulate packets in an encrypted form within another protocol to secure the contents.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Which of the following is not one of the primary components of the Network Function Virtualization (NFV) framework?
VNF
NFV ISG
NFVI
NFV-MANO

A

NFV ISG - The NFV specification, published by the European Telecommunications Standards Institute (ETSI), calls for three main components: virtualized network functions (VNFs), which are software-based implementations of standard network services, such as firewalls and load balancers; a Network Functions Virtualization Infrastructure (NFVI), which is the hardware/software environment that hosts the VNFs; and a Network Functions Virtualization-Management And Orchestration (NFV-MANO) framework, which includes the elements required to deploy and administer the NFVI and the VNFs. The Network Functions Virtualization Industry Specification Group (NFV ISG) is the group within ETSI that develops the NFV specifications; it is not one of the three components.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Identify the organizations that developed the general cable type standards for voice and data communications that are currently in use and identify the document name.
ANSI/TVA, document C568
TWA/ANSI/EIA, document T530-A
EIA/ANSI/TWA, document 802.2
TDA/EIA/TIA, document 802.11
ANSI/TIA/EIA, document T568b

A

ANSI/TIA/EIA, document T568b - The three organizations that collectively developed the T568b document, which defines the standard for a structured cabling system for voice and data communications, are the American National Standards Institute (ANSI), the Telecommunications Industry Association (TIA), and the Electronic Industries Association (EIA). All of the other options are not standards organizations or cabling standards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Which cable types and connectors are used to attach a television set to a cable television (CATV) network?

A

A coaxial cable and an F-type connector - The cable type and connector used to attach a television set to a CATV network is a coaxial cable with a screw-on F-type connector. Although CATV networks typically use fiber-optic cables and ST connectors for outdoor connections, they do not use fiber for internal connections to television sets. Coaxial cables with BNC connectors are most commonly used for Thin Ethernet LANs, not CATV network connections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Which of the cable types is used for Thick Ethernet network segments?

A

RG-8 - The cable type used for Thick Ethernet segments is a coaxial cable called RG-8. RG-58 is used exclusively on Thin Ethernet segments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Which of the cable types is used for Thin Ethernet network segments?

A

RG-58 - RG-58 coaxial cable is used exclusively for Thin Ethernet segments. RG-8 cable is used for Thick Ethernet segments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

What is a common European alternative to the 110 punchdown block used in U.S. telecommunications installations?

A

Krone LSA-Plus - The Krone LSA-Plus is a proprietary telecommunications connector type commonly used in European installations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Which of the following coaxial cable types are still in general use? (Choose all that apply.)
RG-6
RG-8
RG-58
RG-59

A

RG-6 and RG-59 - RG-6 and RG-59 are 75 ohm cables that are still used for cable television and similar connections. RG-8 and RG-58 are 50 ohm cables that were formerly used for Thick Ethernet and Thin Ethernet, respectively, but are no longer in general use.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Which of the following is not a type of fiber-optic connector?
SC
MTRJ
ST
BNC

A

BNC - Bayonet-Neill-Concelman (BNC) is a type of connector used with coaxial cable. Subscriber Connector (SC), Mechanical Transfer-Registered Jack (MT-RJ), and Straight Tip (ST) are all types of fiber-optic connectors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

Which of the following physical layer transceiver module standards is the oldest and therefore the most obsolete?
SFP
SFP+
GBIC
QSFP
QSFP+

A

The Gigabit Interface Converter (GBIC) transceiver standard was first published in 1995 and defines a maximum data transfer rate of 1.25 Gbps. It was rendered all but obsolete by the Small Form-factor Pluggable (SFP) standard, introduced in 2001, which ran at the same maximum speed but was smaller in size.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

Which of the following cable types is typically configured in a star topology, uses eight copper conductors arranged in four pairs, and uses RJ-45 connectors?
RG-8
Twisted pair
RG-58
Fiber optic

A

There are two main types of twisted pair wiring used for data communications: Unshielded Twisted Pair (UTP) and Shielded Twisted Pair (STP). Both types can be used in a star topology. UTP and STP cables contain eight copper conductors twisted in four pairs. UTP and STP cables use RJ-45 connectors to connect end systems to switches, patch panels, and wall plates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Which of the following statements explains the purpose of the twists in twisted pair cabling?
- The twists prevent collisions.
- The twists completely eliminate crosstalk and electromagnetic interference (EMI) in adjacent wire pairs.
- The twists prevent crosstalk in adjacent wire pairs and limit the effects of EMI on the signals carried over the cable.
- The twists extend the bend radius allowance of the cable.

A

The twists in a twisted pair cable prevent the signals on the different wires from interfering with each other (which is called crosstalk) and also provide resistance to outside electromagnetic interference. The twists have no effect on collisions. The twists cannot completely eliminate the effects of EMI.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Thin Ethernet network?

A

RG-58, 50-ohm, 0.195-inch, coaxial cable with BNC connectors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Which of the following connector types was typically associated with a T-connector attached to the computer?
RJ45
MT-RJ
8P8C
BNC
F

A

BNC - Thin Ethernet networks use a type of coaxial cable that runs from each computer to the next one, forming a bus topology. To connect the cable to the network computers, each network interface adapter has a T-connector attached to it, with two additional male BNC connectors, to which you connect two lengths of network cabling.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Which of the following connector types are associated with fiber-optic cables? (Choose all that apply.)
RJ11
ST
F
LC
MT-RJ

A

ST, LC, MT-RJ - Fiber-optic cable connectors all function on the same basic principles, but there are a variety of form factors from which to choose, including Straight Tip (ST), Local Connector (LC), and Mechanical Transfer–Registered Jack (MT-RJ). RJ-11 is a twisted pair cable connector, and F connectors are for coaxial cable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Which of the following types of cable, when installed, sometimes employed a device called a vampire tap?
Unshielded twisted pair
Shielded twisted pair
Multimode fiber optic
Single-mode fiber optic
Coaxial

A

Coaxial - Thick Ethernet installations used a type of coaxial cable called RG-8. To connect a node to the network, installers ran a separate cable called an Attachment Unit Interface (AUI) cable from the computer to the RG-8 and connected it using a device called a vampire tap that pierced the sheathing to make contact with the conductors within.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

In an internal UTP cable installation, each horizontal cable run connects a wall plate in the work area to a centralized cabling nexus in a telecommunications room. Which of the following is the correct term for this cabling nexus?
Telepole
Demarc
Backbone
Patch panel
Fiber distribution panel

A

Patch Panel - The cabling nexus in a telecommunications room is called a patch panel. A telepole is a tool used for installing cables. A backbone is a network that connects other Local Area Networks (LANs) together. A demarcation point, or demarc, is the location at which a telecommunication provider’s service meets the customer’s private network. A fiber distribution panel is used for fiber optic cable, not Unshielded Twisted Pair (UTP), connections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Ralph has been hired by a client to install cabling to connect two existing networks. The two networks are in different buildings approximately 1000 feet apart. The cable type must support Gigabit Ethernet data rates of 1000 megabits per second (Mbps) and provide a high level of resistance to electromagnetic interference (EMI). Your client wants the most economical cabling solution that meets their needs. Which of the cable types best meets the needs of this client?

A

Multimode Fibre Optic - Multimode fiber-optic cable best meets the client’s needs. Fiber-optic cable supports the required 1000 Mbps data rate and can connect networks that are more than 1000 feet apart. Fiber-optic cable is immune to EMI. Although both multimode and single-mode fiber would meet the corporation’s general needs, multimode is best in this scenario because it is less expensive than single-mode fiber.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

What are the steps are followed when connecting bulk cables to jacks in wall plates and patch panels?

A
  1. Strip some of the sheath off the cable end to expose the wires.
  2. Separate the twisted wire pairs at the ends.
  3. Strip a small amount of insulation off each wire.
  4. Insert the wires into the appropriate contacts in the jack.
  5. Press the bare wire down between the two metal contacts that hold it in place.
  6. Cut off the excess wire that protrudes past the contacts.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Which of the following cable connector types is not used with fiber-optic cable?
Straight Tip (ST)
Subscriber Connector (SC)
Mechanical Transfer–Registered Jack (MT-RJ)
F-type
Fiber Local Connector (LC)

A

F-type - ST, SC, fiber LC, and MT-RJ are all connectors used with fiber-optic cables. F-type connectors are used with coaxial cables.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Which of the following twisted pair cable types can you use to construct a 10GBase-T network with 100-meter segments? (Choose all that apply.)
CAT5
CAT5e
CAT6
CAT6a
CAT7
CAT8

A

CAT6a, CAT7, CAT8 - Category 6a (CAT6a) twisted pair cable is a variant on CAT6 that enables you to create 10GBase-T networks with segments up to 100 meters long. Category 7 (CAT7) cable adds shielding both to the individual wire pairs and to the entire cable, for even greater resistance to crosstalk and noise. CAT7 supports 100-meter 10GBase-T segments as well. CAT8 cable supports bandwidth up to 2 GHz, making it even more suitable for 10GBase-T networks than CAT6a (500 MHz) or CAT7 (600 MHz). CAT5 and CAT5e are not suitable for use with 10GBase-T. You can use CAT6 for 10GBase-T, but it is limited to 55-meter segments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

Which of the following Ethernet specifications calls for CAT8 UTP cable exclusively?
10GBase-T
40GBase-T
100Base-TX
1000Base-SX

A

40GBase-T - is a 40-gigabits-per-second (Gbps) Ethernet specification that calls for 4-pair CAT8 twisted pair cabling for lengths up to 30 meters. 10GBase-T and 100Base-TX do not require CAT8 cable, and 1000Base-SX is a fiber optic standard.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Ralph has been hired to connect three Local Area Networks (LANs) together with redundant paths that form a fault-tolerant backbone. The LANs reside on different floors in the same building and are approximately 600 meters apart. Each LAN is currently configured in a star topology using twisted pair cabling. Each LAN includes wall plates and rack-mounted patch panels and switches. Building and fire codes allow cables to run through existing risers, ceilings, and walls, but a 50,000-watt radio station occupies one of the floors between the LANs. Which topology, cable type, and installation method are best suited for this network?
- Star topology, fiber-optic cabling, and internal installation
- Star topology, coaxial cabling, and external installation
- Mesh topology, fiber-optic cabling, and external installation
- Bus topology, twisted pair cabling, and internal installation
- Mesh topology, fiber-optic cabling, and internal installation
- Star topology, twisted pair cabling, and external installation

A

Mesh Topology, Fibre-optic cabling and internal installation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

In the 100Base-TX specification, what are the functions of the Fast Link Pulse (FLP) signals exchanged by switches and network interface adapters?

A
  • The FLP signals verify the integrity of the connection between the devices
  • The FLP signals enable the devices to negotiate to speed of the link between them
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

Which of the following 10 Gigabit Ethernet specifications calls for the use of copper cable?
10GBase-LR
10GBase-CX4
10GBase-ER
10GBase-LX4
10GBase-SR

A

The 10GBase-CX4 specification calls for the use of a twinaxial copper cable with segments no longer than 15 meters. The10GBase-LR, 10GBase-ER, 10GBase-LX4, and 10GBase-SR specifications all call for fiber-optic cable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

Alice is a network consultant who has been contracted to upgrade an existing Ethernet network to Gigabit Ethernet. The network consists of 20 workstations with integrated 10Base-T/100Base-TX/1000Base-T network interface adapters. The network cabling is Category 5 (CAT5) Unshielded Twisted Pair (UTP), installed when the building was constructed. All of the workstations are connected to a single 100Base-TX switch. Which of the following options would Alice find to be a valid upgrade path to Gigabit Ethernet?
- Replace the CAT5 cable with at least Category 5e (CAT5e) or Category 6 (CAT6), and leave the existing network interface adapters and switch in place.
- Install a 1000Base-T network interface card in each computer, and leave the existing cables and switch in place.
- Replace the CAT5 cable with at least CAT5e or CAT6, and replace the 100Base-T switch with a 1000Base-T switch.
- Replace the 100Base-TX switch with a 1000Base-T switch, and leave the existing cables and network interface adapters in place.

A

Replace the 100Base-TX switch with a 1000Base-T switch, and leave the existing cables and network interface adapters in place - The multispeed network interface adapters in the computers can run at 1 Gbps speed using the existing CAT5 cable, but the 100Base-T switch must be replaced with a 1000Base-T switch. While the network might run better with a cable upgrade, it is not immediately necessary. Replacing the network interface adapters is not necessary because the existing multispeed adapters can run at 1 Gbps if they are connected to a 1000Base-T switch.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Which of the following services enables computers on a private IPv4 network to access the Internet using a registered IP address?
DHCP
NAT
DNS
NTP

A

Network Address Translation (NAT) is a service that enables computers with unregistered IP addresses to access the Internet by substituting a registered address in packets as they pass through a router. The Dynamic Host Configuration Protocol (DHCP) is an IP address allocation service. Domain Name System (DNS) resolves domain and hostnames into IP addresses, and Network Time Protocol (NTP) enables network devices to synchronize their time settings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

Which of the following best defines the concept of the dual stack?
A computer with two network interface adapters
A computer with two installed operating systems
A computer with two sets of networking protocols
A computer with connections to two different network segments

A

A dual stack is an IP implementation that includes both IPv4 and IPv6 protocol stacks, operating simultaneously. A computer with two network adapters or connections to two network segments is often called multihomed. A computer with two installed operating systems is called a dual-boot system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Which of the following IPv4 addresses are you unable to assign to a network host? (Choose all that apply.)
A)1.1.1.1
B)229.6.87.3
C)103.256.77.4
D)9.34.0.1

A

B, C. IPv4 addresses with first byte values from 224 to 239 are Class D addresses, which are reserved for use as multicast addresses. Therefore, you cannot assign 229.6.87.3 to a host. Option C, 103.256.77.4, is an invalid address because the value 256 cannot be represented by an 8-bit binary value. The other options, 1.1.1.1 and 9.34.0.1, are both valid IPv4 addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

How many bits are allocated to the host identifier in an IPv4 address on the 10.72.0.0/17 network?

A

15 - The value after the slash in a Classless Inter-Domain Routing (CIDR) address specifies the number of bits in the network identifier. An IPv4 address has 32 bits, so if 17 bits are allocated to the network identifier, 15 bits are left for the host identifier.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

Alice has been instructed to create an IPv4 network with 8 subnets and 30 hosts per subnet. She has been assigned a Class C network address. Which of the following subnet masks will she have to use?
255.255.255.128
255.255.255.192
255.255.255.224
255.255.255.240
255.255.255.248

A

255.255.255.224 - To create a network with 8 subnets and 30 hosts per subnet, Alice would have to allocate 3 of the 8 bits in the last octet for subnet identifiers. This would result in a binary value of 11100000 for the last octet in the subnet mask, which converts to a decimal value of 224.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Which of the following is a valid IPv6 address?

fe00::b491:cf79:p493:23ff

2001:0:49e6:39ff:8cf5:6812:ef56

fe00::c955:c944:acdd:3fcb

2001:0:44ef68:23eb:99fe:72bec6:ea5f

A

fe00::c955:c944:acdd:3fcb - The address fe00::c955:c944:acdd:3fcb is correctly formatted for IPv6, with the double colon replacing three blocks of zeroes. Uncompressed, the address would appear as follows: fe00:0000:0000:0000:c955:c944:acdd:3fcb. Option A contains a nonhexadecimal digit. Option B contains only seven 16-bit blocks (and no double colon) instead of the eight required for 128 bits. Option D contains blocks larger than 16 bits.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

To which class does the following IPv4 address belong: 190.126.14.251?
Class A
Class B
Class C
Class D

A

Class B - All Class B addresses have first octet values between 128 and 191. The first octet range of a Class A address is 1 to 126, and the Class C first octet range is 192 to 223. Class D addresses have a first octet range of 224 to 239.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

Ralph has been instructed to use the network address 10.12.0.0/14 for the new network he is installing. What subnet mask value should he use when configuring his computers?

255.248.0.0

255.252.0.0

255.254.0.0

255.255.248.0

255.255.252.0

255.255.254.0

A

255.252.0.0 - The 14-bit prefix indicated in the network address will result in a mask with 14 ones followed by 18 zeroes. Broken into 8-bit blocks, the binary mask value is as follows:

11111111 11111100 00000000 00000000

Converted into decimal values, this results in a subnet mask value of 255.252.0.0.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

What is the greatest number of subnets you can create with a Class A IPv4 address if you use a 14-bit subnet identifier?

A

The formula for calculating the number of subnets you can create using a subnet identifier of a given length is 2x, where x is the number of bits in the subnet identifier. Therefore, with a 14-bit subnet, you can conceivably create 214, or 16,384, subnets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

Alice has been asked to design her company’s Internet Protocol (IPv4) addressing scheme. The company has been assigned a Class C network address of 192.168.30.0. Alice’s director wants 4 subnets with 28 hosts per subnet. How many bits are required for subnets? How many bits are required for hosts? What will the new subnet mask be for this network?

A

In this scenario, the last byte of the IP address assigned to the company must be subdivided into 3 subnet bits and 5 host bits. The 3 subnet bits will give Alice up to 8 subnets, with 5 host bits for up to 30 hosts per subnet. The new subnet mask is 255.255.255.224. The 224 is the decimal equivalent of the binary value 11100000, which represents the 3 subnet bits and the 5 host bits.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

A network interface adapter in a workstation has a hexadecimal MAC address of 001F9EFC7AD0. Which of the following would be the adapter’s IPv6 link local address based on its EUI-64 value?

