Test 2

Question 1

1. The administrator modifies a rule on the firewall, and now all the FTP users cannot access the server any longer. The manager calls the administrator and asks what caused the extreme downtime for the server. In regards to the manager’s inquiry, what did the administrator forget to do first?
   A) DOCUMENT THE CHANGES
   B) PROVIDE NOTIFICATION OF CHANGE TO USERS
   C) SCHEDULE A MAINTENANCE WINDOW
   D) SUBMIT A CHANGE REQUEST

Answer 1

D) SUBMIT A CHANGE REQUEST
Explanation
OBJ-3.2: A change request should be submitted through the change management process prior to any changes being made. Change management is a systematic approach to dealing with the transition or transformation of an organization’s goals, processes, or technologies.

Question 2

2. You have just finished installing a new web application and need to connect it to your SQLnet database server. Which port must be allowed to enable communications through your firewall between the web application and your database server?
   A) 3389
   B) 1433
   C) 1521
   D) 3306

Answer 2

C) 1521
Explanation
OBJ-1.5: SQLnet uses ports 1521, and is a relational database management system developed by Oracle that is fully compatible with the structured query language (SQL). Microsoft SQL uses ports 1433 and is a proprietary relational database management system developed by Microsoft that is fully compatible with the structured query language (SQL). MySQL uses ports 3306 and is an open-source relational database management system that is fully compatible with the structured query language (SQL). Remote Desktop Protocol (RDP) uses port 3389 and is a proprietary protocol developed by Microsoft which provides a user with a graphical interface to connect to another computer over a network connection.

Question 3

3. Your company has just finished replacing all of its computers with brand new workstations. Colleen, one of your coworkers, has asked the company’s owner if she can have the old computers that are about to be thrown away. Colleen would like to refurbish the old computers by reinstalling a new operating system and donating them to a local community center for disadvantaged children in the neighborhood. The owner thinks this is a great idea but is concerned that the private and sensitive corporate data on the old computer’s hard drives might be placed at risk of exposure. You have been asked to choose the best solution to sanitize or destroy the data while ensuring the computers will still be usable by the community center. What type of data destruction or sanitization method do you recommend?
   A) WIPING
   B) PURGING
   C) DEGAUSSING
   D) SHREDDING

Answer 3

A) WIPING
Explanation
OBJ-4.5: Data wiping or clearing occurs by using a software tool to overwrite the data on a hard drive to destroy all electronic data on a hard disk or other media. Data wiping may be performed with a 1x, 7x, or 35x overwriting, with a higher number of times being more secure. This allows the hard drive to remain functional and allows for hardware reuse. Degaussing a hard drive involves demagnetizing a hard drive to erase its stored data. You cannot reuse a hard drive once it has been degaussed. Therefore, it is a bad solution for this scenario. Purging involves removing sensitive data from a hard drive using the device’s internal electronics or an outside source such as a degausser, or by using a cryptographic erase function if the drive supports one. Shredding involves the physical destruction of the hard drive. This is a secure method of destruction but doesn’t allow for device reuse.

Question 4

4. Dion Training has created a guest wireless network for students to use during class. This guest network is separated from the corporate network for security. Which of the following should be implemented to require the least amount of configuration for a student to access the Internet over the guest network?
   A) CONFIGURE THE ACCESS POINT TO 802.1x FOR AUTHENTICATION
   B) ENABLE TWO-FACTOR AUTHENTICATION ON THE STUDENT’S DEVICE
   C) ENABLE SSID BROADCAST FOR THE GUEST WIRELESS NETWORK
   D) CONFIGURE WEP WITH A PRE-SHARED KEY

Answer 4

C) ENABLE SSID BROADCAST FOR THE GUEST WIRELESS NETWORK
Explanation
OBJ-2.4: Since security was not listed as a requirement for the guest wireless network, it would be easiest not to set up any encryption, passwords, or authentication mechanisms on the network. Instead, you should enable the SSID broadcast for the guest network so students can easily find and connect to it. Using two-factor authentication, 802.1x, or WEP would require the students to complete additional configurations prior to connecting to the guest network.

Question 5

5. You are currently troubleshooting a workstation in the office and determined that it is an issue with the cabling somewhere between the workstation and the switch. You have tested the patch cable from the workstation to the wall jack and it is not faulty. You want to check the port on the switch next. Which of the following would BEST help you identify which switch port is associated with the workstation’s wall jack?
   A) NETWORK BASELINE
   B) PROPER LABELING
   C) INVENTORY MANAGEMENT
   D) STANDARD PROCEDURES

Answer 5

B) PROPER LABELING
Explanation
OBJ-3.2: You should always use proper labeling of your cables, wall jacks, and patch panels to make it easy to locate which switchport is associated with each portion of the cable distribution plant. Ensuring everything is properly labeled will help when you need to troubleshoot a network connection in your interior cable distribution plant. A standard procedure is a set of step-by-step instructions compiled by an organization to help workers carry out routine operations. A baseline is a process for studying the network at regular intervals to ensure that the network is working as designed. Inventory management refers to the process of ordering, storing, and using a company’s inventory.

Question 6

6. Which type of antenna broadcasts an RF signal in a specific direction with a narrow path?
   A) PATCH
   B) BIDIRECTIONAL
   C) UNIDIRECTIONAL
   D) OMNIDIRECTIONAL

Answer 6

C) UNIDIRECTIONAL
Explanation
OBJ-2.4: Directional antennas broadcast radio frequencies in a single direction (unidirectional) or two directions (bidirectional) to create a zone or area of coverage. Unidirectional antennas focus the broadcast signal in a single direction instead of all directions, focusing the transmission and making the signal stronger. A specific type of unidirectional antenna is known as a Yagi antenna. Omnidirectional antennas broadcast radio frequencies in all directions creating a large sphere of coverage. The antenna has the capability to send and receive signals in a circumference around the antenna. A patch antenna is a type of antenna with a low profile that can be mounted on a surface. A patch antenna can be omnidirectional, bidirectional, or unidirectional, therefore it is not the best answer to this question and unidirectional should be chosen instead.

Question 7

7. A network technician responds to a customer reporting that a workstation continually loses the connection to the network. The user explains that it occurs randomly, and it happens several times throughout the day. Which step of the troubleshooting method should the technician perform NEXT?
   A) ESTABLIH A PLAN OF ACTION TO RESOLVE THE PROBLEM
   B) ESTABLIH A PLAN OF PROBABLE CAUSE
   C) VERIFY FULL SYSTEM FUNCTIONALITY
   D) TEST THE THEORY TO DETERMINE THE CAUSE

Answer 7

B) ESTABLIH A PLAN OF PROBABLE CAUSE
Explanation
OBJ-5.1: The scenario described in the question is best classified as “identify the problem”, so the next step would be to “establish a theory of probable cause”. The troubleshooting steps are to (1) Identify the problem, (2) Establish a theory of probable cause, (3) Test the theory to determine the cause, (4) Establish a plan of action to resolve the problem and identify potential effects, (5) Implement the solution or escalate as necessary, (6) Verify full system functionality and if applicable implement preventative measures, and (7) Document findings, actions, outcomes, and lessons learned.

Question 8

8. Which of the following is a connectionless protocol?
   A) ICMP
   B) TCP
   C) SSL
   D) SSH

Answer 8

A) ICMP
Explanation
OBJ-1.5: A connectionless protocol is a form of data transmission in which data is transmitted automatically without determining whether the receiver is ready or even whether a receiver exists. ICMP, UDP, IP, and IPX are well-known examples of connectionless protocols. TCP, SSH, and SSL are all examples of connection-oriented protocols.

Question 9

9. Which of the following levels would an emergency condition generate?
   A) 0
   B) 7
   C) 1
   D) 6

Answer 9

A) 0
Explanation
OBJ-3.1: The severity levels range from zero to seven, with zero being the most severe and seven being the least severe. Level 0 is used for an emergency and is considered the most severe condition because the system has become unstable. Level 1 is used for an alert condition and means that there is a condition that should be corrected immediately. Level 2 is used for a critical condition, and it means that there is a failure in the system’s primary application and it requires immediate attention. Level 3 is used for an error condition, and it means that something is happening to the system that is preventing the proper function. Level 4 is used for warning conditions and it may indicate that an error will occur if action is not taken soon. Level 5 is used for notice conditions and it means that the events are unusual, but they are not error conditions. Level 6 is used for information conditions and it is a normal operational message that requires no action. Level 7 is used for debugging conditions and is just information that is useful to developers as they are debugging their networks and applications.

Question 10

10. Dion Training allows its visiting business partners from CompTIA to use an available Ethernet port in their conference room to establish a VPN connection back to the CompTIA internal network. The CompTIA employees should obtain internet access from the Ethernet port in the conference room, but nowhere else in the building. Additionally, if any of the Dion Training employees use the same Ethernet port in the conference room, they should access Dion Training’s secure internal network. Which of the following technologies would allow you to configure this port and support both requirements?
    A) MAC FILTERING
    B) CONFIGURE A SIEM
    C) IMPLEMENT NAC
    D) CREATE AN ACL TO ALLOW ACCESS

Answer 10

C) IMPLEMENT NAC
Explanation
OBJ-4.3: Network Access Control (NAC) uses a set of protocols to define and implement a policy that describes how to secure access to network nodes whenever a device initially attempts to access the network. NAC can utilize an automatic remediation process by fixing non-compliant hosts before allowing network access. Network Access Control can control access to a network with policies, including pre-admission endpoint security policy checks and post-admission controls over where users and devices can go on a network and what they can do. In this scenario, implementing NAC can identify which machines are known and trusted Dion Training assets and provide them with access to the secure internal network. NAC could also determine unknown machines (assumed to be those of CompTIA employees) and provide them with direct internet access only by placing them onto a guest network or VLAN. While MAC filtering could be used to allow or deny access to the network, it cannot by itself control which set of network resources could be utilized from a single ethernet port. A security information and event management (SIEM) system provides real-time analysis of security alerts generated by applications and network hardware. An access control list could define what ports, protocols, or IP addresses the ethernet port could be utilized. Still, it would be unable to distinguish between a Dion Training employee’s laptop and a CompTIA employee’s laptop like a NAC implementation could.

Question 11

11. When you arrived at work today, you saw a message on your computer screen stating that your hard drive has been encrypted and you must pay 1 ETH to get the decryption key. What type of attack has occurred against your workstation?
    A) BRUTE-FORCE
    B) MALWARE
    C) RANSOMEWARE
    D) PHISHING

Answer 11

C) RANSOMEWARE
Explanation
OBJ-4.2: Ransomware is a type of malware from cryptovirology that threatens to publish the victim’s personal data or perpetually block access to it unless a ransom is paid. Malware is any software intentionally designed to cause damage to a computer, server, client, or computer network. By contrast, software that causes unintentional harm due to some deficiency is typically described as a software bug. Malware includes viruses, worms, logic bombs, and many other malicious types of code. Phishing is a type of social engineering where an attacker sends a fraudulent email designed to trick a human victim into revealing sensitive information to the attacker or to deploy malicious software on the victim’s infrastructure like ransomware. A brute-force attack consists of an attacker submitting many passwords or passphrases with the hope of eventually guessing correctly. A brute-force attack consists of an attacker submitting many passwords or passphrases with the hope of eventually guessing correctly.

