Test 0

Question 1

1. Alexander needs to set up two public-facing web servers and ensure that an attacker cannot access its intranet if those servers are compromised. Which of the following should he use?
   a) EAP
   B) DMZ
   C) VNC
   D) VPN

Answer 1

B. DMZ
Explanation
OBJ-4.1: A DMZ or demilitarized zone is a physical or logical subnetwork that contains and exposes an organization’s external-facing (public-facing) services to an untrusted, usually larger, network such as the Internet. A DMZ is a type of screen subnet. A virtual private network extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. The Extensible Authentication Protocol (EAP) is a protocol for wireless networks that expands the authentication methods used by the Point-to-Point Protocol (PPP), a protocol often used when connecting a computer to the internet. Virtual Network Computing is a graphical desktop-sharing system that uses the Remote Frame Buffer protocol to remotely control another computer by transmitting the keyboard and mouse input from one computer to another, relaying the graphical-screen updates, over a network. Since Alexander wants to install two public-facing web servers on his network, he should place them in the DMZ.

Question 2

2. A company has just installed a VoIP system on its network. Before the installation, all of the switches were replaced with layer 3 multilayer switches to allow for the VoIP devices to be placed on separate VLANs and have the packets routed accurately between them. What type of network segmentation technique is this an example of?
   A) COMPLIANCE ENFORCEMENT
   B) SEPERAT PUBLIC/ PRIVATE NETWORKING
   C) PERFORMANCE OPTIMIZATION
   D) HONEYNET IMPLEMENTATION

Answer 2

C. PERFORMANCE OPTIMIZATION
Explanation
OBJ-4.1: Voice over Internet Protocol (VoIP) performance optimization can help a business improve the quality of its video and audio communications over the Internet by decreasing the size of the broadcast domain through the creation of VLANs. Each VLAN can contain the VoIP devices for a single department or business unit, and traffic is routed between the VLANs using layer 3 multilayer switches to increase the performance of the voice communication systems. Performance optimization helps companies bolster the availability, accessibility, security, and overall performance of their networks. Compliance enforcement involves dividing up one network into smaller sections to better control the flow of traffic across the network and to restrict confidential data to a specific network segment based on a specific regulation or contractual requirement, such as PCI DSS segmentation requirements. A honeynet is an intentionally vulnerable network segment that is used to observe and investigate the attack techniques of a hacker or adversary. Separate public/private networking involves segmenting the network into two portions: public and private. This is often used in cloud architectures to protect private data.

Question 3

3. Dion Training has just purchased a new domain name and needs to indicate which DNS server is the definitive information source for the domain. Which type of DNS record should be created?
   A) AAAA
   B) A
   C) MX
   D) SOA

Answer 3

D. SOA
Explanation
OBJ-1.6: A Start of Authority (SOA) resource record indicates which Domain Name Server (DNS) is the best source of information for the specified domain. An AAAA record associates your domain name with an IPv6 address. An A record associates your domain name with an IPv4 address. An MX record is used for outgoing (SMTP) and incoming (POP3/IMAP) traffic.

Question 4

4. You have been asked to select the best WAN connection for a new network at Dion Training. The company has stated that they must have a guaranteed throughput rate on their Internet connection at all times. Based on this requirement, what type of WAN connection should you recommend?
   A) CABLE BROADBAND
   B) DSL
   C) DIAL-UP
   D) T-1

Answer 4

D. T-1
Explanation
OBJ-1.2: A T-1 connection provides a guaranteed 1.544 Mbps of throughput. Dial-up, DSL, and cable broadband do not provide a guaranteed throughput rate. Instead, these services provide a variable throughput rate based on network conditions and demand in the area of your business.

Question 5

5. You run the command ipconfig on your laptop and see that you have been assigned an IP address of 169.254.0.56. Which category of IPv4 address is this?
   A) APIPA
   B) PRIVATE
   C) PUBLIC
   D) STATIC

Answer 5

A. APIPA
Explanation
OBJ-1.4: APIPA stands for Automatic Private IP Addressing and is a feature of Windows operating systems. When a client computer is configured to use automatic addressing (DHCP), APIPA assigns a class B IP address from 169.254.0.0 to 169.254.255.255 to the client if the DHCP server is unavailable. A static IP address is used when the DHCP server is disabled and clients are configured manually to join the network properly. A public IP address is the outward-facing (public-facing) IP address assigned to a client. A private IP address lets a router correctly direct traffic within its network and allows devices within a network to communicate with one another, but private IP addresses cannot be used to route traffic across the internet.

Question 6

6. What describes an IPv6 address of ::1?
   A) MULTICAST
   B) PUBLIC
   C) BROADCAST
   D) LOOPBACK

Answer 6

D. LOOPBACK
Explanation
OBJ-1.4: In IPv6, ::1 is the loopback address. In IPv4, the loopback address is 127.0.0.1. The loopback address is used to send a test signal sent to a network destination to diagnose problems. A broadcast address is an IP address that is used to target all systems on a specific subnet network instead of single hosts. A multicast address is a logical identifier for a group of hosts in a computer network that are available to process datagrams or frames intended to be multicast for a designated network service. The address shown is not a broadcast or multicast address. A public address is routable over the internet but ::1 is a loopback address and therefore not publicly routable on the internet.

Question 7

7. What is the broadcast address associated with the host located at 10.10.10.200/25?
   A) 10.10.10.128
   B) 10.10.10.254
   C) 10.10.10.127
   D) 10.10.10.255

Answer 7

D. 10.10.10.255
Explanation
OBJ-1.4: In classless subnets using variable-length subnet mask (VLSM), the broadcast address is the last IP address associated within an assigned range. In this example, the CIDR notation is /25, so each subnet will contain 128 IP addresses. Since the IP address provided is 10.10.10.200, the broadcast address will be 10.10.10.255.

Question 8

8. Mathan has just purchased a domain name and created an A record to bind his domain name to an IP address. Which of the following tools should he use to verify the record was created properly?
   A) ARP
   B) TCPDUMP
   C) IPCONFIG
   D) DIG

Answer 8

D. DIG
Explanation
OBJ-5.3: The dig command is used to query the domain name system (DNS) to obtain information about host addresses, mail exchanges, nameservers, and related information. The arp command is used to view and modify the local address resolution protocol (ARP) cache of a device, which contains recently resolved MAC addresses of IP hosts on the network. The tcpdump tool is a text-based packet capture and analysis tool that can capture packets and display the contents of a packet capture (pcap) file. The ipconfig command is used on Windows devices to display the current TCP/IP network configuration and refresh the DHCP and DNS settings on a given host.

Question 9

9. Which of the following is a security concern with using a cloud service provider and could result in a data breach caused by data remnants?
   A) ON-DEMAND
   B) METERED SERVICES
   C) RAPID ELASTICITY
   D) RESOURCE POOLING

Answer 9

C. RAPID ELASTICITY
Explanation
OBJ-1.8: Rapid elasticity can be a security threat to your organization’s data due to data remanences. Data remanence is the residual representation of digital data that remains even after attempts have been made to remove or erase it. So, when a cloud resource is deprovisioned and returned to the cloud service provider, it can be issued to another organization for use. If the data was not properly erased from the underlying storage, it could be exposed to the other organization. For this reason, all cloud-based storage drives should be encrypted by default to prevent data remanence from being read by others. Metered services are pre-paid, a-la-carte, pay-per-use, or committed offerings. A metered service like a database may charge its users based on the actual usage of the service resources on an hourly or monthly basis. For example, Dion Training used the AWS Lambda serverless product in some of our automation. This service charges us $0.20 for every 1 million requests processed. Resource pooling refers to the concept that allows a virtual environment to allocate memory and processing capacity for a VMs use. On-demand refers to the fact that a consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider.

Question 10

10. A network technician wants to centrally manage the switches and segment the switches into separate broadcast domains. The Dion Training network is currently using VLAN 1 for all of its devices and uses a single private IP address range with a 24-bit mask. Their supervisor wants VLAN 100 to be the management subnet and all of the switches must share VLAN information. Which of the following should the technician configure to meet these requirements?
    A) CONFIGURE VLSM FOR THE IP ADDRESS RANGE
    B) CONFIGURE STP AND 802.1Q ON THE INTER-SWITCH CONNECTIONS WITH NATIVE VLAN 100
    C) CONFIGURE VTP AND 802.1X ON ALL INTER-SWITCH CONNECTIONS WITH NATIVE VLAN 100
    D) CONFIGURE STP AND 802.1W ON THE INTER-SWITCH CONNECTIONS WITH NATIVE VLAN 100
    E) CONFIGURE VTP AND 802.1Q ON THE INTER-SWITCH CONNECTIONS WITH NATIVE VLAN 100

Answer 10

E. CONFIGURE VTP AND 802.1Q ON THE INTER-SWITCH CONNECTIONS WITH NATIVE VLAN 100
Explanation
OBJ-2.2: The 801.q standard is used to define VLAN tagging (or port tagging) for Ethernet frames and the accompanying procedures to be used by bridges and switches in handling such frames. Traffic should be properly tagged when combined over a single trunk port to ensure they are not sent to the wrong VLAN by mistake. If VLAN tagging is not enabled, all of the VLAN traffic will be sent to the native or default VLAN, VLAN 1. By default, VLAN 1 is enabled and all unused ports are assigned to it. VLSM stands for Variable Length Subnet Mask where the subnet design uses more than one mask in the same network which means more than one mask is used for different subnets of a single class A, B, or C network. The Spanning Tree Protocol (STP) is a network protocol that builds a loop-free logical topology for Ethernet networks to prevent bridge loops and the broadcast storms that result from them. STP is defined in the IEEE 802.1d standard and Rapid Reconfiguration of Spanning Tree is defined in the IEEE 802.1w standard. The IEEE 802.1x standard is a network authentication protocol that opens ports for network access when an organization authenticates a user’s identity and authorizes them for access to the network. This defines port security. The user’s identity is determined based on their credentials or certificate, which is confirmed by the RADIUS server.

Question 11

11. You have been assigned to assist with deploying a new web-based application to your company’s intranet. After installing the application, it was identified that the database server is becoming overloaded by the number of requests that the users create. The team lead has proposed adding a device between the web server and the database server to alleviate the issue. Which of the following is being implemented by adding this new device?
    A) CONDUCT CONTENT FILTERING AND NETWORK ANALYSIS
    B) IMPLEMENT LOAD BALANCING AND PROVIDE HIGH AVAILABILITY
    C) IMPLEMENT CLUSTERING AND NIC TEAMING ON THE DATABASE SERVER
    D) CONDUCT PORT SNIFFING AND PROTOCOL ANALYSIS

Answer 11

B. IMPLEMENT LOAD BALANCING AND PROVIDE HIGH AVAILABILITY
Explanation
OBJ-3.3: The device being added is most likely a load balancer. Adding this device will allow the delivery team to install a series of database servers to handle the requests by dividing the incoming requests among the various servers. NIC teaming would be an action that occurs on the database server itself. It is not a separate device. The other options are focused on troubleshooting efforts, not increasing the database server’s capability or availability.

Question 12

12. A client reports that half of the office is unable to access a shared printer on the network. Which of the following should the network technician use to troubleshoot the issue?
    A) NETWORK DIAGRAMS
    B) DATA BACKUPS
    C) BASELINE INFORMATION
    D) VENDOR DOCUMENTATION

Answer 12

A) NETWORK DIAGRAMS
Explanation
OBJ-3.2: Network diagram is a visual representation of a computer network. Understanding all the connections is a fundamental step in network troubleshooting. A baseline is a process for studying the network at regular intervals to ensure that the network is working as designed. This baseline information can be used for anticipating future problems, as well as planning for future growth. Data backups are a copy of the data on your system that you use for recovery in case your original data is lost or corrupted. Vendor documentation is a group of documents supplied by the manufacturer that document the proper usage and configuration of a network device.