A

To convert a MAC address to an Extended Unique Identifier (EUI-64), you split the 6-byte MAC address into two 3-byte halves and insert the 2-byte value FFFE in between, as follows:

001F9E FFFE FC7AD0

Then, you change the seventh bit in the first byte, the universal/local bit, from 0 to 1, indicating that this is a locally created address. This results in a binary first byte value of 00000010, which converts to 02 in hexadecimal.

Finally, you add the IPv6 link local prefix FE80::/10, resulting in the following complete address:

FE80::021F:9EFF:FEFC:7AD0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

The default mask for a IPv4 Class B network is 255.255.0.0. How many subnet bits do you need to create 600 subnets with 55 hosts per subnet, and what is the new subnet mask for the network?

A

A standard Class B address with a mask of 255.255.0.0 has 16 bits that can be used for subnets and hosts. To get 600 subnets, you must use 10 of the available bits, which gives you up to 1024 subnets. This leaves 6 host bits, which gives you up to 62 hosts per subnet, which exceeds the requirement of 55 requested by the client. Using 9 bits would give you only 510 subnets, while 11 bits would give you 2046 subnets but leave you only 5 bits for a maximum of 30 hosts, which is not enough.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

What is the greatest number of host addresses you can create on a single subnet of a network with the following address: 172.16.0.0/20?

A

The formula for calculating the number of hosts you can create using a host identifier of a given length is 2x–2, where x is the number of bits in the host identifier. You cannot create a host with an address of all zeroes or all ones, which is why you subtract 2. On a network that uses 20 bits for network identification, 12 bits are left for the host identifier. Using those 12 bits, you can create 212–2 or 4,094 host addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

Ralph has an IPv4 Class B network with a subnet mask of 255.255.248.0. How many subnets can he create, and how many hosts can he create per subnet?

A

With a Class B subnet mask of 255.255.248.0, the binary form of the third and fourth bytes is 11111000 00000000. There are 5 subnet bits, providing up to 32 subnets and 11 host bits, providing up to 2046 hosts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

Convert the binary mask 11111111.11111111.11100000.00000000 into its equivalent decimal value. What is the decimal representation of this mask?

A

The decimal value for 11111111 is 255, the value for 11100000 is 224, and the value for 00000000 is 0, so the mask is 255.255.224.0.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

If you have an IPv4 network address of 192.168.1.32/27, what is the valid range of host addresses you can use for your workstations?

A

With a network address of 192.168.1.32 and 27 mask bits, the subnet mask value is 11111111.11111111.11111111.11100000 in binary form, or 255.255.255.224 in decimal form. This leaves 5 bits for the host identifier. The valid range of host bits is therefore 00001 (1) through 11110 (30). This gives you a range of 192.168.1.32 + 1 (33) through 192.168.1.32 + 30 (62).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

Alice has been assigned the IPv4 network address 172.21.0.0/22 for the creation of a new department network in her company. How many host addresses does she have available to her?

A

To calculate the number of host addresses available, Alice must determine the number of host bits in the address, which is 10, raise 2 to that power, and subtract 2 for the network and broadcast addresses, which are unusable for hosts. The formula is therefore 2x–2. 210–2=1022.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

Which of the following is the correct subnet mask for an IPv4 network with the address 172.16.0.0/20?

A

The address given uses 20 bits to identify the network, leaving 12 bits for the host identifier. In binary form, therefore, the subnet mask value would be 11111111 11111111 11110000 00000000. The decimal value for 11111111 is 255, and the decimal value for 11110000 is 240. Therefore, the subnet mask is 255.255.240.0.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
122
Q

Ed has been assigned the IPv4 network address 192.168.2.32/28 for the computers in his department. What range of addresses can Ed use to configure the TCP/IP clients on his computers?

A

A /28 address leaves 4 bits for the host identifier. To calculate the number of hosts, Ed uses 24–2=14. The first address on the subnet is therefore 192.168.2.33, and the fourteenth is 192.168.2.46.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
123
Q

When two workstations access the Internet using the same Port Address Translation (PAT) router, which of the following does the router assign to each workstation? (Choose all that apply.)
A unique port number
A common public IPv4 address
A common port number
A unique public IPv4 address

A

Unlike network address translation, port address translation uses a single public IPv4 address for all of the client workstations. Instead of assigning each workstation a unique address, PAT assigns each workstation a unique port number.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
124
Q

Which of the following pairs of well-known ports are the default values you would use to configure a POP3 email client?
110 and 25
143 and 25
110 and 143
80 and 110
25 and 80

A

The default port for the Post Office Protocol (POP3) is 110. The default port for the Simple Mail Transfer Protocol (SMTP), the other protocol used by email clients, is 25. Port 143 is the default for the Internet Message Access Protocol (IMAP), a different email mailbox protocol that clients never use with POP3. Port 80 is the default for the Hypertext Transfer Protocol (HTTP), which is not used by POP3 email clients.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
125
Q

Which component does the port number in a transport layer protocol header identify?

A

The port numbers specified in a transport layer protocol header identify the application that generated the data in the packet or the application that will receive the data. Port numbers do not identify transport layer protocols, gateways, or proxy servers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
126
Q

What is the term for the combination of an IPv4 address and a port number, as in the following example: 192.168.1.3:23?

A

Socket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
127
Q

Which protocols generate messages that are carried directly within Internet Protocol (IPv4) datagrams, with no intervening transport layer protocol?

A

Internet Control Message Protocol (ICMP) and Internet Group Management Protocol (IGMP) are unusual in that they generate messages that are encapsulated directly within IP datagrams. Nearly all of the other TCP/IP protocols, including Simple Mail Transfer Protocol (SMTP) and Simple Network Management Protocol (SNMP), are encapsulated within one of the transport layer protocols—User Datagram Protocol (UDP) or Transmission Control Protocol (TCP)—which is encapsulated in turn within an IP datagram.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
128
Q

Which protocol is used to exchange directory service information?

A

The Lightweight Directory Access Protocol (LDAP) is an application layer protocol used for managing and accessing information stored in directory services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
129
Q

Ralph is configuring a new email client on a workstation to use the Simple Mail Transfer Protocol (SMTP) and Post Office Protocol (POP3) email protocols. He wants both protocols to use encryption when communicating with the email server. Which of the following port numbers should Ralph use to secure the SMTP connection with Transport Layer Security (TLS) and the POP3 connection with Secure Sockets Layer (SSL) encryption? (Choose all that apply.)
110
25
587
993
995

A

587, 995 - SMTP with TLS uses port number 587. POP3 over SSL uses port number 995. Port numbers 25 and 110 are used for SMTP and POP3 without encryption. Port number 993 is used for Internet Message Access Protocol (IMAP) over SSL.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
130
Q

Which of the following is not a port number used for Structured Query Language (SQL) communications?
1433
1521
3306
3389

A

3389 - The port number 3389 is used by the Remote Desktop Protocol (RDP) and is not involved in SQL communication. Port 1433 is used by SQL Server; 1521 is used by SQLnet; 3306 is used by MySQL.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
131
Q

Which of the following port numbers is assigned to a Unix logging services program?
389
514
636
993

A

Port number 514 is assigned to syslog, a Unix standard designed to facilitate the transmission of log entries generated by a device or process, such as the sendmail SMTP server, across an IP network to a message collector, called a syslog server. Port number 389 is assigned to the Lightweight Directory Access Protocol (LDAP). Port number 636 is assigned to LDAP over Secure Sockets Layer (SSL). Port number 993 is assigned to Internet Message Access Protocol (IMAP) over SSL.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
132
Q

Which of the following protocols use(s) the term datagram to describe the data transfer unit it creates? (Choose all that apply.)
Ethernet
IP
TCP
UDP

A

IP, UDP - The term datagram is typically used by protocols offering connectionless delivery service. The two main connectionless protocols in the TCP/IP suite are the Internet Protocol (IP) and the User Datagram Protocol (UDP), both of which use the term datagram. Ethernet uses the term frame, and Transmission Control Protocol (TCP) uses segment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
133
Q

What is the native file sharing protocol used on all Microsoft Windows operating systems?
Hypertext Transfer Protocol (HTTP)
Network File System (NFS)
File Transfer Protocol (FTP)
Server Message Block (SMB)
Lightweight Directory Access Protocol (LDAP)

A

The default file sharing protocol used on all Windows operating systems is SMB. HTTP is the native protocol used by web clients and servers. NFS is the native file sharing protocol used on Unix/Linux networks. FTP is a protocol used for transferring files from one system to another. LDAP is a protocol for transmitting directory service information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
134
Q

Which of the following terms describes the Transmission Control Protocol (TCP) exchange that establishes a connection prior to the transmission of any data?
Synchronization
Initialization exchange
Connection establishment
Three-way handshake

A

Three-way handshake - Two systems establishing a TCP connection exchange three messages before they begin transmitting data. The exchange of these synchronization messages is referred to as a three-way handshake.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
135
Q

Alice has been instructed to install 100 Windows workstations, and she is working on automating the process by configuring the workstations to use PXE boots. Each workstation therefore must obtain an IP address from a DHCP server and download a boot image file from a TFTP server. Which of the following well-known ports must Alice open on the firewall separating the workstations from the servers? (Choose all that apply.)
65
66
67
68
69

A

67, 68, 69 - Dynamic Host Configuration Protocol (DHCP) servers use port numbers 67 and 68. The Trivial File Transfer Protocol (TFTP) uses port number 69.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
136
Q

What is the valid range of numbers for the ephemeral client ports used by the Transmission Control Protocol (TCP) and User Datagram Protocol (UDP)?

A

49152 through 65535 - Ephemeral client ports are in the range of 49152 through 65535. Well-known TCP and UDP server ports are in the range of 1 through 1023. Registered port numbers are in the range of 1024 to 49151.

137
Q

Which of the following protocols does IPsec use to digitally encrypt packets before transmitting them over the network?
ESP
SSL
AH
MSCHAP

A

ESP - Encapsulating Security Protocol (ESP) is a protocol in the TCP/IP suite that is capable of providing encryption services for IPsec. Authentication Header (AH) provides digital integrity services for IPsec, in the form of a digital signature. Secure Sockets Layer (SSL) is a security protocol that provides encrypted communications between web browsers and servers. MSCHAP is an authentication protocol used by remote access services.

138
Q

Which of the following are the protocols that IPsec uses to secure network traffic? (Choose all that apply.)
SSH
AH
ESP
SSL

A

AH, ESP - Authentication Header (AH) is an IPsec protocol that provides authentication and digital integrity services. Encapsulating Security Protocol (ESP) provides encryption services for IPsec. Secure Shell (SSH) is a remote administration tool, and Secure Sockets Layer (SSL) is a security protocol that provides encrypted communications between web browsers and servers.

139
Q

Which of the following message types are exchanged by Dynamic Host Configuration Protocol (DHCP) clients and servers during a successful IP address allocation transaction? (Choose all that apply.)
DHCPDISCOVER
DHCPOFFER
DHCPINFORM
DHCPACK
DHCPREQUEST
DHCPNAK
DHCPRENEW
DHCPRELEASE

A

In a successful DHCP address allocation, the client issues DHCPDISCOVER broadcasts to locate servers, and the servers reply with DHCPOFFER messages containing addresses. Then, the client sends a DHCPREQUEST message to one server accepting an offered address, to which the server replies with a DHCPACK. DHCPNAK messages are only used in unsuccessful transactions, and DHCPRENEW, DHCPRELEASE, and DHCPINFORM messages are not used during the address allocation process.

140
Q

In designing a network for a client, Ed has decided to use both internal and external DNS servers. Which of the following resources should Ed register with the external DNS server? (Choose all that apply.)
Company database servers
Internet web servers
Incoming email servers
Domain controllers

A

Internet Web Servers, Incoming Email servers - The external DNS server should contain records only for the resources that must be accessible from the Internet, such as web servers and public email servers. For security reasons, servers containing sensitive data, such as database servers and domain controllers, should be registered on the internal DNS server.

141
Q

DHCP clients use broadcast messages to contact a DHCP server on the local subnet. Which of the following are mechanisms by which DHCP broadcast messages can be forwarded to a DHCP server on another subnet when there is none on the local subnet? (Choose all that apply.)
DHCP relay
UDP forwarding
Zone transfer
IP helper

A

DHCP Relay, UDP Forwarding, IP helper - DHCP relay, UDP forwarding, and IP helper are all router mechanisms that perform the same task, forwarding broadcast messages on one subnet to a specific IP address on another subnet as a unicast message. This enables DHCP clients to contact DHCP servers on another subnet to obtain IP addresses. Zone transfer is a DNS zone replication mechanism not used by DHCP clients or servers.

142
Q

Which of the following Storage Area Network (SAN) protocols are capable of sharing a network medium with standard Local Area Network (LAN) traffic? (Choose all that apply.)
iSCSI
Fibre Channel
FCoE
InfiniBand

A

iSCSI, FCoE - iSCSI runs on a standard IP network, and Fibre Channel over Ethernet (FCoE) runs on a standard Ethernet network. Both of these protocols can share a network with LAN traffic, although the use of a Quality of Service (QoS) mechanism is usually recommended. Fibre Channel and InfiniBand both require a dedicated network medium that does not support LAN traffic.

143
Q

Which of the following technologies do iSCSI initiators use to locate iSCSI targets on the network?
Active Directory
ICMP
DNS
iWINS
iSNS

A

iSNS - The Internet Storage Name Service (iSNS) is an application that provides iSCSI initiators with automated discovery of targets located on the network. iSNS can also function as a discovery service for Fibre Channel devices.

144
Q

Which of the following protocols are included in an iSCSI packet? (Choose all that apply.)
Ethernet
IP
TCP
UDP
None of the above

A

Ethernet, IP, TCP - iSCSI runs on a standard IP network; therefore, iSCSI messages are encapsulated using Transmission Control Protocol (TCP) at the transport layer, Internet Protocol (IP) at the network layer, and Ethernet at the data link layer. iSCSI does not use the User Datagram Protocol (UDP).

145
Q

Ed has just created a new Windows application for his company, and he wants to deploy it in the public cloud. He is looking for a provider that will furnish his company with a fully installed and configured Windows server on which he can install and run his application. Which of the following service models is he seeking to use?
IaaS
PaaS
SaaS
DaaS
None of the above

A

The Platform as a Service (PaaS) model provides consumers with the ability to install applications of their choice on a server furnished by the provider. Infrastructure as a Service (IaaS) provides the consumers with processing, storage, and networking resources that they can use to install and run operating systems and other software of their choice. Software as a Service (SaaS) provides consumers with access to a specific application running on the provider’s servers. Desktop as a Service (DaaS) provides remote virtualization of the entire workstation desktop, instead of a single application.

146
Q

Ralph is designing a hybrid deployment for a corporate client that will require a connection between the client’s private network and a public cloud provider. The client is concerned about this connection becoming a speed bottleneck at times of heavy user traffic. Which of the following options can Ralph offer the client that will best address this potential problem?
- Use a different ISP for the cloud connection.
- Use a VPN for the cloud connection.
- Use a cloud direct connection for the hybrid link.
- Use a leased line connection to the ISP

A

A cloud direct connection is a private link between the client’s private network and the cloud service provider. This link is independent from any ISP connection used by the client organization for other traffic, so it ensures a consistent bandwidth for the hybrid cloud network. Using a different ISP or a leased line does not replace the entire connection; there are still potential bottlenecks. A VPN can provide better performance than a standard connection and greater security, but it is not as consistent (or as expensive) as a direct cloud connection.

147
Q

Which of the following is typically not an example of the Internet of Things (IoT)?
A key fob that unlocks your car
A smartphone home automation app
A remotely monitored cardiac pacemaker
A seismic early warning system

A

A key fob that unlocks your car is typically a short-range radio or infrared device that does not use the Internet for its communications. Each of the other examples describes a device with an IP address that uses the Internet to communicate with a controller or monitoring station.

148
Q

Which of the following devices can split a single network into two collision domains while maintaining a single broadcast domain?
Hub
Bridge
Switch
Router
Repeater

A

A bridge can split a single network into two collision domains, because it forwards only the packets that are destined for the other side of the bridge. The bridge forwards all broadcast packets, so it maintains a single broadcast domain. A hub maintains a single collision domain and a single broadcast domain. A switch creates a separate collision domain for each port, and a single broadcast domain for the entire network. A router creates two collision domains, but it does not forward broadcasts, so there are two broadcast domains as well. A repeater is a physical layer device that amplifies signals; it does not affect collision domains.

149
Q

Which of the following terms is used to describe the method by which a firewall examines the port numbers in transport layer protocol headers?
IP address filtering
Service-dependent filtering
Deep Packet Inspection (DPI)
Next-Generation Firewall (NGFW)

A

Service-dependent filtering blocks traffic based on the port numbers specified in the transport layer header fields. Because port numbers represent specific applications, you can use them to prevent traffic generated by these applications from reaching a network. IP address filtering operates at the network layer. DPI scans the contents of packets, rather than their headers. NGFW defines a device with advanced protection capabilities; port number scanning is a basic firewall function.

150
Q

Which of the following is not one of the five functional levels associated with a distributed control system such as Supervisory Control and Data Acquisition (SCADA) systems?
Field level
Remote access
Direct control
Plant supervisory
Production control
Production scheduling

A

The five functional levels in a distributed control system such as SCADA are field level, direct control, plant supervisory, production control, and production scheduling. Remote access is not one of the levels.

151
Q

Small Office Home Office (SOHO) networks typically use a multifunction connectivity device that can perform all but which one of the following functions?
DHCP
DNS
Switch
Router
Hub
NAT router
Access Point (AP)

A

SOHO multifunction devices typically function as routers connecting the local network to an Internet Service Provider (ISP), switches providing wired connections to host devices, Dynamic Host Configuration Protocol (DHCP) servers assigning IP addresses, Domain Name System (DNS) servers resolving names into IP addresses, Network Address Translation (NAT) routers providing hosts with private IP addresses access to the Internet, and APs providing wireless devices with access to the network. They do not function as hubs.

