Free CompTIA Network+ Sample Questions

Correct answers: A, C — Establishing, maintaining, and terminating connections; Keeping different applications' data separate

• A. Correct. The Session layer's primary role is to establish, manage, and terminate sessions between applications on different devices. This includes coordinating the dialogue and managing the exchange of data so that it can be resumed if interrupted.
• B. Incorrect. Routing packets and logical addressing are functions of the Network layer (Layer 3).
• C. Correct. The Session layer is responsible for session multiplexing or dialog control, which ensures that data streams from various concurrent applications are kept distinct and do not interfere with each other.
• D. Incorrect. Data encryption, formatting, and translation are handled by the Presentation layer (Layer 6).
• E. Incorrect. Converting data into electrical, optical, or radio signals for physical transmission is the responsibility of the Physical layer (Layer 1).
• F. Incorrect. MAC (Media Access Control) addressing and framing occur at the Data Link layer (Layer 2).

Correct answer: C — DHCP

• A. Incorrect. DNS (Domain Name System) is responsible for resolving domain names into IP addresses. While DNS is necessary for browsing the internet by name, a failure here would not result in an APIPA address (169.254.x.x).
• B. Incorrect. SMTP (Simple Mail Transfer Protocol) is used for sending email messages between servers or from a client to a server. It has no role in the network addressing or configuration process.
• C. Correct. DHCP (Dynamic Host Configuration Protocol) is designed to automatically assign IP addresses and other configuration settings (like subnet masks and default gateways) to devices. When a device is set to obtain an IP automatically but cannot reach a DHCP server, it assigns itself an APIPA (Automatic Private IP Addressing) address in the 169.254.0.1 to 169.254.255.254 range.
• D. Incorrect. SNMP (Simple Network Management Protocol) is used for collecting information from, and configuring, network devices such as hubs, switches, and routers on an IP network. It does not provide IP address configuration to workstations.

Correct answers: A, C — BNC; F-type

• A. Correct. BNC (Bayonet Neill-Concelman) connectors are the industry standard for analog CCTV systems using coaxial cable. They feature a bayonet-style locking mechanism that allows for quick and secure connection and disconnection.
• B. Incorrect. SC (Subscriber Connector) is a fiber-optic connector characterized by its square shape and push-pull latching mechanism. It is used for high-speed data transmission, not coaxial cabling.
• C. Correct. F-type connectors are threaded coaxial connectors commonly used for cable television (CATV), satellite installations, and cable modems. They are a common type of connector found in legacy video distribution environments.
• D. Incorrect. RJ45 is an 8P8C modular connector used with twisted-pair copper cabling (e.g., Cat5e or Cat6) for Ethernet networking. This is what the contractor will likely use for the new IP-based system, but it is not found on legacy coaxial cables.
• E. Incorrect. LC (Lucent Connector) is a small form-factor fiber-optic connector used in high-density networking environments and often found in SFP transceivers.
• F. Incorrect. MPO (Multi-fiber Push On) is a high-density connector used with fiber optic ribbon cables to connect multiple fibers in a single interface, typically within data centers.

Correct answer: B — NAS provides file-level storage accessed via protocols like SMB/NFS, while SAN provides block-level storage accessed via protocols like iSCSI/Fibre Channel.

• A. This option incorrectly reverses the roles and typical transmission methods of SAN and NAS. NAS provides file-level storage usually over Ethernet, while SAN provides block-level storage often associated with Fibre Channel or iSCSI.
• B. Correct. NAS provides file-level storage accessed by clients via file-sharing protocols such as SMB/CIFS or NFS. SAN provides block-level storage that is accessed by servers using protocols like iSCSI or Fibre Channel, allowing the storage to appear to the OS as a locally attached disk.
• C. This option incorrectly describes the network infrastructure requirements. SANs often require a dedicated, high-speed storage network (such as a Fibre Channel fabric) to ensure performance, while NAS systems typically operate on the existing standard Ethernet LAN.
• D. This option incorrectly describes the use cases for NAS and SAN. NAS is commonly used for individual user file shares, while SAN is preferred for enterprise applications requiring high-speed block access, such as virtual machine clustering or database management.