Question 13

13. You need to connect your laptop to a router in order to add a static route. What type of cable would you use to connect to the router’s console port?
    A) STRAIGHT-THROUGH
    B) RG-6
    C) CROSSOVER
    D) ROLLOVER

Answer 13

D) ROLLOVER
Explanation
OBJ-5.2: Typically, a router or switch’s console port is connected using a rollover cable, which has an RS-232 (DB-9) port on one side and an RJ-45 on the other. A rollover or console cable is a type of null-modem cable that is used to connect a computer terminal to a router’s console port. An RG-6 cable is a coaxial cable used to connect to a cable modem or television. An Ethernet crossover cable is a network cable used to connect two Ethernet network devices directly, such as two computers without a switch or router in between. A straight-through cable is a type of twisted pair cable that is used in local area networks to connect a computer to a network switch.

Question 14

14. Dion Training wants to purchase an email marketing solution to better communicate with their students. A promising new startup has a new offering to provide access to their product from a central location rather than requiring Dion Training to host the product on their internal network. Dion Training wants to ensure that their sensitive corporate information is not accessible by any startup’s other clients. Which type of cloud server should Dion Training look to purchase to meet these needs?
    A) HYBRID IAAS
    B) PUBLIC SAAS
    C) COMMUNITY IAAS
    D) PRIVATE SAAS

Answer 14

D) PRIVATE SAAS
Explanation
OBJ-1.8: SaaS (Software as a Service) is a cloud model whereby a service provider provides a software service and makes the service available to customers over the Internet. Examples of SaaS solutions include Microsoft Office 365, Microsoft Exchange Online, and Google Docs. Because of the concerns with sensitive corporate information being processed by the SaaS, Dion Training should ensure a Private SaaS is chosen. A private cloud is a particular model of cloud computing that involves a distinct and secure cloud-based environment in which only the specified client (Dion Training in this case) can operate. A public cloud contains services offered by third-party providers over the public Internet and is available to anyone who wants to use or purchase them. They may be free or sold on-demand, allowing customers to pay only per usage for the CPU cycles, storage, or bandwidth they consume. A community cloud is a collaborative effort in which infrastructure is shared between several organizations from a specific community with common concerns (security, compliance, jurisdiction, etc.), whether managed internally or by a third-party and hosted internally or externally. A hybrid cloud uses a mix of on-premises, private cloud, and third-party, public cloud services with orchestration between these platforms. This typically involves a connection from an on-premises data center to a public cloud.

Question 15

15. Which of the following provides a standard nomenclature for describing security-related software flaws?
    A) VPC
    B) SIEM
    C) CVE
    D) SOX

Answer 15

C) CVE
Explanation
OBJ-4.1: Common Vulnerabilities and Exposures (CVE) is an element of the Security Content Automation Protocol (SCAP) that provides a standard nomenclature for describing security flaws or vulnerabilities. A SIEM is a solution that provides a real-time or near-real-time analysis of security alerts generated by network hardware and applications. A VPC is a private network segment made available to a single cloud consumer on a public cloud. The Sarbanes-Oxley Act (SOX) dictates requirements for storing and retaining documents relating to an organization’s financial and business operations, including the type of documents stored and their retention periods.

Question 16

16. Your boss is looking for a recommendation for a cloud solution that will only allow your company’s employees to use the service while preventing anyone else from accessing it. What type of cloud model would you recommend to ensure the contents are best secured from those outside your company?
    A) COMMUNITY CLOUD
    B) PRIVATE CLOUD
    C) HYBRID CLOUD
    D) PUBLIC CLOUD

Answer 16

B) PRIVATE CLOUD
Explanation
OBJ-1.8: A private cloud service would be the best recommendation to protect and secure the services from those outside the company from accessing its contents. The private cloud is defined as computing services offered either over the Internet or a private internal network and only to select users instead of the general public. Private cloud computing gives businesses many of the benefits of a public cloud including self-service, scalability, and elasticity with the additional control and customization available from dedicated resources over a computing infrastructure hosted on-premises. Private clouds also deliver a higher level of security and privacy through both company firewalls and internal hosting to ensure operations and sensitive data are not accessible to third-party providers. A public cloud contains services offered by third-party providers over the public Internet and is available to anyone who wants to use or purchase them. They may be free or sold on-demand, allowing customers to pay only per usage for the CPU cycles, storage, or bandwidth they consume. A public cloud contains services offered by third-party providers over the public Internet and is available to anyone who wants to use or purchase them. They may be free or sold on-demand, allowing customers to pay only per usage for the CPU cycles, storage, or bandwidth they consume. A community cloud is a collaborative effort in which infrastructure is shared between several organizations from a specific community with common concerns (security, compliance, jurisdiction, etc.), whether managed internally or by a third party and hosted internally or externally.

Question 17

17. Which of the following levels would an alert condition generate?
    A) 2
    B) 0
    C) 3
    D) 1

Answer 17

D) 1
Explanation
OBJ-3.1: The severity levels range from zero to seven, with zero being the most severe and seven being the least severe. Level 0 is used for an emergency and is considered the most severe condition because the system has become unstable. Level 1 is used for an alert condition and means that there is a condition that should be corrected immediately. Level 2 is used for a critical condition, and it means that there is a failure in the system’s primary application and it requires immediate attention. Level 3 is used for an error condition, and it means that something is happening to the system that is preventing the proper function. Level 4 is used for warning conditions and it may indicate that an error will occur if action is not taken soon. Level 5 is used for notice conditions and it means that the events are unusual, but they are not error conditions. Level 6 is used for information conditions and it is a normal operational message that requires no action. Level 7 is used for debugging conditions and is just information that is useful to developers as they are debugging their networks and applications.

Question 18

18. Which of the following protocols are designed to avoid loops on a Layer 2 network?
    A) 802.1D
    B) 802.1Q
    C) OSPF
    D) RIPv2

Answer 18

A) 802.1D
Explanation
OBJ-2.3: The Spanning Tree Protocol is part of the 802.1d standard and avoids loops in the switching network (layer 2). The 802.1q standard is used to define virtual LANs (VLANs) on an ethernet network. RIPv2 is a layer 3 distance-vector protocol for local and wide-area networks, and does not prevent or avoid loops by default. Open Shortest Path First (OSPF) is a layer 3 link-state routing protocol that was developed for IP networks and is based on the Shortest Path First (SPF) algorithm. OSPF does not avoid or prevent loops by default. Instead, RIP and OSPF both rely on split horizon and route poisoning to avoid layer 3 loops.

Question 19

19. Your company has purchased a new office building down the street for its executive suites. You have been asked to choose the BEST encryption for AP1, AP2, and AP3 to establish a wireless connection inside the main building for visitors to use. Your boss has stated that the main building’s internal wireless network is only going to be used by visitors and should not require the visitors to set up any special configuration on their devices to connect. Which of the following is the BEST encryption to use from the options below to meet your manager’s requirements for the new visitors’ Wireless Network?

A) WPA
B) WEP
C) WPA-CCMP
D)WPA2-TKIP
E) OPEN

Answer 19

E) OPEN
Explanation
OBJ-5.4: Since your manager has required that the visitors not be required to configure anything on their devices to connect, the only option you can choose is Open. This option presents no security for the visitor’s wireless network, but it also requires no setup on the user’s devices. All of the other options would require a pre-shared key and set up to allow the visitor to use the network. This wireless network should act as a guest network, be segmented from your corporate network, and only allow the visitors to access the internet directly using this network.

Question 20

20. Which of the following policies or plans would dictate how an organization would respond to an unplanned outage of their primary internet connection?
    A) INCIDENT RESPONSE PLAN
    B) BUSINESS CONTINUITY PLAN
    C) SYSTEM LIFE CYCLE PLAN
    D) DISASTER RECOVERY PLAN

Answer 20

B) BUSINESS CONTINUITY PLAN
Explanation
OBJ-3.2: A business continuity plan is a document that outlines how a business will continue operating during an unplanned service disruption. A business continuity plan is more comprehensive than a disaster recovery plan and contains contingencies for business processes, assets, human capital and business partners, and essentially every other aspect of the business that might be affected. A disaster recovery plan is a documented, structured approach that documents how an organization can quickly resume work after an unplanned incident. These unplanned incidents include things like natural disasters, power outages, cyber attacks, and other disruptive events. An incident response plan contains a set of instructions to help our network and system administrators detect, respond to, and recover from network security incidents. These types of plans address issues like cybercrime, data loss, and service outages that threaten daily work. System life cycle plans, also known as life cycle planning, describe the approach to maintaining an asset from creation to disposal. In the information technology world, we normally have a 5-phase lifecycle that is used for all of our systems and networks: Planning, Design, Transition, Operations, and Retirement.

Question 21

21. Which of the following policies or plans would dictate the complexity requirements for a wireless network’s shared secret key?
    A) REMOTE ACCESS POLICY
    B) ACCEPTABLE USE POLICY
    C) PASSWORD POLICY
    D) DATA LOSS PREVENTION POLICY

Answer 21

C) PASSWORD POLICY
Explanation
OBJ-3.2: A password policy is a set of rules created to improve computer security by motivating users to create dependable, secure passwords and then store and utilize them properly. This document promotes strong passwords by specifying a minimum password length, complexity requirements, requiring periodic password changes, and placing limits on the reuse of passwords. An acceptable use policy (AUP) is a set of rules applied by the owner, creator, or administrator of a network, website, or service, that restrict how the network, website, or system may be used and sets guidelines as to how it should be used. A data loss prevention policy is a document that defines how organizations can share and protect data. It guides how data can be used in decision-making without it being exposed to anyone who should not have access to it. The goal of a data loss prevention policy is to minimize accidental or malicious data loss. A remote access policy is a document that outlines and defines acceptable methods of remotely connecting to the internal network.

Question 22

22. Which of the following network performance metrics is used to represent variable delay experienced by a client when receiving packets from a sender?
    A) JITTER
    B) BANDWIDTH
    C) LATENCY
    D) THROUGHPUT

Answer 22

A) JITTER
Explanation
OBJ-3.2: Jitter is a network condition that occurs when a time delay in the sending of data packets over a network connection occurs. Jitter is a big problem for any real-time applications you may be supporting on your networks, like video conferences, voice-over IP, and virtual desktop infrastructure clients. Latency is the measure of time that it takes for data to reach its destination across a network. Usually, we measure network latency as the round-trip time from a workstation to the distant end and back. Throughput is an actual measure of how much data is successfully transferred from the source to a destination. Bandwidth is the maximum rate of data transfer across a given network. Now, bandwidth is more of a theoretical concept that measures how much data could be transferred from a source to a destination under ideal conditions. Therefore, we often measure throughput, instead of bandwidth, to monitor our network performance.