152
Q

Which of the following is the correct term for the process by which the Spanning Tree Protocol (STP) on a switch evaluates the paths through the network and places each port in the forwarding or blocking state?
Assimilation
Convergence
Tree-building
Listening

A

The process by which STP populates its database with information about each port in a switch and designates the ports as forwarding or blocking is called convergence.

153
Q

Which of the following types of systems are frequently used to collect information from Intrusion Detection Systems (IDSs)?
SIEM
NGFW
RADIUS
VoIP

A

Security Information and Event Management (SIEM) systems can function as a central clearinghouse for information gathered by IDSs and other security processes.

154
Q

Which of the following hub types are supported by the 100Base-TX physical layer specification? (Choose all that apply.)
Class I
Class II
Class III
Class IV

A

The 100Base-TX specification specifies two hub types: Class I and II. Class I hubs perform signal translation; Class II hubs do not. A network can have only one Class I hub per collision domain; a network can have two Class II hubs per collision domain. The other options do not exist.

155
Q

Proxy servers operate at which layer of the OSI reference model?
Data link
Network
Transport
Application

A

A proxy server is an application layer service, because it receives Internet service requests from client computers, reads the application layer protocol data in each request, and then generates its own request for the same service and transmits it to the Internet server the client specifies. Only an application layer service can read and process the application layer data in network packets. A proxy server cannot be a data link layer device, because it can provide Internet access to an entire internetwork, while the data link layer is concerned with communications on a single subnet. Proxy servers cannot be network layer devices, because the network layer handles all internetwork packets indiscriminately and is unaware of what application generated the data carried inside the packets. The transport layer is not involved in processing application data, so proxy servers cannot be said to function at the transport layer.

156
Q

Which of the following is a feature that is not found in a traditional firewall product, but which might be found in a Next-Generation Firewall (NGFW)?
Stateful packet inspection
Deep Packet Inspection (DPI)
Network Address Translation (NAT)
Virtual Private Network (VPN) support

A

DPI is a firewall technique that examines the data carried in packets and not just the protocol headers. While traditional firewalls typically do not support DPI, NGFWs often do. Stateful packet inspection, NAT, and VPN support are all features that are commonly supported by traditional firewall products.

157
Q

Which of the following is not one of the criteria typically used by load balancers to direct incoming traffic to one of a group of servers?
Which server has the lightest load
Which server has the fastest response time
Which server is next in an even rotation
Which server has the fastest processor

A

Which server has the fastest processor - In most cases, a load balancing router works by processing incoming traffic based on rules set by the administrator. The rules can distribute traffic among a group of servers using various criteria, such as each server’s current load or response time, or which server is next in a given rotation. Load balancers typically do not use the hardware configuration of the servers to direct traffic since this is a factor that does not change.

158
Q

Which of the following protocols can be used by wireless controllers to communicate with the Access Points (APs) on a Wireless Local Area Network (WLAN)? Choose all that apply.
CAPWAP
LWAPP
LDAP
PPTP

A

The Control and Provisioning of Wireless Access Points (CAPWAP) protocol and the Lightweight Access Point Protocol (LWAPP) are both protocols that enable wireless controllers to manage and control Access Points (APs).

159
Q

A load balancer is a type of which of the following devices?
Switch
Router
Gateway
Firewall

A

A load balancer is a type of router that forwards traffic with a single IP address to multiple servers in turn. In most cases, a load balancing router works by processing incoming traffic based on rules set by the administrator. Because a load balancer works with IP addresses, it is a network layer device. Load balancers are not switches, gateways, or firewalls.

160
Q

Which of the following is a device that switches calls between endpoints on the local IP network and provides access to external Internet lines?
VoIP PBX
VoIP gateway
VoIP endpoint
Multilayer switch

A

A private branch exchange (PBX) switches internal calls and provides access to external lines. A VoIP PBX performs the same tasks as a traditional PBX. A VoIP gateway is the device that provides the conduit between an IP network and the Public Switched Telephone Network (PSTN). A VoIP endpoint is a device that makes use of the VoIP system, such as a computer or handset. A multilayer switch is a data networking device that includes both switching and routing capabilities.

161
Q

Which of the following features enables an Intrusion Detection System (IDS) to monitor all of the traffic on a switched network?
Stateful packet inspection
Port mirroring
Trunking
Service-dependent filtering

A

Port mirroring is a feature found in some switches that takes the form of a special port that runs in promiscuous mode. This means that the switch copies all incoming traffic to that port, as well as to the dedicated destination ports. By connecting an IDS or protocol analyzer to this port, an administrator can access all of the network’s traffic. Stateful packet inspection is a firewall feature that enables the device to examine network and transport layer header fields, looking for patterns that indicate damaging behaviors, such as IP spoofing, SYN floods, and teardrop attacks. Trunking is a switch feature that enables administrators to create VLANs that span multiple switches. Service-dependent filtering is a firewall feature that blocks traffic based on transport layer port numbers.

162
Q

Which of the following are techniques used in traffic shaping to prevent networks from being overwhelmed by data transmissions? (Choose all that apply.)
Bandwidth throttling
Rate limiting
Broadcast storming
Network Address Translation (NAT)

A

Bandwidth throttling, Rate limiting - Bandwidth throttling is a traffic shaping technique that prevents specified data streams from transmitting too many packets. Rate limiting is a traffic shaping technique that controls the transmission rate of sending systems. A broadcast storm is a type of network switching loop. NAT is a method by which private networks can share registered IP addresses. Neither of these last two is a traffic shaping technique.

163
Q

Which of the following mechanisms for prioritizing network traffic uses a 6-bit classification identifier in the Internet Protocol (IP) header?
Diffserv
CoS
Traffic shaping
QoS
Administrative distance

A

Differentiated services (Diffserv) is a mechanism that provides Quality of Service (QoS) on a network by classifying traffic types using a 6-bit value in the differentiated services (DS) field of the IP header. Class of Service (CoS) is a similar mechanism that operates at the data link layer by adding a 3-bit Priority Code Point (PCP) value to the Ethernet frame. Traffic shaping is a means of prioritizing network traffic that typically works by delaying packets at the application layer. Quality of Service (QoS) is an umbrella term that encompasses a variety of network traffic prioritization mechanisms. Administrative distance is a value that routers use to select the most efficient route to a destination.

164
Q

Which of the following terms refers to a routing protocol that does not rely on hop counts to measure the efficiency of routes?
Interior gateway protocol
Edge gateway protocol
Distance vector protocol
Link state protocol

A

Link State Protocol - Distance vector protocols rely on hop counts to evaluate the efficiency of routes. Link state protocols use a different type of calculation, usually based on Dijkstra’s algorithm. The terms interior gateway protocol and edge gateway protocol do not refer to the method of calculating routing efficiency.

165
Q

What is the maximum number of routes that can be included in a single RIP broadcast packet?

A

A single RIP broadcast packet can include up to 25 routes. If there are more than 25 routes in the computer’s routing table, then RIP must generate additional packets.

166
Q

What is the term for the process by which dynamic routing protocols update other routers with routing table information?

A

Convergence is the term for the process by which routers propagate information from their routing tables to other routers on the network using dynamic routing protocols.

167
Q

Which of the following types of routing protocols route datagrams between autonomous systems?
EGP
RIP
IGP
OSPF

A

Exterior Gateway Protocol (EGP) routes datagrams between autonomous systems. Interior Gateway Protocol (IGP) routes datagrams within an autonomous system. Routing Information Protocol (RIP) and Open Shortest Path First (OSPF) are examples of interior gateway protocols.

168
Q

Which of the following command-line tools can you use to create and modify static routes on a Unix or Linux system? (Choose all that apply.)
route
ifconfig
traceroute
ip

A

The route command was originally created to display a Unix or Linux system’s routing table and modify its contents by adding, changing, and deleting static routes. The ip command is part of the iproute2 command-line utility package, which has replaced route in many Unix and Linux distributions. Running ip with the route parameter can manipulate the routing table. The traceroute and ifconfig tools are not commands for manipulating the routing table.

169
Q

Routers that use the Open Shortest Path First (OSPF) routing protocol calculate the relative costs of routes through the network by exchanging which of the following specifications for each interface with other routers?
Transmission speed
Data link layer protocol
Network medium
IP address

A

Routers that use OSPF transmit the speed of each network interface with the other OSPF routers in the network. This enables the routers to evaluate the cost of various routes through the network and transmit packets using the route with the smallest cost value. The routers do not need to share information about the data link layer protocols or network media they use or their IP addresses.

170
Q

Which of the following routing protocols has both interior and exterior designations, based on whether it is used for routing within an autonomous system or on the Internet?
RIP
OSPF
EIGRP
BGP

A

The Border Gateway Protocol (BGP) is a highly scalable protocol used for routing both on private autonomous systems, where it is known as the Internal Border Gateway Protocol (iBGP) and maintains full mesh communication among all of the routers, and on the Internet, where it is known as the External Border Gateway Protocol (eBGP).

171
Q

Which of the following network layer protocols includes a Time to Live (TTL) field? (Choose all that apply.)
IPv4
IPv6
ICMP
IGMP

A

The Internet Protocol (IP) in both of its versions (IPv4 and IPv6) includes a TTL field in its message header that limits the number of times a packet can be routed on a network. Each router processing the packet reduces the TTL value by one until it reaches zero, after which it is discarded. The Internet Control Message Protocol (ICMP) and the Internet Group Management Protocol (IGMP) do not have a TTL field.

172
Q

An enterprise network has been designed with individual departmental switches because, in most cases, the devices in a specific department exchange network traffic with other devices in the same department. Each of the departmental switches is also connected to a host switch, which enables devices to communicate with other departments. Which term describes this switching architecture?

A

Distributed switching describes a hierarchical switching architecture in which remote switches (departmental switches in this case) handle most of the network traffic, with a host switch used only for traffic between the remote locations.

173
Q

Which of the following protocols prevents network switching loops from occurring by shutting down redundant links until they are needed?
RIP
STP
VLAN
NAT
ARP

A

The Spanning Tree Protocol (STP) prevents packets from endlessly looping from switch to switch due to redundant links. Creating redundant links is a good preventive against switch failure, but packets transmitted over multiple links can circulate from switch to switch infinitely. STP creates a database of switching links and shuts down the redundant ones until they are needed.

174
Q

Which of the following is a protocol that identifies VLANs by inserting a 32-bit field in the Ethernet frame?
IEEE 802.1P
IEEE 802.1Q
IEEE 802.1X
IEEE 802.1AB
IEEE 802.1AX

A

IEEE 802.1Q is a standard defining a mechanism (called Ethernet trunking by some manufacturers) that identifies the Virtual Local Area Network (VLAN) to which a packet belongs by inserting an extra 32-bit field into its Ethernet frame. IEEE 802.1P is a standard that defines a mechanism for implementing Quality of Service (QoS) at the data link layer by adding a 3-bit field into Ethernet frames. IEEE 802.1X is a standard defining an authentication mechanism called Port-based Network Access Control (PNAC). IEEE 802.1AB is a standard defining the Link Layer Discovery Protocol (LLDP). IEEE 802.1AX is a specification for the Link Aggregation Control Protocol (LACP), which is a mechanism for combining physical ports into a single logical channel.

175
Q

Which of the following elements can be used to identify the devices in a particular VLAN? (Choose all that apply.)
Hardware addresses
IP addresses
DNS names
Switch port numbers

A

Every network device has a unique hardware address coded into its network interface adapter, and administrators can use these addresses to select the devices that will be part of a specific Virtual Local Area Network (VLAN). When VLANs are implemented inside the switch, selecting the ports to which specific computers are attached is a simple way to identify the computers in a particular VLAN. IP addresses are layer 3 (network layer) constructs, so they do not apply to layer 2 (data link layer) devices like switches. Although DNS names do uniquely identify computers on a network, DNS is an application layer process and has nothing to do with the switching and routing processes, which occur at the data link and network layers. Therefore, you cannot use DNS names to identify the computers in a VLAN.

176
Q

The jumbo frame capability is associated with which layer of the Open Systems Interconnection (OSI) model?

A

Ethernet uses jumbo frames at the data link layer to transfer large amounts of data more efficiently. Ethernet typically restricts frame size to 1500 bytes, but jumbo frames enable Ethernet systems to create frames up to 9000 bytes. Frames are protocol data units associated only with the data link layer, so they do not apply to the network, transport, or application layer.

177
Q

Which of the following technologies would you be less likely to find on the average home or small office network? (Choose all that apply.)
NAT
DHCP
10GBase-T
VLAN

A

10GBase-T, VLAN - Home and small office networks typically consist of a single subnet and require only a basic switch without the advanced Virtual Local Area Network (VLAN) capabilities that enable administrators to create separate subnets. Most home and small office networks have a Dynamic Host Configuration Protocol (DHCP) server that assigns IP addresses and other TCP/IP configuration settings to clients. The DHCP server can be integrated into a broadband router or another Internet access sharing solution. Most home and small office networks support Network Address Translation (NAT), enabling them to use private IP addresses and still access the Internet. 10GBase-T is the designation for UTP-based 10 Gigabit Ethernet, which is an advanced standard for network interface adapters often found in servers.

178
Q

Which of the following modifications occur when you configure the native Virtual Local Area Network (VLAN) on your network switches to use 802.1q tagging? (Choose all that apply.)
Double-tagged packets are prevented.
BPDU guards are applied.
Root guards are applied.
Trunk traffic is routed, not switched.

A

Double-tagged packets are prevented. - To join ports on different switches into one VLAN, you designate a trunk port on each switch for the traffic between switches. Initially, the native VLAN uses the default VLAN1 for trunk traffic, and that traffic is left untagged. Untagged traffic is susceptible to attacks using double-tagged packets. When you configure the native VLAN to use tagging, this makes it impervious to double-tagging. Changing the native VLAN does not create root guards or Bridge Protocol Data Unit (BPDU) guards, and all traffic continues to be switched, not routed.

179
Q

Which of the following features helps to protect network switches from attacks related to the Spanning Tree Protocol (STP)? (Choose all that apply.)
BPDU guard
Root guard
DHCP snooping
Geofencing

A

BPDU guard, Root guard - Bridge Protocol Data Units (BPDUs) are messages that switches running the STP exchange to learn about the available paths through a switched network and the states of other switches. Switches should only receive BPDUs through ports that are connected to other switches. BPDU guard is a feature that prevents BPDU messages from arriving through ports connected to end systems, such as computers, thus preventing an attacker from manipulating the STP topology. A root guard affects the behavior of the STP by enforcing the selection of root bridge ports on a switched network. Without root guards, there is no way for administrators to enforce the topology of a network with a redundant switching fabric.

180
Q

Which of the following wireless LAN standards include the ability to use Multiple Input, Multiple Output (MIMO) antennae? (Choose all that apply.)
IEEE 802.11a
IEEE 802.11b/g
IEEE 802.11n
IEEE 802.11ac
IEEE 802.11ax

A

The IEEE 802.11n, 802.11ac, and 802.11ax standards include MIMO, which enables them to effectively multiplex signals using multiple antennae. This capability was first introduced in the 802.11n standard, so the 802.11a and 802.11b/g standards do not support it.

181
Q

Ralph is planning a wireless LAN installation for a warehouse with two offices at either end of the building, approximately 300 feet apart. If he installs a single Access Point (AP) in the center of the warehouse, equidistant from the two offices, which of the following standards should he look for when purchasing hardware so that workstations in both offices will be able to connect to the network at the best possible speed?
IEEE 802.11a
IEEE 802.11g
IEEE 802.11n
IEEE 802.11ac

A

Wireless networks using equipment based on the IEEE 802.11n standard can span indoor distances of up to 175 feet at speeds up to 600 Mbps. An 802.11ac network can run at faster speeds—up to 1.3 Gbps—but it is limited to approximately 115-foot distances. Networks using 802.11g equipment can span 150 feet, but they run at only a maximum of 54 Mbps. An 802.11a network cannot span more than 75 feet, and it runs at no more than 54 Mbps.

182
Q

What is the maximum channel width possible using wireless networking equipment based on the ratified IEEE 802.11 regulatory standards?
20 MHz
40 MHz
80 MHz
160 MHz

A

Using a technique called channel bonding, the 802.11ac standard defines the combination of up to eight 20 MHz channels, for a total possible channel width of 160 MHz. The 802.11n standard can bond up to two channels, for a 40 MHz width. Earlier standards are limited to a single 20 MHz channel.

183
Q

Upgrading a wireless network from the Wired Equivalent Privacy (WEP) security protocol to WiFi Protected Access (WPA) enables it to use the Temporal Key Integrity Protocol (TKIP) for encryption, which generates a unique key for each packet. Which of the following types of attacks does this capability prevent?
Denial-of-Service (DoS) attacks
Brute-force attacks
Replay attacks
Deauthentication attacks

A

A replay attack is one in which an attacker utilizes the encryption key found in a previously captured packet to gain access to the network. Because TKIP generates a unique encryption key for every packet, it prevents this type of attack from being successful.

184
Q

After starting work as the network administrator of Wingtip Toys, you discover that all of the switches in the company’s datacenter have support for remote management, with built-in Simple Network Management Protocol (SNMP) agents in each port. Which of the following tasks must you perform to be able to gather information from the agents on those switches and display it on a central console? (Choose all that apply.)
- Install the network management software on a network computer.
- Install a Management Information Base (MIB) on each of the switches.
- Install an agent on the console computer.
- Install an MIB on the console computer.
- Purchase a network management product.