Correct answer: C — 15

• A. Incorrect. Six links would only be sufficient for a ring or star topology for six nodes. This does not satisfy the requirement for every outpost to have a direct, dedicated link to every other outpost.
• B. Incorrect. Twelve links is an incorrect calculation for a mesh network. In a full mesh, the number of connections grows exponentially relative to the number of nodes, requiring more than two links per node.
• C. Correct. This scenario describes a full mesh topology. The mathematical formula to calculate the number of required links in a full mesh is n(n-1)/2, where n is the number of nodes (outposts). For 6 outposts, the calculation is 6(6-1)/2 = 15 links.
• D. Incorrect. Thirty links is the result of calculating n(n-1) without dividing by 2. This overestimates the requirement because it counts the connection between two points twice (e.g., A to B and B to A) instead of as one single dedicated link.

Correct answer: A — To replace proprietary hardware appliances with software running on standard servers

• A. Correct. NFV aims to replace traditional, proprietary network hardware appliances (such as routers, firewalls, and load balancers) with virtualized software instances running on standard, commodity (COTS) servers. This approach enhances flexibility, scalability, and reduces both capital and operational expenses.
• B. Incorrect. This describes a dedicated physical connection or cloud interconnect service (like AWS Direct Connect or Azure ExpressRoute), not the virtualization of network functions.
• C. Incorrect. This is the definition of Software as a Service (SaaS), which delivers end-user applications over the internet. NFV focuses on network infrastructure services rather than end-user software.
• D. Incorrect. This describes logical resource isolation and multitenancy (often achieved via VPCs or VNETs), which is a general cloud computing concept rather than the specific purpose of NFV.

Correct answer: C — Satellite; high latency and atmospheric attenuation

• A. Cellular networks can experience congestion and interference, but they are rarely available in remote mining sites lacking basic terrestrial infrastructure. Furthermore, the significant latency affecting VoIP is much more characteristic of satellite communication than cellular data.
• B. 802.11ac (Wi-Fi 5) is a local area networking standard designed for short-range indoor or limited outdoor use. It is not a viable technology for providing primary internet backhaul to a remote industrial site without existing infrastructure.
• C. Satellite internet is the primary solution for remote locations without terrestrial cabling. It introduces high latency due to the massive distance (approx. 35,000 km for GEO satellites) the signal must travel, which negatively impacts real-time applications like VoIP. Additionally, satellite signals are highly susceptible to atmospheric attenuation, specifically 'rain fade,' which can cause complete signal loss during heavy storms.
• D. Microwave line-of-sight is used for point-to-point links, but this option is incorrect because 'modal dispersion' is a phenomenon specifically related to multi-mode fiber optic cabling, not wireless radio transmissions. While microwave can be affected by rain, the combination of high latency and the remote nature of the site points more definitively to satellite.

Correct answers: A, B, C — HTTP; FTP; SSH

• A. HTTP (Hypertext Transfer Protocol) typically relies on unicast traffic for end-to-end communication. It operates as a request-response protocol in the client-server model, where a specific client requests data from a specific server in a one-to-one session.
• B. FTP (File Transfer Protocol) uses unicast traffic for its standard communication. It establishes direct, one-to-one control and data connections between a specific client and a specific server for the purpose of file transfers.
• C. SSH (Secure Shell) is a point-to-point remote administration protocol that relies on unicast traffic. It creates a secure channel between a single client and a target host for remote command execution or data transfer.
• D. ARP (Address Resolution Protocol) does not rely on unicast traffic for its standard discovery operation. In order to resolve a MAC address from an IP address on a local network, the ARP Request is typically sent as a broadcast.
• E. The DHCP (Dynamic Host Configuration Protocol) discovery phase uses broadcast traffic. Because the client does not yet have an IP address and does not know the address of the DHCP server, it broadcasts a DHCPDISCOVER message to the entire local subnet.
• F. OSPF (Open Shortest Path First) Hello packets are typically sent to multicast addresses (such as 224.0.0.5 or 224.0.0.6) rather than unicast. This allows the router to discover and maintain relationships with multiple neighbors on a shared network segment.

Correct answer: B — 192.168.15.128

• A. Incorrect. A subnet mask of 255.255.255.224 (/27) creates subnets in increments of 32 in the last octet. 192.168.15.0 is the network address for the 0-31 range, which does not contain the host 192.168.15.137.
• B. Correct. A subnet mask of 255.255.255.224 is a /27 prefix. This results in a block size of 32 (256 - 224 = 32). Subnet boundaries for the last octet occur at multiples of 32: 0, 32, 64, 96, 128, 160, etc. Since the host address 192.168.15.137 falls between 128 and 159, 192.168.15.128 is the base network address.
• C. Incorrect. 192.168.15.136 is a valid host address within the 192.168.15.128/27 subnet, but it is not the network address. Network addresses must align with the subnet boundary defined by the mask (multiples of 32 in this case).
• D. Incorrect. 192.168.15.160 is the network address for the next subnet (the 160-191 range). It does not include the server IP address 192.168.15.137.