Question 12

12. You are troubleshooting a cable modem for a home user’s network. The connection speeds are much lower than you expected. You suspect the coaxial cable between the wall jack and the cable modem is faulty. Based on your research, a coaxial cable used in data networks should have an impedance of 50 ohms. Which of the following tools should you use to measure the resistance of the coaxial cable?
    A) MULTIMETER
    B) CABLE CERTIFIER
    C) SPECTRUM ANALYZER
    D) CABLE TESTER

Answer 12

A) MULTIMETER
Explanation
OBJ-5.2: A multimeter is a measuring instrument that can measure the voltage, resistance, and amperage of a cable or conduit. To test this cable, you should set the multimeter to resistance and connect one of the multimeter’s leads to each end of the coaxial cable to determine the resistance as measured in ohms. A cable tester is used to verify the electrical connections in a twisted pair or coaxial cable. A cable certifier is used to test the continuity of a cable and verify that a cable meets its specifications such as the bandwidth, frequency, and length. A spectrum analyzer is used to measure the magnitude of an input signal’s frequency.

Question 13

13. A network administrator needs to allow employees to upload files to a remote server securely. What port must be allowed through the firewall?
    A) 21
    B) 161
    C) 25
    D) 22

Answer 13

D) 22
Explanation
OBJ-1.5: To securely upload a file, the employees could use SFTP (Secure FTP) or SCP (Secure Copy). Both SFTP and SCP operate over port 22, therefore port 22 must be opened by the firewall so that the employees can reach the file servers. Port 21 is used by the File Transfer Protocol, but it is not a secure method of sending files. There is a more secure version of FTP known as FTPS, but that uses port 990. Port 25 is reserved for the simple mail transfer protocol (SMTP), which is an internet standard communication protocol for electronic mail transmission. Port 161 is reserved for simple network management protocol (SNMP), which is a networking protocol used for the management and monitoring of network-connected devices in Internet Protocol networks.

Question 14

15. Which of the following layers within software-defined networking focuses on resource requests or information about the network?
    A) INFRASTRUCTURE LAYER
    B) APPLICATION LAYER
    C) MANAGEMENT PLANE
    D) CONTROL LAYER

Answer 14

B) APPLICATION LAYER
Explanation
OBJ-1.7: The application layer focuses on the communication resource requests or information about the network. The control layer uses the information from applications to decide how to route a data packet on the network and to make decisions about how traffic should be prioritized, how it should be secured, and where it should be forwarded to. The infrastructure layer contains the physical networking devices that receive information from the control layer about where to move the data and then perform those movements. The management plane is used to monitor traffic conditions, the status of the network, and allows network administrators to oversee the network and gain insight into its operations.

Question 15

16. Which type of network device operates at layer 2 of the OSI model and allows connected devices to operate at full-duplex since each port is in their own collision domain?
    A) ACCESS POINT
    B) ROUTER
    C) SWITCH
    D) HUB

Answer 15

C) SWITCH
Explanation
OBJ-2.1: A switch is networking hardware that connects devices on a computer network by using packet switching to receive and forward data to the destination device. A switch operates at the data link layer (Layer 2) of the OSI model and makes switching decisions based upon MAC addresses. Each switchport on a switch is a separate collision domain, but all switchports are in a common broadcast domain. A router is networking hardware that connects computer networks and forwards data packets between those networks. A router operates at the network layer (Layer 3) of the OSI model and makes routing decisions based upon IP addresses. Each switchport on a router is a separate collision domain and a separate broadcast domain. A hub is a network hardware device for connecting multiple Ethernet devices together and making them act as a single network segment. A hub operates at the physical layer (Layer 1) of the OSI model. All devices connected by a hub are in a single collision domain and a single broadcast domain, therefore they must use half-duplex for communication and CSMA/CD. A wireless access point is a networking device that allows other Wi-Fi devices to connect to a wired network. A wireless access point operates at the physical layer (Layer 1) of the OSI model to extend the wired network into the wireless domain.

Question 16

17. The network administrator noticed that the border router has high network capacity loading during non-working hours. This excessive load is causing outages for the company’s web servers. Which of the following is the MOST likely cause of the issue?
    A) DISTRIBUTED DoS
    B) SESSION HIJACKING
    C) EVIL TWIN
    D) ARP SPOOFING

Answer 16

A) DISTRIBUTED DoS
Explanation
OBJ-4.2: A distributed denial-of-service (DDoS) attack occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. A denial-of-service attack is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting the services of a host connected to the Internet. ARP spoofing is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker’s MAC address with the IP address of a legitimate computer or server on the network. Session hijacking, also known as TCP session hijacking, is a method of taking over a web user session by surreptitiously obtaining the session ID and masquerading as the authorized user. An evil twin is a rogue wireless access point that masquerades as a legitimate Wi-Fi access point so that an attacker can gather personal or corporate information without the user’s knowledge.

Question 17

18. Dion Training is concerned with the threat of an attacker modifying the MAC address to IP bindings within the local area network. Which of the following could be enabled on the company’s network to prevent this from occurring?
    A) DHCP SNOOPING
    B) DYNAMIC ARP INSPECTION
    C) PRIVATE VLAN
    D) ROUTER ADVERTISEMENT GUARD

Answer 17

B) DYNAMIC ARP INSPECTION
Explanation
OBJ-4.3: Dynamic ARP Inspection (DAI) is a security feature that validates Address Resolution Protocol (ARP) packets in a network. DAI allows a network administrator to intercept, log, and discard ARP packets with invalid MAC address to IP address bindings. A virtual LAN (VLAN) is any broadcast domain that is partitioned and isolated in a computer network at the data link layer (OSI layer 2). Port mirroring, ARP inspection, and VLANs do not add any redundancy to the network. DHCP snooping is a series of techniques applied to improve the security of a DHCP infrastructure. When DHCP servers are allocating IP addresses to the LAN clients, DHCP snooping can be configured on LAN switches to prevent malicious or malformed DHCP traffic or rogue DHCP servers. The IPv6 Router Advertisement Guard feature provides support for allowing the network administrator to block or reject unwanted or rogue router advertisement guard messages that arrive at the network device platform.

Question 18

19. A technician is tasked with troubleshooting a network’s slowness. While troubleshooting, the technician is unable to ping any external websites. Users report they can access the sites using the web browsers. What is the MOST likely cause of the failed pings?
    A) A VLAN HOPPING ATTACK IS BEING CONDUCTED
    B) TACACS+ IS MISCONFIGURED ON THIS NETWORK
    C) JUMBO FRAMES ARE NOT ENABLED ON THE NETWORK
    D) ICMP TRAFFIC BEING BLOCKED BY THE FIREWALL

Answer 18

D) ICMP TRAFFIC BEING BLOCKED BY THE FIREWALL
Explanation
OBJ-5.3: Many companies block ICMP at the firewall, causing ping to fail since it relies on ICMP. If the user can access the site in the web browser but cannot when using ping, then ICMP is most likely being blocked by the firewall. Jumbo frames are any frames larger than 1500 bytes, which is the default MTU size on most networks. VLANs are logical segments of the local area network. TACACS+ is used for remote authentication.

Question 19

20. You have just received an email regarding a security issue detected on the company’s standard web browser. Which of the following should you do to fix the issue?
    A) FIRMWARE UPDATE
    B) OS UPDATE
    C) DRIVER UPDATE
    D) VULNERABILITY PATCH

Answer 19

D) VULNERABILITY PATCH
Explanation
OBJ-4.3: Since there is a security issue with the current web browser, it most likely needs to be updated with a manufacturer’s vulnerability patch. A vulnerability patch is a piece of software that fixes security issues.

Question 20

21. Which of the following network devices would be considered a perimeter device and installed at the outermost part of the network?
    A) SWITCH
    B) BRIDGE
    C) WIRELESS ACCESS POINT
    D) FIREWALL

Answer 20

D) FIREWALL
Explanation
OBJ-2.1: A firewall is considered a perimeter security device. It should be installed at the perimeter or boundary of a network to provide maximum security. Switches, bridges, and wireless access points are all considered internal network devices and should not be installed at the network’s outermost perimeter.

Question 21

22. Which of the following IEEE specifications describes the use of VLANs?
    A) 802.1q
    B) 802.1x
    C) 802.3af
    D) 802.1d

Answer 21

A) 802.1q
Explanation
OBJ-2.3: 802.1Q is the networking standard that supports virtual LANs on an IEEE 802.3 Ethernet network. The standard defines a system of VLAN tagging for Ethernet frames and the accompanying procedures to be used by bridges and switches in handling such frames. Power over Ethernet (POE) is a technology that lets network cables carry electrical power. POE is defined in the IEEE 802.3af. The IEEE 802.1x standard is a network authentication protocol that opens ports for network access when an organization authenticates a user’s identity and authorizes them for access to the network. This defines port security. The user’s identity is determined based on their credentials or certificate, which is confirmed by the RADIUS server. The Spanning Tree Protocol (STP) is a network protocol that builds a loop-free logical topology for Ethernet networks to prevent bridge loops and the broadcast storms that results from them. STP is defined in the IEEE 802.1d standard.

Question 22

23. Your router has been turning itself off and on again for a few weeks. You begin to think back to when these issues began to occur and remember that each time it happened the lights also dimmed momentarily. You hook up a device to monitor the power being supplied to the router and identify that brownouts are frequently occurring, resulting in the router’s power cycling. What should you (a network technician) do to solve this problem?
    A) INSTALL A UPS
    B) INSTALL AN UPGRADED ROUTER
    C) INSTALL A NEW ELECTICAL OUTLET
    D) INSTALL A SURGE PROTECTOR

Answer 22

A) INSTALL A UPS
Explanation
OBJ-3.3: The best solution would be to install a UPS. Since you are a network technician and not an electrician, you should not install a new electrical circuit. The primary function of UPS is to provide battery backup when the electrical power fails or drops to an unacceptable voltage level. It ensures that your electrical equipment gets a consistent current so damage and device power cycling do not occur. A surge protector defends against possible voltage spikes that could damage your electronics, appliances, or equipment. A network technician is not qualified to install a new electrical outlet since that is a job for an electrician. The scenario presents issues that focus on the power levels, therefore installing an upgraded router would not solve these issues.