Question 23

23. Which of the following policies or plans would dictate which type of virtual private network connections will be authorized for use by an organization’s employees?
    A) PASSWORD POLICY
    B) ACCEPTABLE USE POLICY
    C) DATA LOSS PREVENTION POLICY
    D) REMOTE ACCESS POLICY

Answer 23

D) REMOTE ACCESS POLICY
Explanation
OBJ-3.2: A remote access policy is a document which outlines and defines acceptable methods of remotely connecting to the internal network. A password policy is a set of rules created to improve computer security by motivating users to create dependable, secure passwords and then store and utilize them properly. This document promotes strong passwords by specifying a minimum password length, complexity requirements, requiring periodic password changes, and placing limits on the reuse of passwords. An acceptable use policy (AUP) is a set of rules applied by the owner, creator, or administrator of a network, website, or service, that restrict the ways in which the network, website, or system may be used and sets guidelines as to how it should be used. A data loss prevention policy is a document that defines how organizations can share and protect data. It guides how data can be used in decision-making without it being exposed to anyone who should not have access to it. The goal of a data loss prevention policy is to minimize accidental or malicious data loss.

Question 24

24. Your company has decided to begin moving some of its data into the cloud. Currently, your company’s network consists of both on-premise storage and some cloud-based storage. Which of the following types of clouds is your company currently using?
    A) COMMUNITY
    B) PUBLIC
    C) PRIVATE
    D) HYBRID

Answer 24

D) HYBRID
Explanation
OBJ-1.8: A hybrid cloud is a cloud computing environment that uses a mix of on-premises, private cloud, and third-party public cloud services with orchestration between these platforms. This typically involves a connection from an on-premises data center to a public cloud. A community cloud is a collaborative effort in which infrastructure is shared between several organizations from a specific community with common concerns (security, compliance, jurisdiction, etc.), whether managed internally or by a third-party and hosted internally or externally. A public cloud contains services offered by third-party providers over the public Internet and is available to anyone who wants to use or purchase them. They may be free or sold on-demand, allowing customers to pay only per usage for the CPU cycles, storage, or bandwidth they consume. A private cloud contains services offered either over the Internet or a private internal network and only to select users instead of the general public.

Question 25

25. Today, your company’s network started to experience network connectivity issues for various workstations around the company. As you begin troubleshooting, you identify that all the workstations receive their connectivity from a single switch on the 3rd floor of the office building. You start searching the 3rd floor for the cause of this issue and find a small wired router plugged into a network jack in the sales manager’s office. From this small wired router, he has connected his workstation and a small Smart TV to watch Netflix while working. You question the sales manager about when he brought in the new router. He states that he just hooked it up this morning. What type of issue did the sales manager accidentally introduced into the network by installing the router?
    A) EVIL TWIN
    B) ROGUE DHCP SERVER
    C) VLAN MISMATCH
    D) SWITCHING LOOP

Answer 25

B) ROGUE DHCP SERVER
Explanation
OBJ-5.5: Routers usually contain their own DHCP servers. When the sales manager installed the wired router, he inadvertently introduced a secondary DHCP server into the network. This could cause the same IP addresses to be assigned to two different workstations, resulting in connectivity issues for those workstations. Had the sales manager installed a simple hub or switch, this would not have caused any issues. Because this is a wired router, it cannot be an evil twin since evil twins are wireless access points. We have no indications of a VLAN mismatch since this would only affect the workstations connected to this router. Similarly, we have no indications of a network loop, so this network might already be implementing STP to prevent them. Remember, always ask yourself, “what changed recently that might have caused this issue?” In this case, it was the new router added this morning by the sales manager.

Question 26

26. What is the network ID associated with the host located at 205.12.35.26/27?
    A) 205.12.35.48
    B) 205.12.35.32
    C) 205.12.35.0
    D) 205.12.35.16

Answer 26

C) 205.12.35.0
Explanation
OBJ-1.4: In classless subnets using variable length subnet mask (VLSM), the network ID is the first IP address associated within an assigned range. In this example, the CIDR notation is /27, so each subnet will contain 32 IP addresses. This means that there eight networks in this class C range: 205.12.35.0, 205.12.35.32, 205.12.35.64, 205.12.35.96, 205.12.35.128, 205.12.35.160, 205.12.35.196, and 205.12.35.224. Since the IP address provided is 205.12.35.26, it will be in the 205.12.35.0/27 network.

Question 27

27. You have just finished installing a small network consisting of a router, a firewall, and a single computer. The computer is connected to the firewall and the firewall is connected to the router. What type of physical network topology have you created in this scenario?
    A) STAR
    B) BUS
    C) RING
    D) MESH

Answer 27

B) BUS
Explanation
OBJ-1.2: As described, this network would resemble a physical bus network topology because the router connects directly to the firewall, and the firewall connects directly to the computer. This would form a single line (or bus) from one device to the next. A bus topology uses a single cable that connects all the included nodes and the main cable acts as a backbone for the entire network. A ring topology connects every device to exactly two other neighboring devices to form a circle. Messages in a ring topology travel in one direction and usually rely on a token to control the flow of information. A star topology connects all of the other nodes to a central node, usually a switch or a hub. A star topology is the most popular network topology in use on local area networks. A mesh topology connects every node directly to every other node. This creates a highly efficient and redundant network, but it is expensive to build and maintain.

Question 28

28. A technician has been troubleshooting a network problem, has determined the likely cause of the issue, and implemented a solution. What is the NEXT step they should perform according to the CompTIA troubleshooting methodology?
    A) TEST THE THEORY TO DETERMINE THE CAUSE
    B) DOCUMENT FINDINGS, ACTIONSM, OUTCOMES, AND LESSONS LEARNED
    C) ESTABLISH A PLAN OF ACTION TO RESOLVE THE PROBLEM
    D) VERIFY SYSTEM FUNCTIONALITY

Answer 28

D) VERIFY SYSTEM FUNCTIONALITY
Explanation
OBJ-5.1: The next step would be to “verify full system functionality and, if applicable, implement preventive measures” since you just finished the “implement a solution or escalate as necessary” step. The troubleshooting steps are to (1) Identify the problem, (2) Establish a theory of probable cause, (3) Test the theory to determine the cause, (4) Establish a plan of action to resolve the problem and identify potential effects, (5) Implement the solution or escalate as necessary, (6) Verify full system functionality and if applicable implement preventative measures, and (7) Document findings, actions, outcomes, and lessons learned.

Question 29

29. Which of the following weaknesses exist in WPS-enabled wireless networks?
    A) BRUTE FORCE OCCURS WITHIN 11000 COMBINATIONS
    B) UTILIZES TKIP TO SECURE THE AUTHENTICATION HANDSHAKE
    C) UTILIZES A 24-BIT INITIALIZATION VECTOR
    D) UTILIZES A 40-BIT ENCRYPTION KEY

Answer 29

A) BRUTE FORCE OCCURS WITHIN 11000 COMBINATIONS
Explanation
OBJ-2.4: The most prominent attack against WPS0-enabled wireless networks involves brute-forcing the 8-digit PIN that client uses to enroll their devices without knowing the pre-shared key. WPS checks each half of the PIN individually, reducing the number of possible combinations from a maximum of 100,000,000 to only 11,000. This only takes a few minutes to crack on most modern computers, as long as the WAP doesn’t have a lockout after a certain number of failures. The lockout mechanism may also be triggered based on the client’s MAC, so you can often spoof MAC to bypass this defense.

Question 30

30. Last night, your company’s system administrators conducted a server upgrade. This morning, several users are having issues accessing the company’s shared drive on the network. You have been asked to troubleshoot the problem. What document should you look at first to create a probable theory for the cause of the issue?
    A) RELEASE NOTES FOR THE SERVER SOFTWARE
    B) CHANGE MANAGEMENT DOCUMENTATION
    C) PHYSICAL NETWORK DIAGRAM
    D) CABLE MANAGEMENT PLAN

Answer 30

B) CHANGE MANAGEMENT DOCUMENTATION
Explanation
OBJ-3.2: Since everything worked before the server upgrade and doesn’t now, it would be a good idea to first look at the change management documentation that authorized the change/upgrade. This should include the specific details of what was changed and what things may have been affected by the change. This is the best place to start when determining what changed since yesterday. Change management is a systematic approach to dealing with the transition or transformation of an organization’s goals, processes, or technologies.

Question 31

31. Your company has just installed a brand new email server, but you determined that the server cannot send emails to another server during your initial testing. You decide to check the firewall’s ACL to see if the server’s outgoing email is being blocked. Which of the following ports should you ensure is open and not blocked by the firewall?
    A) 110
    B) 22
    C) 143
    D) 25

Answer 31

D) 25
Explanation
OBJ-1.5: The Simple Mail Transfer Protocol (SMTP) uses port 25 and is an internet standard communication protocol for electronic mail transmission. Internet Message Access Protocol (IMAP) uses port 143 and is an Internet standard protocol used by email clients to retrieve email messages from a mail server over a TCP/IP connection. Post Office Protocol version 3 (POP3) uses port 110 and is an application-layer Internet standard protocol used by e-mail clients to retrieve e-mail from a mail server. Secure Shell (SSH) uses port 22 to securely create communication sessions over the Internet for remote access to a server or system.

Question 32

32. In which type of non-technical attack does an attacker attempt to trick a user into providing sensitive information?
    A) ON-PATH
    B) EVIL TWIN
    C) BLUESNARFING
    D) SOCIAL ENGINEERING

Answer 32

D) SOCIAL ENGINEERING
Explanation
OBJ-4.2: Social engineering is the art of convincing people to reveal confidential information to the intruder. Bluesnarfing is the unauthorized access of information from a wireless device through a Bluetooth connection. Bluesnarfing is a technical exploit, not one that relies on tricking a user like social engineering would. An on-path attack, formerly known as a man-in-the-middle attack, is a technical method used by attackers to place themselves between a victim’s client and a server to intercept or modify communications between the two devices. This is another form of technical attack and it does not rely on tricking a user. An evil twin a rogue wireless access point that masquerades as a legitimate Wi-Fi access point so that an attacker can gather personal or corporate information without the user’s knowledge. An evil twin is another technical means of attack that could be combined with an on-path attack to collect sensitive information from a victim. The best answer, though, still is a social engineering attack since those manipulate and trick a user into directly providing sensitive information to an attacker.

Question 33

33. Dion Training’s corporate network appears to be suffering from a broadcast storm and you have been asked to assist in troubleshooting. You just arrived in the main distribution frame and see another technician looking at the equipment rack. What step of the troubleshooting methodology should you perform NEXT?
    A) TEST A THEORY TO DETERMINE THE CAUSE
    B) IDENTIFY THE PROBLEM
    C) ESTABLISH A THEORY OF PROBABLE CAUSE
    D) ESTABLISH A PLAN OF ACTION TORESOLVE THE PROBLEM

Answer 33

B) IDENTIFY THE PROBLEM
Explanation
OBJ-5.1: The troubleshooting steps are to (1) Identify the problem, (2) Establish a theory of probable cause, (3) Test the theory to determine the cause, (4) Establish a plan of action to resolve the problem and identify potential effects, (5) Implement the solution or escalate as necessary, (6) Verify full system functionality and if applicable implement preventative measures, and (7) Document findings, actions, outcomes, and lessons learned. Since you just arrived at the main distribution frame, you need to begin by identifying the problem. This could include gathering information, questioning users or the other technician, identifying symptoms, determining if anything has changed, or trying to duplicate the problem.

Question 34

34. While working as a security analyst, you have been asked to monitor the SIEM. You observed network traffic going from an external IP to an internal host’s IP within your organization’s network over port 443. Which of the following protocols would you expect to be in use?
    A) TLS
    B) SSH
    C) TFTP
    D) HTTP

Answer 34

A) TLS
Explanation
OBJ-4.4: Transport Layer Security (TLS) is used to secure web connections over port 443. Since port 443 was in use, you should expect either HTTPS, SSL, or TLS to be used as the protocol. If not, this would be suspicious activity and should be investigated. In fact, since this was a connection from the external IP to an internal host over port 443, this is suspicious and could be indicative of a remote access trojan on your host.