A
  • Install the network management software on a network computer.
  • Purchase a network management product.
    An SNMP-based network management system consists of three components: a management console software product installed on a network computer, agents installed on the devices you want to manage, and MIBs for each of the agents. Because the switches support SNMP management and already have agents, they have MIBs also. Therefore, all you have to do is purchase the network management software and install the console on a network computer.
185
Q

Which versions of the Simple Network Management Protocol (SNMP) do not include any security protection other than a cleartext community string? (Choose all that apply.)
SNMPv1
SNMPv2
SNMPv2c
SNMPv3

A

SNMPv1, SNMPv2c - SNMP version 1, the original version, used an unencrypted community string. SNMPv2 added better security, but it was not backward compatible with the version 1 community string. A revised version, SNMP2c, added backward compatibility. SNMPv3, the one most often seen today, includes more advanced security and does not use a community string.

186
Q

Which of the following technologies provides both real-time monitoring of security events and automated analysis of the event information gathered?
SIEM
SNMP
SEM
SIM

A

Security Information and Event Management (SIEM) is a product that combines two technologies: security event management (SEM) and security information management (SIM). Together, the two provide a combined solution for gathering and analyzing information about a network’s security events. Simple Network Management Protocol (SNMP) is a technology that gathers information about managed devices.

187
Q

When monitoring performance metrics on one of your servers, you notice that the server is utilizing 100 percent of the network bandwidth available to it. What modification could you make to the server that will most likely address the problem?
Add memory to the system.
Install a second network adapter.
Update the network adapter’s firmware.
Install a second processor.

A

If a server is using all of its network bandwidth, then the most logical solution is to add more. You can do this by installing a second network adapter and connecting it to a different subnet.

188
Q

Which of the following syslog message severity levels indicates that a system is unusable?
0
1
2
3
4

A

Every syslog message includes a single-digit severity code. Code 0 is the most severe, indicating an emergency that has rendered the system unusable. Severity code 1 is an alert message, indicating that immediate action is needed. Severity code 2 is a critical condition message, and code 3 is an error condition. Code 4 is a warning message.

189
Q

Which of the following syslog message severity levels indicates that the message is purely informational?
0
2
4
6
7

A

Every syslog message includes a single-digit severity code. Code 6 indicates that the message is purely informational. Code 0 is the most severe, indicating an emergency that has rendered the system unusable. Severity code 2 is a critical condition message, and code 4 is a warning message. Code 7 is used strictly for debugging.

190
Q

A Simple Network Management Protocol (SNMP) console can inform administrators when a managed device requires attention. For this to occur, the agent in the device first has to send a message to the console. What is the term used for a message sent by an SNMP agent to the central console?
Ping
Alert
Notification
Trap

A

Messages that SNMP agents send to consoles when an event needing attention occurs are called traps. Alerts and notifications are terms for the messages that the console sends to administrators. A ping is an Internet Control Message Protocol (ICMP) echo request message sent from one TCP/IP computer to another.

191
Q

Log management typically consists of which of the following tasks? (Choose all that apply.)
Rollback
Utilization
Security
Cycling

A

Logs frequently contain sensitive information, so securing them with the appropriate permissions is an essential part of log management. Logs also can grow to overwhelm the storage medium on which they are stored, so cycling is a technique for managing log size by configuring it to delete the oldest record each time a new one is added.

192
Q

Which of the following Security Information and Event Management (SIEM) processes performs searches for specific criteria, during specific time frames, in logs located on different computers?
Data aggregation
Forensic analysis
Correlation
Retention

A

In SIEM, forensic analysis is a process of searching logs on multiple computers for specific information based on set criteria and time periods. Data aggregation is a process of consolidating log information from multiple sources. Correlation is the process of linking logged events with common attributes together. Retention is the long-term storage of log data.

193
Q

Which of the following terms best describes a connectivity problem on wired networks that is caused by individual packets that are delayed due to network congestion, different routing, or queuing problems?
Latency
Attenuation
Jitter
Bottleneck

A

When individual packets in a data stream are delayed, the resulting connectivity problem is called jitter. Although this condition might not cause problems for asynchronous applications, real-time communications, such as Voice over Internet Protocol (VoIP) or streaming video, can suffer interruptions, from which the phenomenon gets its name. Latency describes a generalized delay in network transmissions, not individual packet delays. Attenuation is the weakening of a signal as it travels through a network medium. A bottleneck is a condition in which all traffic is delayed, due to a faulty or inadequate component.

194
Q

Which of the following network interface occurrences are considered to be malfunctions on a full-duplex Ethernet network? (Choose all that apply.)
Runts
Giants
Collisions
Late collisions

A

All of these occurrences are malfunctions on a full-duplex Ethernet network. Runt frames occur when a network interface generates packets that are smaller than the 64-byte minimum allowable length. Giants occur when frames are larger than the 1518-byte maximum allowable length. Collisions are normal on a half-duplex network, but on a full-duplex network, collisions are considered to be malfunctions. Late collisions occur when network cables are too long.

195
Q

Which of the following Windows applications would you most likely use to create a baseline of system or network performance?
Performance Monitor
Event Viewer
Syslog
Network Monitor

A

Performance Monitor is a Windows application that can create logs of specific system and network performance statistics over extended periods. Such a log created on a new computer can function as a baseline for future troubleshooting. Event Viewer is a Windows application for displaying system log files; it cannot create a performance baseline. Syslog is a log compilation program originally created for Unix systems; it does not create performance baselines. Network Monitor is a protocol analyzer. Although it can capture a traffic sample that can function as a reference for future troubleshooting efforts, this ability cannot be called a performance baseline.

196
Q

At what humidity level do electronic components become vulnerable to damage from electrostatic shock?
Below 30 percent
Below 50 percent
Above 70 percent
Above 90 percent

A

Humidity prevents the buildup of static electricity that can cause discharges that damage equipment. Humidity levels of 50 percent or lower can cause equipment to be susceptible to electrostatic shock.

197
Q

Which of the following event logs on a Windows server can record information about both successful and failed access attempts?
System
Application
Security
Setup

A

When you enable audit policies on Windows systems, you can specify whether to audit successful or failed events (or both), including access attempts. This audit information is recorded in the Security event log.

198
Q

Which of the following is the most likely cause of Cyclic Redundancy Check (CRC) errors on an Ethernet network interface?
Half-duplex communication
A network adapter malfunction
Electromagnetic interference
Excessive cable length

A

Electromagnetic interference is the likely cause of CRC errors. A network interface adapter malfunction can cause runts and giant frames. Collisions are normal on a half-duplex network, but CRC errors are not. Late collisions occur when network cables are too long, but they do not cause CRC errors.

199
Q

Which of the following is not an SNMP component?
MIBs
Traps
OIDs
CRCs

A

Cyclical Redundancy Checks (CRCs) are faults that occur when data does not arrive at its destination in the same state as when it was sent; they are not Simple Network Management Protocol (SNMP) components. Management Information Bases (MIBs), traps, and Object Identifiers (OIDs) are all components of a Simple Network Management Protocol (SNMP) implementation.

200
Q

Routers using link states and Dijkstra’s algorithm to calculate the lowest cost route to a specific destination can conceivably be running which of the following interior gateway routing protocols? (Choose all that apply.)
OSPF
RIP
EIGRP
IS-IS
BGP

A

OSPF, IS-IS - Link states and Dijkstra’s algorithm are used by link state routing protocols, such as Open Shortest Path First (OSPF) and Intermediate System – Intermediate System (IS – IS). Routing Information Protocol (RIP) and Enhanced Interior Gateway Routing Protocol (EIGRP) are distance vector protocols, which do not use link states. Border Gateway Protocol (BGP) is a distance vector protocol and an exterior (not interior) gateway protocol.

201
Q

Which of the following is the term usually applied to a representation of network devices, automatically compiled, and containing information such as IP addresses and connection speeds?
Network map
Network diagram
Cable diagram
Management information base

A

A network map is a depiction of network devices, not drawn to scale, with additional information added, such as IP addresses and link speeds. In most cases, network maps are automatically created by a software product, such as Nmap, that scans the network and creates a display from the information it discovers.

202
Q

Which of the following is not one of the typical heights for devices mounted in IT equipment racks?
1 unit
2 units
3 units
4 units

A

3 units - Devices designed to fit into IT equipment racks typically have heights measured in units. One unit equals 1.75 inches. Most rack-mounted devices are one (1U), two (2U), or four units (4U) tall.

203
Q

The documentation for Main Distribution Frames (MDFs) and Intermediate Distribution Frames (IDFs) should incorporate details on which of the following elements? (Choose all that apply.)
Power
Environment
Distances
Costs

A

MDF and IDF documentation should take into account the power sources available at the locations, the HVAC equipment needed to keep the temperature and humidity levels under control, and the distances the cable runs must span. This type of documentation is typically used for installation and troubleshooting purposes, so the costs of components and services are unnecessary and can be covered elsewhere.

204
Q

At what point in the installation process should patch panel ports and wall plates be labeled?
When the patch panels and wall plates are installed
When a length of cable is cut from the spool
When the cables are attached to the connectors
When the cable runs are tested, immediately after their installation

A

Patch panel ports and wall plates should be labeled when the cable runs are attached to them. Labeling them at any earlier time can result in cable runs being connected incorrectly.

205
Q

What is the width of a standard equipment rack in a datacenter?
12 inches
16 inches
19 inches
24 inches

A

The standard width of an equipment rack in a data center is 19 inches. Network hardware manufacturers use this width when designing rack-mountable components.

206
Q

The precise locations of devices in a datacenter are typically documented in which of the following documents?
Rack diagram
Network map
Wiring schematic
Logical diagram
Business continuity plan
Audit and assessment report

A

Datacenters typically mount components in racks, 19-inch-wide and approximately 6-foot-tall frameworks in which many networking components are specifically designed to fit. A rack diagram is a depiction of one or more racks, ruled out in standardized 1.752-inch rack units, and showing the exact location of each piece of equipment mounted in the rack.

207
Q

After being hired for a job as an IT administrator, you have been assigned two user accounts, one of which is intended for general use and the other only for administrative tasks. You are also required to sign an agreement that outlines the restrictions for your account use. Specifically, you are not permitted to use the administrative account for anything other than administrative tasks, including browsing the Internet and accessing data for which you are not authorized. What is the best name for this type of agreement?

A

A privileged user agreement specifies the abilities and limitations of users with respect to the administrative accounts and other privileges they have been granted.

208
Q

The terms on-boarding and off-boarding are typically associated with which of the following policies?
Data loss prevention
Incident response
Inventory management
Identity management
Disaster recovery
Business continuity

A

On-boarding and off-boarding are identity management processes in which users are added or removed from an organization’s identity and access management (IAM) system. This grants new users the privileges they need to use the network, modifies their privileges if they change positions, and revokes privileges when they leave the company.

209
Q

The term off-boarding refers to which of the following procedures?
Removing a node from a cluster
Disconnecting all cables from a switch
Revoking a user’s network privileges
Retiring old workstations

A

On-boarding and off-boarding are identity management processes in which users are added or removed from an organization’s identity and access management (IAM) system. Off-boarding revokes a user’s privileges when he or she leaves the company.

210
Q

Which of the following tasks is not considered to be part of an IT department’s incident response plan?
Stopping an ongoing incident
Containing the damage caused by an incident
Repairing the damage caused by an incident
Rebuilding an infrastructure destroyed by an incident

A

Once a network infrastructure has been partially or completely destroyed, it is no longer a matter of incident response; the responsibility passes over to the disaster recovery plan, which requires a different set of policies. Stopping, containing, and remediating an incident are all considered incident response policies.

211
Q

Which of the following are occurrences that are typically addressed by an IT department’s incident response policies? (Choose all that apply.)
Denial-of-Service (DoS) attack
Hard disk failure
Electrical fire
Server outage

A

A, B, D. Attacks, hardware failures, and crashes are all events that can be addressed by incident response policies that define what is to be done to analyze and remediate the problem. An electrical fire is typically not something that would be addressed by an IT department’s incident response team; it is a job for trained firefighters. Once the fire is out, the company’s response falls under the heading of disaster recovery.

212
Q

Your company has been acquired by another firm and, as IT director, you will have to comply with the new firm’s safety policies in your datacenter and other IT workspaces. One of the new requirements states that there must be a fail closed policy for the datacenter. Which of the following best describes what this policy dictates should occur in the event of an emergency?
All computers that are logged on should automatically log off.
All computers that are running should automatically shut down.
All doors that are normally open should lock themselves.
All doors that are normally locked should open themselves.

A

A fail closed policy for the datacenter specifies that any open doors should lock themselves in the event of an emergency. To support this policy, the datacenter will have to have a self-contained fire suppression system, which uses devices such as fire detectors and oxygen-displacing gas systems.

213
Q

You are the first responder to an incident of computer crime at your company. The datacenter’s security has been penetrated, a server accessed, and sensitive company data stolen. The company’s incident response plan lists the specific tasks that you are responsible for performing. Which of the following are likely to be among those tasks? (Choose all that apply.)
Turn off the server.
Secure the area.
Document the scene.
Collect evidence.
Cooperate with the authorities.

A

While securing the area to prevent contamination of evidence, documenting the scene with photographs or video, collecting any evidence that might be visible, and cooperating with the authorities are tasks that are likely to be in the company’s incident response policy. Turning off the server most certainly would not, because this could disturb or delete evidence of the crime.

214
Q

Account lockout policies are designed to protect against which of the following types of attacks?
Social engineering
Spoofing
Brute force
Man in the middle

A

A brute-force password attack is one in which the perpetrator tries as many passwords as possible in an effort to guess or deduce the right one. Account lockout policies are intended to prevent this type of attack by limiting the number of incorrect password attempts.

215
Q

Which of the following media types is Windows Server Backup unable to use to store backed-up data?
Local hard disks
Local optical disks
Magnetic tape drives
Remote shared folders

A

Windows Server Backup cannot back up data to magnetic tape drives. However, it can back up to local hard disks, optical disks, and remote shares.

216
Q

Which of the following Redundant Array of Independent Disks (RAID) levels provides fault tolerance by storing parity information on the disks, in addition to the data? (Choose all that apply.)
RAID 0
RAID 1
RAID 5
RAID 10

A

RAID 5 - RAID is a technology for storing data on multiple hard disk drives, providing fault tolerance, increased performance, or both. The various RAID levels provide different levels of functionality and have different hardware requirements. RAID 5 combines disk striping with distributed storage of parity information, which provides fault tolerance. The parity information enables the array to rebuild a disk whose data has been lost. RAID 0 uses data striping only (blocks written to each disk in turn), which does not provide any form of fault tolerance. RAID 1 provides fault tolerance through disk mirroring. RAID 10 creates fault-tolerant mirrored stripe sets.

217
Q

Which of the following RAID levels uses disk striping with distributed parity?
RAID 0
RAID 1
RAID 5
RAID 10

A

RAID 5 - Redundant Array of Independent Disks (RAID) is a technology for storing data on multiple hard disk drives, providing fault tolerance, increased performance, or both. The various RAID levels provide different levels of functionality and have different hardware requirements. RAID 5 combines disk striping (blocks written to each disk in turn) with distributed storage of parity information, for fault tolerance. RAID 0 provides data striping only. RAID 1 provides disk mirroring. RAID 10 creates mirrored stripe sets.

218
Q

Which of the following mechanisms for load balancing web servers is able to read the incoming HTTP and HTTPS requests and perform advanced functions based on the information they contain?
Content switches
Multilayer switches
Failover clustering
DNS round-robin

A

A content switch is an application layer device, which is what renders it capable of reading the incoming Hypertext Transfer Protocol (HTTP) and Hypertext Transfer Protocol Secure (HTTPS) messages. HTTP is an application layer protocol. Multilayer switches do not operate above the transport layer. Failover clustering and (DNS) round-robin are both techniques for distributing incoming traffic without actually processing it.

219
Q

Which of the following statements about the differences between online and standby Uninterruptible Power Supplies (UPSs) are correct? (Choose all that apply.)
A standby UPS runs devices using battery power all the time.
An online UPS provides no gap in the power supplied to the devices during a main power failure.
An online UPS switches devices to battery power only during a main power failure.
A standby UPS provides only enough power for an orderly shutdown of the devices.

A

B, D. It is an online UPS that runs devices using battery power all the time so that there is no gap to the power supplied to devices during a failure. It is a standby UPS that switches devices to battery power during a main power failure. Both online and standby UPSs provide only enough power for an orderly shutdown of the devices.

220
Q

Which of the following are valid reasons why online Uninterruptible Power Supplies (UPSs) are more expensive than standby UPSs?
Online UPSs enable devices to run longer when a main power failure occurs.
Online UPSs enable devices to run continuously when a main power failure occurs.
Online UPSs are managed devices that can generate alerts.
Online UPSs provide greater protection against power spikes and sags.

A

B. Online UPSs run devices from the battery all the time, while simultaneously keeping the battery charged. There is therefore no switchover gap when a power failure occurs. Online UPSs do not necessarily run longer than standby UPSs, nor do they provide more protection again power spikes and sags. Both online and standby UPSs can be managed devices.

221
Q

Which of the following are equivalent terms for the process of combining the bandwidth of two or more network adapters to increase the overall speed of the connection and provide fault tolerance? (Choose all that apply.)
Bonding
Link aggregation
Clustering
Port aggregation
NIC teaming

A

A, B, D, E. Bonding, link aggregation, port aggregation, and Network Interface Card (NIC) teaming are all terms for the same basic technology, in which the bandwidth of multiple network adapter connections is joined to speed up transmissions. The technology also enables the network communication to continue if one of the adapters should be disconnected. Clustering refers to combining servers into a single unit, not network adapters.