Question 23

24. A network engineer is designing an 802.11g wireless network that uses three wireless access points for complete coverage. Which of the following channel selections would result in the LEAST amount of interference between each access point?
    A) ADJACENT ACCESS POINTS SHOULD BE ASSIGNED CHANNELS 4, 8, AND 12 WITH A 40MHz CHANNEL WIDTH
    B) ADJACENT ACCESS POINTS SHOULD BE ASSIGNED CHANNELS 2, 6, AND 10 WITH A 20MHz CHANNEL WIDTH
    C) ADJACENT ACCESS POINTS SHOULD BE ASSIGNED CHANNELS 1, 6, AND 11 WITH A 20MHz CHANNEL WIDTH
    D) ADJACENT ACCESS POINTS SHOULD BE ASSIGNED CHANNELS 7, 9, AND 11 WITH A 40MHz CHANNEL WIDTH

Answer 23

C) ADJACENT ACCESS POINTS SHOULD BE ASSIGNED CHANNELS 1, 6, AND 11 WITH A 20MHz CHANNEL WIDTH
Explanation
OBJ-5.4: Because the overlapping signals are from access points from unrelated non-overlapping channels, the access points are least likely to interfere with each other. For Wireless B and G networks, you should always use channels 1, 6, and 11 to ensure you are using non-overlapping frequencies.

Question 24

25. It has been determined by network operations that there is a severe bottleneck on its mesh topology network. The field technician has chosen to use log management and found that one router makes routing decisions slower than the others on the network. Which of the following types of issues would you classify this as?
    A) DELAYED RADIUS RESPONSES
    B) NETWORK DEVICE CPU ISSUES
    C) STORAGE AREA NETWORK ISSUES
    D) NETWORK DEVICE POWER ISSUES

Answer 24

B) NETWORK DEVICE CPU ISSUES
Explanation
OBJ-5.5: Routing decisions are processed by the router and rely on the networking device’s central processing unit (CPU). The CPU performance can become a severe bottleneck in the network performance if you have an underpowered router for a large enterprise environment. Network device power issues would cause network outages, not network slowdowns as this scenario presented. The scenario did not state that this mesh network is a storage area network, therefore it is not a SAN issue. Similarly, the scenario did not mention authentication issues, therefore the network performance issue is not caused by delayed RADIUS responses.

Question 25

26. The network administrator is troubleshooting the switchports for a file server with dual NICs. The file server needs to be configured for redundancy, and the dual NICs need to be combined for maximum throughput. What feature on the switch should the network administrator ensure is enabled for best results?
    A) LOAD BALANCING
    B) LACP
    C) BPDU
    D) SPANNING TREE

Answer 25

B) LACP
Explanation
OBJ-2.3: The Link Aggregation Control Protocol (LACP) is the 802.3ad protocol is used to group numerous physical ports to make one high bandwidth path. This method can increase bandwidth and therefore, throughput. LACP can also provide network redundancy and load balancing. The Spanning Tree Protocol (STP) is a network protocol that builds a loop-free logical topology for Ethernet networks to prevent bridge loops and the broadcast storms that result from them. STP is defined in the IEEE 802.1d standard. A Bridge Protocol Data Unit (BPDU) is used by STP to prevent the bridge loops. Load balancing refers to the process of distributing a set of tasks over a set of resources, with the aim of making their overall processing more efficient. Load balancing can optimize the response time and avoid unevenly overloading some compute nodes while other compute nodes are left idle.

Question 26

27. Which of the following IEEE specifications describes the use of network authentication?
    A) 802.1d
    B) 802.3af
    C) 802.3ad
    D) 802.1x

Answer 26

D) 802.1x
Explanation
OBJ-2.3: The IEEE 802.1x standard is a network authentication protocol that opens ports for network access when an organization authenticates a user’s identity and authorizes them for access to the network. This defines port security. The user’s identity is determined based on their credentials or certificate, which is confirmed by the RADIUS server. The Spanning Tree Protocol (STP) is a network protocol that builds a loop-free logical topology for Ethernet networks to prevent bridge loops and the broadcast storms that result from them. STP is defined in the IEEE 802.1d standard. Link Aggregation Control Protocol or LACP is one element of an IEEE specification (802.3ad) that provides guidance on the practice of link aggregation for data connections. Power over Ethernet (POE) is a technology that lets network cables carry electrical power. POE is defined in the IEEE 802.3af.

Question 27

28. A wireless networking technician has completed an assessment of a wireless network and documented the detected signal strengths in various locations. Which of the following best describes this document?
    A) LOGICAL NETWORK DIAGRAM
    B) AUDIT REPORT
    C) NETWORK BASELINE
    D) SITE SURVEY REPORT

Answer 27

D) SITE SURVEY REPORT
Explanation
OBJ-3.2: A wireless site survey report will usually take the form of a floorplan with a color-coded series of rings on it to show the signal strengths of wireless network signals in various locations. This is often referred to as a “heat map” by technicians. The technician performing the survey will document this information and use it as a tool during troubleshooting and optimization efforts concerning the wireless coverage in a specific office or building. A logical network diagram illustrates the flow of information through a network and shows how devices communicate with each other. It typically includes elements like subnets, network objects and devices, routing protocols and domains, voice gateways, traffic flow, and network segments. Network baselining is the act of measuring and rating the performance of a network in real-time situations. Providing a network baseline requires testing and reporting of the physical connectivity, normal network utilization, protocol usage, peak network utilization, and average throughput of the network usage. A network audit entails collecting data, identifying threats and areas of weakness, and compiling a formal audit report. This report is then sent on to network administrators and other relevant parties.

Question 28

29. Which of the following types of agreements is used to protect an organization’s intellectual property and is considered legally binding between the signatories?
    A) SLA
    B) NDA
    C) AUP
    D) MOU

Answer 28

B) NDA
Explanation
OBJ-3.2: A non-disclosure agreement (NDA) is a documented agreement between two parties that define what data is considered confidential and cannot be shared outside of that relationship. An NDA is used to protect an organization’s intellectual property. An acceptable use policy (AUP) is a set of rules applied by the owner, creator, or administrator of a network, website, or service, that restrict how the network, website, or system may be used and sets guidelines as to how it should be used. A memorandum of understanding (MOU) is a non-binding agreement between two or more organizations to detail what common actions they intend to take. A service level agreement (SLA) is a documented commitment between a service provider and a client, where the quality, availability, and responsibilities are agreed upon by both parties.

Question 29

30. A network administrator, Tamera, follows the best practices to implement firewalls, patch management, and security policies on his network. Which of the following should be performed to verify that the security controls are in place?
    A) SINGLE POINT OF FAILURE TESTING
    B) PENETRATION TESTING
    C) AAA AUTHENTICATION TESTING
    D) DISASTER RECOVERY TESTING

Answer 29

B) PENETRATION TESTING
Explanation
OBJ-4.1: Penetration testing or pentesting is the practice of testing a computer system, network, or web application in order to find vulnerabilities that an attacker could exploit. It can be used to ensure all security controls are properly configured and in place. Authentication, authorization, and accounting (AAA) is a term for a framework for intelligently controlling access to computer resources, enforcing policies, auditing usage, and providing the information necessary to bill for services. Testing AAA might be a part of a larger penetration test, but by itself it would not test the firewalls and patch management systems sufficiently. A disaster recovery test (DR test) is the examination of each step in a disaster recovery plan as outlined in an organization’s business continuity/disaster recovery planning process. A disaster recovery test would not test the firewalls, patch management, or security policies. A single point of failure (SPOF) is a part of a system that, if it fails, will stop the entire system from working. A single point of failure test is used to identify a single point of failure in the network or system, and it is not designed to test the network’s firewalls, patch management, or security policies.

Question 30

31. Which of the following encryption types was used by WPA to better secure wireless networks than WEP?
    A) AES
    B) TKIP
    C) CCMP
    D) IV

Answer 30

B) TKIP
Explanation
OBJ-2.4: Wi-Fi protected access (WPA) is an improved encryption scheme for protecting Wi-Fi communications designed to replace WEP. WPA uses the RC4 cipher and a temporal key integrity protocol (TKIP) to overcome the vulnerabilities in the older WEP protection scheme. Wired equivalent privacy (WEP) is an older mechanism for encrypting data sent over a wireless connection. WEP is considered vulnerable to attacks that can break its encryption. WEP relies on the use of a 24-bit initialization vector to secure its preshared key. Wi-Fi protected access version 2 (WPA2) replaced the original version of WPA after the completion of the 802.11i security standard. WPA2 features an improved method of key distribution and authentication for enterprise networks, though the pre-shared key method is still available for home and small office networks. WPA2 uses the improved AES cipher with counter mode with cipher-block chaining message authentication protocol (CCMP) for encryption.

Question 31

32. A network administrator needs to install a centrally located firewall that needs to block specific incoming and outgoing IP addresses without denying legitimate return traffic. Which type of firewall should the administrator install?
    A) A HOST-BASED STATELESS FIREWALL
    B) A STATELESS NETWORK-BASED FIREWALL
    C) A HOST-BASED STATEFUL FIREWALL
    D) A STATEFUL NETWORK-BASED FIREWALL

Answer 31

D) A STATEFUL NETWORK-BASED FIREWALL
Explanation
OBJ-2.1: A stateful firewall enhances security through packet filtering, and these types of firewalls also keep track of outbound requests and open the port for the returning traffic to enter the network. Since a centrally located firewall was required by the question, a network-based firewall should be chosen instead of a host-based firewall.

Question 32

33. Which of the following would require the network administrator to schedule a maintenance window?
    A) A MAJOR RELEASE UPGRADE OF A CORE SWITCH IN A TEST LAB
    B) REBOOTING THE NETWORK ADMINISTRATOR’S LAPTOP
    C) A MINOR RELEASE UPGRADE OF A PRODUCTION ROUTER
    D) A COMPANY-WIDE EMAIL NOTIFICATION MUST BE SENT OUT

Answer 32

C) A MINOR RELEASE UPGRADE OF A PRODUCTION ROUTER
Explanation
OBJ-3.2: During an update of a production router, the router would not route packets, and the network traffic would be affected. Therefore, it would be necessary to announce a maintenance window. A maintenance window is a period of time designated in advance by the technical staff, during which preventive maintenance that could disrupt service is allowed to be performed.

Question 33

34. A network engineer is conducting an assessment for a customer who wants to implement an 802.11ac wireless network. What should the engineer reference before estimating the number of WAPs required?
    A) PoE REQUIREMENTS
    B) SITE SURVEY
    C) NETWORK TOPOLOGY
    D) NETWORK DIAGRAM

Answer 33

B) SITE SURVEY
Explanation
OBJ-3.2: Since it is a wireless network, a review of a site survey is necessary to determine any physical advantages and disadvantages. Network topology and network diagrams can be created once the site survey is complete, and the location of the access points is determined based on distance and expected coverage requirements. The purpose of a wireless site survey is to look at the feasibility of each individual wireless link to provide seamless connectivity for a wireless network.