Question 35

35. After installing some new switches in your network, you notice that a switching loop has begun to occur. You contact the manufacturer’s technical support for your switches and they recommended that you enable 802.1d. Which of the following BEST represents why the manufacturer suggested this?
    A) THE SPANNING TREE PROTOCOL USES SPLIT HORIZON TO PREVENT LOOPS IN NETWORK TOPOLOGIES
    B) THE SPANNING TREE PROTOCOL USES BPDU TO DETECT LOOPS IN NETWORK TOPOLOGIES
    C) THE LINK AGGREGATION CONTROL PROTOCOL USES BPDU TO DETECT LOOPS IN NETWORK TOPOLOGIES
    D) THE LINK AGGREGATION CONTROL PROTOCOL USES SPLIT HORIZON TO PREVENT LOOPS IN NETWORK TOPOLOGIES

Answer 35

B) THE SPANNING TREE PROTOCOL USES BPDU TO DETECT LOOPS IN NETWORK TOPOLOGIES
Explanation
OBJ-2.3: The Spanning Tree Protocol (STP) is a network protocol that builds a loop-free logical topology for Ethernet networks to prevent bridge loops and the broadcast storms that result from them. The Spanning Tree Protocol operates at Layer 2 of the OSI model to detect switching loops. STP is defined in the IEEE 802.1d standard. The Link Aggregation Control Protocol (LACP) enables you to assign multiple physical links to a logical interface that will appear as a single link to a route processor. LACP is used to combine multiple network connections in parallel to increase throughput beyond what a single connection could sustain and to provide redundancy in case one of the links should fail. LACP is defined in the IEEE 802.3ad standard. Split horizon is used by routing protocols at layer 3 to prevent routing loops, and it does not affect switching loops.

Question 36

36. A network technician has just installed a new point-to-point 200-meter single-mode fiber link between two local routers within the Dion Training offices. The fiber has been connected to each router, but the interface fails to come up. The network technician has double-checked the interface configuration on both routers, both SFPs have been hard looped to confirm they are functioning, connectors on both ends of the links have been cleaned, and there is sufficient power. What is the MOST likely cause of the problem?
    A) WAVELENGTH MISMATCH
    B) DUPLEX MISMATCH
    C) DISTANCE LIMITATIONS
    D) WRONG IP ADDRESS

Answer 36

A) WAVELENGTH MISMATCH
Explanation
OBJ-5.2: Wavelength mismatch occurs when two different transceivers are used at each end of the cable. For example, if one SFP uses a 1310nm transceiver and the other end uses a 850 nm transceiver, they will be unable to communicate properly and the link will remain down. A duplex mismatch is a condition where two connected devices operate in different duplex modes, that is, one operates in half-duplex while the other one operates in full-duplex. The effect of a duplex mismatch is a link that operates inefficiently. All networking cables have a limited supported distance. For example, copper cables must be less than 100 meters. Single-mode fiber cables can be up to 40 kilometers, therefore the issue is not a distance limitation in this scenario. The link is established before an IP address is assigned by DHCP. In this scenario, the link is not being established, therefore it cannot be a wrong IP address being assigned to the interfaces.

Question 37

37. What ports do SMTP and SNMP utilize?
    A) 23,25
    B) 161, 443
    C) 25, 161
    D) 445, 3389

Answer 37

C) 25, 161
Explanation
OBJ-1.5: SMTP (Simple Mail Transfer Protocol) uses port 25. SNMP (Simple Network Management Protocol) uses port 161. Port 23 is used by Telnet. Port 445 is used by the Server Message Block (SMB) protocol. Port 3389 is used by the Remote Desktop Protocol (RDP). Port 443 is used by the Hypertext Transfer Protocol Secure (HTTPS). If this were a question on the real exam, you would see a list of ports on one side and a list of protocols on the other, and you would drag and drop each one to match them up.

Question 38

38. You have recently been hired as a security analyst at Dion Training. On your first day, your supervisor begins to explain the way their network is configured, showing you the physical and logical placement of each firewall, IDS sensor, host-based IPS installations, the networked spam filter, and the DMZ. What best describes how these various devices are placed into the network for the highest level of security?
    A) UTM
    B) NETWORK SEGMENTATION
    C) DEFENSE IN DEPTH
    D) LOAD BALANCER

Answer 38

C) DEFENSE IN DEPTH
Explanation
OBJ-4.1: Defense in depth is the concept of layering various network appliances and configurations to create a more secure and defensible architecture. Dion Training appears to be using various host-based and network-based devices to ensure there are multiple security layers in the network.

Question 39

39. Which of the following protocols must be implemented for two switches to share VLAN information?
    A) PPTP
    B) VTP
    C) STP
    D) MPLS

Answer 39

B) VTP
Explanation
OBJ-2.3: The VLAN Trunking Protocol (VTP) allows a VLAN created on one switch to be propagated to other switches in a group of switches in a VTP domain. Spanning Tree Protocol (STP) is a Layer 2 protocol that runs on bridges and switches to ensure that you do not create loops when you have redundant paths in your network. Multiprotocol Label Switching is a routing technique in telecommunications networks that directs data from one node to the next based on short path labels rather than long network addresses, thus avoiding complex lookups in a routing table and speeding traffic flows. The Point-to-Point Tunneling Protocol is an obsolete method for implementing virtual private networks. MPLS, STP, and PPTP are not used to share VLAN information like VTP and the 802.1q standard do.

Question 40

40. You are assisting a member of Dion Training’s security team during an incident response. The team member asks you to determine if any strange TCP connections are occurring on a given workstation. You open the command prompt on the workstation. Which of the following tools would provide you with information on any TCP connections currently established on the workstation?
    A) TRACERT
    B) ARP
    C) NETSTAT
    D) ROUTE

Answer 40

C) NETSTAT
Explanation
OBJ-5.3: Netstat (network statistics) is a command-line network utility tool that displays network connections for the Transmission Control Protocol (incoming and outgoing), routing tables, and several network interface and network protocol statistics. It is useful when determining if a workstation is attempting outbound connections due to malware (beaconing activity) or has ports open and listening for inbound connections. The tracert command is used on Windows devices to show details about the path that a packet takes from a host to a target and displays information about each hop in the path. The arp command is used to view and modify the local address resolution protocol (ARP) cache of a device, which contains recently resolved MAC addresses of IP hosts on the network. The route command is used to create, view, or modify manual entries in the network routing tables of a computer or server.

Question 41

41. Which network element enables unified communication devices to connect to and traverse traffic onto the PSTN?
    A) ACCESS SWITCH
    B) UC SERVER
    C) EDGE ROUTER
    D) UC GATEWAY

Answer 41

D) UC GATEWAY
Explanation
OBJ-2.1: Unified Communications (UC) enables people to use different modes of communication, media, and devices to communicate with anyone, anywhere, anytime. To accomplish this, a UC gateway is needed. Unified communications (UC) refers to the integration of multiple forms of real-time communications including voice, video, collaboration, and text messaging. A UC gateway connects your IP-based voice system to the Public Switched Telephone Network (PSTN).

Question 42

42. You have just moved into a new apartment in a large building. Your wireless network is acting strangely, so you are worried that it may be due to interference from the numerous other wireless networks in each of the other apartments in this building. You want to determine what wireless signals are within the walls of your apartment and their relative strength. What technique should you utilize to determine whether the nearby wireless networks are causing interference with your own Wi-Fi network?
    A) PERFORM A BANDWIDTH SPEED TEST
    B) PERFORM A SITE SURVEY
    C) PERFORM A PORT SCAN
    D) PERFORM A PACKET CAPTURE

Answer 42

B) PERFORM A SITE SURVEY
Explanation
OBJ-5.4: If you suspect interference within your apartment or other personal spaces, you should conduct a site survey to identify what wireless signals are emanating into your apartment and the RSSI of those signals. This will allow you to choose the least used frequency/channel to increase your own signal strength and reduce the wireless network’s interference. For example, if you are using a 2.4 GHz wireless network, you should aim to use either channel 1, 6, or 11 to minimize interference.

Question 43

43. You are a network administrator troubleshooting an issue with a newly installed web server. The web server is available to internal network users, but users outside the internal network (Internet users) cannot reach the server. You run an IPCONFIG and receive the configuration below:
    Which of the following is the MOST LIKELY reason why the server is unreachable from the Internet?
    A) THE LAYER 3 SWITCH PORT CONNECTING THE WEBSERVER IS BLOCKING PORT 80
    B) THE CONFIGURED DNS SERVER IS NOT REACHABLE BY THE WEBSERVER
    C) THE GATEWAY IP HAS BEEN MISCONFIGURED
    D) NAT HAS NOT BEEN CONFIGURED ON THE BORDER FIREWALL

Answer 43

D) NAT HAS NOT BEEN CONFIGURED ON THE BORDER FIREWALL
Explanation
OBJ-5.5: The most likely cause is that the NAT has not been properly configured on the border firewall. This would cause the internal network users to access the web servers still (since internal traffic doesn’t have to transit the firewall), but would still prevent Internet users from accessing the webserver. The subnet mask provided of 255.255.254.0 represents a /23 CIDR network, therefore the IP and the gateway are on the same subnet and the gateway is not the issue. The layer 3 switch cannot be the issue either, because if it blocked port 80 then the internal users would have been blocked, too. The web server does not need to access the DNS server, since the webserver is the target being accessed and not the system initiating the connection.

Question 44

44. You are working as part of a network installation team. Your team has been asked to install Cat 5e cabling to some new offices on the building’s second floor. Currently, the office only has one network closet, which is located on the first floor. Your team spent the morning running 24 new CAT 5e cables from a patch panel in the networking closet on the first floor to a new networking closet you are outfitting on the second floor. Your team terminated these cables in a new patch panel in the 2nd-floor closet. You measured the distance from the switch in the 1st-floor closet to the new 2nd-floor patch panel and determined it was 80 meters. The team then ran cables from this patch panel to each of the new offices. Some of the offices are working properly, but others are not. You suspect that some of the cable runs are exceeding the maximum length allowed by Cat 5e cabling. What is the BEST solution to this problem?
    A) INSTALL A SMALL SWITCH IN EACH OFFICE TO INCREASE THE SIGNAL
    B) INSTALL A SWITCH IN THE SECOND-FLOOR NETWORKING CLOSET TO INCREASE THE SIGNAL
    C) INSTALL A REPEATER BETWEEN THE PATCH PANEL AND EACH OFFICE
    D) INSTALL A HUB IN THE SECOND-FLOOR NETWORKING CLOSET TO INCREASE THE SIGNAL

Answer 44

B) INSTALL A SWITCH IN THE SECOND-FLOOR NETWORKING CLOSET TO INCREASE THE SIGNAL
Explanation
OBJ-5.2: The best option is to install a switch in the networking closet on the second floor, connecting to the cables coming from the first-floor closet and then to the cables on the second-floor patch panel. This will act as a repeater to boost the signal strength over the Cat5e cable, effectively resetting the cable length to 0 meters before leaving the closet. While a repeater may be a good option, a switch is more effective in this case since there are so many cables, and repeaters usually only work for an individual cable. A hub would similarly work but would introduce a signal collision domain for all 24 computers. This would drastically decrease the performance of the network. Finally, we don’t want to include a switch in each office, as this is a bad security practice and an inefficient use of resources. It is easier to manage and administer a single, centralized switch in the network closet.