222
Q

A network load balancing cluster is made up of multiple computers that function as a single entity. Which of the following terms is used to describe an individual computer in a load balancing cluster?
Node
Host
Server
Box

A

Host - In a network load balancing cluster, each computer is referred to as a host. Other types of clusters use other terms. For example, in a failover cluster, each computer is called a node. The terms server and box are not used in clustering.

223
Q

Which of the following RAID levels does not provide fault tolerance?
RAID 0
RAID 1
RAID 5
RAID 10

A

Redundant Array of Independent Disks (RAID) is a technology for storing data on multiple hard disk drives, providing fault tolerance, increased performance, or both. The various RAID levels provide different levels of functionality and have different hardware requirements. RAID 0 uses data striping only (blocks written to each disk in turn), which does not provide any form of fault tolerance. RAID 1 provides disk mirroring, RAID 5 combines disk striping with distributed storage of parity information, and RAID 10 creates mirrored stripe sets—these three levels all provide fault tolerance.

224
Q

Which of the following networking concepts frequently use virtual Internet Protocol (IP) addresses to provide high availability? (Choose all that apply.)
Clustering
Load balancing
Network Address Translation (NAT)
Network Interface Card (NIC) teaming

A

Clustering, Load Balancing - A high availability virtual IP address implementation is when multiple servers are identified by a single address, enabling all of the servers to receive incoming client traffic. In the case of server clustering and network load balancing arrangements, the cluster itself has a unique name and IP address, separate from those of the individual servers. Clients address themselves to the cluster, not to one of the servers in the cluster. NAT is not a high availability technology, and NIC teaming does not use virtual IP addresses.

225
Q

Which of the following disaster recovery mechanisms can be made operational in the least amount of time?
A cold site
A warm site
A hot site
All of the options are the same.

A

A Hot Site - Cold, warm, and hot backup sites differ in the hardware and software they have installed. A cold site is just a space at a remote location. The hardware and software must be procured and installed before the network can be restored. It is therefore the least expensive and takes the most time. A warm site has hardware in place that must be installed and configured. A hot site has all of the necessary hardware already installed, configured, and ready to go in the event of a disaster. A warm site is more expensive than a cold site, and a hot site is the most expensive and takes the least amount of time to be made operational.

226
Q

Which of the following datacenter disaster recovery mechanisms is the least expensive to implement?
A cold site
A warm site
A hot site
A cloud site

A

A Cloud Site - A cloud site is the least expensive to implement. Cold, warm, and hot backup sites differ in the hardware and software they have installed, but they all require the maintenance of a facility for a new datacenter. A cold site is just a space at a remote location. The hardware and software must be procured and installed before the network can be restored. It is therefore the least expensive of the cold, warm, and hot options and takes the most time. A warm site has hardware in place that must be installed and configured. A hot site has all of the necessary hardware already installed, configured, and ready to go in the event of a disaster. A warm site is more expensive than a cold site, and a hot site is the most expensive and takes the least amount of time to be made operational. A cloud site is a virtual facility maintained with a cloud service provider. The cloud site does not require physical space or physical hardware, so it is therefore the least expensive.

227
Q

If you have a server with dual power supplies, both of which are connected to a single Uninterruptible Power Supply (UPS), with a building power circuit connected to a backup generator, which of the following failures can the server survive and keep running indefinitely? (Choose all that apply.)
Failure of one server power supply
Failure of the UPS
Failure of the building power circuit
Failure of the building backup generator

A

A, D. If one of the server’s power supplies fails, the other will continue to function. If the building’s backup generator fails, the server will continue to run as long as the building still has outside power. If the UPS fails, the server will go down. If the breaker for the building power circuit trips, the server will run only as long as the UPS battery holds out.

228
Q

Which of the following is the criterion most commonly used to filter files for backup jobs?
Filename
File extension
File attributes
File size

A

The archive bit that backup software uses to perform incremental and differential jobs is a file attribute, so this is the most commonly used filter type. It is possible to filter files based on their names, their extensions, and their size, but these are not used as often as the archive file attribute.

229
Q

Which of the following statements about port aggregation is not true?
All of the aggregated ports use the same MAC address.
Port aggregation can be a fault tolerance mechanism.
Aggregating ports increases network throughput.
Port aggregation provides load balancing

A

Load balancing refers to the distribution of traffic between two or more channels. Port aggregation combines ports into a single logical channel with a single Media Access Control (MAC) address and provides greater throughput. Port aggregation also provides fault tolerance in the event of a port failure.

230
Q

Which of the following RAID levels provides fault tolerance with the smallest amount of usable disk space? (Choose all that apply.)
RAID 0
RAID 1
RAID 5
RAID 10

A

RAID 1, RAID 10 - Redundant Array of Independent Disks (RAID) is a technology for storing data on multiple hard disk drives, providing fault tolerance, increased performance, or both. The various RAID levels provide different levels of functionality and have different hardware requirements. RAID 1 provides disk mirroring, and RAID 10 creates mirrored stripe sets. Both provide fault tolerance by maintaining two copies of every stored file, for a usable disk space percentage of 50 percent. Some mirroring configurations store more than two copies of each file, for even less usable space. RAID 0 provides data striping only, with no fault tolerance. RAID 5 combines disk striping (blocks written to each disk in turn) with distributed storage of parity information, for fault tolerance with a usable disk space percentage of at least 66 percent.

231
Q

Disk mirroring and disk duplexing are both fault tolerance mechanisms for hard disk data storage. Which of the following statements about disk mirroring and disk duplexing is true?
Disk mirroring enables a server to survive the failure of a disk drive.
Disk duplexing enables a server to survive the failure of a disk controller.
Disk mirroring enables a server to survive a failure of a disk drive or a disk controller.
Disk duplexing enables a server to survive a failure of a disk drive or a disk controller.

A

Disk duplexing enables a server to survive a failure of a disk drive or a disk controller. - Disk mirroring and disk duplexing both use multiple hard disk drives to store duplicate copies of all data. However, disk duplexing calls for each disk to be connected to a separate controller so that the data remains available despite a disk failure or a disk controller failure.

232
Q

Which of the following RAID levels provide fault tolerance without using parity data? (Choose all that apply.)
RAID 0
RAID 1
RAID 5
RAID 10

A

RAID 1, RAID 10 - Redundant Array of Independent Disks (RAID) is a technology for storing data on multiple hard disk drives, providing fault tolerance, increased performance, or both. The various RAID levels provide different levels of functionality and have different hardware requirements. RAID 1 and RAID 10 both use disk mirroring to provide fault tolerance, which does not require parity data. RAID 0 uses data striping only (blocks written to each disk in turn), which does not provide any form of fault tolerance. RAID 5 combines disk striping with distributed storage of parity information.

233
Q

Which of the following backup job types does not reset the archive bits of the files it backs up?
Full
Incremental
Differential
Supplemental

A

Differential backups use the archive bit to determine which target files to back up. However, a differential backup does not reset the archive bit. Full backups do not pay attention to the archive bit, because they back up all of the files. A full backup, however, does clear the archive bit after the job is completed. Incremental backups also use the archive bit to determine which files have changed since the previous backup job. The primary difference between an incremental and a differential job, however, is that incremental backups clear the archive bit so that unchanged files are not backed up. There is no such thing as a supplemental backup job.

234
Q

What are the three elements in the Grandfather-Father-Son media rotation system for network backups?
Hard disk drives, optical drives, and magnetic tape drives
Incremental, differential, and full backup jobs
Monthly, weekly, and daily backup jobs
QIC, DAT, and DLT tape drives

A

The generational media rotation system uses the terms grandfather, father, and son to refer to backup jobs that are run monthly, weekly, and daily. The jobs can be full, incremental, or differential, and the terms have nothing to do with whether the backup medium is a hard disk, optical, or any type of tape drive.

235
Q

Which of the following types of backup jobs are supported by the Windows Server Backup program? (Choose all that apply.)
Incremental
Differential
Full
Supplemental

A

Incremental, Full - Windows Server Backup can perform full backups and incremental backups. It does not support differential backups, and there is no backup job called a supplemental.

236
Q

Which of the following storage techniques prevents version skew from occurring during a system backup?
Incrementals
Differentials
Iterations
Snapshots

A

Snapshots - Version skew can occur when a data set changes while a system backup is running. A file written to a directory that has already been backed up will not appear on the backup media, even though the job might still be running. This can result in unprotected files, or worse, data corruption. A snapshot is a read-only copy of a data set taken at a specific moment in time. By creating a snapshot and then backing it up, you can be sure that no data corruption has occurred due to version skew. Incrementals and differentials are types of backup jobs, and iteration is not a specific storage technology.

237
Q

If you back up your network by performing a full backup every Wednesday at 6:00 p.m. and incremental backups in the evening of the other days of the week, how many jobs would be needed to completely restore a computer with a hard drive that failed on a Monday at noon?
One
Two
Five
Six

A

Five - An incremental backup is a job that backs up all of the files that have changed since the last backup of any kind. Therefore, to restore a system that failed on Monday at noon, you would have to restore the most recent full backup from the previous Wednesday and the incrementals from Thursday, Friday, Saturday, and Sunday.

238
Q

How does an autochanger increase the overall storage capacity of a backup solution?
By compressing data before it is stored on the medium
By automatically inserting media into and removing it from a drive
By running a tape drive at half its normal speed
By writing two tracks at once onto a magnetic tape

A

An autochanger is a robotic device containing one or more removable media drives, such as magnetic tape or optical disk drives. The robotic mechanism inserts and removes media cartridges automatically so that a backup job can span multiple cartridges, increasing its overall capacity.

239
Q

If you back up your network by performing a full backup every Wednesday at 6:00 p.m. and differential backups in the evening on the other six days of the week, how many jobs would be needed to completely restore a computer with a hard drive that failed on a Tuesday at noon?
One
Two
Six
Seven

A

Two - A differential backup is a job that backs up all the files that have changed since the last full backup. Therefore, to restore a system that failed on Tuesday at noon, you would have to restore the most recent full backup from the previous Wednesday and the most recent differential from Monday.

240
Q

Why does performing incremental backups to a hard drive, rather than a tape drive, make it possible to restore a server with a single job, rather than multiple jobs?
Because hard drives hold more data than tape drives
Because hard drives can transfer data faster than tape drives
Because hard drives are random access devices and tape drives are not
Because hard drives use a different block size than tape drives

A

Because hard drives are random access devices and tape drives are not - Data is stored on tape drives in a linear fashion. Once you write backup data to a tape, you cannot selectively replace individual files. When you perform a restore job, you might have to restore the most recent full backup, followed by incremental backups, which overwrites some of the full backup files with newer ones. Hard disk drives are random access devices, meaning that individual files can be written to and read from any location on the disk. When you perform incremental backup jobs to a hard disk, the software can restore data using any version of each file that is available.

241
Q

Which of the following is the primary difference between the Power Distribution Units (PDUs) used in datacenters and the standard power strips used in offices and homes?
More outlets
Larger power input
Larger power output
All of the above

A

Larger Power Input - A PDU for a datacenter performs the same basic function as an office power strip, but it typically has a larger power input. It does not necessarily have more outlets or a larger power output.

242
Q

Which of the following is the most commonly recommended fire suppression system for a datacenter?
Carbon Dioxide
Water
Foam
HFC-125

A

Hydrofluorocarbon (HFC) 125 is a heat-absorbing gas that is frequently used for fire suppression systems. Many large datacenters include HFC-125 total flooding fire suppression systems because the products resulting from the flame retardation process are less toxic than carbon dioxide and do not damage electric and electronic equipment as water and foam do.

243
Q

Which of the following is not a First Hop Redundancy Protocol (FHRP)?
CARP
VRRP
HSRP
RARP

A

RARP - FHRPs provide a fault tolerant default gateway for network hosts by automatically failing over to an alternative router address in the event of a router failure. The Reverse Address Resolution Protocol (RARP) is a deprecated Internet Protocol (IP) address assignment protocol; it is not an FHRP. Common Address Redundancy Protocol (CARP), Virtual Router Redundancy Protocol (VRRP), and Hot Standby Router Protocol (HSRP) are all FHRPs.

244
Q

To build a network with redundant Internet connections that ensures full fault tolerance, it is necessary to use which of the following?
Different ISPs
Different WAN connections
Different routers
All of the above

A

All - Access to the Internet can be interrupted by a failure on the Internet Service Provider’s (ISP’s) network, by a failure on the Wide Area Network (WAN) provider’s network, or by a router failure on the local network. Building redundancy into all of these elements is the best way to ensure continuous access to the Internet.

245
Q

Which of the following protocols can you use to authenticate Windows remote access users with smartcards?
EAP
MS-CHAPv2
CHAP
PAP

A

The Extensible Authentication Protocol (EAP) is the only Windows remote authentication protocol that supports the use of authentication methods other than passwords, such as smartcards. MS-CHAPv2 is a strong remote access authentication protocol, but it supports password authentication only. Users cannot use smartcards. The Challenge Handshake Authentication Protocol (CHAP) is a relatively weak authentication protocol that does not support the use of smartcards. The Password Authentication Protocol (PAP) supports only cleartext passwords, not smartcards.

246
Q

Which of the following security protocols can authenticate users without transmitting their passwords over the network?
Kerberos
802.1X
TKIP
LDAP

A

Kerberos is a security protocol used by Active Directory that employs a system of tickets to authenticate users and other network entities without the need to transmit credentials over the network. IEEE 802.1X does authenticate by transmitting credentials. Temporal Key Integrity Protocol (TKIP) and Lightweight Directory Access Protocol (LDAP) are not authentication protocols.

247
Q

Which of the following statements about authentication auditing are not true?
Auditing can disclose attempts to compromise passwords.
Auditing can detect authentications that occur after hours.
Auditing can identify the guess patterns used by password cracking software.
Auditing can record unsuccessful as well as successful authentications.

A

Auditing can identify the guess patterns used by password cracking software. - Auditing of authentication activities can record both successful and unsuccessful logon attempts. Large numbers of logon failures can indicate attempts to crack passwords. Auditing tracks the time of authentication attempts, sometimes enabling you to detect off-hours logons that indicate an intrusion. Auditing does not record the passwords specified during authentications, so it cannot identify patterns of unsuccessful guesses.

248
Q

Which of the following statements best describes the primary scenario for the use of TACACS+?
TACACS+ was designed to provide authentication, authorization, and accounting services for wireless networks.
TACACS+ was designed to provide authentication, authorization, and accounting services for the Active Directory service.
TACACS+ was designed to provide authentication, authorization, and accounting services for remote dial-up users.
TACACS+ was designed to provide authentication, authorization, and accounting services for network routers and switches.

A

TACACS+ was designed to provide authentication, authorization, and accounting services for network routers and switches. - Terminal Access Controller Access Control System Plus (TACACS+) is a protocol designed to provide Authentication, Authorization, and Accounting (AAA) services for networks with many routers and switches, enabling administrators to access them with a single set of credentials.

249
Q

Which of the following is an implementation of Network Access Control (NAC)?
RADIUS
802.1X
LDAP
TACACS+

A

802.1X - NAC is a set of policies that define security requirements that clients must meet before they are permitted to connect to a network. 802.1X is a basic implementation of NAC.

250
Q

Which of the following is not one of the roles involved in an 802.1X transaction?
Supplicant
Authentication server
Authorizing agent
Authenticator

A

An 802.1X transaction involves three parties: the supplicant, which is the client attempting to connect to the network; the authenticator, which is a switch or access point to which the supplicant is requesting access; and the authentication server, which is typically a Remote Authentication Dial-In User Service (RADIUS) implementation that verifies the supplicant’s identity. There is no party to the transaction called an authorizing agent.

251
Q

Which of the following standards was originally designed to provide Authentication, Authorization, and Accounting (AAA) services for dial-up network connections?
RADIUS
TACACS+
Kerberos
LDAP

A

RADIUS - Remote Authentication Dial-In User Service (RADIUS) was originally conceived to provide AAA services for Internet Service Providers (ISPs), which at one time ran networks with hundreds of modems providing dial-up access to subscribers. Terminal Access Controller Access Control System Plus (TACACS+) is a protocol that was designed to provide AAA services for networks with many routers and switches, but not for dial-up connections. Kerberos and Lightweight Directory Access Protocol (LDAP) are not AAA services.

252
Q

Which of the following statements about RADIUS and TACACS+ are correct?
By default, RADIUS uses UDP, and TACACS+ uses TCP.
By default, RADIUS uses TCP, and TACACS+ uses UDP.
By default, both RADIUS and TACACS+ use TCP.
By default, both RADIUS and TACACS+ use UDP.

A

Remote Authentication Dial-In User Service (RADIUS) uses User Datagram Protocol (UDP) ports 1812 and 1813 or 1645 and 1646 for authentication, whereas Terminal Access Controller Access Control System Plus (TACACS+) uses Transmission Control Protocol (TCP) port 49.

253
Q

Which of the following terms refers to the process of determining whether a user is a member of a group that provides access to a particular network resource?
Authentication
Accounting
Authorization
Access control

A

Authorization is the process of determining what resources a user can access on a network. Typically, this is done by assessing the user’s group memberships. Authentication is the process of confirming a user’s identity. Accounting is the process of tracking a user’s network activity. Access control is the creation of permissions that provide users and groups with specific types of access to a resource.

254
Q

Which of the following types of servers are typically found in a screened subnet? (Choose all that apply.)
Domain controllers
DHCP servers
Email servers
Web servers

A

Email Servers, Web Servers - A network segment that is separated from the internal network by a firewall and exposed to the Internet is called a screened subnet, a demilitarized zone (DMZ), or a perimeter network. Administrators typically use a screened subnet for servers that must be accessible by outside users, such as web and email servers. For security reasons, domain controllers and Dynamic Host Configuration Protocol (DHCP) servers should be located on internal network segments.