Question 34

35. Which of the following network devices is used to separate broadcast domains?
    A) BRIDGE
    B) SWITCH
    C) HUB
    D) ROUTER

Answer 34

D) ROUTER
Explanation
OBJ-2.1: A router is networking hardware that connects computer networks and forwards data packets between those networks. A router operates at the network layer (Layer 3) of the OSI model and makes routing decisions based upon IP addresses. Each switchport on a router is a separate collision domain and a separate broadcast domain. A hub is a network hardware device for connecting multiple Ethernet devices together and making them act as a single network segment. A hub operates at the physical layer (Layer 1) of the OSI model. All devices connected by a hub are in a single collision domain and a single broadcast domain, therefore they must use half-duplex for communication and CSMA/CD. A switch is networking hardware that connects devices on a computer network by using packet switching to receive and forward data to the destination device. A switch operates at the data link layer (Layer 2) of the OSI model and makes switching decisions based upon MAC addresses. Each switchport on a switch is a separate collision domain, but all switchports are in a common broadcast domain. A bridge is networking hardware that forwards traffic between network segments at the data link layer (Layer 2) of the OSI model using MAC addresses. Each switchport on a bridge is a separate collision domain, but all switchports are in a common broadcast domain.

Question 35

36. The Security Operations Center is trying to determine if there are any network anomalies currently being observed. To assist them, you gather information about the current performance of the network. Which of the following should you also gather to compare the current information against?
    A) Pcap
    B) LOGS
    C) NetFlow
    D) BASELINE

Answer 35

D) BASELINE
Explanation
OBJ-3.1: While all of the network artifacts, such as logs, pcap files, and NetFlow data, are useful, the general terms for the historical network performance data is a baseline. A baseline may be created from these other types of data, but the baseline is the MOST correct answer based on the question. A baseline is a process for studying the network at regular intervals to ensure that the network is working as designed.

Question 36

37. You typed IPCONFIG at the command prompt and find out your IP is 192.168.1.24. You then go to Google.com and search for “what is my IP,” and it returns a value of 35.25.52.11. How do you explain why your computer has two different IP addresses?
    A) THIS IS CAUSED BECAUSE OF THE WAY ROUTERS HANDLE IP ADDRESSES
    B) THIS IS CAUSED BY HOW A SWITCH HANDLES IP ADDRESSES
    C) THIS IS CAUSED BY THE WAY TRAFFIC IS ROUTED OVER THE INTERNET
    D) THIS IS CAUSED BECAUSE YOUR GATEWAY IS CONDUCTING NAT OR PAT

Answer 36

D) THIS IS CAUSED BECAUSE YOUR GATEWAY IS CONDUCTING NAT OR PAT
Explanation
OBJ-1.4: Your computer network uses a private IP address for machines within the network and assigns a public IP address for traffic being routed over the network using either NAT or PAT. Most small office home office (SOHO) networks utilize a single public IP for all of their devices and use a technique known as PAT to associate the public IP with each internal client’s private IP when needed. Network Address Translation (NAT) and Port Address Translation (PAT) allow multiple devices on a LAN to be mapped to a single public IP address to conserve IP address. In NAT, private IP addresses are translated into public IP addresses. In PAT, private IP addresses are translated into a single public IP address and their traffic is segregated by port numbers.

Question 37

38. Which of the following provides accounting, authorization, and authentication via a centralized privileged database, as well as challenge/response and password encryption?
    A) ISAKMP
    B) MULTI-FACTOR AUTHENTICATION
    C) NETWORK ACCESS CONTROL
    D) TACACS+

Answer 37

D) TACACS+
Explanation
OBJ-4.1: TACACS+ is a AAA (accounting, authorization, and authentication) protocol to provide AAA services for access to routers, network access points, and other networking devices. TACACS+ is a remote authentication protocol, which allows a remote access server to communicate with an authentication server to validate user access onto the network. TACACS+ allows a client to accept a username and password, and pass a query to a TACACS+ authentication server. Multifactor authentication is an authentication scheme that works based on something you know, something you have, something you are, something you do, or somewhere you are. These schemes can be made stronger by combining them (for example, protecting the use of a smart card certification [something you have] with a PIN [something you know]). Network Access Control (NAC) is a means of ensuring endpoint security by ensuring that all devices connecting to the network conform to a health policy such as its patch level, antivirus/firewall configuration, and other factors. Internet Security Association and Key Management Protocol (ISAKMP) is used for negotiating, establishing, modification, and deletion of SAs and related parameters in the IPSec protocol.

Question 38

39. An end-user receives a new computer and now is unable to connect to the MySQL database over the Dion Training local area network. Other users can successfully connect. The network technician can successfully ping the database server but still is unable to connect. Which of the following is the most likely reason for this issue?
    A) THE ROUTE TO THE DATABASE SERVER’S SUBNET IS MISSING
    B) THE DATABASE SERVER IS CONFIGURED WITH THE WRONG DEFAULT GATEWAY ADDRESS
    C) A HOST-BASED FIREWALL ON THE USER’S COMPUTER IS BLOCKING PORT 3306
    D) THE END USER’S NETWORK INTERFACE CARD IS DEFECTIVE

Answer 38

C) A HOST-BASED FIREWALL ON THE USER’S COMPUTER IS BLOCKING PORT 3306
Explanation
OBJ-5.5: MySQL uses ports 3306, and is an open-source relational database management system that is fully compatible with the structured query language (SQL). Since the network technician can pin the MySQL server, it indicates that the route is not missing, the database server is configured with the proper gateway, and the network interface card is not defective. Instead, it is likely that the end user’s computer has a host-based firewall installed, like Windows Defender, and it is blocking outbound requests over port 3306 (MySQL). A change in the firewall settings to allow access to the specified ports will fix the problem. It appears the default firewall on this new computer is blocking the port used to communicate with the database server.

Question 39

40. What is the broadcast address associated with the host located at 201.58.12.245/28?
    A) 201.58.12.241
    B) 201.58.12.255
    C) 201.58.12.254
    D) 201.58.12.240

Answer 39

B) 201.58.12.255
Explanation
OBJ-1.4: In classless subnets using variable-length subnet mask (VLSM), the broadcast address is the last IP address associated within an assigned range. In this example, the CIDR notation is /28, so each subnet will contain 16 IP addresses. Since the IP address provided is 201.58.12.245, the broadcast address will be 201.58.12.255.

Question 40

41. A network administrator recently set up a network computer lab and discovered some connectivity issues. The administrator can ping the fiber uplink interface, but none of the new workstations plugged into the switch are responding to the technician’s ICMP requests. Which of the following actions should the technician perform next?
    A) VERIFY THE PORTS ON THE SWITCH ARE FULL-DUPLEX
    B) DETERMINE IF PORT SECURITY IS ENABLED
    C) DETERMINE IF THE LINK LIGHTS ARE LIT FOR THE PORTS
    D) VERIFY THAT THE UPLINK INTERFACE IS CONFIGURED CORRECTLY

Answer 40

C) DETERMINE IF THE LINK LIGHTS ARE LIT FOR THE PORTS
Explanation
OBJ-5.2: A technician can use the LEDs on the switchports to quickly monitor activity and performance for the interfaces. By determining if the link lights are lit for the ports, the administrator can verify if there is any activity on the network, if the ports are enabled, and if the Layer 1 components are working properly. Additionally, some switches have LEDs to indicate if the switchport is operating in half-duplex or full-duplex, and the speed of the link

Question 41

42. You are currently troubleshooting a network connection error. When you ping the default gateway, you receive no reply. You checked the default gateway, and it is functioning properly, but the gateway cannot connect to any of the workstations on the network. Which of the following layers could be causing this issue?
    A) TRANSPORT
    B) PHYSICAL
    C) PRESENTATION
    D) SESSION

Answer 41

B) PHYSICAL
Explanation
OBJ-1.1: Ping requests occur at layer 3 (Network Layer). Therefore, the problem could exist in layer 1 (physical), layer 2 (data link), or layer 3 (network). Since Physical (layer 1) is the only choice from layers 1-3 given, it must be the correct answer. Also, since the gateway cannot reach any of the other devices on the network, it is most likely a cable (physical) issue between the gateway and the network switch.

Question 42

43. Dion Training wants to implement a technology that will automatically test any wireless device that connects to their network before allowing the device full access to the corporate network and its resources. Which of the following should be implemented?
    A) PSK
    B) VPN
    C) DMZ
    D) NAC

Answer 42

D) NAC
Explanation
OBJ-4.1: Network Access Control is an approach to computer security that attempts to unify endpoint security technology, user or system authentication, and network security enforcement. Effective network access control restricts access to only those devices that are authorized and compliant with security policies, meaning they have all the required security patches and anti-intrusion software. When a device connects to the network, it is placed into a automated testing area. If it passes the compliance testing, it is placed into the full corporate network. If it fails the compliance testing, it is placed into quarantine where it remains until it has been remediated or upgraded to meet the compliance requirements. A virtual private network extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. A pre-shared key (PSK) is a shared secret which was previously shared between the two parties using some secure channel before it needs to be used. A pre-shared key is used to encrypt data traversing over a WEP, WPA, or WPA2 wireless network. A DMZ or demilitarized zone is a physical or logical subnetwork that contains and exposes an organization’s external-facing services to an untrusted, usually larger, network such as the Internet.

Question 43

44. Mark is setting up a DHCP server on a segment of the corporate LAN. Which of the following options is NOT required in the DHCP scope to allow hosts on that LAN segment to be assigned a dynamic IP address and still be able to access the Internet and internal company servers?
    A) DEFAULT GATEWAY
    B) SUBNET MASK
    C) RESERVATIONS
    D) DNS SERVERS

Answer 43

C) RESERVATIONS
Explanation
OBJ-1.6: The DHCP must provide an IP address, subnet mask, default gateway, and DNS server to each client to effectively access the Internet. Using DHCP reservations is not required to be configured to meet the requirements provided in the question. DHCP reservations allow the DHCP server to pre-set an IP address to a specific client based on its MAC address. This ensures that the client will always get the same IP address from the DHCP server when it connects to the network. DHCP reservations are usually used with servers or printers on your internal network and are rarely used with end-user or client devices.

Question 44

45. Which of the following ports does SIP use?
    A) 80/443
    B) 389/636
    C) 5060/5061
    D) 139/445

Answer 44

C) 5060/5061
Explanation
OBJ-1.5: Session Initiation Protocol (SIP) uses ports 5060 and 5061, and is a signaling protocol for initiating, maintaining, and terminating real-time sessions that include voice, video, and messaging applications. The Hypertext Transfer Protocol (HTTP) uses port 80 and is an application layer protocol for distributed, collaborative, hypermedia information systems using unencrypted data transfer. HTTPS, the secured version of HTTP, uses port 443. The Lightweight Directory Access Protocol (LDAP) uses port 389 and is an open, vendor-neutral, industry-standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. LDAPS, the secured version of LDAP, uses port 636. Server Message Block (SMB) uses ports 139 and 445 and is a network file sharing protocol that runs on top of the NetBIOS architecture in Windows environments

Question 45

46. What port number does LDAP utilize?
    A) 636
    B)389
    C) 3389
    D) 1433

Answer 45

B)389
Explanation
OBJ-1.5: The Lightweight Directory Access Protocol (LDAP) uses port 389 and is an open, vendor-neutral, industry-standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. The Lightweight Directory Access Protocol Secure (LDAPS) uses port 636 and is an open, vendor-neutral, industry-standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network that is encrypted using an SSL connection. Microsoft SQL uses ports 1433 and is a proprietary relational database management system developed by Microsoft that is fully compatible with the structured query language (SQL). Remote Desktop Protocol (RDP) uses port 3389 and is a proprietary protocol developed by Microsoft which provides a user with a graphical interface to connect to another computer over a network connection.