Question 45

45. Which media access control technology will listen to a cable to ensure there is no traffic being transmitted before sending its traffic but will implement a back-off timer if a collision does occur?
    A) CSMA/CD
    B) CSMA/CA
    C) DEMAND PRIORITY
    D) TOKEN

Answer 45

A) CSMA/CD
Explanation
OBJ-2.3: In networking technologies that use CSMA/CD as their access method, a device first listens to the network media to make sure there is no signal already present from another device before it tries to place its own signal on the media. If a carrier signal is detected on the media, which indicates that a device is currently transmitting a signal, no other device can initiate a transmission until the carrier stops. If no carrier is detected, any device can transmit a signal. If two devices listen to the wire and detect no carrier signal, they may decide to send signals simultaneously. If this happens, a collision occurs between the two signals generated. Next, both devices detect the collision and stop transmitting their signals immediately, sending out a jamming signal that informs all other devices on the network that a collision has occurred and should not transmit. Meanwhile, the two devices whose signals created the collision cease transmitting and wait for random intervals of time (usually a few milliseconds) before attempting to retransmit.

Question 46

46. Which of the following features is supported by Kerberos but not by RADIUS?
    A) SERVICES FOR AUTHENTICATION
    B) TICKETS USED TO IDENTIFY AUTHENTICATED USERS
    C) SINGLE SIGN ON CAPABILITIES
    D) XML FOR CROSS-PLATFORM INTEROPERABILITY

Answer 46

B) TICKETS USED TO IDENTIFY AUTHENTICATED USERS
Explanation
OBJ-4.1: Whether you learned the in-depth details of each of these protocols during your studies or not, you should be able to answer this question by remembering that Kerberos is all about ‘tickets.’ Kerberos uses a system of tickets to allow nodes to communicate over a non-secure network and securely prove their identity. Kerberos is a computer network authentication protocol that works based on tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Kerberos is used in Windows Active Directory domains for authentication. Single sign-on (SSO) is a type of mutual authentication for multiple services that can accept the credential from one domain or service as authentication for other services. The Remote Authentication Dial-in User Service (RADIUS) is used to manage remote and wireless authentication infrastructure. Users supply authentication information to RADIUS client devices, such as wireless access points. The client device then passes the authentication data to an AAA (Authentication, Authorization, and Accounting) server that processes the request.

Question 47

47. The corporate network uses a centralized server to manage credentials for all of its network devices. What type of server is MOST likely being used in this configuration?
    A) FTP
    B) DNS
    C) RADIUS
    D) KERBEROS

Answer 47

C) RADIUS
Explanation
OBJ-4.1: RADIUS is used to manage credentials for network devices centrally. Remote Authentication Dial-In User Service is a networking protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service. TACACS+ is an older username and login system that uses authentication to determine access, while RADIUS combines authorization AND authentication. For this question, either RADIUS or TACACS would be an acceptable answer. Kerberos is a computer network authentication protocol that works based on tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Kerberos is used in Windows Active Directory domains for authentication. The domain name system (DNS) protocol is the protocol used to provide names for an IP address based on their mappings in a database using TCP/UDP port 53. The file transfer protocol (FTP) is the protocol used to transfer files across the internet over ports 20 and 21.

Question 48

48. Which of the following remote access protocols should you use to connect to a Windows 2019 server and control it with your mouse and keyboard from your workstation?
    A) RDP
    B) VNC
    C) SSH
    D) Telnet

Answer 48

A) RDP
Explanation
OBJ-4.4: The RDP (remote desktop protocol) is a Windows feature that allows a remote user to initiate a connection at any time and sign on to the local machine using an authorized account. This connection allows a Windows administrator to see and control what is on a remote computer’s screen. RDP authentication and session data are always encrypted. This means that a malicious user with access to the same network cannot intercept credentials or interfere or capture anything transmitted during the session. Secure Shell (SSH) uses port 22 to securely create communication sessions over the Internet for remote access to a server or system. Telnet uses port 23 to provide a bidirectional interactive text-oriented communication facility using a virtual terminal connection but sends its data in plaintext making it an insecure protocol. Virtual Network Computing (VNC) is a cross-platform screen sharing system that was created to remotely control another computer from a distance by a remote user from a secondary device as though they were sitting right in front of it.

Question 49

49. An administrator’s router with multiple interfaces uses OSPF as its routing protocol. You have discovered that one of the router’s interfaces is not passing traffic. You enter the “show interface eth 0/0” command at the CLI and receive the following output:
    Which of the following actions should you perform to allow the interface to pass traffic again?
    A) ENABLE THE SWITCHPORT FOR ETH 0/0
    B) VERIFY THE CABLE IS CONNECTED AT ETH 0/0
    C) SET THE LOOPBACK ADDRESS TO 127.0.0.1
    D) MODIFY THE IP ADDRESS TO 10.20.30.4/8

Answer 49

B) VERIFY THE CABLE IS CONNECTED AT ETH 0/0
Explanation
OBJ-5.5: The key to answering this question is the first line of the output that states the line protocol is down. This means that the specified interface has been correctly configured and enabled, but the Ethernet cable might be disconnected from the switchport. The line protocol being down indicates a clocking or framing problem on the connection, and the most common reason for this is a cable that is not properly connected. If “Fast Ethernet 0/0 is administratively down”, this would have indicated that the switchport was manually shut down using the shutdown command by a network administrator and would need to be reenabled. But, since “Fast Ethernet 0/0 is up”, this indicates the interface was already enabled for eth 0/0. The IP address is currently set to 10.20.30.40/25 which is a private IP address in a classless subnet range. As long as the default gateway is an IP between 10.20.30.0 and 10.20.30.127, though, there is nothing wrong with using this IP address. Without knowing the default gateway, we cannot identify the IP address as the issue. The “loopback is not set” indicates that the interface is not in diagnostic mode and should be properly sending traffic instead of sending it to a loopback address or port.

Question 50

50. Which of the following describes the ID of a specified native VLAN when traffic passes over a trunk?
    A) IT BECOMES THE DEFAULT VLAN FOR UNTAGGED FRAMES
    B) IT BECOMES THE GATEWAY OF LAST RESORT FOR THE SWITCH OR ROUTER
    C) IT BECOMES THE DEFAULT GATEWAY FOR THE PORT OR PORTS
    D) IT BECOMES THE PRIORITY ID FOR ALL THE VLAN TRAFFIC ACROSS THE DEVICE

Answer 50

A) IT BECOMES THE DEFAULT VLAN FOR UNTAGGED FRAMES
Explanation
OBJ-2.3: Trunk ports carry all traffic, regardless of VLAN number, between all switches in a LAN. The VLAN designation for a trunk port is its native or default VLAN. If the trunk port has a native VLAN that differs from the tag placed on the frame as it entered the access port, the switch leaves the tag on the frame and sends the tagged frame along to the next switch or switches. If the trunk port’s native VLAN is the same as the access port’s VLAN, then the switch drops the tag and sends the untagged frame out of the trunk port.

Question 51

51. A network administrator has determined that the ingress and egress traffic of a router’s interface are not correctly reported to the monitoring server. Which of the following can be used to determine if the router interface uses 64 bit versus 32-bit counters?
    A) SYSLOG SERVER
    B) SNMP WALK
    C) PORT SCANNER
    D) PACKET ANALYZER

Answer 51

B) SNMP WALK
Explanation
OBJ-3.1: SNMP Walk can be used to determine if the counter is using 32 bits or 64 bits by querying the OID of the endpoint (router interface). This is a complex topic beyond the scope of the Network+ exam (how to use the SNMP Walk tool) and usually serves as a type of in-depth question that CompTIA might ask to determine if a candidate has actual real-world experience in networking or just studied from a textbook. Some instructors like to claim that CompTIA uses these types of questions to determine if someone is cheating because only people who studied from a “brain dump” are likely to get this question correct! This type of question reminds you that it is ok not to know all the answers on test day. Just take your best guess, and then move on!

Question 52

52. Which of the following needs to be configured to allow jumbo frames on a network?
    A) MIB
    B) MAC
    C) IPS
    D) MTU

Answer 52

D) MTU
Explanation
OBJ-2.3: MTU is the largest unit that can be transmitted across a network. If the MTU is set at a value above 1500, the network is configured to support jumbo frames. A media access control address is a unique identifier assigned to a network interface controller for use as a network address in communications within a network segment. Management information base (MIB) is a collection of definitions which define the properties of the managed object within the device to be managed (such as a router, switch, etc.). An intrusion prevention system (IPS) is a form of network security that works to detect and prevent identified threats.

Question 53

53. A network technician at a warehouse must implement a solution that will allow a company to track shipments as they enter and leave the facility. The warehouse workers must scan and concurrently upload large images of items to a centralized server. Which of the following technologies should they utilize to meet these requirements?
    A) NFC
    B) RFID
    C) WI-FI
    D) BLUETOOTH

Answer 53

C) WI-FI
Explanation
OBJ-2.4: Wi-Fi is the best solution to meet this organization’s needs. 802.11ac is a very fast high-speed Wi-Fi network capable of 1 Gbps speeds over a 5 GHz spectrum and is perfect for uploading large image files quickly over a wireless local area network. Radio-frequency identification (RFID) uses electromagnetic fields to automatically identify and track tags attached to objects. While the warehouse might want to also utilize RFID to allow for the accurate scanning of items using radio frequency tracking tags, RFID cannot upload large images of the items to the centralized server since it is limited to 2 KB of data per RFID tag. Bluetooth is a short-range wireless technology standard that is used for exchanging data between fixed and mobile devices over short distances using UHF radio waves in the ISM bands, from 2.402 GHz to 2.48 GHz and building personal area networks. Bluetooth would not allow the worker to have full coverage throughout the warehouse due to the short distance requirement between a transmitter and receiver. Near-Field Communication (NFC) is a set of communication protocols for communication between two electronic devices over a distance of 4 cm or less. NFC offers a low-speed connection with a simple setup that can be used to bootstrap more capable wireless connections.

Question 54

54. You are troubleshooting a network connectivity issue for clients on the Dion Training corporate network. You have identified a rogue DHCP server connected to the network by one of the employees. Which of the following symptoms would most likely be observed due to this rogue DHCP server operating on the network?
    A) DUPLICATE MAC ADDRESSES
    B) MULTICAST FLOODING
    C) COLLISIONS
    D) DUPLICATE IP ADDRESSES

Answer 54

D) DUPLICATE IP ADDRESSES
Explanation
OBJ-5.5: A duplicate IP address occurs when two or more devices have been assigned the same IP address, either dynamically by the DHCP server or statically by a network administrator. This is a common symptom observed when there are two DHCP servers on the network, such as an authorized DHCP server and a rogue DHCP server. A duplicate MAC address occurs when two or more devices are responding to data requests as if they are the only device on the network with that physical address. One indication of this occurring is when a switch continually changes the port assignments for that address as it updates its content-addressable memory (CAM) table to reflect the physical address and switchport bindings. A collision is the result of two devices on the same Ethernet network attempting to transmit data at the exact same time. Collisions are a common occurrence in half-duplex networks but should not occur in a full-duplex switched environment. Multicast flooding occurs because no specific host is associated with the multicast MAC address in the content-addressable memory (CAM) table of a switch.