255
Q

Which of the following statements best describes the difference between an exploit and a vulnerability?
- An exploit is a potential weakness in software, and a vulnerability is a potential weakness in hardware.
- A vulnerability is a potential weakness in a system, and an exploit is a hardware or software element that is designed to take advantage of a vulnerability.
- An exploit is a potential weakness in a system, and a vulnerability is a hardware or software element that is designed to take advantage of a vulnerability.
- A vulnerability is a potential weakness in software, and an exploit is a potential weakness in hardware.

A

B. A vulnerability is a weakness, whether in software or hardware, of which an exploit is designed to take advantage. Neither term is specific to hardware or software.

256
Q

Ralph is evaluating software products for potential deployment on his company’s network. Which of the following types of searches can Ralph use to identify security issues that have been discovered in specific products?
CIA
CVE
SKU
SIEM

A

The Common Vulnerabilities and Exposures (CVE) database is a resource that assigns identifier numbers to known security issues found in software products. By searching the database, Ralph can learn about the vulnerabilities that have already been found in the products he is evaluating. The Confidentiality - Integrity - Availability (CIA) triad lists important information security concepts, but it does not provide information about specific products. Stock Keeping Units (SKU) are product identifiers that do not involve security issues. Security Information and Event Management (SIEM) is a product that gathers and analyzes information about a network’s security events, but it would not help Ralph discover vulnerabilities in the products he is evaluating.

257
Q

Which of the following is a practice that a zero trust architecture is designed to protect against?
Zero-day vulnerabilities
External threats
Deauthentication
Lateral movement

A

Lateral movement is when a user gains basic access to a network by legitimate means and then uses it to gain unauthorized access to other resources inside the network. A zero trust provides full protection for all sensitive resources, even from users already inside the network. A zero trust architecture does not protect against zero-day vulnerabilities, which are exploits in software; external threats; or deauthentication, which is a type of Denial-of-Service (DoS) attack.

258
Q

As part of her company’s new risk management initiative, Alice has been assigned the task of performing a threat assessment for the firm’s data resources. For each potential threat she discovers, which of the following elements should Alice estimate? (Choose all that apply.)
Severity
Mitigation
Likelihood
Posture

A

A, C. A threat assessment should estimate the potential severity of a threat, such as the damage that the loss of a specific resource can cause to the organization. The assessment should also estimate the likelihood of a particular threat occurring, as the organization will have to devote more attention to the more likely threats. An assessment of the organization’s current posture (or status) with regard to a specific threat and the mitigation techniques used to counter it are both elements that come later in the risk management process, after the threat assessment has been completed.

259
Q

Which of the following attack types typically involves modifying network packets while they are in transit? (Choose all that apply.)
Spoofing
Denial-of-Service
On-path
Logic bomb

A

A, C. Spoofing is the process of modifying network packets to make them appear as though they are transmitted by or addressed to someone else. One way of doing this is to modify the Media Access Control (MAC) address in the packets to one that is approved by the MAC filter. An on-pass (or man-in-the-middle) attack is one in which an attacker intercepts network traffic, reads the traffic, and can even modify it before sending it on to the destination. Denial-of-Service (DoS) is a type of attack that overwhelms a computer with traffic, preventing it from functioning properly, whereas a logic bomb is a code insert placed into a legitimate software product that triggers a malicious event when specific conditions are met. Neither of these last two involves modifying network packets.

260
Q

Which of the following is the name for an attack in which an intruder uses a Bluetooth connection to steal information from a wireless device, such as a smart phone?
Bluedogging
Bluesnarfing
Bluesmurfing
Bluejacking

A

Bluesnarfing is an attack in which an intruder connects to a wireless device using Bluetooth, for the purpose of stealing information. Bluejacking is the process of sending unsolicited messages to a device using Bluetooth. The other options do not exist.

261
Q

Which of the following types of Denial-of-Service (DoS) attack does not involve flooding a server with traffic?
Amplified
Reflective
Distributed
Permanent

A

Permanent - Although a DoS attack typically involves traffic flooding, any attack that prevents a server from functioning can be called a DoS attack. A permanent DoS attack is one in which the attacker actually damages the target system and prevents it from functioning. This can be a physical attack that actually damages the hardware, or the attacker can disable the server by altering its software or configuration settings. Flood-based attacks include the Distributed Denial-of-Service (DDoS) attack, one in which the attacker uses hundreds or thousands of computers controlled by malware and called bots or zombies, to send traffic to a single server or website in an attempt to overwhelm it and prevent it from functioning. An amplified DoS attack is one in which the messages sent by the attacker require an extended amount of processing by the target servers, increasing the burden on them more than simpler messages would. A reflective DoS attack is one in which the attacker sends requests containing the target server’s IP address to legitimate servers on the Internet, such as Domain Name System (DNS) servers, causing them to send a flood of responses to the target.

262
Q

Which of the following statements best describes the difference between distributed and reflective Denial-of-Service (DoS) attacks?
- A distributed DoS attack uses other computers to flood a target server with traffic, whereas a reflective DoS attack causes a server to flood itself with loopback messages.
- A distributed DoS attack uses malware-infected computers to flood a target, whereas a reflective DoS attack takes advantage of other servers’ native functions to make them flood a target.
- A reflective DoS attack uses malware-infected computers to flood a target, whereas a distributed DoS attack takes advantage of other servers’ native functions to make them flood a target.
- A distributed DoS attack floods multiple target computers with traffic, whereas a reflective DoS attack only floods a single target.

A

B. Distributed Denial-of-Service (DDoS) attacks use hundreds or thousands of computers that have been infected with malware, called bots or zombies, to flood a target server with traffic in an attempt to overwhelm it and prevent it from functioning. A reflective DoS attack is one in which the attacker sends requests containing the target server’s IP address to legitimate servers on the Internet, such as Domain Name System (DNS) servers, causing them to send a flood of responses to the target. Neither attack type causes a computer to flood itself.

263
Q

Which of the following types of attacks require no additional hardware or software components? (Choose all that apply.)
Brute-force
Social engineering
Denial-of-Service
Phishing

A

A, B, C. A brute-force attack is one in which an attacker uses repeated guesses to find a password, an open port, or some other type of sensitive data. A Denial-of-Service (DoS) attack floods a target server with traffic so that it is unable to function normally. While both of these attack types can be mounted using specialized software, they can also be the work of a lone attacker using nothing more than the tools provided on a standard workstation. Social engineering is the practice of obtaining sensitive data by contacting users and pretending to be someone with a legitimate need for that data. It requires nothing more than a telephone or an email client. Phishing is the term for an attack that uses bogus emails or websites designed to infect users with some type of malware.

264
Q

Which of the following types of attacks are rarely seen anymore because of changes in device design that were specifically designed to prevent them? (Choose all that apply.)
VLAN hopping
Logic bomb
Phishing
Smurf

A

VLAN Hopping, Smurf - Smurf attacks rely on routers to forward broadcast traffic. Routers no longer forward broadcast messages, so smurf attacks have been rendered ineffective. In the same way, Virtual Area Network (VLAN) hopping, which is a method for sending commands to switches to transfer a port from one VLAN to another, is rarely seen because switches are now designed to prevent them.

265
Q

Which of the following attack types can be facilitated by ARP poisoning? (Choose all that apply.)
Evil twin
On-path
Session hijacking
Social engineering

A

On-path, Session hijacking - Address Resolution Protocol (ARP) poisoning is the deliberate insertion of fraudulent information into the ARP cache stored on computers and switches. This can enable an attacker to intercept traffic intended for another system. In an on-path (man-in-the-middle) attack, the attacker can read the intercepted traffic and even modify it before sending it on to the destination. In a session hijacking attack, the attacker can use the intercepted traffic to obtain authentication information, including passwords.

266
Q

Which of the following statements best describes a type of replay attack?
An intruder reenters a resource previously compromised by another intruder.
An intruder retransmits captured authentication packets to gain access to a secured resource.
An intruder uses the same technique that provided access to other resources to penetrate a new resource.
An intruder accesses a resource that was accidentally left unsecured by an authorized user.

A

B. A replay attack is one in which an attacker utilizes the information found in previously captured packets to gain access to a secured resource. In many cases, the captured packets contain authentication data. In this way, the attacker can make use of captured passwords, even when they are encrypted and cannot be displayed.

267
Q

Which of the following standards defines a framework for the authentication process, but does not specify the actual authentication mechanism?
WPA
EAP
TKIP
TLS

A

EAP - Extensible Authentication Protocol (EAP) is a framework for the encapsulation of authentication messages. EAP is used on wireless networks and point-to-point connections and supports dozens of different authentication methods. WiFi Protected Access (WPA) is a wireless encryption standard. Temporal Key Integrity Protocol (TKIP) is an encryption algorithm. Transport Layer Security (TLS) is an encryption protocol used for Internet communications.

268
Q

Which of the following Extended Authentication Protocol (EAP) variants utilize tunneling to provide security for the authentication process? (Choose all that apply.)
PEAP
EAP-FAST
EAP-TLS
EAP-PSK

A

PEAP, EAP-FAST - Protected Extended Authentication Protocol (PEAP) encapsulates EAP inside a Transport Layer Security (TLS) tunnel. Flexible Authentication via Secure Tunneling (FAST) also establishes a TLS tunnel to protect user credential transmissions. EAP-TLS uses TLS for encryption, but not for tunneling. EAP-PSK uses a preshared key to provide an authentication process that does not use encryption.

269
Q

In addition to EAP-TLS, which of the following are also Extensible Authentication Protocol (EAP) variants that use the Transport Layer Security (TLS) protocol? (Choose all that apply.)
PEAP
EAP-PWD
EAP-MD5
EAP-FAST

A

PEAP, EAP-FAST - The Protected Extensible Authentication Protocol (PEAP) and EAP Flexible Authentication via Secure Tunneling (EAP-FAST) both use TLS tunneling to secure authentication transmissions. EAP Password (EAP-PWD) and EAP-MP5 do not use TLS for tunneling or any other purpose.

270
Q

For which of the following reasons is disabling the Service Set Identifier (SSID) broadcast of a wireless network to prevent unauthorized access a relatively weak method of device hardening?
Attackers have ways of connecting to the network without the SSID.
Attackers can capture packets transmitted over the network and read the SSID from them.
Every access point’s SSID is printed on a label on the back of the device.
Attackers have software that can easily guess a network’s SSID

A

B. Disabling SSID broadcasts is a way of hiding the presence of a wireless network, but if an intruder knows that a network is there, it is a simple matter to capture packets transmitted by the wireless devices and read the SSID from them. It is not possible to connect to a wireless network without the SSID. SSIDs are set by the administrator of the access point; they are not printed on the device’s label. SSIDs can be found relatively easily but guessing them is no easier than guessing a password.

271
Q

Which of the following cannot be considered to be a server hardening policy?
Disabling unnecessary services
Disabling unused TCP and UDP ports
Upgrading firmware
Creating privileged user accounts

A

C. Upgrading the UEFI or BIOS firmware on a server typically does not enhance its security, so it cannot be considered a form of server hardening. Disabling services and ports that are not in use reduces the attack surface of a server, and creating privileged user accounts reduces the chance that privileged accounts will be compromised. Therefore, these are all forms of server hardening.

272
Q

Which of the following are valid reasons not to disable unused switch ports? (Choose all that apply.)
The datacenter is secured from unauthorized access.
The unused ports are not patched in to wall jacks.
The unused ports are left open to facilitate the on-boarding of new users.
The switch is configured to use a MAC-based access control list.

A

A, D. If there is no way for unauthorized people to access the datacenter, then there is no danger of someone plugging a device into a port that is left enabled. If the switch uses an Access Control List (ACL) that specifies the Media Access Control (MAC) addresses of systems permitted to connect to it, then there is no need to disable unused ports. However, disabling the ports is probably far easier than creating and maintaining the ACL. Ports that are not patched in can still be compromised at the switch location. Enabling ports is not difficult, so accommodating new users is not a valid reason for leaving them enabled.

273
Q

Which of the following is not a method for hardening a Wireless Access Point (WAP)?
Upgrading firmware
Changing default credentials
Generating new Pre-Shared Keys
Deauthentication

A

Deauthentication is a type of Denial-of-Service (DoS) attack in which the attacker targets a wireless client by sending a deauthentication frame that causes the client to be disconnected from the network. It is therefore not a method for hardening an access point. Upgrading the device’s firmware to apply security fixes, changing the default administrative credentials applied at the factory, and frequent Pre-Shared Key (PSK) changes are all means of hardening the security of an access point.

274
Q

Creating a policy instructing users to avoid passwords that use commonly shared information, such as birth dates and the names of children and pets, is an example of which of the following?
Mitigation techniques
Multifactor authentication
Network hardening
Access control

A

Network hardening is a term used to describe any method of making it more difficult for intruders to penetrate. In many cases, network hardening techniques are based on education rather than technology. Compelling users to create passwords that are difficult to guess is one example of this. Mitigation techniques are methods for reducing the severity of an attack.

275
Q

Which of the following types of mitigation techniques is not applicable to servers?
Role separation
Applying ACLs
File integrity monitoring
DHCP snooping

A

Dynamic Host Configuration Protocol (DHCP) snooping is a feature found in some network switches that prevents rogue DHCP servers from assigning IP addresses to clients. It can also detect when DHCP release or decline messages arrive over a port other than the one on which the DHCP transaction originated. The other options are all techniques that are applicable to servers.

276
Q

Which of the following terms describes the threat mitigation technique of deploying individual applications and services on virtual servers so that no more than one is endangered at any one time, rather than deploying multiple applications on a single server?
Geofencing
Network segmentation
Role separation
VLAN hopping

A

Role separation is the practice of creating a different virtual server for each server role or application. In addition to providing other benefits as well, this forces intruders to mount attacks on multiple servers to disable an entire network.

277
Q

Role separation is a threat mitigation technique that is applied to which of the following types of network components?
Switches
Servers
Routers
Wireless Access Points (WAPs)

A

Role separation is the practice of creating a different virtual server for each server role or application. In addition to providing other benefits as well, this forces intruders to mount attacks on multiple servers to disable an entire network.

278
Q

A server’s firewall is configured using a default policy that does not allow any users remote access to the server unless an administrator creates a rule granting them access. Which of the following terms describes this default policy?
Explicit allow
Explicit deny
Implicit allow
Implicit deny

A

An implicit deny is a policy that denies access to a resource by default, without a rule defining that denial. Creating a new rule denying access is an explicit deny. If anyone was able to access the server remotely by default, that would be an implicit allow. An explicit allow is a rule granting specific users remote access.

279
Q

Dynamic ARP Inspection (DAI) is a feature in some network switches that prevents on-path (man-in-the-middle) attacks facilitated by Address Resolution Protocol (ARP) poisoning, the deliberate insertion of fraudulent information into the ARP cache. A switch with DAI inspects incoming ARP packets and rejects those that contain incorrect pairs of IP and Media Access Control (MAC) addresses. Which of the following is the means by which the switch compiles a table of the correct ARP information for comparison with the incoming packets?
DHCP snooping
Secure SNMP
DNS name resolution
NDP

A

Dynamic Host Configuration Protocol (DHCP) snooping is a process in which the switch examines DHCP traffic to determine the IP addresses that DHCP servers have assigned to specific MAC addresses. DAI detects ARP poisoning attempts by comparing the IP-and-MAC address pairs in ARP packets with those in the DHCP snooping table it has compiled. The switch then discards packets with address pairs that do not match. Secure SNMP Secure Network Protocol (SNP), Domain Name Server (DNS) name resolution, and Neighbor Discovery Protocol (NDP) are not used to implement DAI.

280
Q

At which layer of the Open Systems Interconnection (OSI) reference model does Dynamic Host Configuration Protocol (DHCP) snooping operate?
Data link
Network
Transport
Application

A

Although DHCP is an application layer service that uses the User Datagram Protocol (UDP) transport layer protocol to assign network layer IP addresses, DHCP snooping is a data link layer process in which a network switch examines incoming DHCP traffic to determine whether it originates from an authorized server and is arriving over the correct port.

281
Q

Which of the following protocols is a root guard designed to affect?
EAP
STP
LDAP
ARP

A

A root guard affects the behavior of the Spanning Tree Protocol (STP) by enforcing the selection of root bridge ports on a switched network. Without root guards, there is no way for administrators to enforce the topology of a network with a redundant switching fabric.

282
Q

When Ralph digitally signs and encrypts a document with his private key, Alice can decrypt the document only by using Ralph’s public key. As long as the private key is accepted to be secure, which of the following statements are true? (Choose all that apply.)
Ralph cannot deny having created the document.
No one has altered the document since Ralph sent it.
No one but Ralph can have created the document.
No one but Alice can decrypt and read the document.

A

A, B, C - Because only Ralph possesses the private key, only he could have signed and encrypted it. Although it is possible for someone other than Alice to have decrypted the document while it was in transit, using Ralph’s public key, that individual could not have modified it and encrypted it again.

283
Q

Which of the following technologies utilize Access Control Lists (ACLs) to limit access to network resources? (Choose all that apply.)
NTFS
LDAP
WAP
Kerberos

A

NTFS, WAP - NTFS files and folders all have ACLs, which contain Access Control Entries (ACEs) that specify the users and groups that can access them and the specific permissions they have been granted. Wireless Access Points (WAPs) have ACLs that contain Media Access Control (MAC) addresses of the devices that are permitted to connect to the wireless network.

