Network Troubleshooting and Tools (7) Flashcards
Ralph has a wired home network with three Windows computers, a switch, and a cable modem/router that provides access to the Internet. All three computers are able to access the Internet, but none of them can access file system shares on the others. Which of the following is the most likely cause of the problem on the three network computers?
Incorrect IP addresses
Incorrect Subnet mask
Incorrect ACL settings
Incorrect ACL settings
he problem is most likely incorrect ACL settings. Because the computers are all able to access the Internet, their TCP/IP settings, including their IP addresses, subnet mask, and default gateway address, must be correct. However, if the users do not have the correct permissions in the access control lists (ACLs) of the file system shares, they will not be able to access the shares over the network
Alice has been asked to update an accounts receivable spreadsheet with information about the day’s incoming payments, a task she has never performed before. After locating and opening the spreadsheet on the network server, she types in her new information, but when she attempts to save the changes, she receives an error message that directs her to save the file on her local drive instead of the network server. Which of the following is the probable cause of the problem?
Blocked TCP/UDP ports
Incorrect filesystem ACL settings
Incorrect firewall settings
Incorrect filesystem ACL settings
Because Alice is able to access the server and open the spreadsheet file, the problem is not related to blocked ports, firewall settings, or an untrusted certificate. The problem is most likely that though she has the necessary filesystem access control list (ACL) permissions to open and read the file, she does not have the permissions needed to modify it
Ralph is a network administrator attempting to use his workstation to remote into a web server called WebServ1 on the perimeter network. However, the remote desktop client software is unable to establish a connection to the server. Ralph can see all of the computers on his local network and on the perimeter network. He tries using the ping utility to test the WebServ1’s TCP/IP functionality, and the ping test is successful. Ralph then calls his colleague Ed and has him try to connect to WebServ1 using the same remote access tool. Ed connects successfully. Which of the following could be the cause of the problem Ralph is experiencing?
Unresponsive service on the web server
Blocked TCP/UDP ports on the web server
Incorrect firewall settings on Ralph’s workstation
Incorrect firewall settings on Ralph’s workstation
Because Ed can connect to WebServ1 successfully, the problem is not an unresponsive service or blocked ports on the server. The problem is not a name resolution failure because Ralph can successfully ping WebServ1 by name. Therefore, of the options listed, the only possible problem must be that the firewall on Ralph’s workstation is not configured to allow the remote desktop client’s traffic out
A user calls the company’s IT help desk to report that she has received an error message on her Windows workstation. The error states that her computer has an IP address that is duplicated on the network. Ralph is concerned that there might be a configuration problem with the DHCP servers on the network. He suspects that there are DHCP servers configured with scopes that overlap, resulting in two DHCP servers assigning the same IP addresses to different clients. He is worried that they are about to receive a flood of calls reporting the same problem. Alice reassures Ralph, telling him that it cannot be a DHCP problem and that there must be two computers that are manually configured with the same IP address. How does Alice know this?
Because Windows computers check the routing table before accepting an IP address from a DHCP server
Because DHCP servers use DNS queries to check for duplicate IP addresses
Because DHCP clients use ARP broadcasts to check for duplicate IP addresses
Because DHCP clients use ARP broadcasts to check for duplicate IP addresses
When a Dynamic Host Configuration Protocol (DHCP) client is offered an IP address by a DHCP server, the client broadcasts Address Resolution Protocol (ARP) requests using that address before accepting it. If another computer on the local network is using the offered address, the computer responds to the ARP request and the DHCP client declines the address. The DHCP server then offers another address. DNS queries and routing table checks are not reliable means of checking for duplicate IP addresses. It is possible to have two DHCP servers on the same local network, but they must be configured with scopes that do not overlap
A user, Ed, is reporting what appear to be intermittent traffic interruptions on his workstation. Sometimes he receives responses to his server requests, and sometimes not. It doesn’t seem to be an Internet issue, because the problem also occurs with local server requests. While troubleshooting the problem, Ralph performs a series of packet captures and analyzes the network traffic. He discovers that all of the request messages generated by Ed’s workstation have responses on the network, but in some cases, the responses are going to a workstation other than Ed’s. Which of the following conditions could be causing this to happen?