Question 55

55. A network administrator is tasked with building a wireless network in a new building located next door to your company’s office building. The wireless clients should not be able to communicate with other wireless clients but should be able to communicate with any wired users on the network. The users must be able to seamlessly migrate between the buildings while maintaining a constant connection to the LAN. How should the administrator configure the new wireless network in this new building?
    A) USE DIFFERENT SSIDs ON DIFFERENT CHANNELS AND VLANS
    B) USE THE SAME SSIDs ON THE SAME CHANNELS WITH AP ISOLATION
    C)USE THE SAME SSIDs ON DIFFERENT CHANNELS AND AP ISOLATION
    D) USE DIFFERENT SSIDs ON THE SAME CHANNELS WITH VLANs

Answer 55

C)USE THE SAME SSIDs ON DIFFERENT CHANNELS AND AP ISOLATION
Explanation
OBJ-2.4: For users to be able to seamlessly migrate between the two buildings, both Access Points (AP) must use the same SSIDs. To prevent frequency interference, though, each device needs to select a different and non-overlapping channel to utilize. Finally, the AP isolation should be enabled. Access Point (AP) isolation is a technique for preventing mobile devices connected to an AP from communicating directly with each other.

Question 56

56. John is investigating a performance issue on a server and has begun by gathering its utilization statistics. John notices that the statistics are outside of the normal, acceptable ranges. What should John do next?
    A) ARCHIVE THE LOGS
    B) CONDUCT A BASELINE REVIEW
    C) CONDUCT A PORT SCAN
    D) CONDUCT A VULNERABILITY SCAN

Answer 56

B) CONDUCT A BASELINE REVIEW
Explanation
OBJ-3.1: John should conduct a baseline review to compare the statistics he collected against the previous baseline. He can then use this information further to investigate the drop in the server’s performance. A baseline is a process for studying the network at regular intervals to ensure that the network is working as designed.

Question 57

57. Which of the following IEEE specifications describes the use of power over ethernet (POE)?
    A) 802.1D
    B) 802.1AF
    C) 802.1X
    D) 802.1AD

Answer 57

B) 802.1AF
Explanation
OBJ-2.3: Power over Ethernet (POE) is a technology that lets network cables carry electrical power. POE is defined in the IEEE 802.3af. The Spanning Tree Protocol (STP) is a network protocol that builds a loop-free logical topology for Ethernet networks to prevent bridge loops and the broadcast storms that result from them. STP is defined in the IEEE 802.1d standard. Link Aggregation Control Protocol or LACP is one element of an IEEE specification (802.3ad) that provides guidance on the practice of link aggregation for data connections. The IEEE 802.1x standard is a network authentication protocol that opens ports for network access when an organization authenticates a user’s identity and authorizes them for access to the network. This defines port security. The user’s identity is determined based on their credentials or certificate, which is confirmed by the RADIUS server.

Question 58

58. What device is used to configure various hypervisor guests to use different VLANs in the same virtualization environment?
    A) VIRTUAL ROUTER
    B) VIRTUAL SWITCH
    C) VIRTUAL FIREWALL
    D) NIC TEAMING

Answer 58

B) VIRTUAL SWITCH
Explanation
OBJ-1.2: A virtual switch (vSwitch) is a software application that allows communication between virtual machines. A vSwitch does more than just forward data packets, it intelligently directs the communication on a network by checking data packets before moving them to a destination.

Question 59

59. Which of the following is a logical host on the network that is configured with known vulnerabilities so that an attacker’s techniques can be studied in order to improve your network defenses?
    A) BOTNET
    B) VIRTUAL TERMINAL
    C) HONEYPOT
    D) CVE

Answer 59

C) HONEYPOT
Explanation
OBJ-4.1: A honeypot is a computer security mechanism set to detect, deflect, or in some manner counteract attempts of unauthorized use of information systems. A honeypot is a security mechanism that creates a virtual trap to lure attackers. An intentionally compromised computer system allows attackers to exploit vulnerabilities so you can study their techniques and improve your security policies. The Common Vulnerabilities and Exposures (CVE) system provides a reference method for publicly known information-security vulnerabilities and exposures. CVE is a website and database, not something you install or configure on your network. A botnet is a collection of internet-connected devices infected by malware that allow hackers to control them. A virtual terminal allows a PC to connect to a remote server, usually to perform a file transfer or run an application.

Question 60

60. Your company’s corporate headquarters provided your branch office a portion of their Class C subnet to use at a new office location. You must allocate the minimum number of addresses using CIDR notation in order to accommodate each department’s needs. What is the correct CIDR notation for the Sales department’s subnet which requires 55 devices?
    A) /29
    B) /27
    C) /30
    D) /26
    E) /28
    F) /25

Answer 60

D) /26
Explanation
OBJ-1.4: Since the Sales department needs 55 devices plus a network ID and broadcast IP, it will require 57 IP addresses. The smallest subnet that can fit 57 IPs is a /26 (64 IPs). A /26 will borrow 2 host bits and assign those to the network portion of the subnet mask. This would create a subnet with 2^6 available host IP addresses, or 64 total IP addresses. Of the 64 IP addresses, there are 62 available for clients to use, one for the network ID, and one for the broadcast address.

Question 61

61. Which encryption type MOST likely is used for securing the key exchange during a client-to-server VPN connection?
    A) ISAKMP
    B) KERBEROS
    C) AES
    D) TKIP

Answer 61

A) ISAKMP
Explanation
OBJ-4.4: ISAKMP is used in IPsec, which is commonly used in securing the key exchange during the establishment of a client-to-server VPN connection. TKIP (Temporal Key Integrity Protocol) is an encryption protocol included as part of the IEEE 802.11i standard for wireless LANs (WLANs). Kerberos is a computer network authentication protocol that works based on tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner. The Advanced Encryption Standard (AES) is a symmetric key encryption and is not used for key exchanges.

Question 62

62. Dion Training has configured a new web server and connected it to their screened subnet. A network technician wants to ensure the server is properly hardened and that it only allows inbound HTTPS requests while blocking any HTTP requests. Which of the following tools should the technician utilize?
    A) PORT SCANNER
    B) NSLOOKUP
    C) NETFLOW ANALYZER
    D) IP SCANNER

Answer 62

A) PORT SCANNER
Explanation
OBJ-5.3: A port scanner is used to determine which ports and services are open and available for communication on a target system. The port scanner will scan the server and display any open ports. If the technician finds that port 443 (HTTPS) is open and all other ports are closed, then they know the server has been properly hardened. A NetFlow analyzer is used to perform monitoring, troubleshooting, inspection, interpretation, and synthesis of network traffic flow data. An IP scanner is used to monitor a network’s IP address space in real-time and identify any devices connected to the network. The nslookup command is used to query the domain name system (DNS) to obtain information about host addresses, mail exchanges, nameservers, and related information. The nslookup command has an interactive and non-interactive mode.

Question 63

63. Dion Training has a single switch that services every room within its offices. The switch contains 48 ports, but Jason wants to divide the ports based on functional areas, such as web development, instruction support, and administration. Which technology should Jason utilize to divide the physical switch into three logically divided areas?
    A) VLAN
    B) VPN
    C) NAT
    D) DSL

Answer 63

A) VLAN
Explanation
OBJ-4.3: A VLAN (virtual LAN) allows a single physical switch to be divided into logical networks. VLANs are only supported on managed switches, but they allow for a different logical subnetwork address to be assigned to various ports on the switch. This requires that communications between different VLANs must go through a router, just as if you had multiple switches. A virtual private network (VPN) extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. A digital subscriber line (DSL) modem is a device used to connect a computer or router to a telephone line which provides the digital subscriber line service for connection to the Internet. Dynamic NAT is a many-to-one mapping of a private IP address or subnets inside a local area network to a public IP address or subnet outside the local area network. The traffic from different zones and subnets over trusted (inside) IP addresses in the LAN segment is sent over a single public (outside) IP address.

Question 64

64. Which of the following types of telecommunication links is used to provide high-speed internet service over a traditional phone line?
    A) LEASED LINE
    B) CABLE
    C) DSL
    D) SATELLITE

Answer 64

C) DSL
Explanation
OBJ-1.2: A digital subscriber line (DSL) modem is a device used to connect a computer or router to a telephone line which provides the digital subscriber line service for connection to the Internet. A satellite connection is a wireless connection spread across multiple satellite dishes located both on earth and in space that provides remote areas with valuable access to core networks. Data Over Cable Service Interface Specification (DOCSIS) is used to connect a client’s local area network to a high-bandwidth internet service provider over an existing coaxial cable TV system. A leased line is a private telecommunications circuit between two or more locations provided according to a commercial contract, normally over a fiber-optic connection.

Question 65

65. Which of the following would be the BEST addition to a business continuity plan to protect the business from a catastrophic disaster such as a fire, tornado, or earthquake?
    A) UPS AND BATTERY BACKUPS
    B) HOT SITES OR COLD SITES
    C) FIRE SUPPRESSION SYSTEMS
    D) BUILDING GENERATOR

Answer 65

B) HOT SITES OR COLD SITES
Explanation
OBJ-3.3: Although all answers are adequate suggestions to aid in business continuity, the addition of a hot or cold site is the BEST option. A hot or cold site is a commercial service that provides all equipment and facilities to allow a computer or networking company to continue operations in the event of a catastrophic event. In the case that the building has been destroyed, the hot/cold site is the only option that will allow the business to continue their operations effectively.

Question 66

66. A network’s design includes gateways connecting an assembly-line network. The assembly-line network uses specialized cabling and interfaces to allow the assembly-line robots to communicate with one another. Which type of network would you classify this design as?
    A) CSU/DSU
    B) NFV
    C) EIGRP
    D) SCADA/ICS

Answer 66

D) SCADA/ICS
Explanation
OBJ-2.1: Supervisory Control and Data Acquisition (SCADA)/Industrial Control Systems (ICS) are used in manufacturing and assembly-line networks. SCADA systems are used by industrial organizations and companies in the public and private sectors to control and maintain efficiency, distribute data for smarter decisions, and communicate system issues to help mitigate downtime. Industrial control system (ICS) is a collective term used to describe different types of control systems and associated instrumentation, which includes the devices, systems, networks, and controls used to operate and/or automate industrial processes. Network Function Virtualization (NFV) is a way to reduce cost and accelerate service deployment for network operators by decoupling functions like a firewall or encryption from dedicated hardware and moving them to virtual servers. Enhanced Interior Gateway Routing Protocol (EIGRP) is an advanced distance-vector routing protocol that is used on a computer network for automating routing decisions and configuration. Channel Service Unit/Data Service Unit (CSU/DSU) is a hardware device about the size of an external modem that converts digital data frames from the communications technology used on a local area network (LAN) into frames appropriate to a wide-area network (WAN) and vice versa.

Question 67

67. A technician is setting up a new network and wants to create redundant paths through the network. Which of the following should be implemented to prevent performance degradation within the network?
    A) VLAN
    B) PORT MIRRORING
    C) ARP INSPECTION
    D) SPANNING TREE

Answer 67

D) SPANNING TREE
Explanation
OBJ-2.3: The Spanning Tree Protocol (STP) is a network protocol that builds a logical loop-free topology for Ethernet networks. The basic function of STP is to prevent bridge loops and the broadcast radiation that results from them. If you have redundant links set up, it is important to utilize STP to prevent loops within the network. If a loop occurs, the performance of the entire network can be degraded due to broadcast storms. Port mirroring is used on a network switch to send a copy of network packets seen on one switch port to a network monitoring connection on another switch port. Dynamic ARP Inspection (DAI) is a security feature that validates Address Resolution Protocol (ARP) packets in a network. DAI allows a network administrator to intercept, log, and discard ARP packets with invalid MAC address to IP address bindings. A virtual LAN (VLAN) is any broadcast domain that is partitioned and isolated in a computer network at the data link layer (OSI layer 2). Port mirroring, ARP inspection, and VLANs do not add any redundancy to the network.