284
Q

The Internet of Things (IoT) encompasses a huge number of device types ranging from personal electronics to household appliances to medical equipment to industrial machinery. Many of these devices deal with sensitive information, and many perform critically important tasks. The field of IoT security is still in its infancy; there is no all-encompassing standard defining IoT protection protocols. IoT devices have vastly different security requirements and also vastly different functional capabilities, making it difficult to create a blanket protection mechanism for all of them. Which of the following are potentially viable methods for securing all IoT devices against attack? (Choose all that apply.)
Network segmentation
Network Access Control (NAC)
Security gateways
Firewalls

A

NAC, Security Gateways - Because many IoT devices are mobile or located in unprotected areas, a firewall is not a viable protection mechanism for all of them, nor is the practice of placing them on separate network segments. Network security mechanisms such as access control policies and centralized gateways providing authentication and authorization could conceivably be incorporated into a general IoT security standard.

285
Q

Control plane policing (CPP or CoPP) is a feature on some routers and switches that limits the rate of traffic on the device’s processor, to prevent Denial-of-Service (DoS) and reconnaissance attacks, using which of the following technologies?
IPSec
802.1X
RA Guard
QoS
VLAN hopping

A

Control plane policing uses Quality of Service (QoS) policies to block, allow, or impose rate limits on the traffic processed by the router or switch.

286
Q

Which of the following technologies enables Virtual Private Network (VPN) clients to connect directly to each other, as well as to the VPN server at the home site?
VPN concentrator
DMVPN
SIP trunk
MPLS
Clientless VPN

A

DMVPN - VPN typically enables remote clients to connect to a VPN router at a central site, much like the star topology of a Local Area Network (LAN), in which computers are all connected to a central switch. Dynamic Multipoint Virtual Private Network (DMVPN) is a technology that creates a mesh topology between the remote VPN sites, enabling the remote sites to connect directly to each other, rather than to the central VPN server.

287
Q

Which of the following Virtual Private Network (VPN) protocols does not provide encryption within the tunnel?
PPTP
IPSec
L2TP
SSL

A

Layer 2 Tunneling Protocol (L2TP) is used to create the tunnel forming a VPN connection, but it does not encrypt the traffic passing through the tunnel. To do this, it requires a separate protocol that provides encryption, such as Internet Protocol Security (IPSec). Point-to-Point Tunneling Protocol (PPTP) and Secure Sockets Layer (SSL) are both capable of encrypting tunneled traffic.

288
Q

Which of the following types of Virtual Private Network (VPN) connection is the best solution for allowing clients limited access to your corporate network?
Host-to-site
Site-to-site
Host-to-host
Extranet

A

An extranet VPN is designed to provide clients, vendors, and other outside partners with the ability to connect to your corporate network with limited access. A host-to-site VPN is a remote access solution, enabling users to access the corporate network from home or while traveling. A site-to-site VPN enables a branch office to connect to the home office using the Internet rather a more expensive Wide Area Network (WAN) connection. A host-to-host VPN enables two individual users to establish a protected connection to each other.

289
Q

Which of the following services is provided by the Remote Desktop Protocol (RDP)?
Thin client computing
Clientless virtual private networking
Encrypted tunneling
Unauthenticated file transfers

A

Thin Client Computing - RDP is a component of Remote Desktop Services, a Windows mechanism that enables a client program to connect to a server and control it remotely. RDP does not carry actual application data; it just transfers keystrokes, mouse movements, and graphic display information. Because the client program does not participate in the application computing on the server, it is known as a thin client. RDP does not provide clientless virtual private networking, encrypted tunneling, or unauthenticated file transfers.

290
Q

Which of the following remote access protocols provides users with full graphical control over a Windows computer? (Choose all that apply.)
SSH
RDP
VNC
Telnet

A

RDP, VNC - Remote Desktop Protocol (RDP) is a component of Remote Desktop Services, a Windows mechanism that enables a client program to connect to a server and control it remotely. RDP does not carry actual application data; it just transfers keystrokes, mouse movements, and graphic display information. Virtual Network Computing (VNC) is a similar desktop sharing system that is platform independent and open source. Secure Shell (SSH) and Telnet are character-based remote control solutions.

291
Q

What types of traffic are carried by the RDP?

A

-Keystrokes
-Mouse Movements
-Display Information
RDP is a component of Remote Desktop Services, a Windows mechanism that enables a client program to connect to a server and control it remotely. RDP does not carry actual application data; it just transfers keystrokes, mouse movements, and graphic display information.

292
Q

What four components are required for a computer to establish a remote Transmission Control Protocol/Internet Protocol (TCP/IP) connection?
A) Common protocols
B) Remote Access Service (RAS)
C) A physical layer connection
D) TCP/IP configuration
E) Point-to-Point Tunneling Protocol (PPTP)
F) Host and remote software

A

A, C, D, F. A computer requires four components to establish a remote connection. First, a physical-layer Wide Area Network (WAN) connection is needed. Second, the two systems must share common protocols from the data link layer and above. Third, if TCP/IP is being used to establish a remote session, then TCP/IP parameters must be configured on the systems. Fourth, host and remote software are needed. The remote client must have software that enables it to establish a remote session, and the server must have software that enables it to receive and grant remote sessions. Microsoft RAS supports both client and server remote access software; however, this is not a required component since other types of software can be used. PPTP is a tunneling protocol and is not a required component for establishing a remote session.

293
Q

Which of the following statements explains why web browsing over a client-to-site Virtual Private Network (VPN) connection is usually so much slower than browsing locally?
The browser application is running on the VPN server.
The browser is using the remote network’s Internet connection.
The VPN tunnel restricts the amount of bandwidth available.
VPN encryption is processor intensive.

A

The browser is using the remote network’s Internet connection. - When users connect to a remote network using VPN, they become a participant on that network, which includes using the remote network’s Internet connection. Therefore, when a user opens a browser, the application passes the user’s requests through the VPN tunnel to the remote server, which uses the default gateway and Internet connection at the remote site to connect to the desired address. This is inherently slower than connecting the browser directly to the Internet from the client computer.

294
Q

Which of the following are the two most common types of Transport Layer Security/Secure Sockets Layer (TLS/SSL) Virtual Private Network (VPN) connections? (Choose all that apply.)
TLS/SSL client
TLS/SSL portal
TLS/SSL tunnel
TLS/SSL gateway

A

The two most common types of TLS/SSL VPN connection are TLS/SSL portals, which provide users with access to selected remote network resources through a standard website, and TLS/SSL tunnels, which require the client web browser to run an active control, typically using Java or Flash. TLS/SSL client and TLS/SSL gateway are not common TLS/SSL VPN connections.

295
Q

Which of the following statements about running a site-to-site Virtual Private Network (VPN) connection to join two distant Local Area Networks (LANs) together, rather than using a Wide Area Network (WAN) connection, are generally true? (Choose all that apply.)
The VPN is cheaper.
The VPN is slower.
The VPN is less secure.
The VPN is harder to maintain.

A

Cheaper, Slower - Because the two endpoints of a VPN are connecting to local Internet Service Providers (ISPs), the ongoing connection costs are typically much less than a long-distance WAN connection. However, in most cases, a VPN is slower because it is affected by Internet bandwidth use and other factors. VPN connections are not inherently less secure than WANs, and they are not necessarily more difficult to maintain.

296
Q

Which of the following is not an advantage of the Virtual Network Computing (VNC) terminal emulation product over its competitors?
VNC is free.
VNC runs on many operating systems.
VNC runs faster than the competition.
VNC can run through a web browser.

A

VNC supports many operating systems, can run through a web browser, and is free. However, it is not any faster than the competing products.

297
Q

Which of the following was the first Transmission Control Protocol/Internet Protocol (TCP/IP) terminal emulation program?
Telnet
SSH
Windows Terminal Services
Virtual Network Computing

A

Telnet (TELetype NETwork) was the first TCP/IP terminal emulation program, but it is rarely used today because of its limitations. It is character-based only, and it transmits all data as cleartext, which is insecure. Secure Shell (SSH) addresses the security problem, but it too is character-based. Windows Terminal Services and Virtual Network Computing (VNC) were both created to provide graphical terminal emulation.

298
Q

Virtual Private Networks (VPNs) use tunneling, which is the process of encapsulating a data packet within another packet for transmission over a network connection, typically using the Internet. The system encrypts the entire encapsulated data packet for protection. Split tunneling is a variation of this method that provides which of the following advantages? (Choose all that apply.)
Conservation of VPN bandwidth
Access to local network devices while connected to the VPN
Additional data integrity protection
Faster data transmission through multiplexing

A

Access to local network devices while connected to the VPN
Conservation of VPN bandwidth - A basic VPN typically uses full tunneling, in which all of the system’s network traffic is encapsulated and encrypted for transmission. Split tunneling is a variation of this method in which only part of the system’s traffic uses the VPN connection; the rest is transmitted over the network in the normal manner. Administrators can select which applications and devices use the VPN. Split tunneling can conserve Internet bandwidth used by the VPN and provide access to local services without the need for encapsulation. Split tunneling does not provide additional data integrity protection or improved performance through multiplexing.

299
Q

Which of the following troubleshooting steps involves prioritizing trouble tickets based on the severity of the problem?
Identify symptoms of the problem
Establish a theory of probable cause
Test the theory to determine cause
Establish a plan of action to resolve the problem and identify potential effects
Implement the solution or escalate as necessary
Verify full system functionality and, if applicable, implement preventive measures
Document findings, actions, and outcomes

A

Identify symptoms of the problem - The first step in troubleshooting is to identify the problem by establishing symptoms related to the network issue being reported. In this step, problems are typically reported as trouble tickets, which are prioritized based on the severity of the problem. You complete the other steps after the trouble ticket has been prioritized and is being investigated.

300
Q

Which of the following is considered a systemwide error?
A problem with an order entry or customer service call center resource
A problem with a router that affects only one Local Area Network (LAN)
A fatal error that causes a single computer to fail
A problem with an email server that affects all network users

A

C - A systemwide error is a problem that renders an individual user’s system (computer) completely unusable. All the other problems listed would affect more than one system or user.

301
Q

You have a problem with a server or other network component that prevents many users from working. What type of problem is this?
A networkwide problem
A shared resource problem
A systemwide problem
A user application problem

A

If a problem lies within a specific server or other network component that prevents many users from working, it is a shared resource problem. A problem that lies within resources that provide services to the entire network is a networkwide problem. Systemwide problems put a specific computer out of commission, preventing a user from getting any work done. An application problem is a problem that affects only a single user’s access to a device or application.

302
Q

Alice has a network with a Domain Name System (DNS) server, a proxy server, and an Internet router. A user is complaining that she suddenly cannot connect to hosts on her own Local Area Network (LAN) and other internal LANs, and she cannot access hosts on the Internet. What is the likeliest problem?
The user’s local configuration
The proxy server
The DNS server
The router

A

Since only one user is reporting the problem, the user’s computer and its configuration are the likeliest suspect components. A DNS, proxy, or router problem would affect more than one user.

303
Q

Alice takes a call from a user who is unable to send email to a colleague in one of the company’s branch offices. Alice begins by having the user try to send emails to different people at the branch office, to people in the local office, and to people on the Internet. She then checks the user’s Internet Protocol (IP) configuration settings, the computer’s Local Area Network (LAN) communication, and the cable connection to the network. Which of the following approaches is Alice using to troubleshoot the problem?
OSI bottom-to-top
Divide and conquer
OSI top-to-bottom
Question the obvious

A

Alice is using a top-to-bottom approach, based on the Open Systems Interconnection (OSI) reference model. She begins at the top of the model (the application layer) by checking the system’s email capabilities, and then proceeds downwards to check the computer’s IP configuration (at the network layer), the local network connectivity (the data link layer), and the computer’s cables (the physical layer). A bottom-to-top approach would begin with the cables.

304
Q

Which of the following types of Unshielded Twisted Pair (UTP) wiring faults cannot be detected by a wiremap tester?
Split pairs
Open circuits
Short circuits
Transposed wires

A

Split Pairs - A wiremap tester consists of a main unit that connects to all eight wires of a UTP cable at once and a loopback device that you connect to the other end, enabling you to test all of the wires at once. A wiremap tester can detect opens and shorts, as well as transposed wires. However, it cannot detect split pairs because, in that fault, the pins are properly connected.

305
Q

After connecting a tone generator to the green wire at one end of a twisted-pair cable run, Ralph proceeds to the other end of the cable and touches the locator to each of the eight pins in turn. The green wire and the green striped wire both produce a tone. What type of wiring fault has Ralph discovered?
Split pair
Far end crosstalk
Transposed wires
Short circuit
Delay skew

A

Short Circuit - The first and most essential test that installers must perform on every cable run is a continuity test, which ensures that each wire on both ends of the cable is connected to the correct pin and only the correct pin. If a pin on one end of a cable run is connected to two or more pins on the other end, the cable has a short circuit.

306
Q

A routine test of a newly installed twisted-pair cable run with a wiremap tester indicates that there is a short circuit on one of the wires. Which of the following procedures might possibly correct the fault?
Use a different pinout on both ends of the cable
Replace the connectors at both ends of the cable run
Move the cable away from any potential sources of electromagnetic interference
Use a higher grade of Unshielded Twisted Pair (UTP) cable

A

A short circuit is a wiring fault indicating that a pin at one end of a cable run is connected to two pins at the other end. To correct the problem, you must replace the connector with the faulty wiring. None of the other suggestions are solutions for a wiring fault.

307
Q

Which of the following statements about cable certifiers are true? (Choose all that apply.)
A cable certifier eliminates the need for tools like tone generators and wiremap testers.
Cable certifiers are the most inexpensive cable testing solution.
Cable certifiers must be reconfigured whenever a new cable specification is standardized.
Cable certifiers can only test copper-based cables.

A

A, C. Cable certifiers can detect all of the faults that tone generators and wiremap testers can detect, and they can do a great deal more, such as specify whether a cable run meets the performance specifications defined in a cable standard. When testing a new cable type, the specifications defined in the cable standard must be added to the device. Cable certifiers are far more expensive than most other cable testing solutions. Cable certifiers are available that support various cable media, including copper and fiber optic.

308
Q

After experiencing some problems with devices connected to the company’s fiber-optic network, Alice brings in a contractor to test the fiber-optic cable runs. The contractor detects a significant amount of decibel (dB) loss in some of the cable runs, which could be the source of the problems. Which of the following are possible causes of the decibel loss? (Choose all that apply.)
Electromagnetic interference
Dirty optical cables
Excessive cable length
Signal crosstalk

A

Dirty optical cables, Excessive cable length - Dirt on fiber-optic cable connectors can reduce the strength of the signal, resulting in decibel loss. Excessive cable length can result in greater attenuation and weaker signals due to the decibel loss. Electromagnetic interference and signal crosstalk are both factors that can affect copper cable transmissions, but not fiber optic.

309
Q

Ed is trying to troubleshoot a problem that has caused a wired network connection to fail completely. Which of the following wired network problems will cause a complete failure of a network connection? (Choose all that apply.)
Bottleneck
Speed mismatch
Duplex mismatch
TX/RX reversal
Bad switch port

A

Speed mismatch, TX/RX reversal, Bad switch port - A speed mismatch on a wired network only occurs when two devices are configured to use a specific transmission speed and those speeds are different. In that case, network communication stops. For network communication to occur on a twisted-pair network, transmit (TX) pins must be connected to receive (RX) pins. If the connections are reversed, no communication occurs. If the switch port to which a computer is connected is bad, there will be no network communication. Bottlenecks and duplex mismatches will slow down network communications, but they will not stop them completely.

310
Q

Ed is trying to troubleshoot a problem with his wired network, and his research has led him to a list of possible network faults. The list is rather old, however, and Ed is wondering if some of the problems are relevant. Which of the following wired network problems no longer occur with modern Gigabit Ethernet switches and network adapters in their default configurations? (Choose all that apply.)
Bottleneck
Speed mismatch
Duplex mismatch
Transmit and Receive (TX/RX reversal)

A

Speed mismatch, Duplex mismatch - The Gigabit Ethernet standards call for switches and network adapters to support autonegotiation by default, which enables devices to communicate and select the best network speed and duplex mode available to them both. Therefore, speed mismatches and duplex mismatches no longer occur unless someone modifies the speed or duplex settings to incompatible values on one or both devices.

311
Q

Which of the following Windows tools uses Internet Control Message Protocol (ICMP) messages and manipulates IPv4 time-to-live values to illustrate the route packets take through an internetwork?
ping
netstat
route
tracert
nslookup
hostname

A

The Windows tracert tool transmits a series of ICMP messages with incrementing Time to Live (TTL) values, which identify each router on the path that the packets take through the network. Ping uses ICMP, but it does not manipulate TTL values. Netstat, Route, Nslookup, and Hostname do not use ICMP messages, nor do they manipulate TTL values when performing their normal functions.

312
Q

Which TCP/IP utility should you use to most easily identify a malfunctioning router on your network?
ifconfig
ping
traceroute
netstat

A

traceroute - The traceroute (or tracert) utility can locate a malfunctioning router by using an Echo Request messages with incrementing Time to Live (TTL) values. ifconfig is a network configuration utility for Unix and Linux systems; ping can test connectivity to another Transmission Control Protocol/Internet Protocol (TCP/IP) system, but it cannot locate a malfunctioning router; and netstat displays information about network connections and traffic but cannot locate a malfunctioning router.

313
Q

Ralph has been advised to check his Linux web servers for open ports that attackers might be able to use to penetrate the servers’ security. Which of the following utilities can Ralph use to do this?
tcpdump
dig
iptables
nmap
iperf

A

The nmap utility is capable of scanning a system for open ports that might be a security hazard.