Question 46

47. Which of the following network performance metrics is used to represent the theoretical maximum rate of data transfer from a source to a destination in a given amount of time under ideal conditions?
    A) JITTER
    B) THROUGHPUT
    C) BANDWIDTH
    D) LATENCY

Answer 46

C) BANDWIDTH
Explanation
OBJ-3.2: Bandwidth is the maximum rate of data transfer across a given network. Now, bandwidth is more of a theoretical concept that measures how much data could be transferred from a source to a destination under ideal conditions. Throughput is an actual measure of how much data is successfully transferred from the source to a destination. Therefore, we often measure throughput, instead of bandwidth, to monitor our network performance. Latency is the measure of time that it takes for data to reach its destination across a network. Usually, we measure network latency as the round-trip time from a workstation to the distant end and back. Jitter is a network condition that occurs when a time delay in the sending of data packets over a network connection occurs. Jitter is a big problem for any real-time applications you may be supporting on your networks, like video conferences, voice-over IP, and virtual desktop infrastructure clients.

Question 47

48. You are troubleshooting a point-to-point microwave link between two buildings that is supposed to operate at 1800 MHz. You suspect there is an issue with the frequency as it is transmitted or received. Which of the following tools would you use to observe the frequency as it is transmitted or received?
    A) TONE GENERATOR
    B) WiFi ANALYZER
    C) SPECTRUM ANALYZER
    D) TIME-DOMAIN REFLECTOMETER

Answer 47

C) SPECTRUM ANALYZER
Explanation
OBJ-5.2: A spectrum analyzer is used to measure the magnitude of an input signal’s frequency. A WiFi analyzer is used to gather information about the available wireless networks, troubleshoot wireless networking issues, ensure optimal router placement, and identify existing coverage areas. A tone generator is used with a toner probe to accurately identify the location of a cable pair or conductor within a wiring bundle, cross-connection point, or at the remote end. A tone generator is used with copper cables, not fiber optic cables. A time-domain reflectometer (TDR) is used to determine the characteristics of electrical lines by observing reflected waveforms to characterize and locate faults in copper cables.

Question 48

49. Tamera is troubleshooting a mail server connectivity issue and needs to review the MX records for DionTraining.com. Which of the following tools should she utilize?
    A) TELNET
    B) ROUTE
    C) ARP
    D) NSLOOKUP

Answer 48

D) NSLOOKUP
Explanation
OBJ-5.3: The nslookup command is used to query the domain name system (DNS) to obtain information about host addresses, mail exchanges, nameservers, and related information. The nslookup command has an interactive and non-interactive mode. The arp command is used to view and modify the local address resolution protocol (ARP) cache of a device, which contains recently resolved MAC addresses of IP hosts on the network. The route command is used to create, view, or modify manual entries in the network routing tables of a computer or server. The telnet command is used to open a command-line interface on a remote computer or server. Telnet operates in plain text mode and should never be used over an untrusted or public network.

Question 49

50. Max is a network technician who just terminated the ends on a new copper cable used between two legacy switches. When he connects the two switches using the cable, they fail to establish a connection. What is MOST likely the issue?`
    A) THE CABLE HAS RJ-11 CONNECTORS INSTEAD OF RJ-45
    B) THE CABLE HAS EXCEEDED BEND RADIUS LIMITATIONS
    C) THE CABLE IS A STRAIGHT-THROUGH CABLE
    D) THE CABLE IS A CROSSOVER CABLE

Answer 49

C) THE CABLE IS A STRAIGHT-THROUGH CABLE
Explanation
OBJ-2.3: There are two types of cable, Straight-through and Crossover. In this instance, a crossover cable would need to be used to communicate with legacy switches since they won’t support MDIX. A medium dependent interface crossover (MDIX) is a version of the medium dependent interface (MDI) enabling a connection between corresponding devices, such as a switch to another switch. If the switch doesn’t MDIX, then you must use a crossover cable to connect them. Bend radius cannot be the correct answer to this question since copper cables are being used and not fiber cables. Bend radius is a concern when using fiber cables as it leads to increase reflections and a decrease in signal strength. An RJ-11 connector only has 6 pins and is smaller than an RJ-45 connector. The technician would visually be able to see the difference as the RJ-11 connector would not fit properly in the switchports.

Question 50

51. An organization has hired you to upgrade its wired computer network. The network currently uses static routing for the internal network, but the organization wants to reconfigure it to use a dynamic routing protocol. The new dynamic routing protocol must support both IPv4 and VLSM. Based on the requirements provided, which of the following routing protocols should you enable and configure?
    A) OSPF
    B) HSRP
    C) VRRP
    D) RIPv1

Answer 50

A) OSPF
Explanation
OBJ-2.2: Only OSPF supports IPv4 and VLSM (Variable Length Subnet Mask) from the options provided in this question. Open Shortest Path First (OSPF) is a link-state routing protocol that was developed for IP networks and is based on the Shortest Path First (SPF) algorithm. OSPF is an Interior Gateway Protocol (IGP). VRRP, RIPv1, and HSRP do not support VLSM. The Virtual Router Redundancy Protocol is a computer networking protocol that provides for automatic assignment of available Internet Protocol routers to participating hosts. This increases the availability and reliability of routing paths via automatic default gateway selections on an IP subnetwork. The Hot Standby Router Protocol is a Cisco proprietary redundancy protocol for establishing a fault-tolerant default gateway. The Routing Information Protocol (RIP) is one of the oldest distance-vector routing protocols which employs the hop count as a routing metric. RIP prevents routing loops by implementing a limit on the number of hops allowed in a path from source to destination. While RIPv1 does not support VLSM, RIPv2 does support VLSM but was not an option in this question.

Question 51

52. You have been asked by your supervisor, Tamera, to ensure that you enable 802.3af on a managed switch. Which of the following features does she want you to enable?
    A) PoE
    B) TRUNKING
    C) PORT BONDING
    D) VLAN

Answer 51

A) PoE
Explanation
OBJ-2.3: The IEEE 802.3af standard defines power over Ethernet (PoE) and supports 15.4W of DC power to each device. The IEEE 802.3at standard defines PoE+ and supports 25.5W of DC power to each device. Power over Ethernet or PoE technology describes a system to safely transfer electrical power, along with data, to remote devices over standard data cables in an Ethernet network. Port bonding, or link aggregation, is part of the 802.3ad standard. Port bonding is the combining of multiple network connections in parallel by any of several methods, in order to increase throughput beyond what a single connection could sustain, to provide redundancy in case one of the links should fail, or both. VLANs are part of the 802.1q standard. A virtual LAN (VLAN) is any broadcast domain that is partitioned and isolated in a computer network at the data link layer (OSI layer 2). Trunking is also covered by the 802.1q protocol and supports VLANs.

Question 52

53. Which mitigation provides the best return on investment by mitigating the most vulnerable attack vector in an enterprise network?
    A) UPDATE ALL ANTIVIRUS DEFINITIONS ON WORKSTATIONS AND SERVERS
    B) ENABLE BIOMETRICS AND SSO FOR AUTHENTICATION
    C) REMOVE UNNEEDED SERVICES RUNNING ON THE SERVERS
    D) PROVIDE END-USER AWARENESS TRAINING FOR OFFICE STAFF

Answer 52

D) PROVIDE END-USER AWARENESS TRAINING FOR OFFICE STAFF
Explanation
OBJ-4.5: An enterprise network’s end users are the most vulnerable attack vector. Studies have shown that an investment in end-user cybersecurity awareness training has the best return on investment of any risk mitigation strategy. While all of the options presented are valid security mitigations, only end-user awareness training mitigates the biggest network vulnerability we have: our users.

Question 53

54. Your company has several small branch offices around the country, but you work as a network administrator at the centralized headquarters building. You need the capability of being able to remotely access any of the remote site’s routers to configure them without having to fly to each location in person. Your company’s CIO is worried that allowing remote access could allow an attacker to gain administrative access to the company’s network devices. Which of the following is the MOST secure way to prevent this from occurring while still allowing you to access the devices remotely?
    A) CONFIGURE THE REMOTE ROUTER’S ACLs TO ONLY PERMIT TELNET TRAFFIC
    B) CREATE AN OUT-OF-BAND MANAGEMENT NETWORK
    C) INSTALL AN OUT-OF-BAND MODEM
    D) CONFIGURE THE REMOTE ROUTER’S ACLs TO ONLY PERMIT HTTP TRAFFIC

Answer 53

B) CREATE AN OUT-OF-BAND MANAGEMENT NETWORK
Explanation
OBJ-4.4: You should create an out-of-band management network and use an SSH (console) connection to reach the routers. Out-of-band (OOB) management is a method of remotely controlling and managing critical IT assets and network equipment using a secure connection through a secondary interface that is physically separate from the primary network connection. Telnet and HTTP are not encrypted channels and should not be used for remote connections. Using a modem is also a bad security practice since these are subject to war dialing and provide slow connectivity speeds.

Question 54

55. IPv4 addresses are written using Base 10 numbers, while IPv6 addresses are written in Base 16 numbers. What type of notation does Base16 utilize?
    A) BINARY
    B) OCTET
    C) HEXADECIMAL
    D) DECIMAL

Answer 54

C) HEXADECIMAL
Explanation
OBJ-1.4: Hexadecimal (or Hex for short) is the system of numbering that uses Base16. This includes the numbers 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, and F. All IPv6 addresses and MAC addresses are written in hexadecimal format.

Question 55

56. Your network relies on the use of ATM cells. At which layer of the OSI model do ATM cells operate?
    A) TRANSPORT
    B) DATA LINK
    C) NETWORK
    D) SESSION

Answer 55

B) DATA LINK
Explanation
OBJ-1.1: In the data link layer (layer 2) of the OSI model, the basic unit of transfer is called a frame. In an ATM network, though, these frames are called cells and are of a fixed (53 octets or bytes) length that allows for faster switching of the cells across the network.

Question 56

57. Jason has just connected his new AirPods to his iPhone to listen to his music wirelessly. Which of the following types of networks is he using?
    A) LAN
    B) WAN
    C) CAN
    D) PAN

Answer 56

D) PAN
Explanation
OBJ-1.2: A personal area network (PAN) is centered around a short distance, usually around a person or up to a few meters. PANs are heavily used with Bluetooth and NFC. A local area network (LAN) connects computers within a small and specific area geographically. A campus area network (CAN) is a computer network that spans a limited geographic area. CANs interconnect multiple local area networks (LAN) within an educational or corporate campus. A wide area network (WAN) will typically cover a larger area geographically, such as a continent, a state, or a country.

