A network administrator has been tasked with configuring a network for a new corporate office. The office consists of two buildings, separated by 50 feet with no physical connectivity. The configuration must meet the following requirements:
- Devices in both buildings should be able to access the Internet.
- Security insists that all Internet traffic be inspected before entering the network.
- Desktops should not see traffic destined for other devices.
Select the appropriate network device for each location in the exhibit. Not all devices will be used, but all locations should be filled.
Explanation
A firewall at the point where the office meets the Internet inspects all Internet traffic before any of it enters the network, which is the security requirement. The router behind it is the gateway for the internal network and connects to Building A. The desktops in Building A connect to a switch, which forwards each frame only to the port of its destination, unlike a hub, which repeats every frame to every port and would let desktops see other devices' traffic. Building B has no cabling to Building A and only wireless clients, so a WAP fed from the Building A network provides Wi-Fi toward Building B and a wireless range extender in Building B repeats that signal across the 50-foot gap to the laptops and phone. The hub is the unused device.
After a recent power outage, users are reporting performance issues accessing the application servers. Wireless users are also reporting intermittent Internet issues.
Review the Network Health and Device Monitoring dashboards shown in the exhibits, then answer each question.
WAN uplinks:
| Uplink Name | Uplink Speed | Total Usage | Average Throughput | Loss | Average Latency | Jitter |
|---|---|---|---|---|---|---|
| WAN1 | 10G | 26,690GB Up/1,708.4GB Down | 353MBs Up/23.42MBs Down | 2.51% | 24ms | 9.5ms |
| WAN2 | 1G | 930GB Up/138GB Down | 12.21MBs Up/1.82MBs Down | 0.01% | 11ms | 3.9ms |
Device status:
| Device Name | IP Address | Ping Time | Total Traffic |
|---|---|---|---|
| Switch A | 10.1.99.22 | 30msec | 1Gbit/s |
| Switch B | 10.1.99.24 | 21msec | 100Mbit/s |
| WAP1 | 10.1.99.14 | 52msec | 90Mbit/s |
| WAP2 | 10.1.99.28 | 16msec | 100Mbit/s |
| Router A | 206.208.133.10 | Request timed out | 0Gbit/s |
| Router B | 206.208.133.9 | 40msec | 1Gbit/s |
| WirelessController | 10.1.99.10 | 17msec | 10Gbit/s |
Top hosts:
| # | SRC Host | Pkts | Flows | Bits |
|---|---|---|---|---|
| 1 | 206.208.133.9 | 8.73 Mp | 77 | 104.69 Gb |
| 2 | 10.1.90.53 | 13.45 Mp | 10 | 80.93 Gb |
| 3 | 10.1.90.55 | 12.41 Mp | 7 | 74.68 Gb |
| 4 | 10.1.59.81 | 259.42 kp | 23 | 3.01 Gb |
| 5 | 10.1.99.22 | 182.53 kp | 2 | 2.08 Gb |
| 6 | 10.1.99.14 | 433.96 kp | 11 | 2.08 Gb |
| 7 | 10.1.99.28 | 164.84 kp | 1 | 1.79 Gb |
| 8 | 10.1.99.10 | 840.56 kp | 180 | 1.70 Gb |
| 9 | 10.1.99.24 | 135.64 kp | 2 | 1.54 Gb |
| 10 | 10.1.99.60 | 133.33 kp | 1 | 1.51 Gb |
Explanation
Which WAN station should be preferred for VoIP traffic: WAN 2. Voice needs low loss, latency and jitter rather than raw bandwidth; G.729 voice needs packet loss well under 1 percent and low, steady delay. WAN 2 has 0.01% loss, 11 ms latency and 3.9 ms jitter, while WAN 1 has 2.51% loss, 24 ms latency, 9.5 ms jitter and visible downtime in WAN Health. Which device is experiencing connectivity issues: Router A, the only device whose ping shows Request timed out with 0 Gbit/s of traffic, matching the single device reported Down. Which workstation IP is generating the most traffic: 10.1.90.53. In Top Hosts, 206.208.133.9 is Router B and the 10.1.99.x addresses are the switches, access points and wireless controller listed in Device Status, so the busiest end host is 10.1.90.53 with 80.93 Gb, ahead of 10.1.90.55 (74.68 Gb) and 10.1.59.81 (3.01 Gb).
Which of the following steps of the troubleshooting methodology would most likely include checking through each level of the OSI model after the problem has been identified?
A.Establish a theory.Correct
B.Implement the solution.
C.Create a plan of action.
D.Verify functionality.
Explanation
Establishing a theory of probable cause is the step right after identifying the problem, and it includes questioning the obvious and considering multiple approaches such as working top-to-bottom or bottom-to-top through the OSI layers. Creating a plan of action and implementing the solution come after a theory has been tested and confirmed. Verifying functionality checks that the fix worked, rather than searching layer by layer for the cause.
While troubleshooting a VoIP handset connection, a technician's laptop is able to successfully connect to network resources using the same port. The technician needs to identify the port on the switch. Which of the following should the technician use to determine the switch and port?