314
Q

While performing a protocol analysis, Alice notes that there are many Internet Control Message Protocol (ICMP) packets in her captured traffic samples. She attributes these to her frequent use of Transmission Control Protocol/Internet Protocol (TCP/IP) troubleshooting tools. Which of the following utilities are used to test network layer characteristics of a host using ICMP messages? (Choose all that apply.)
ipconfig
netstat
ping
tracert

A

ping and tracert are both utilities that test network layer characteristics using ICMP messages. ping tests the network layer functionality of the host, and traceroute displays the path to the host through the internetwork. ipconfig and netstat do not use ICMP messages.

315
Q

Which of the following netstat commands can tell you how many IPv6 packets have been received on a particular Windows workstation?
netstat -a
netstat -s
netstat -e
netstat -r

A

-s - The netstat -s command displays packet counts and other traffic statistics for the IPv6, IPv4, ICMP, TCP, and UDP protocols. The netstat -a command displays all of a workstation’s current connections and ports on which it is listening. The netstat -e command displays Ethernet statistics, such as the number of bytes and packets sent and received. The netstat -r command displays the computer’s routing table.

316
Q

Which of the following commands can Ralph use to display the number of bytes that a Windows workstation has transmitted?
netstat
tcpdump
ipconfig
iptables

A

Running netstat with the -e parameter on a Windows workstation displays Ethernet statistics, including the number of bytes and packets the workstation has sent and received. The ipconfig command displays Transmission Control Protocol/Internet Protocol (TCP/IP) configuration data; it does not display network traffic statistics. The tcpdump and iptables commands both run only on Unix and Linux workstations.

317
Q

Alice is troubleshooting a Windows server, and while doing so she runs the following command: ping 127.0.0.1. The command completes successfully. What has Alice proven by doing this?
That the computer’s network adapter is functioning properly
That the computer’s TCP/IP networking stack is loaded and functioning
That the computer’s IP address is correct for the network
Nothing at all

A

The Internet Protocol (IP) address 127.0.0.1 is a dedicated loopback address that directs outgoing IP traffic directly into the incoming IP traffic buffer. A successful ping test using that address indicates that the computer’s Transmission Control Protocol/Internet Protocol (TCP/IP) stack is functioning properly, but the traffic never reaches the network adapter or the network, so the test does not confirm that the adapter is functioning or that the computer has a correct IP address for the network.

318
Q

Which of the following are the three main categories of information that you can display by running the netstat command on a Windows computer?
Connection state
Active connections
Routing table
Interface statistics

A

B, C, D. When you run the netstat command without any switch options, it displays the computer’s active connections. Running netstat -e displays the computer’s interface statistics. Running netstat -r displays the routing table. There is no netstat switch that displays the computer’s connection state.

319
Q

Which of the following tools can administrators use to monitor network bandwidth and traffic patterns?
Protocol analyzer
Bandwidth speed tester
NetFlow analyzer
IP scanner

A

NetFlow Analyser - A NetFlow analyzer is a tool that can collect network traffic data and analyze how bandwidth is being used and who is using it. A protocol analyzer is also a tool that captures network packets, but for the purpose of analyzing their contents. A bandwidth speed tester measures a network’s internet access speed. An Internet Protocol (IP) scanner lists the IP addresses that are in use on a network.

320
Q

Which of the following protocols does the traceroute utility on Unix and Linux systems use to test TCP/IP connectivity?
ICMP
HTTP
TCP
UDP

A

UDP - On Unix and Linux systems, the traceroute utility tests Transmission Control Protocol/Internet Protocol (TCP/IP) connectivity by transmitting User Datagram Protocol (UDP) messages. This is unlike the tracert utility on Windows systems, which uses Internet Control Message Protocol (ICMP) messages. Neither version uses TCP or Hypertext Transfer Protocol (HTTP).

321
Q

Ed is implementing a web server farm on his company’s network and has created a screened subnet (or perimeter network) on which the web servers will be located. The screened subnet is using the network Internet Protocol (IP) address 192.168.99.0/24. He has also installed a router connecting the screened subnet to the internal network, which uses the 192.168.3.0/24 network address. The IP addresses of the router’s interfaces are 192.168.3.100 and 192.168.99.1. Ed needs to access the web servers from his Windows workstation on the internal network, but right now, he cannot do so. Because he needs to have a different router specified as his default gateway, Ed decides to add a route for the screened subnet to his computer’s routing table. Which of the following commands will create a routing table entry that enables Ed to access the screened subnet?
- route add 192.168.3.0 MASK 255.255.255.0 192.168.3.100
- route add 192.168.99.1 MASK 255.255.255.0 192.168.3.0
- route add 192.168.3.100 MASK 255.255.255.0 192.168.99.0
- route add 192.168.99.0 MASK 255.255.255.0 192.168.3.100

A

route add 192.168.99.0 MASK 255.255.255.0 192.168.3.100 -
The correct syntax for the Windows route add command is to specify the destination network address, followed by the subnet mask for the destination network, followed by the address of the router interface on the local network that provides access to the destination network. The other options do not specify the correct addresses in the syntax.

322
Q

Which of the following processes scans multiple computers on a network for a particular open Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port?
Port scanning
War driving
Port sweeping
Bluejacking

A

Port Sweeping - Port scanning identifies open ports on a single computer, whereas port sweeping scans multiple computers for a single open port. War driving and bluejacking are methods of attacking wireless networks.

323
Q

Which of the following statements about protocol analyzers is not true?
To troubleshoot using a protocol analyzer, you must be familiar with the OSI model and the protocols that operate at each of its layers.
Protocol analyzers can be a network security risk.
Some network monitoring products are both analyzers and sniffers.
All Windows operating systems include a protocol analyzer.

A

D. A protocol analyzer captures frames and displays their contents, including the header fields created by the protocols at the various Open Systems Interconnection (OSI) model layers. To interpret the exchanges between the computers on the network, you must be familiar with the protocols and how they operate. Protocol analyzers are useful tools in the hands of experienced network administrators, but they can also be used for malicious purposes, such as displaying unencrypted passwords and other confidential information in the captured packets. The difference between analyzers and sniffers is that analyzers read the internal contents of the packets they capture, parse the individual data units, and display information about each of the protocols involved in the creation of the packet, while sniffers look for trends and patterns in the network traffic without examining the contents of each packet.

324
Q

Which of the following utilities can be classified as port scanners? (Choose all that apply.)
Nmap
Nessus
Network Monitor
Performance Monitor

A

A, B. nmap is a command-line utility that scans a range of IP addresses, runs a series of scripts against each device it finds, and displays a list of the open ports it finds on each one. Nessus is similar to nmap in that it also scans a range of IP addresses to find open ports, but it then proceeds to mount attacks against those ports, to ascertain their vulnerability.

325
Q

Which Unix/Linux performance monitoring tool, with output shown in the figure, enables you to display information about processes that are currently running on a system?

A

top - The top utility displays performance information about the currently running processes on a Unix/Linux system.

326
Q

A port scanner examines a system for network vulnerabilities at which layer of the Open Systems Interconnection (OSI) model?
Application
Transport
Network
Data Link

A

Transport - A port is a numbered service endpoint identifying an application running on a Transmission Control Protocol/Internet Protocol (TCP/IP) system. A port scanner examines a system for open endpoints, accessible using the TCP or User Datagram Protocol (UDP) at the transport layer, which intruders can conceivably use to gain access to the system from the network.

327
Q

Alice is attempting to troubleshoot a communication problem between two hosts on the same network. She decides to use a protocol analyzer to capture traffic on the network. After finishing the capture, Alice notices that there are over 15,000 frames in the protocol analyzer’s capture buffer. She is having a difficult time identifying the frames that relate to the problem because there are so many in the buffer. She wants to eliminate the extraneous frames from her view, enabling her to view only the frames transmitted by these two hosts. What does Alice have to do to accomplish this?
Configure a display filter
Configure a capture filter
Delete the extraneous frames from the buffer
Configure a capture and display filter

A

A. Once the frames are in the buffer, Alice can configure a display filter to block the unwanted frames from view. This does not delete them from the buffer. Since the capture was already performed, there is no need to restart the capture. Configuring a capture filter will not meet the requirements, because the filter will eliminate the other frames completely from the buffer. It is not possible to delete specific frames from an analyzer buffer.

328
Q

Ralph is adding new workstations to his wireless network, which uses an Access Point (AP) that is configured to use WiFi Protected Access II (WPA2) encryption. However, after installing the wireless network adapter on the first workstation, Ralph finds that he cannot see the Wireless Access Point (WAP) on the Available Networks display. Which of the following could be the problem? (Choose all that apply.)
Incorrect passphrase
Channel overlap
Incorrect SSID
Incorrect antenna polarization
Antenna cable attenuation

A

B, D, E. Interference resulting from channel overlap, a weak signal due to incorrect antenna polarization, and signal loss due to antenna cable attenuation could render the workstation unable to make contact with the AP. An incorrect passphrase would not be the problem unless Ralph had already seen the AP and attempted to connect to it. An incorrect Service Set Identifier (SSID) would be the problem only if Ralph had already attempted to manually enter an SSID.

329
Q

Ralph is the administrator of a small company’s wireless network. He has recently discovered evidence that users outside of the company’s office space have been accessing its wireless network. The office is located in a narrow space against the building’s outside wall. Ralph is concerned that the network’s Wireless Access Point (WAP) is extending coverage outside the building. Speaking with a consultant friend of his, Ralph is advised to install a different type of antenna on his Access Point (AP). Which of the following antenna types would most likely help Ralph to alleviate the problem?
Dipole
Yagi
Patch
Unidirectional

A

A patch antenna is a flat device that transmits signals in a half-spherical pattern. By placing the antenna against the building’s outer wall, Ralph can provide coverage inside the building and minimize coverage extending to the outside.

330
Q

Alice receives a call from a user who cannot connect to the company’s 802.11n wireless network with a laptop that has an 802.11g network adapter. Other users working in the same area are able to connect to the network without difficulty. Which of the following steps should Alice take first to try to resolve the problem? (Choose all that apply.)
Change the channel used by the Wireless Access Point (WAP)
Check whether the user is connecting to the correct Service Set Identifier (SSID)
Check whether the wireless adapter in the user’s laptop is enabled
Provide the user with an 802.11n wireless network adapter

A

B, C. The first steps Alice should take are the simplest ones: make sure that the wireless interface in the user’s laptop is turned on and that she is attempting to connect to the correct SSID for the company network. Changing the channel would not be necessary unless other users in the area are also having problems due to interference. The 802.11n wireless networking standard is backward compatible with 802.11g, so it should not be necessary to provide the user with a new network adapter.

331
Q

Users on Ed’s 802.11n wireless network are dropping their connections intermittently. Which of the following might help to resolve the problem?
Restart the Wireless Access Point (WAP)
Change the network’s Service Set Identifier (SSID)
Change the channel the devices are using
Change the wireless security protocol

A

C. If the users are losing their connections due to interference from other types of devices, changing the channel alters the frequency the network uses and can enable it to avoid the interference. The other options are not likely to affect any condition that would cause users to drop their connections.

332
Q

Which of the following is a power measurement of a specific transmitter and antenna combination, as used in a wireless access point?
RSSI
EIRP
SSID
MIMO

A

Effective Isotropic Radiated Power (EIRP) is a measurement of the signal strength generated by an access point (or other radio transceiver) with a particular antenna. Received Signal Strength Indicator (RSSI) is a measurement of the strength of the signal received by a device from an access point. Service Set Identifier (SSID) is a designation assigned to a specific wireless network, which appears in the Available Networks list of a WiFi client. Multiple Input, Multiple Output (MIMO) is a technology used by some IEEE wireless networking standards to increase throughput by using multiple antennae.

333
Q

Ralph has two computers that he long ago networked together by plugging one end of an Ethernet cable into each machine. He recently bought an old Ethernet hub at a garage sale and wants to use it to expand his network. The hub has four numbered ports and a fifth port marked with an X. Ralph plugs one computer into port 1 using his existing cable and buys a new cable to plug the other computer into port 4. The two computers cannot communicate, however. Which of the following solutions will not enable his computers to communicate?
Move the port 4 cable to port 2
Replace the old cable with a second new one
Plug the computer with the old cable into the X port
Plug the computer with the new cable into the X port

A

A. The problem is unlikely to be a bad hub port or a bad cable, so moving the cable from port 4 to port 2 will not help. The problem is the crossover circuit between the two computers. The two systems were once connected directly together, which means that Ralph was using a crossover cable. The hub also provides a crossover circuit (except in the X port), and old hubs often do not autonegotiate crossovers. Therefore, the connection has two crossovers, which is the equivalent of wiring transmit pins to transmit pins, instead of transmit pins to receive pins. All of the other options eliminate one of the crossover circuits, enabling the computers to be wired correctly.

334
Q

Ed is troubleshooting some network performance problems. After exhausting many other possibilities, he is examining the twisted-pair cable runs in the office’s drop ceiling. He finds that some cables have been damaged, apparently by electricians working in that space. In some cases, the cable sheath has been split along its length, and some of the insulation on the wires inside has been scraped off as well. Which of the following types of faults might be caused by this damage? (Choose all that apply.)
Open circuits
Short circuits
Split pairs
Transposed wires

A

Open and Short circuits - An open circuit is caused either by a break in the wire somewhere inside the cable or a bad connection with the pin in one or both connectors. A short is when a wire is connected to two or more pins at one end of the cable or when the conductors of two or more wires are touching inside the cable. In this instance, the damage to the cables could have resulted in either condition. A split pair is a connection in which two wires are incorrectly mapped in exactly the same way on both ends of the cable. Having transposed pairs is a fault in which both of the wires in a pair are connected to the wrong pins at one end of the cable. Both of these faults are the result of incorrect wiring during installation; they are not caused by damaged cables.

335
Q

Alice is examining a captured sample of network traffic to create a network performance baseline for future reference. She notices that the sample contains a flood of multicast traffic, but she does not know why. After some investigation, she learns that there is video traffic on the network being transmitted as multicasts, but it is only intended for a particular group of users, not for everyone. However, since the multicast traffic is flooding the network, all of the hosts must process the packets, possibly resulting in performance degradation or even Denial-of-Service (DoS). Which of the following can Alice use to prevent the traffic from being processed by the unintended hosts?
Asymmetric routing
Flow control
Multipathing
IGMP snooping

A

Internet Group Management Protocol (IGMP) snooping is a switching technique that prevents network hosts from receiving multicast packets when they are not members of the multicast group. The multicast traffic will still appear on the network, but only the members of the multicast group will process the packets.

336
Q

A user calls the company’s IT help desk to report that she has received an error message on her Windows workstation. The error states that her computer has an IP address that is duplicated on the network. Ralph is concerned that there might be a configuration problem with the DHCP servers on the network. He suspects that there are DHCP servers configured with scopes that overlap, resulting in two DHCP servers assigning the same IP addresses to different clients. He is worried that they are about to receive a flood of calls reporting the same problem. Alice reassures Ralph, telling him that it cannot be a DHCP problem, and that there must be two computers that are manually configured with the same IP address. How does Alice know this?
Because Windows computers check the routing table before accepting an IP address from a DHCP server
Because DHCP servers use DNS queries to check for duplicate IP addresses
Because DHCP clients use ARP broadcasts to check for duplicate IP addresses
Because it is only possible to have one DHCP server on a given subnet

A

Because DHCP clients use ARP broadcasts to check for duplicate IP addresses -
When a Dynamic Host Configuration Protocol (DHCP) client is offered an Internal Protocol (IP) address by a DHCP server, the client broadcasts Address Resolution Protocol (ARP) requests using that address before accepting it. If another computer on the local network is using the offered address, the computer responds to the ARP request, and the DHCP client declines the address. The DHCP server then offers another address. Domain Name Service (DNS) queries and routing table checks are not reliable means of checking for duplicate IP addresses. It is possible to have two DHCP servers on the same local network, but they must be configured with scopes that do not overlap.

337
Q

A user, Ed, is reporting what appear to be intermittent traffic interruptions on his workstation. Sometimes he receives responses to his server requests, and sometimes not. It does not seem to be an Internet issue, because the problem also occurs with local server requests. While troubleshooting the problem, Ralph performs a series of packet captures and analyzes the network traffic. He discovers that all of the request messages generated by Ed’s workstation have responses on the network, but in some cases, the responses are going to a workstation other than Ed’s. Which of the following conditions could be causing this to happen?
Duplicate IP addresses
Blocked TCP/UDP ports
Duplicate MAC addresses
Incorrect host firewall settings
Multicast flood

A

Duplicate MAC addresses - If someone on the network is spoofing the Media Access Control (MAC) address of Ed’s workstation, the MAC address table in the switch handing the network traffic might be continually changing as packets from each computer reach the switch. This could cause some of the response packets to be forwarded to Ed’s workstation and some to the spoofer’s workstation. Duplicate IP addresses would not cause this problem, because they would be detected by the operating system. Blocked Transmission Control Protocol/User Datagram Protocol (TCP/UDP) ports, incorrect firewall settings, or a flood of multicast transmissions could prevent Ed from receiving responses, but they would not be sent to another workstation.

338
Q

Ralph has installed a new Category 5e (Cat 5e) cable run himself. He has attached keystone connectors to both ends of the cable, mounted the office-side connector to a wall plate, and mounted the datacenter connector into a patch panel. Then he took a patch cord and connected the patch panel port to an open port in one of the network switches. However, the Light-Emitting Diode (LED) on the switch port does not light. What should Ralph do?
Repull the cable run using Category 6 cable
Check the cable run for wiring faults
Make sure the switch port is not disabled
Plug a computer into the wall plate

A

For the link pulse LED on the switch port to light up, there must be a completed connection between the switch and a computer at the other end. None of the other options will cause the LED to light.

339
Q
A