Question 57

58. You opened your web browser and attempted to visit DionTraining.com, but you appear to have been redirected to a malicious website instead. What type of attack is being conducted?
    A) ROGUE DHCP
    B) DNS POISONING
    C) VLAN HOPPING
    D) ARP SPOOFING

Answer 57

B) DNS POISONING
Explanation
OBJ-4.2: DNS spoofing or DNS poisoning is an attack that corrupts the Domain Name System data in the DNS resolver’s cache and causes the name server to return an incorrect result record, such as an attacker’s IP address instead of the IP of the legitimate server. VLAN Hopping is an attack where the attacker is able to send traffic from one VLAN into another by either double tagging the traffic or conducting switch spoofing. ARP spoofing is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker’s MAC address with the IP address of a legitimate computer, server, or gateway on the network. A rogue DHCP server is a DHCP server set up on a network by an attacker, or by an unaware user, and is not under the control of network administrators. Rogue DHCP servers are also commonly used by attackers for the purpose of network attacks such as an on-path or man-in-the-middle attack.

Question 58

59. Which of the following is the BEST way to regularly prevent different security threats from occurring within your network?
    A) BUSINESS CONTINUITY TRAINING
    B) USER TRAINING AND AWARENESS
    C) PENETRATION TESTING
    D) DISASTER RECOVERY PLANNING

Answer 58

B) USER TRAINING AND AWARENESS
Explanation
OBJ-4.5: An enterprise network’s end users are the most vulnerable attack vector. Studies have shown that an investment in end-user cybersecurity awareness training has the best return on investment of any risk mitigation strategy. While a penetration test might detect various threats and vulnerabilities in your network, it does not prevent them from occurring. Disaster recovery planning creates a disaster recovery plan, which is a documented, structured approach that describes how an organization can quickly resume work after an unplanned incident. Business continuity training will teach employees what to do in the case of a business continuity plan execution. A business continuity plan defines how an organization will continue the delivery of products or services at pre-defined acceptable levels following a disruptive incident. Only end-user awareness training mitigates the biggest network vulnerability we have: our users.

Question 59

60. What remediation strategies are the MOST effective in reducing the risk to an embedded ICS from a network-based compromise? (Select TWO)
    A) SEGMENTATION
    B) NIDS
    C) DISABLING UNUSED SERVICES
    D) PATCHING

Answer 59

A) SEGMENTATION
C) DISABLING UNUSED SERVICES
Explanation
OBJ-2.1: Segmentation is the best method to reduce the risk to an embedded ICS system from a network-based compromise. Additionally, you could disable unused services to reduce the footprint of the embedded ICS. Many of these embedded ICS systems have a large number of default services running. So, by disabling the unused services, we can better secure these devices. By segmenting the devices off the main portion of the network, we can also better protect them. A NIDS might detect an attack or compromise, but it would not reduce the risk of the attack succeeding since it can only detect it. Patching is difficult for embedded ICS devices since they usually rely on customized software applications that rarely provide updates.

Question 60

61. Dion Training’s remote office is experiencing poor network performance. You have been asked to look at the traffic patterns for the remote office and compare them to the network performance baselines. Which of the following tools should you utilize?
    A) IP SCANNER
    B) SPECTRUM ANALYZER
    C) TERMINAL EMULATOR
    D) NETFLOW ANALYZER

Answer 60

D) NETFLOW ANALYZER
Explanation
OBJ-5.3: A NetFlow analyzer is used to perform monitoring, troubleshooting, inspection, interpretation, and synthesis of network traffic flow data. A NetFlow analyzer can help you quickly identify traffic patterns and the different applications/protocols in use on the network. A terminal emulator is used by a network administrator to make a given computer appear like an actual terminal or client computer networked to a server or mainframe. An IP scanner is used to monitor a network’s IP address space in real-time and identify any devices connected to the network. A spectrum analyzer is used to measure the magnitude of an input signal’s frequency.

Question 61

62. You are testing a cable you found in your network closet. You connect a cable tester to both sides of the cable to verify the pinout of the Ethernet cable. After testing each pin, your cable tester gives you the following output:
    A) RG-6 CABLE
    B) PATCH CABLE
    C) ROLLOVER CABLE
    D) CROSSOVER CABLE

Answer 61

B) PATCH CABLE
Explanation
OBJ-5.2: This is a patch cable (also known as a straight-through cable), as indicated by the matching of the Tx and Rx pins (pins 1, 2, 3, and 6) on both sides of the cable. Additionally, you may have noticed that there is an open on this cable on pin 4 since it is not sending a signal from pin 4 to pin 4 in the diagram. A crossover cable would have pins crossing from one side to the other, such as pin 1 going to pin 6. A rollover cable has opposite pin assignments on each end of the cable, such as pin 1 going to pin 8, pin 2 going to pin 7, etc. An RG-6 cable only has one internal copper wire, not 8 as shown in this diagram for a twisted-pair copper cable.

Question 62

63. Which of the following authentication protocols was developed by Cisco to provide authentication, authorization, and accounting services?
    A) TACACS+
    B) RADIUS
    C) CHAP
    D) KERBEROS

Answer 62

A) TACACS+
Explanation
OBJ-4.1: TACACS+ is an extension to TACACS (Terminal Access Controller Access Control System) and was developed as a proprietary protocol by Cisco. The Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that operates on port 1812 and provides centralized Authentication, Authorization, and Accounting management for users who connect and use a network service, but Cisco did not develop it. Kerberos is a network authentication protocol designed to provide strong mutual authentication for client/server applications using secret-key cryptography developed by MIT. Challenge-Handshake Authentication Protocol (CHAP) is used to authenticate a user or network host to an authenticating entity. CHAP is an authentication protocol but does not provide authorization or accounting services.

Question 63

64. The network install is failing redundancy testing at the MDF. The traffic being transported is a mixture of multicast and unicast signals. Which of the following devices would BEST handle the rerouting caused by the disruption of service?
    A) LAYER 3 SWITCH
    B) LAYER 2 SWITCH
    C) SMART HUB
    D) PROXY SERVER

Answer 63

A) LAYER 3 SWITCH
Explanation
OBJ-2.1: A layer 3 switch is the best option because, in addition to its capability of broadcast traffic reduction, it provides fault isolation and simplified security management. This is achieved through the use of IP address information to make routing decisions when managing traffic between LANs. Multicast and unicast are layer 3 messaging flows, so you need a router or layer 3 switch to route them across the network. A smart hub is a layer 1 device. A proxy server operates at layer 4, but would still require a router or layer 3 switch to route the traffic.

Question 64

65. Which network device operates at Layer 3?
    A) ROUTER
    B) HUB
    C) REPEATER
    D) BRIDGE

Answer 64

A) ROUTER
Explanation
OBJ-1.1: A router is a layer 3 device. A router is a networking device that forwards data packets between computer networks. Routers perform the traffic directing functions on the Internet. Routers make the Internet work by forwarding data using a unified addressing system. In our TCP/IP networks, routers forward their traffic based upon the IP address of the packets. A hub and repeater are both layer 1 devices (physical layer). A bridge is a layer 2 device (data link layer).

Question 65

66. Which of the following communication types are used in IPv6 to send a packet to the nearest interface that shares a common address in a routing table?
    A) MULTICAST
    B) BROADCAST
    C) UNICAST
    D) ANYCAST

Answer 65

D) ANYCAST
Explanation
OBJ-1.4: An IPv6 anycast address is an address that can be assigned to more than one interface (typically different devices). In other words, multiple devices can have the same anycast address. A packet sent to an anycast address is routed to the “nearest” interface having that address, according to the router’s routing table. Anycast communications are sent to the nearest receiver in a group of receivers with the same IP. Anycast only works with IPv6. Multicasting is a technique used for one-to-many communication over an IP network. Multicast can be used with both IPv4 and IPv6. Broadcast communication has one sender, but it sends the traffic to every device on the network. Broadcast only works with IPv4. Unicast communication only has one sender and one receiver. Unicast works with IPv4 or IPv6.

Question 66

67. You suspect that your server has been the victim of a web-based attack. Which of the following ports would most likely be seen in the logs to indicate the attack’s target?
    A) 21
    B) 443
    C) 389
    D) 3389

Answer 66

B) 443
Explanation
OBJ-1.5: Web-based attacks would likely appear on port 80 (HTTP) or port 443 (HTTPS). An attack against Active Directory is likely to be observed on port 389 LDAP. An attack on an FTP server is likely to be observed on port 21 (FTP). An attack using the remote desktop protocol would be observed on port 3389 (RDP).

Question 67

68. You have been asked to install a media converter that connects a newly installed RG-6 cable to the existing Cat 6a infrastructure. Which type of media converter should you use?
    A) MULTIMODE TO SINGLE-MODE
    B) FIBER TO COAXIAL
    C) FIBER TO ETHERNET
    D) COAXIAL TO ETHERNET

Answer 67

D) COAXIAL TO ETHERNET
Explanation
OBJ-1.3: A media converter is a Layer 1 device that changes one type of physical network connection to another. In this case, we are converting coaxial (RG-6) cable to Cat 6a (ethernet) cable.

Question 68

69. Which of the following components is used to identify a variable that may be set or read using SNMP?
    A) GRANULAR TRAP
    B) MIB
    C)OID
    D) VERBOSE TRAP

Answer 68

C)OID
Explanation
OBJ-3.1: The Simple Network Management Protocol (SNMP) uses ports 161 and 162, and it is a networking protocol used for the management and monitoring of network-connected devices in Internet Protocol networks. A unique objective identifier (OID) identifies a variable that can be read or set using the SNMP protocol. The management information base (MIB) is a translation file that is used to describe the structure of the management data of a device subsystem using a hierarchical namespace containing object identifiers (OID). A trap is an asynchronous notification from the agent to the manager. A trap is sent by the agent to notify the management of a significant event that is occurring in real-time, such as an alarming condition. A granular trap contains a unique object identifier (OID) number and a value for that OID. A verbose trap may contain all the information about a given alert or event as its payload. A verbose trap contains more information and data than a granular trap, and therefore requires more bandwidth to send the verbose trap over the network.

Question 69

70. Which of the following layers is NOT used in a three-tiered data center network architecture?
    A) ACCESS/EDGE LAYER
    B) CONTROL LAYER
    C) CORE LAYER
    D) DISTRIBUTION/AGGREGATION LAYER

Answer 69

B) CONTROL LAYER
Explanation
OBJ-1.7: The control layer is used in software-defined networking (SDN), not the three-tiered data center network architecture. The Core Layer is considered the backbone of our network and is used to merge geographically separated networks back into one logical and cohesive unit. In general, you will have at least two routers at the core level, operating in a redundant configuration. The distribution or aggregation layer is located under the core layer and it provides boundary definition by implementing access lists and filters to define the policies for the network at large. The access or edge layer is located beneath the distribution or aggregation layer and is used to connect all the endpoint devices like computers, laptops, servers, printers, wireless access points, and others.