Duplicate IP addresses
Blocked TCP/UDP ports
Duplicate MAC addresses
Duplicate MAC addresses
If someone on the network is spoofing the MAC address of Ed’s workstation, the MAC address table in the switch handing the network traffic might be continually changing as packets from each computer reach the switch. This could cause some of the response packets to be forwarded to Ed’s workstation and some to the spoofer’s workstation. Duplicate IP addresses would not cause this problem because they would be detected by the operating system. Blocked ports and incorrect firewall settings could prevent Ed from receiving responses, but they would not be sent to another workstation
A user calls Alice at the IT help desk and reports that she is having intermittent problems accessing both local servers and Internet websites. Which of the following potential problems can Alice rule out immediately?
Duplicate MAC addresses
Duplicate IP addresses
Malfunctioning router
Duplicate IP addresses
Operating systems detect duplicate IP addresses immediately and display error messages or notifications on the computers involved. Therefore, the user with the problem would have been informed immediately if another system was using her IP address. All of the other options are possible causes of the problem that are more difficult to troubleshoot
The entire network at Adatum Corp. is unable to access the Internet. All of the users throughout the network are complaining that their browsers are displaying DNS failure messages. The company does not have an in-house network administrator, so they call Ralph at his consulting firm. Which of the following should be the first question that Ralph asks in his attempt to pinpoint the location of the malfunction?
What browser are the users running?
Where is the DNS server located?
What technology is used to provide access to the Internet?
Where is the DNS server located?
The users’ browsers are failing to resolve the host names of the requested web sites into IP addresses, which they must do before they can connect to the web servers. By asking where the company’s DNS server is located, Ralph can determine if the problem is the DNS server itself or the router that provides access to the Internet. If the DNS server is located on Adatum’s company network, then the DNS server could be failing to resolve the website names. However, the DNS server could be located on the Internet service provider’s network, in which case the problem might be in the router that provides access to the ISP’s network
Ed has recently discovered a rogue DHCP server on his network. After disabling the server, he now needs to terminate all of the rogue IP address leases currently held by DHCP clients on the network and have them request new leases from the authorized DHCP server. Which of the following commands must he use on each client to do this? (Choose all correct answers.)
ipconfig /dump
ipconfig /renew
ipconfig /lease
ipconfig /discard
ipconfig /release
ipconfig /renew
ipconfig /release
The ipconfig /release command terminates the current DHCP address lease. Then, the ipconfig /renew causes the client to begin the process of negotiating a new lease, this time with an authorized DHCP server. Dump, lease, and discard are not valid ipconfig parameters
Ed is implementing a web server farm on his company’s network and has created a perimeter network on which the web servers will be located. The perimeter network is using the network IP address 192.168.99.0/24. He has also installed a router connecting the perimeter network to the internal network, which uses the 192.168.3.0/24 network address. The IP addresses of the router’s interfaces are 192.168.3.100 and 192.168.99.1. Ed needs to access the web servers from his Windows workstation on the internal network, but right now, he cannot do so. Because he needs to have a different router specified as his default gateway, Ed decides to add a route for the perimeter network to his computer’s routing table. Which of the following commands will create a routing table entry that enables Ed to access the perimeter network?
route add 192.168.99.0 MASK 255.255.255.0 192.168.3.100
route add 192.168.3.0 MASK 255.255.255.0 192.168.3.100
route add 192.168.99.1 MASK 255.255.255.0 192.168.3.0
route add 192.168.99.0 MASK 255.255.255.0 192.168.3.100
The correct syntax for the Windows route add command is to specify the destination network address, followed by the subnet mask for the destination network, followed by the address of the router interface on the local network that provides access to the destination network. The other options do not specify the correct addresses in the syntax
Alice has recently created a new perimeter network for the company’s web server cluster, along with a router to connect it to the internal network. When she is finished, she sends Ralph an email instructing him to run the following command on his Windows workstation so that he can access the servers on the perimeter network. What function does the IP address 192.168.87.226 perform in this command?
route add 192.168.46.0 MASK 255.255.255.0 192.168.87.226
- 168.87.226 is the address of Ralph’s workstation.
- 168.87.226 is the network address of the perimeter network.
- 168.87.226 is the address of one of the router’s interfaces.
192.168.87.226 is the address of one of the router’s interfaces.
The correct syntax for the Windows route add command is to specify the destination network address, followed by the subnet mask for the destination network, followed by the address of the router interface on the local network that provides access to the destination network. Therefore, 192.168.87.226 is the address of the router interface on the internal network, where Ralph’s workstation is located
To save the company money and to provide some new hires with Gigabit Ethernet connectivity, Ralph has installed some new Category 5e cable runs, connecting his company’s datacenter with a newly rented office at the far end of the building. However, the new users are complaining of intermittent connectivity problems. The company brings in a cabling contractor to investigate, and his diagnosis is attenuation. Which of the following solutions will most likely be a sure solution to the problem?