Question 68

68. You are about to perform a major configuration upgrade to a network device. What should you have prepared in case the upgrade fails?
    A) VULNERABILITY REPORT
    B) BUSINESS CONTINUITY PLAN
    C) BASELINE REPORT
    D) ROLLBACK PLAN

Answer 68

D) ROLLBACK PLAN
Explanation
OBJ-3.2: The purpose of a rollback plan is to document at every point during the deployment of a change or upgrade where you can stop the deployment and return to a known good state.

Question 69

69. You are working as a service desk analyst. This morning, you have received multiple calls from users reporting that they cannot access websites from their work computers. You decide to troubleshoot the issue by opening up your command prompt on your Windows machine and running a program to determine where the network connectivity outage is occurring. This tool tests the end-to-end connection and reports on each hop found in the connection. Which tool should you use to determine if the issue is on the intranet portion of your corporate network or if it is occurring due to a problem with your ISP?
    A) PING
    B) NSLOOKUP
    C) NETSTAT
    D) TRACERT

Answer 69

D) TRACERT
Explanation
OBJ-5.3: Tracert is a command-line utility used to trace an IP packet’s path as it moves from its source to its destination. While using ping will tell you if the remote website is reachable or not, it will not tell you where the connection is broken. Tracert performs a series of ICMP echo requests to determine which device in the connection path is not responding appropriately. This will help to identify if the connectivity issue lies within your intranet or is a problem with the ISP’s connection. The nslookup tool is used to troubleshoot DNS issues. The netstat tool is used to display network statistics and active connections. The ping tool is used to test an end-to-end connection, but it will not provide any data on the hops found in the connection.

Question 70

There are two switches connected using both a Cat 6 cable and a Cat 5e cable. Which type of problem might occur with this setup?
A) AUTO-SENSING PORTS
B) IMPROPER CABLE TYPES
C) MISSING ROUTE
D) SWITCHING LOOP

Answer 70

D) SWITCHING LOOP
Explanation
OBJ-2.3: A switching loop is when there is more than one Layer 2 path exists between two endpoints. This can be prevented by using the STP (Spanning Tree Protocol). The Spanning Tree Protocol (STP) is a network protocol that builds a loop-free logical topology for Ethernet networks to prevent bridge loops and the broadcast storms that result from them. STP is defined in the IEEE 802.1d standard. Both Cat 6 and Cat 5e are compatible with each other and can both operate at speeds of up to 1000 Mbps (1 Gbps), so it is not an improper cable type issue. Auto-sensing ports refer to a feature found in network adapters that allows them to automatically recognize the current local network’s speed and adjust its own setting accordingly. This would not be an issue since the switch can detect the appropriate speed to use with the Cat 6 and Cat 5e cables. Routes are used at layer 3, but switches are layer 2 devices. Therefore, the switches do not need to use a route to pass traffic between each other.

Question 71

71. Your physical security manager, Janice, wants to ensure she can detect any unauthorized access to the data center. Which technology should be used to meet her requirement?
    A) VIDEO SURVEILLANCE
    B) ACCESS BADGE READER
    C) BIOMETRIC ACCESS
    D) SMART CARD

Answer 71

A) VIDEO SURVEILLANCE
Explanation
OBJ-4.5: Since she requires to detect unauthorized access, video surveillance should be utilized. Closed-circuit television is a type of video surveillance where video cameras transmit a signal to a specific place using a limited set of monitors. If she were trying to prevent access from occurring, the other three options would provide that. Still, they cannot detect unauthorized access (for example, if the attacker stole a valid smart card or access badge). A biometric lock is any lock that can be activated by biometric features, such as a fingerprint, voiceprint, or retina scan. Biometric locks make it more difficult for someone to counterfeit the key used to open the lock or a user’s account. A smart card is a form of hardware token. A smart card, chip card, PIV card, or integrated circuit card is a physical, electronic authorization device used to control access to a resource. It is typically a plastic credit card-sized card with an embedded integrated circuit chip. In high-security environments, employee badges may contain a smart card embedded chip that must be inserted into a smart card reader to log in or access information on the system. A badge reader can be used to read a security badge using RFID, a smart card, or a barcode to authenticate a user.

Question 72

72. Timothy, a network technician, receives a phone call from an end-user who states their laptop cannot connect to the corporate wireless network. Which of the following should the technician do FIRST according to the troubleshooting methodology?
    A) ESTABLISH A PLAN OF ACTION
    B) IDENTIFY THE PROBLEM
    C) VERIFY FULL SYSTEM FUNCTIONALITY
    D) IMPLEMENT THE SOLUTION

Answer 72

B) IDENTIFY THE PROBLEM
Explanation
OBJ-5.1: The troubleshooting steps are to (1) Identify the problem, (2) Establish a theory of probable cause, (3) Test the theory to determine the cause, (4) Establish a plan of action to resolve the problem and identify potential effects, (5) Implement the solution or escalate as necessary, (6) Verify full system functionality and if applicable implement preventative measures, and (7) Document findings, actions, outcomes, and lessons learned. At this point, the technician does not have enough information to clearly identify the problem. The technician should continue to identify the problem by gathering information, questioning the user, identifying the symptoms, determining if anything has changed, and attempting to duplicate the problem to verify the issue. Once the problem is clearly identified, the technician will establish a theory of probable cause and continue their troubleshooting efforts.

Question 73

73. You have been asked to install a media converter that connects a newly installed RG-6 cable to the existing single-mode cable plant. Which type of media converter should you use?
    A) MULTIMODE TO SINGLE MODE
    B) ETHERNET TO FIBER
    C) COAXIAL TO FIBER
    D) COAXIAL TO ETHERNET

Answer 73

C) COAXIAL TO FIBER
Explanation
OBJ-1.3: A media converter is a Layer 1 device that changes one type of physical network connection to another. In this case, we are converting coaxial (RG-6) cable to fiber-optic (SMF) cable.

Question 74

74. Jason wants to use his personal cell phone for work-related purposes. Because of his position, Jason has access to sensitive company data, which might be stored on his cell phone during its usage. The company is concerned about this but believes that it might be acceptable with the proper security controls in place. Which of the following should be done to protect both the company and Jason if they allow him to use his personal cell phone for work-related purposes?
    A) ESTABLISH A CONSENT TO MONITORING POLICY SO THAT THE COMPANY CAN AUDIT JASON’S CELL PHONE USAGE
    B) ESTABLISH AN NDA THAT STATES JASON CANNOT SHARE CONFIDENTIAL DATA WITH OTHERS
    C) CONDUCT REAL-TIME MONITORING OF THE PHONE’S ACTIVITY AND USAGE
    D) ESTABLISH AN AUP THAT ALLOWS A PERSONAL PHONE TO BE USED FOR WORK-RELATED PURPOSES

Answer 74

C) CONDUCT REAL-TIME MONITORING OF THE PHONE’S ACTIVITY AND USAGE
Explanation
OBJ-3.1: While all four are good options, the BEST solution is to conduct real-time monitoring of the phone’s activity since it is a technical control that could quickly identify an issue. The other options are all administrative controls (policies), which are useful but would not actually identify if the sensitive data was leaked from Jason’s phone.

Question 75

75. Which network device operates at Layer 1?
    A) ROUTER
    B) FIREWALL
    C) BRIDGE
    D) HUB

Answer 75

D) HUB
Explanation
OBJ-1.1: A hub is a layer 1 device and operates at the physical layer. Cables, hubs, repeaters, and wireless access points are all examples of layer 1, or physical layer, devices. The Physical Layer defines electrical and physical specifications for devices. The physical layer defines the relationship between a device and a transmission medium, such as a copper or optical cable. A Bridge is a layer 2 device. A switch is a layer 3 device. A firewall is a layer 3 through layer 7 device, depending on the type of firewall.

Question 76

76. An analyst reviews a triple-homed firewall configuration that connects to the internet, a private network, and one other network. Which of the following would best describe the third network connected to this firewall?
    A) DATA ZONE
    B) SCREENED SUBNET
    C) STAGING ENVIRONMENT
    D) AVAILABILITY ZONE

Answer 76

B) SCREENED SUBNET
Explanation
OBJ-4.1: A triple-homed firewall connects to three networks internal (private), external (internet/public), and a screened subnet (formerly called a demilitarized zone or DMZ). The screened subnet is used to host systems that require access from external hosts. Data zones describe the state and location of data to help isolate and protect it from unauthorized/inappropriate use-for example, as data transitions from raw storage, processing, production, and analytical use. Data zones are associated with data lakes and designed to help manage big data used by analysts and scientists for data exploration and discovery tasks. An availability zone is an individual data center within a region of a cloud service provider’s network. A staging environment is a pre-production enclave used for testing and development.

Question 77

77. What would be used in an IP-based video conferencing deployment?
    A) NFC
    B) 56K MODEM
    C) CODEC
    D)RS-232

Answer 77

C) CODEC
Explanation
OBJ-2.1: The term “codec” is a concatenation of “encoder” and “decoder.” In video conferencing, a codec is a software (or can be hardware) that compresses (encodes) raw video data before it is transmitted over a network. Generally, audio/video conferencing systems utilize the H.323 protocol with various codecs like H.263 and H.264 to operate. A 56k modem is a legacy device, also called a dial-up modem. These devices are too slow to allow an IP-based video conferencing system deployment. RS-232 is a standard protocol used for serial communication, and is too slow to support IP-based video conferencing systems. Near Field Communication (NFC) is a set of short-range wireless technologies, typically requiring a distance of 4cm or less to initiate a connection. NFC is not used with IP-based video conferencing systems.

Question 78

78. Which of the following should be implemented to allow wireless network access for clients in the lobby using a shared password as the key?
    A) WPA2
    B) GEOFENCING
    C) IPsec
    D) FIREWALL

Answer 78

A) WPA2
Explanation
OBJ-4.3: Wi-Fi Protected Access 2 Pre-Shared Key or WPA2-PSK is a system of encryption used to authenticate users on wireless local area networks using a shared password as the key. WPA2-PSK [AES] is the recommended secure method of making sure no one can listen to your wireless data while it is being transmitted back and forth between your router and other devices on your network. A Firewall is a network security device that monitors and filters incoming and outgoing network traffic based on an organization’s previously established security policies, not a shared password. Internet Protocol Security (IPsec) is a secure network protocol suite that authenticates and encrypts the packets of data to provide secure encrypted communication between two computers over an Internet Protocol network and is used in virtual private networks. A geofence is a virtual perimeter for a real-world geographic area. Geofencing does not use shared passwords to secure your next, it uses GPS coordinates or other location-based data.

Question 79

79. Which of the following is a DNS record type?
    A) TTL
    B) PTR
    C) DHCP
    D) LDAP

Answer 79

B) PTR
Explanation
OBJ-1.6: There are several types of DNS records, including A, AAAA, CNAME, PTR, SVR, and TXT. PTR records are used for the Reverse DNS (Domain Name System) lookup. Using the IP address, you can get the associated domain/hostname. An A record should exist for every PTR record. Time to live (TTL) or hop limit is a mechanism which limits the lifespan or lifetime of data in a computer or network. The Dynamic Host Configuration Protocol (DHCP) is a network management protocol used on Internet Protocol networks for automatically assigning IP addresses and other communication parameters to devices connected to the network using a client-server architecture. The Lightweight Directory Access Protocol (LDAP) is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol network.