Question 70

71. Barbara has connected her personal wireless router to a network jack inside her office. The router cannot get a DHCP address even though her corporate laptop can get a DHCP address when connected to the same jack. Barbara checked the router’s configuration to ensure it is set up to obtain a DHCP address. Which of the following is the MOST likely reason that the router is not getting a DHCP address?
    A) ONLY ALLOW LISTED MAC ADDRESSES CAN CONNECT TO THE NETWORK
    B) THE WIRELESS ROUTER’S MAC ADDRESS IS BLOCKLIST BY THE NETWORK
    C) DHCP REQUESTS THAT ORIGINATE FROM ACCESS POINTS ARE BLOCKED
    D) DHCP SNOOPING IS ENABLED ON THE NETWORK

Answer 70

A) ONLY ALLOW LISTED MAC ADDRESSES CAN CONNECT TO THE NETWORK
Explanation
OBJ-4.3: Allow lists specify MAC addresses as a security measure implemented by the administrator to only grant access to a specific user. It avoids a person with malicious intentions to access the corporate network. Since the router has a different MAC address, it is blocked from connecting to the wired network. Allow listed MAC addresses can be implemented automatically using different forms of port security on a network switch.

Question 71

72. A customer is trying to configure an 802.11b wireless card in an old laptop to connect to an 802.11g wireless router. When the customer scans for the wireless network’s SSID (Dion-Corp), it is not displayed within Windows. What is the MOST likely reason that the SSID is not being displayed?
    A) THE WIRELESS ROUTER IS NOT CONFIGURED FOR DHCP SUPPORT
    B) THE BROADCAST IS DISABLED ON THE WIRELESS ROUTER
    C) 802.11G AND 802.11B USE DIFFERENT FREQUENCIES
    D) THE WIRELESS ROUTER IS CONFIGURED WITH WPA2 ENCRYPTION

Answer 71

B) THE BROADCAST IS DISABLED ON THE WIRELESS ROUTER
Explanation
OBJ-5.4: If the SSID (Secure Set Identifier) is disabled, then the wireless network name will not be broadcast to any available devices within range. Both Wireless B and G use the same frequency band (2.4 GHz) and would not cause this issue. Similarly, encryption that is enabled or disabled would not affect the SSID broadcast since the SSID is sent out in cleartext. DHCP support is used once a device connects to the network. Therefore it would not affect the SSID broadcast.

Question 72

73. Which of the following is the correct order of the following Fiber Connectors shown?
    A) SC, ST, FC, LC(SINGLE), LC(DUPLEX)
    B) ST, SC, LC (SINGLE), LC (DUPLEX), FC
    C) LC (SINGLE), LC (DUPLEX), FC, ST, SC
    D) FC, LC (SINGLE), LC (DUPLEX), SC, ST

Answer 72

B) ST, SC, LC (SINGLE), LC (DUPLEX), FC
Explanation
OBJ-1.3: The correct order of the Fiber connections shown is ST, SC, LC (single), LC (duplex), and FC. If this were a real question on the exam, you would have the words provided in a list, and you would drag them below the appropriate fiber connector’s drawing.

Question 73

74. Dion Training installed a new router 183 days ago and it stopped working today due to a faulty power supply. The network technicians replaced the power supply and the router was returned to service within 4 hours. Which of the following terms would BEST represent the 183 days in this scenario?
    A) RTO
    B) MTTR
    C) RPO
    D) MTBF

Answer 73

D) MTBF
Explanation
OBJ-3.3: The mean time between failures (MTBF) measures the average time between when failures occur on a device. The mean time to repair (MTTR) measures the average time it takes to repair a network device when it breaks. The recovery time objective (RTO) is the duration of time and a service level within which a business process must be restored after a disaster to avoid unacceptable consequences associated with a break in continuity. The recovery point objective (RPO) is the interval of time that might pass during a disruption before the quantity of data lost during that period exceeds the Business Continuity Plan’s maximum allowable threshold or tolerance.

Question 74

75. Which of the following technologies deliver multiple voice calls over a copper wire if you have an ISDN or T-1 connection?
    A) ANALOG CIRCUIT SWITCHING
    B) CSMA/CD
    C) TIME-DIVISION MULTIPLEXING
    D) TIME-DIVISION SPREAD SPECTRUM

Answer 74

C) TIME-DIVISION MULTIPLEXING
Explanation
OBJ-1.2: Time-division multiplexing allows for two or more signals or bitstreams to be transferred in what appears to be simultaneous sub-channels in one communication channel but is physically taking turns on the channel. This is the technology used in a single PRI (ISDN or T-1) service to essentially share a single cable but pass multiple voice calls over it. Analog circuit switching is used by telephone providers on the Public Switched Telephone Network (PSTN), not with ISDN or T-1 connections. Time-division spread spectrum is not a real thing, spread spectrum is used in Wi-Fi, but it is based on frequency and not time. CSMA/CD is the carrier sense multiple access collision detection that is used for ethernet access at layer 2 of the OSI model. CSMA/CD is not used with ISDN or T-1 connections.

Question 75

76. A disgruntled employee executes an on-path attack on the company’s network. Layer 2 traffic destined for the gateway is now being redirected to the employee’s computer. What type of attack is this an example of?
    A) ARP SPOOFING
    B) IP SPOOFING
    C) REFLECTIVE DNS
    D) EVIL TWIN

Answer 75

A) ARP SPOOFING
Explanation
OBJ-4.2: ARP spoofing (also known as ARP poisoning) is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker’s MAC address with the IP address of a legitimate computer, server, or gateway on the network. A reflective DNS attack is a two-step attack used in DDoS attacks. The attacker sends a large number of requests to one or more legitimate DNS servers while using a spoofed source IP of the targeted victim. The DNS server then replies to the spoofed IP and unknowingly floods the targeted victim with responses to DNS requests that it never sent. An evil twin is a rogue wireless access point that masquerades as a legitimate Wi-Fi access point so that an attacker can gather personal or corporate information without the user’s knowledge. IP spoofing is the creation of Internet Protocol (IP) packets that have a modified source address to either hide the identity of the sender, impersonate another computer system, or both.

Question 76

77. Jason, a network technician, is troubleshooting a single-mode fiber that provides network connectivity to a remote site. He sees that the link light is off on the router’s network interface, and suspects that the fiber may have a break somewhere between his router and the remote site. Single-mode fiber is not providing network connectivity to a remote site. Which of the following tools could be used to identify the location of the break in the fiber?
    A) TONE GENERATOR
    B) MEDIA CONVERTER
    C) LIGHT METER
    D) OTDR

Answer 76

D) OTDR
Explanation
OBJ-5.2: An Optical Time Domain Reflectometer (OTDR) is used by organizations to certify the performance of new fiber optics links and detect problems with existing fiber links. An OTDR can identify if a fiber cable is broken and provide an approximate location for the break in meters or feet. A fiber light meter, also known as an optical power meter, is used to measure the power in an optical signal over a fiber optic cable. A fiber light meter could be used to test if the cable is broken, but it would not be able to determine where the break in the fiber cable is located. A tone generator is used with a toner probe to accurately identify the location of a cable pair or conductor within a wiring bundle, cross-connection point, or at the remote end. A tone generator is used with copper cables, not fiber optic cables. A media converter is a layer 1 networking device that connects two different media types, such as a copper twisted pair cable and a fiber optic cable.

Question 77

78. A user’s smartphone is displaying text in other languages in their web browser when accessing the company’s main website. Which of the following is the MOST likely cause of the issue?
    A) DENIAL-OF-SERVICE ATTACK
    B) ON-PATH ATTACK
    C) DEAUTHENTICATION ATTACK
    D) REFLECTIVE DNS ATTACKS

Answer 77

B) ON-PATH ATTACK
Explanation
OBJ-4.2: An on-path attack (previously known as a man-in-the-middle attack) is a general term when a perpetrator positions himself in a conversation between a user and an application, either to eavesdrop or impersonate one of the parties, making it appear as if a normal exchange of information is occurring. For example, if your user and server are both in the United States (English language), but the attacker is performing the on-path attack from Russia, then the server will utilize the Russian language in the text since it sees the connection coming from a Russian IP address. A denial-of-service attack is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet. A reflective DNS attack is a two-step attack used in DDoS attacks. The attacker sends a large number of requests to one or more legitimate DNS servers while using a spoofed source IP of the targeted victim. The DNS server then replies to the spoofed IP and unknowingly floods the targeted victim with responses to DNS requests that it never sent. A Wi-Fi deauthentication attack is a type of denial-of-service attack that targets communication between a user and a Wi-Fi wireless access point by sending a deauthentication frame to the victim’s machine.

Question 78

79. An outside organization has completed a penetration test for a company. One of the report items states that an attacker may have the ability to read TLS traffic from the webserver due to a software bug. What is the MOST likely mitigation for this reported item?
    A) IMPLEMENT A VPN FOR EMPLOYEES
    B) INSTALL AN IDS ON THE NETWORK
    C) ENSURE PATCHES ARE DEPLOYED
    D) CONFIGURE THE FIREWALL TO BLOCK TRAFFIC ON PORT 443

Answer 78

C) ENSURE PATCHES ARE DEPLOYED
Explanation
OBJ-4.3: A patch is designed to correct a known bug or fix a known vulnerability. Since the server is allowing an attacker to read TLS traffic, which should be encrypted and unreadable, this is a software bug in the webserver’s code that must be fixed using a patch. An intrusion detection system is a device or software application that monitors and reports on any malicious activity or policy violations on a network or system. An IDS would not mitigate or stop the attacker from reading the TLS traffic, it would only report that it is occurring. A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules to establish a barrier between a trusted and untrusted network. If you configured the firewall to block traffic on port 443 (HTTPS/SSL/TLS), it would block all of the webserver’s legitimate users, as well. A virtual private network extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. A VPN would not stop an attacker from being able to read the TLS traffic from the webserver.

Question 79

80. You work for a bank interested in moving some of its operations to the cloud, but it is worried about security. You recently discovered an organization called CloudBank that was formed by 15 local banks as a way for them to build a secure cloud-based environment that can be accessed by the 15 member banks. Which cloud model BEST describes the cloud created by CloudBank?
    A) PRIVATE CLOUD
    B) COMMUNITY CLOUD
    C) HYBRID CLOUD
    D) PUBLIC CLOUD

Answer 79

B) COMMUNITY CLOUD
Explanation
OBJ-1.8: Community Cloud is another type of cloud computing in which the cloud setup is shared manually among different organizations that belong to the same community or area. A multi-tenant setup is developed using the cloud among different organizations belonging to a particular community or group with similar computing concerns. For joint business organizations, ventures, research organizations, and tenders, a community cloud is an appropriate solution. Based on the description of 15 member banks coming together to create the CloudBank organization and its cloud computing environment, a community cloud model is most likely described. A public cloud contains services offered by third-party providers over the public Internet and is available to anyone who wants to use or purchase them. They may be free or sold on-demand, allowing customers to pay only per usage for the CPU cycles, storage, or bandwidth they consume. A private cloud contains services offered either over the Internet or a private internal network and only to select users instead of the general public. A hybrid cloud is a cloud computing environment that uses a mix of on-premises, private cloud, and third-party public cloud services with orchestration between these platforms. This typically involves a connection from an on-premises data center to a public cloud.