A.LLDPCorrect
B.IKE
C.VLAN
D.netstat
Explanation
LLDP (IEEE 802.1AB) is a vendor-neutral discovery protocol in which the switch advertises its system name and port details, so a laptop running an LLDP client on that wall jack can read exactly which switch and port it is connected to. IKE negotiates IPsec security associations, a VLAN is a broadcast domain rather than a discovery tool, and netstat shows the host's own connections and ports, not the upstream switch port.
A network administrator needs to set up a file server to allow user access. The organization uses DHCP to assign IP addresses. Which of the following is the best solution for the administrator to set up?
A.A separate scope for the file server using a /32 subnet
B.A reservation for the server based on the MAC addressCorrect
C.A static IP address within the DHCP IP range
D.A SLAAC for the server
Explanation
A DHCP reservation binds a specific IP address to the server's MAC address, so the file server always receives the same address while still being managed centrally by DHCP. A separate /32 scope is not a practical way to serve a single host and adds needless complexity. Configuring a static address inside the DHCP pool risks an address conflict when DHCP hands the same address to another client. SLAAC is an IPv6 self-addressing method and does not guarantee a predictable address managed by the organization's DHCP service.
Which of the following technologies are X.509 certificates most commonly associated with?
A.PKICorrect
B.VLAN tagging
C.LDAP
D.MFA
Explanation
X.509 is the standard format for digital certificates used in a public key infrastructure (PKI), where a certificate authority signs certificates that bind a public key to an identity. VLAN tagging is a Layer 2 frame-marking method unrelated to certificates. LDAP can store or serve certificates but is a directory protocol, not the technology certificates belong to. MFA may use certificates as one factor, but X.509 itself is defined for PKI.
A network administrator wants to implement an authentication process for temporary access to an organization's network. Which of the following technologies would facilitate this process?
A.Captive portalCorrect
B.Enterprise authentication
C.Ad hoc network
D.WPA3
Explanation
A captive portal intercepts a new client's web traffic and requires it to authenticate or accept terms before granting network access, which suits temporary access such as guests and visitors. Enterprise authentication (802.1X with a RADIUS server) is designed for permanent users with managed credentials. An ad hoc network is a peer-to-peer wireless mode, not an authentication process. WPA3 secures the wireless link but does not by itself provide a temporary sign-in workflow.
A user is unable to navigate to a website because the provided URL is not resolving to the correct IP address. Other users are able to navigate to the intended website without issue. Which of the following is most likely causing this issue?
A.Hosts fileCorrect
B.Self-signed certificate
C.Nameserver record
D.IP helper
Explanation
When only one user resolves a name to the wrong IP address, the cause is local to that machine, and the hosts file is checked before DNS, so an incorrect entry there overrides the correct answer from the name servers. A wrong nameserver record would affect every user who relies on that DNS zone, not just one. A self-signed certificate causes a browser trust warning, not an incorrect name resolution. An IP helper forwards DHCP broadcasts across subnets and has nothing to do with resolving URLs.
A network administrator is planning to host a company application in the cloud, making the application available for all internal and third-party users. Which of the following concepts describes this arrangement?
A.MultitenancyCorrect
B.VPC
C.NFV
D.SaaS
Explanation
Multitenancy means a single cloud-hosted instance of an application or infrastructure serves several separate groups of users (tenants), here the company's internal users and its third-party users, while keeping their data and access logically isolated. SaaS describes a service model in which a provider delivers a finished application to customers; the administrator here is hosting the company's own application rather than consuming a provider's software. A VPC is an isolated virtual network segment in a public cloud, and NFV replaces dedicated network appliances with virtualized functions; neither describes sharing one application among different user groups.
Which of the following should be used to obtain remote access to a network appliance that has failed to start up properly?
A.Crash cart
B.Jump box
C.Secure Shell
D.Out-of-band managementCorrect
Explanation
Out-of-band management uses a dedicated path, such as a console server or a separate management network or cellular modem, that does not depend on the device's production interfaces or a fully booted operating system, so it gives remote access to an appliance that failed to start properly. A crash cart provides console access but requires someone to be physically present. A jump box and Secure Shell both rely on the appliance's in-band network stack being up, which is not the case when it has failed to boot.
Which of the following attacks utilizes a network packet that contains multiple network tags?
A.MAC flooding
B.VLAN hoppingCorrect
C.DNS spoofing
D.ARP poisoning
Explanation
VLAN hopping by double tagging places two 802.1Q tags in a frame: the first switch strips the outer tag that matches the native VLAN and forwards the frame, and the next switch reads the inner tag and delivers the frame into a VLAN the attacker should not reach. MAC flooding overwhelms a switch's MAC address table, DNS spoofing falsifies name resolution answers, and ARP poisoning sends forged ARP replies; none of them relies on multiple VLAN tags.
A network administrator is configuring a new switch and wants to connect two ports to the core switch to ensure redundancy. Which of the following configurations would meet this requirement?