Question 80

80. You have just installed a new switch in your company’s network closet. The switch connects to your router using an SFP port on both the router and switch. Unfortunately, you only had a long cable available to make the connection, so after running the cable from the rack containing the switch to the other rack containing the router, you decide to coil up the excessive cable and use a zip tie to hold the coil to the side of the rack. You head back to your office, log into the switch over SSH, and check the log file. You notice that several messages indicate that the signal strength on the transmit portion of the SFP is registering as too weak. What is the BEST explanation for the cause of this error?
    A) YOU USED AN MTRJ CONNECTOR INSTEAD OF AN ST CONNECTOR
    B) YOU USED AN MMF CABLE INSTEAD OF AN SMF CABLE
    C) THE SFP MODULE HAS GONE BAD AND SHOULD BE REPLACED
    D) THE BEND RADIUS OF THE CABLE HAS BEEN EXCEEDED

Answer 80

D) THE BEND RADIUS OF THE CABLE HAS BEEN EXCEEDED
Explanation
OBJ-5.2: The most likely explanation for this issue is the coiled up the excess cable was wound too tightly and exceeded the bend radius for the cable. Bend radius is the measure of how sharply a cable can safely bend without causing damage by creating micro cracks on the glass fibers. By tightly coiling the cable, the cable may have broken or cracked the fiber connected to the transmit portion of the SFP. It is unlikely that the SFP failed since only the transmit portion is registering as weak. If you used the wrong type of cable (MTRJ vs. ST), you would not have been able to connect it to the SFP module as it wouldn’t fit. Similarly, if you used an MMF instead of an SMF cable, you would not receive a weak connection but would instead get no connection.

Question 81

81. What is considered a classless routing protocol?
    A) OSPF
    B) RIPv1
    C) STP
    D) IGRP

Answer 81

A) OSPF
Explanation
OBJ-2.2: OSPF is known as a classless protocol. Classless routing protocols are those protocols that include the subnet mask information when the routing tables or updates are exchanged. Other classless routing protocols include EIGRP, RIPv2 (or newer), and IS-IS.

Question 82

82. Which of the following types of traffic flows describes network traffic that is entering your datacenter through the firewall or router?
    A) NORTH
    B) WEST
    C) SOUTH
    D) EAST

Answer 82

C) SOUTH
Explanation
OBJ-1.7: North-South traffic or communication refers to traffic that enters or leaves the data center from a system physically residing outside the datacenter. North traffic is traffic exiting the datacenter. South traffic is traffic entering the data center. In both cases, the data is exiting or entering the data center through a firewall or other network infrastructure boundary device, such as a router. East-West traffic or communication refers to data flow within a datacenter. For example, if we are using a spine and leaf architecture, any data flow between the various servers in the datacenter, even if it goes between different leaves, would be considered east-west traffic.

Question 83

83. A technician is attempting to resolve an issue with users on the network who cannot access websites like DionTraining.com and Google.com. The technician can ping their default gateway, DNS servers, and the website using its IP address successfully. The technician tries to use the command “ping diontraining.com” and receives an error message stating “Ping request could not find host diontraining.com.” Which of the following actions should the technician attempt next to resolve this issue?
    A) UPDATE THE HOST FILE WITH THE URL AND IP FOR THE WEBSITES
    B) ENSURE ICMP MESSAGES TRANSIT THROUGH THE FIREWALL
    C) USE NSLOOKUP TO RESOLVE THE URLs MANUALLY
    D) ENSURE PORT 53 IS ENABLED ON THE FIREWALL

Answer 83

D) ENSURE PORT 53 IS ENABLED ON THE FIREWALL
Explanation
OBJ-5.5: The Domain Name System (DNS) uses port 53 and is a hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network. When a client wants to access a website, it will make a request to the DNS server over port 53 to translate the domain name to its corresponding IP address. Since the technician is only able to access the servers using their IP addresses, this validates that the connectivity is functioning correctly but the DNS process is failing. The most likely reason for this is that port 53 is blocked at the firewall and is preventing the client from sending their requests to the DNS server. The nslookup command is used to query the domain name system (DNS) to obtain information about host addresses, mail exchanges, nameservers, and related information. The nslookup command has an interactive and non-interactive mode. The nslookup command will still need to communicate with a DNS server over port 53, though, to perform these lookups. The ping command is used to test whether a given target is reachable across an IP network by sending an ICMP Echo Request packet and receiving an ICMP Echo Reply. Since the technician successfully used ping to communicate with the server using their IP addresses, this indicates that ICMP is not blocked by the firewall. The HOST file is a text file containing domain names and IP addresses. The HOST file works like a local DNS lookup, but the technician would have to enter the domain name and IP for every website a user might want to access, making this an unacceptable option to solve this issue for the long term.

Question 84

84. Which of the following communication types can only be used with IPv6?
    A) UNICAST
    B) MULTICAST
    C) ANYCAST
    D) BROADCAST

Answer 84

C) ANYCAST
Explanation
OBJ-1.4: Anycast only works with IPv6. Anycast communications are sent to the nearest receiver in a group of receivers with the same IP. Broadcast only works with IPv4. Broadcast communication has one sender, but it sends the traffic to every device on the network. Multicasting is a technique used for one-to-many communication over an IP network. In this example, the central location sends a signal to subscribed devices. It reduces bandwidth as the source only sends the signal once, which is then received by multiple hosts simultaneously. Multicast can be used with both IPv4 and IPv6. Unicast communication only has one sender and one receiver. Unicast works with IPv4 or IPv6.

Question 85

85. Your company has installed a guest wireless network in the break room. According to company policy, employees may only connect to the network and use it during their lunch break. Which of the following policies should you have each employee sign to show they understand and accept the use conditions for this guest network?
    A) AUP
    B) MOU
    C) SLA
    D) NDA

Answer 85

A) AUP
Explanation
OBJ-3.2: An acceptable use policy (AUP), acceptable usage policy, or fair use policy is a set of rules applied by the owner, creator, or administrator of a network, website, or service, that restrict how the network, website, or system may be used and sets guidelines as to how it should be used. In this scenario, this is the most appropriate policy to utilize. A memorandum of understanding (MOU) is important because it defines the responsibilities of each party in an agreement, provides the scope and authority of the agreement, clarifies terms, and outlines compliance issues. A non-disclosure agreement (NDA) is a legal contract or part of a contract between at least two parties that outlines confidential material, knowledge, or information that the parties wish to share for certain purposes, but wish to restrict access to. A service level agreement (SLA) is a commitment between a service provider and a client for particular aspects of the service, such as quality, availability, or responsibilities.

Question 86

86. Tim, a network administrator, is configuring a test lab that consists of three routers using RIP for dynamic routing. He connects the routers in a full mesh topology. When he attempts to ping Router 1 from Router 3 using its IP address, he receives a “Destination Unreachable” error message. Which of the following is the most likely reason for the connectivity error?
    A) IMPROPER DNS SETTINGS
    B) DENIAL OF SERVICE ATTACK
    C) RADIUS AUTHENTICATION ERRORS
    D) SPIT-HORIZON IS MISCONFIGURED

Answer 86

D) SPIT-HORIZON IS MISCONFIGURED
Explanation
OBJ-5.5: Split horizon is a method used by distance vector protocols to prevent network routing loops. With split horizon, if a router receives routing information from another router, the first router will not broadcast that information back to the second router, thus preventing routing loops from occurring. If it is misconfigured, the routers could suffer a routing loop which would produce the error message received when trying to communicate with each other. The other options would not cause a communication error between the three internal routers when testing the connectivity using their IP addresses. A Denial-of-Service (DoS) attack is an attack meant to shut down a machine or network, making it inaccessible to its intended users. The Domain Name System (DNS) uses port 53 and is a hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network and maps a domain name to an IP address. Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized authentication, authorization, and accounting (AAA) management for users who connect and use a network service.

Question 87

87. Dion Training is adding a new screen subnet that will host a large number of VDIs and wants to assign them a small portion of their public Class C IPv4 address space. Dion Training has been assigned a Class C scope of 187.15.3.0/24. There will be a total of 105 VDI clients that will each need an IP address assigned. What is the correct CIDR notation for the new subnet in order to accommodate the 105 VDI clients while allocating the minimum number of addresses?
    A) /25
    B) /28
    C) /27
    D) /26

Answer 87

A) /25
Explanation
OBJ-1.4: To answer this question, you must be able to perform a basic subnetting calculation. First, you need to determine the number of IP addresses that will be needed. In this scenario, you have 105 clients that will each need an IP address, but you also need one IP address for the network and a second IP for the broadcast. This means you need 107 IP addresses total. IP addresses are assigned in multiples of 2 (1, 2, 4, 8, 16, 32, 64, 128, 256). Since we need 107 IP addresses, we need to round up to a block of 128. To symbolize a CIDR block with 128 IP addresses, we would use /25, which is 2^7 =128.

Question 88

88. You are working as a penetration tester and have discovered a new method of exploiting a vulnerability within the Windows 10 operating system. You conduct some research online and discover that a security patch against this particular vulnerability doesn’t exist yet. Which type of threat would this BEST be categorized as?
    A) ZERO-DAY
    B) DDOS
    C) BRUTE FORCE
    D) SPOOFING

Answer 88

A) ZERO-DAY
Explanation
OBJ-4.1: A zero-day attack happens once that flaw, or software/hardware vulnerability, is exploited, and attackers release malware before a developer has an opportunity to create a patch to fix the vulnerability, hence the term zero-day. A Distributed Denial of Service (DDoS) attack is an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. A brute-force attack consists of an attacker systematically trying all possible password and passphrase combinations until the correct one is found. Spoofing is the act of disguising a communication from an unknown source as being from a known, trusted source.

Question 89

89. Which type of threat actor can accidentally or inadvertently cause a security incident in your organization?
    A) APT
    B) HACKTIVIST
    C) INSIDER THREAT
    D) ORGANIZED CRIME

Answer 89

C) INSIDER THREAT
Explanation
OBJ-4.1: An insider threat is a type of threat actor assigned privileges on the system that cause an intentional or unintentional incident. Insider threats can be used as unwitting pawns of external organizations or make crucial mistakes that can open up exploitable security vulnerabilities. Hacktivists, Organized Crimes, and advanced persistent threats (APT) entities do not accidentally or unwittingly target organizations. Instead, their actions are deliberate. A hacktivist is an attacker that is motivated by a social issue or political cause. Organized crime is a type of threat actor that uses hacking and computer fraud for commercial gain. An advanced persistent threat (APT) is a type of threat actor that can obtain, maintain, and diversify access to network systems using exploits and malware.

Question 90

90. A company owns four kiosks that are near a shopping center. The owner is concerned about someone accessing the Internet via the kiosk’s wireless network. What should be implemented to provide wireless access only to the employees working at the kiosk?
    A) HOST-BASED ANTIVIRUS
    B) FIREWALL
    C) WEB FILTERING
    D) MAC FILTERING

Answer 90

D) MAC FILTERING
Explanation
OBJ-4.3: MAC Filtering will control access to the network by restricting access to only certain devices. MAC address filtering allows you to block traffic coming from certain known machines or devices. The router uses the MAC address of a computer or device on the network to identify it and block or permit access. Traffic coming in from a specified MAC address will be filtered depending upon the policy. In this scenario, you should implement an allow list that only allows approved MAC addresses to connect to and communicate over the wireless network.