Question 80

81. A network technician has downloaded the latest operating system of a particular vendor’s switch. This update includes new features and enhancements. What should the technician perform FIRST when updating the switch’s operating systems?
    A) POWER CYCLE THE COMPANY’S BORDER ROUTER
    B) INSTALL DURING NON-BUSINESS HOURS TO TEST THE SYSTEM
    C) TEST THE O/S ON ONE OF THE PRODUCTION SWITCHES
    D) BACKUP THE CURRENT CONFIGURATION FOR EACH SWITCH

Answer 80

D) BACKUP THE CURRENT CONFIGURATION FOR EACH SWITCH
Explanation
OBJ-4.3: A preventive method is always to back up the current configuration to the NVRAM (SW# copy run start) in case the newly downloaded operating system doesn’t work properly. This would allow the technician to restore the switch from the previous backup. It is a good idea to install the operating system during non-business hours, as well, but you should first always make a backup of the current configuration.

Question 81

82. A network technician needs to monitor the network to find a user who is browsing websites that go against the company’s acceptable use policy. What should the technician use to view the website and find the user browsing it?
    A) INTRUSION DETECTION SYSTEM
    B) SNMP GET
    C) TOP LISTENER TOOL
    D) PACKET SNIFFER

Answer 81

D) PACKET SNIFFER
Explanation
OBJ-5.3: Packet Sniffers can capture and analyze network user traffic. This information can be queried to view website addresses, contents, and sometimes even password information. This differs from an intrusion detection system in that IDS’s wait to receive implicitly malicious data in a network before logging the event.

Question 82

83. Which of the following types of fire suppression systems utilizes a sprinkler system with water to extinguish a fire but requires both an actuator and the sprinklers to be tripped prior to water being released?
    A) CLEAN AGENT SYSTEM
    B) PRE-ACTION SYSTEM
    C) HVAC SYSTEM
    D) WET PIPE SYSTEM

Answer 82

B) PRE-ACTION SYSTEM
Explanation
OBJ-3.3: A fire suppression system is an engineered set of components that are designed to extinguish an accidental fire in a workplace or datacenter. A pre-action system minimizes the risk of accidental release from a wet pipe system. With a pre-action system, both a detector actuation like a smoke detector and a sprinkler must be tripped prior to water being released. A wet pipe system is the most basic type of fire suppression system, and it involved using a sprinkler system and pipes that always contain water in the pipes. Special suppression systems, like a clean agent system, use either a halocarbon agent or inert gas. When releases, the agents will displace the oxygen in the room with the inert gas and suffocates the fire. Heating Ventilation and Air Conditioning (HVAC) units are responsible for maintaining the proper temperature and humidity within a datacenter.

Question 83

84. Your company has two office buildings which are connected via a copper network cable that is buried underground. There is some construction being performed near the buildings. Now, the second building discovers they have suffered a network outage that doesn’t appear to be temporary. What is the MOST likely cause of the outage?
    A) AN OPEN CIRCUIT HAS BEEN CREATED
    B) CROSS-TALK ON THE CABLE
    C) ELECTROMAGNETIC INTERFERENCE ON THE CABLE
    D) SIGNAL ATTENUATION ON THE CABLE

Answer 83

A) AN OPEN CIRCUIT HAS BEEN CREATED
Explanation
OBJ-5.2: Since the issue started after construction began, it is most likely that the construction crew broke the cable during digging operations. This can cause an open circuit or short circuit, depending on how the cable was cut or broken by the construction workers. This can be verified using a Time-Domain Reflectometer to determine exactly where in the cable the break has occurred. Once the location is identified, the cable can be repaired or spliced to return it to normal operations.

Question 84

85. A technician is troubleshooting a workstation connectivity issue. The technician believes a static ARP may be causing the problem. What should the technician do NEXT according to the network troubleshooting methodology?
    A) REMOVE THE ARP ENTRY ON THE USER’S WORKSTATION
    B) DUPLICATE THE ISSUE IN A LAB BY ADDING A STATIC ARP ENTRY
    C) DOCUMENT THE FINDINGS AND PROVIDE A PLAN OF ACTION
    D) IDENTIFY A SUITABLE TIME TO RESOLVE THE CONNECTIVITY ISSUE

Answer 84

A) REMOVE THE ARP ENTRY ON THE USER’S WORKSTATION
Explanation
OBJ-5.1: Based on the network troubleshooting methodology, you should try to test your theory to determine the cause once you have established a theory of probable cause. In this scenario, the technician has a theory that the static ARP entry is the cause of the problem. Since this issue has already caused the workstation not to communicate, the best way to test your theory would be to remove the static ARP entry and see if the issue is resolved. If this doesn’t fix the issue, you would need to develop a new hypothesis to test. The troubleshooting steps are to (1) Identify the problem, (2) Establish a theory of probable cause, (3) Test the theory to determine the cause, (4) Establish a plan of action to resolve the problem and identify potential effects, (5) Implement the solution or escalate as necessary, (6) Verify full system functionality and if applicable implement preventative measures, and (7) Document findings, actions, outcomes, and lessons learned.

Question 85

86. You have been asked to connect three 802.11a devices to an 802.11g access point configured with WEP. The devices are within 20 feet of the access point, but they still cannot associate with the access point. Which of the following is the MOST likely cause of the devices not associating with the WAP?
    A) FREQUENCY MISMATCH
    B) MISMATCHED ENCRYPTION
    C) INTERFERENCE
    D) SIGNAL LOSS

Answer 85

A) FREQUENCY MISMATCH
Explanation
OBJ-2.4: 802.11a operates in the 5 GHz band, while 802.11g operates in the 2.4 GHz band. Therefore, 802.11a devices will be unable to communicate with 802.11b or 802.11g access points. Wireless networks utilize three different frequency bands: 2.4 GHz, 5 GHz, and 6 GHz. The 2.4 GHz frequency band is used by 802.11b, 802.11g, and 802.11n. The 5 GHz frequency band is used by 802.11a, 802.11n, 802.11ac, and 802.11ax. The 6 GHz frequency band is used by Wi-Fi 6E under the 802.11ax standard.

Question 86

87. You have installed and configured a new wireless router. The clients and hosts can ping each other. The network uses a fiber optic WAN connection with 1 Gbps throughput. The wired clients have fast connections, but the wireless clients are displaying high latency when a ping is performed. The wireless clients are also only receiving 300 Mbps when downloading files from the Internet. Which of the following is MOST likely the cause of the slow speeds experienced by the wireless clients?
    A) A FIBER CONNECTION DOES NOT SUPPORT WIRELESS
    B) THE NETWORK SHOULD USE 802.11G WAPs TO INCREASE THROUGHPUT
    C) A HIGH SIGNAL-TO-NOISE RATIO ON THE WIRELESS NETWORK
    D) THE WIRELESS ACCESS POINT IS EXPERIENCING RF INTERFERENCE

Answer 86

D) THE WIRELESS ACCESS POINT IS EXPERIENCING RF INTERFERENCE
Explanation
OBJ-5.4: If interference in the wireless spectrum occurs, more retransmissions will be needed (and thereby slowing speeds experienced and increasing latency). A high signal-to-noise ratio is a good thing on wireless networks and leads to faster speeds and lower retransmissions. The fiber connection itself is only used for the WAN connection, therefore you can use wired or wireless infrastructure for your internal LAN and connect the LAN to the WAN connection at the router. The wireless network is already getting throughputs of 300 Mbps, so it must be using 802.11n, 802.11ac, or 802.11ax for its wireless access points. If you switched to 802.11g, you would slow down the wireless network more since it has a maximum throughput of 54 Mbps.

Question 87

88. While troubleshooting, a technician notices that some clients using FTP still work and that pings to the local routers and servers are working. The technician tries to ping all known nodes on the network, and they reply positively, except for one of the servers. The technician notices that ping works only when the hostname is used but not when FQDN is used. What server is MOST likely offline?
    A) DNS SERVER
    B) DOMAIN CONTROLLER
    C) DHCP SERVER
    D) WINS SERVER

Answer 87

A) DNS SERVER
Explanation
OBJ-5.5: The DNS Server translates Fully Qualified Domain Names (FQDN) to IP addresses. The Domain Name System (DNS) uses port 53 and is a hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network. The Dynamic Host Configuration Protocol (DHCP) uses port 67 and is a network management protocol used on Internet Protocol (IP) networks for automatically assigning IP addresses and other communication parameters to devices connected to the network using a client-server architecture. A WINS server is a Microsoft Windows-based server running the Windows Internet Name Service (WINS) that can accept NetBIOS name registrations and queries. WINS servers maintain a database of NetBIOS name to IP address mappings for WINS clients on the network and speed up NetBIOS name resolution by eliminating broadcasts. Since the technician can ping the server using its hostname, the WINS server is working properly. Since the technician cannot ping the server using its fully qualified domain name (FQDN), the DNS server is likely offline.

Question 88

89. Which of the following components is used by an agent to send a complete set of key-pair values about a significant event or condition that is occurring in real-time by providing a full list of variables and values for a given device to a manager?
    A) MIB
    B) GRANULAR TRAP
    C) VERBOSE TRAP
    D) OID

Answer 88

C) VERBOSE TRAP
Explanation
OBJ-3.1: The Simple Network Management Protocol (SNMP) uses ports 161 and 162, and it is a networking protocol used for the management and monitoring of network-connected devices in Internet Protocol networks. A trap is an asynchronous notification from the agent to the manager. A trap is sent by the agent to notify the management of a significant event that is occurring in real-time, such as an alarming condition. A verbose trap may contain all the information about a given alert or event as its payload. A granular trap contains a unique object identifier (OID) number and a value for that OID. A verbose trap contains more information and data than a granular trap, and therefore requires more bandwidth to send the verbose trap over the network. A unique objective identifier (OID) identifies a variable that can be read or set using the SNMP protocol. The management information base (MIB) is a translation file that is used to describe the structure of the management data of a device subsystem using a hierarchical namespace containing object identifiers (OID).

Question 89

90. A network technician is selecting the best way to protect a branch office from as many different threats from the Internet as possible using a single device. Which of the following should meet these requirements?
    A) CONFIGURE A NIDS DEVICE
    B) CONFIGURE A HOST-BASED FIREWALL
    C) CONFIGURE A NETWORK_BASED FIREWALL
    D) CONFIGURE A UTM DEVICE

Answer 89

D) CONFIGURE A UTM DEVICE
Explanation
OBJ-2.1: Since this is a branch office and you want to protect it from as many threats as possible, using a Unified Threat Management (UTM) device would be best. A UTM will protect you from most things using a single device. A network-based firewall would provide basic protection, but a UTM will include anti-virus and other protections beyond just a firewall’s capabilities. Host-based firewalls are great, but the network-based firewall or UTM device is configured to protect all devices on a network whereas a host-based firewall only protects the single host device. A network-based intrusion detection system (NIDS) can detect threats, but it cannot stop or prevent them.