A.Full duplex
B.802.1Q tagging
C.Native VLAN
D.Link aggregationCorrect
Explanation
Link aggregation (for example, LACP defined in IEEE 802.1AX) bundles two or more physical ports into one logical link, so traffic continues over the remaining member if one link fails, while also adding bandwidth. Full duplex only lets a single link send and receive at the same time. 802.1Q tagging carries multiple VLANs over a trunk, and the native VLAN is the untagged VLAN on that trunk; neither provides redundancy between two ports.
Which of the following ports is used for secure email?
A.25
B.110
C.143
D.587Correct
Explanation
Port 587 is the mail submission port, where clients send email to their server using STARTTLS to encrypt the session, so it is the secure email port among these options. Port 25 is SMTP relay between mail servers and is not inherently encrypted. Ports 110 (POP3) and 143 (IMAP) are the unencrypted retrieval ports; their TLS-protected counterparts are 995 and 993.
A client wants to increase overall security after a recent breach. Which of the following would be best to implement? (Choose two.)
A.Least privilege network accessCorrect
B.Dynamic inventories
C.Central policy managementCorrect
D.Zero-touch provisioning
E.Configuration drift prevention
F.Subnet range limits
Explanation
Least privilege network access limits each user and device to only the resources it needs, shrinking what an attacker can reach after a breach. Central policy management applies consistent security policies across the whole network from one place, closing gaps left by inconsistent configurations. Dynamic inventories and zero-touch provisioning are automation conveniences rather than security controls, configuration drift prevention mainly keeps devices matching a baseline, and subnet range limits do not by themselves restrict access.
Which of the following is a cost-effective advantage of a split-tunnel VPN?
A.Web traffic is filtered through a web filter.
B.More bandwidth is required on the company's internet connection.
C.Monitoring detects insecure machines on the company's network.
D.Cloud-based traffic flows outside of the company's network.Correct
Explanation
With a split-tunnel VPN, only traffic destined for the corporate network goes through the tunnel, while internet and cloud-based traffic goes directly out the user's own connection. This saves bandwidth on the company's internet link, which is the cost advantage. Filtering web traffic and monitoring insecure machines are benefits of a full tunnel, and needing more company bandwidth is a disadvantage, not an advantage.
A network technician is troubleshooting a web application's poor performance. The office has two internet links that share the traffic load. Which of the following tools should the technician use to determine which link is being used for the web application?
A.netstat
B.nslookup
C.ping
D.tracertCorrect
Explanation
tracert lists every router hop on the path to a destination, so tracing to the web application's server shows which of the two internet links (its first upstream gateway) the traffic leaves through. netstat lists local connections and ports but does not show which upstream path a connection takes. nslookup only resolves names, and ping only tests reachability and latency without showing the route.
Which of the following attacks can cause users who are attempting to access a company website to be directed to an entirely different website?
A.DNS poisoningCorrect
B.Denial-of-service
C.Social engineering
D.ARP spoofing
Explanation
DNS poisoning inserts false records into a DNS resolver's cache, so users who type the company's domain name are resolved to an attacker's IP address and land on a different website. ARP spoofing redirects traffic on a local segment by faking MAC-to-IP mappings, but it does not change which site a name points to for users in general. Denial-of-service makes the site unavailable rather than redirecting users, and social engineering manipulates people rather than name resolution.
As part of an attack, a threat actor purposefully overflows the content-addressable memory (CAM) table on a switch. Which of the following types of attacks is this scenario an example of?
A.ARP spoofing
B.Evil twin
C.MAC floodingCorrect
D.DNS poisoning
Explanation
MAC flooding sends a large number of frames with fake source MAC addresses to fill the switch's CAM table. Once the table is full, the switch floods frames out all ports like a hub, letting the attacker capture traffic. ARP spoofing poisons host ARP caches, an evil twin is a rogue wireless access point, and DNS poisoning corrupts name resolution; none of them targets the CAM table.
A company's office has publicly accessible meeting rooms equipped with network ports. A recent audit revealed that visitors were able to access the corporate network by plugging personal laptops into open network ports. Which of the following should the company implement to prevent this in the future?
A.URL filters
B.VPN
C.ACLs
D.NACCorrect
Explanation
Network access control (NAC), for example 802.1X port-based authentication, checks a device and its user before granting network access, so an unknown laptop plugged into a meeting-room port is blocked or placed in a guest network. URL filters control websites users can reach, a VPN encrypts remote connections, and ACLs filter traffic by address and port but do not authenticate devices connecting to a port.
A user notifies a network administrator about losing access to a remote file server. The network administrator is able to ping the server and verifies the current firewall rules do not block access to the network fileshare. Which of the following tools would help identify which ports are open on the remote file server?
A.dig
B.nmapCorrect
C.tracert
D.nslookup
Explanation
nmap is a port scanner that probes a host and reports which TCP and UDP ports are open, closed or filtered, so it shows whether the file-sharing service port on the server is listening. dig and nslookup query DNS, and tracert shows the routing path; none of them reports open ports on a host.
Verifying access...
Access Required
You need to purchase this exam to access practice mode
Unlock a few more questions every day for 300 points you earn free on
Godlike Academy. Everything you unlock with the Daily Climb stays open for 7 days after your last unlock.