Repull the runs using Category 6 cable.
Shorten the cable runs.
Configure the hardware to run at a slower speed.
Shorten the cable runs.
Attenuation is the weakening of the signals as they traverse the network medium. In this case, it is most likely the result of cable runs that exceed the 100 meter maximum defined in the Ethernet twisted pair specification. Therefore, shortening the cable runs will be likely to solve the problem. All of the Ethernet twisted pair specifications have a 100 meter maximum length, so running the network at a slower speed, installing a higher grade cable, and installing higher end network adapters might have no effect if the runs are overly long
Alice’s network has been experiencing intermittent service slowdowns and outages ever since the company moved into their new building. She has tried every troubleshooting procedure she can think of and hasn’t been able to determine the cause. One particularly irritating user, hoping to be the squeaky wheel that gets the grease, has taken to calling Alice every time he experiences a problem. One day, as she is working in the datacenter, Alice notices that the user calls her every time she hears an additional humming noise begin. After examining the doors in the hallway, Alice realizes that the racks containing her switches are located right next to the elevator machinery room. Which of the following conditions is probably causing the network communication problem?
EMI
NEXT
FEXT
Attenuation
EMI
Elevator machinery, fluorescent light fixtures, and other electrical devices in an office environment can generate magnetic fields, resulting in electromagnetic interference (EMI). When copper-based cables are located too near to such a device, the magnetic fields can generate an electric current on the cable that interferes with the signals exchanged by network devices. If the network users experience a problem every time the elevator machinery switches on, EMI is a likely cause of the problem. Near end crosstalk (NEXT), far end crosstalk (FEXT), and attenuation can all cause intermittent network communication problems, but they cannot be caused by elevator machinery
Ralph is setting up a workstation for the company’s new vice president. He has installed the computer in the VP’s office and plugged it into the wall plate. Then, back in the datacenter, he uses a patch cable to connect the corresponding port in the patch panel to a port in the network switch. However, the computer is unable to access the network. There are no complaints from other users. Which of the following could be the source of the problem? (Choose all correct answers.)
The DNS server is malfunctioning.
The switch port is disabled.
The NAT server is not functioning.
The switch is configured to use port security.
The switch port is disabled.
The switch is configured to use port security.
It is common practice on many networks to disable switch ports that are not in use so that unauthorized individuals can’t plug devices into them. Some networks also use port security, in which switches are configured with access control lists (ACLs) that specify the MAC addresses of devices that are permitted to use them. Either of these could be the source of Ralph’s problem. Because there are no other network users reporting problems, malfunctioning services such as NAT and DNS are not likely to be the cause
Ed has configured his workstation to use IPsec encryption for network communications. Which of the following tools can he use to verify that his network traffic is encrypted?
Packet sniffer
Port scanner
Protocol analyzer
Protocol analyzer
A protocol analyzer is a tool that enables a user to view the contents of packets captured from a network. In Ed’s case, if IPsec is properly implemented, he should be able to see that the data in packets captured from his workstation is encrypted. A packet sniffer is a tool that captures packets for the purpose of traffic analysis, but cannot view their contents. In practice, however, packet sniffer and protocol analyzer capabilities are usually integrated into a single tool. A port scanner examines a system, looking for open TCP and UDP ports, and a multimeter is a tool that reads voltages on electrical circuits. Neither of these tools can examine packet contents
Which of the following statements describes the difference between a packet sniffer and a protocol analyzer?
A packet sniffer captures network traffic, and a protocol analyzer examines packet contents.
A protocol analyzer captures network traffic, and a packet sniffer examines packet contents.
A packet sniffer only captures the local workstation’s traffic, whereas a protocol analyzer can capture all the traffic on the network.
A packet sniffer captures network traffic, and a protocol analyzer examines packet contents.
A packet sniffer is a tool that captures packets for the purpose of traffic analysis, but cannot view their contents. A protocol analyzer is a tool that enables a user to view the contents of packets captured from a network. In practice, however, packet sniffer and protocol analyzer capabilities are usually integrated into a single tool. Both tools can function in promiscuous mode to capture packets from an entire network