Correct answer: B — Configuring 802.1Q encapsulation with the respective VLAN IDs.

• A. A Virtual IP (VIP) is typically used for high availability and redundancy protocols like HSRP, VRRP, or GLBP. It is not a requirement for configuring standard router-on-a-stick inter-VLAN routing.
• B. In a router-on-a-stick configuration, each subinterface must be configured with 802.1Q encapsulation and a matching VLAN ID. This allows the router to identify which VLAN the incoming tagged frames belong to and how to tag outgoing frames.
• C. PortFast is a Spanning Tree Protocol (STP) feature used on switch ports to transition them immediately to the forwarding state. It is not a configuration used on router interfaces and does not enable routing between VLANs.
• D. Dynamic routing protocols like OSPF are used to exchange routing information between different routers. For a single router performing inter-VLAN routing, the subinterfaces are considered directly connected networks, making a routing protocol between them unnecessary.

Correct answer: A — Hot aisle/cold aisle

• A. Correct. The hot aisle/cold aisle configuration involves arranging server racks so that the air intakes (fronts) face each other, creating a cold aisle, and the exhaust fans (backs) face each other, creating a hot aisle. This separation prevents the mixing of hot and cold air, significantly improving the efficiency of the cooling system.
• B. Incorrect. Plenum ventilation refers to the use of a plenum space (such as the area between a structural ceiling and a drop ceiling or beneath a raised floor) for air distribution. While it is a common datacenter feature, it refers to the space used for airflow rather than the specific orientation of the racks.
• C. Incorrect. Humidity control involves maintaining specific moisture levels in the air to prevent static electricity discharge or equipment corrosion. While critical for datacenter health, it is not the concept described by the physical orientation of server racks.
• D. Incorrect. Fire suppression refers to systems designed to detect and extinguish fires using agents like water, chemicals, or inert gases. It is a safety requirement but does not dictate rack layout for cooling efficiency.

Correct answers: B, D — Nodes can dynamically self-configure and self-heal if a path fails.; It uses multiple access points that communicate with each other to extend coverage.

• A. Incorrect. A wireless mesh network is specifically designed to minimize the need for a wired backbone. Only a few gateway nodes typically require a physical connection to the wired network, while others communicate wirelessly.
• B. Correct. One of the defining features of mesh networking is the ability for nodes to dynamically self-configure and self-heal. If one node or link fails, the network automatically calculates a new path to route traffic around the failure.
• C. Incorrect. Relying on a single central access point describes a traditional Basic Service Set (BSS) or star topology. Mesh networks are decentralized, distributing routing responsibilities across all participating nodes.
• D. Correct. In a wireless mesh network, multiple nodes (access points) communicate with each other to relay data across the network. This allows for coverage extension without needing every access point to have a direct wired backhaul connection.
• E. Incorrect. While mesh technology can be used for outdoor connectivity, it is not limited to point-to-point bridging. It is more commonly used for point-to-multipoint and multipoint-to-multipoint configurations in both indoor and outdoor environments.

Correct answer: B — The trunk link is configured as an access port on one side.

• A. A native VLAN mismatch occurs when the untagged VLAN identifiers do not match on both ends of a trunk. While this causes security risks, traffic leakage, and console error messages (like CDP native VLAN mismatch), it generally does not cause the trunk link to go into a 'down' state; it remains operational but handles untagged traffic incorrectly.
• B. For a trunk link to function correctly, both ends must be configured as trunk ports. If one side is configured as an access port and the other as a trunk, they cannot negotiate trunking (DTP will fail), and the link will not pass tagged VLAN traffic, effectively resulting in a trunking failure.
• C. The Spanning Tree Protocol (STP) may place a port in a blocking state to prevent a switching loop. While this stops the port from forwarding data, the link itself is not 'down' in terms of configuration failure; rather, it is in a deliberate state intended by the protocol to protect the network.
• D. A Maximum Transmission Unit (MTU) mismatch occurs when the maximum frame size differs between interfaces. This typically results in dropped frames, fragmentation issues, or performance degradation (especially with jumbo frames), but it does not prevent a trunk from initializing or bring the logical link down.

Correct answer: C — SNMPv3

• A. SNMPv1 is the original version of the protocol and relies on community strings transmitted in cleartext for access control. It does not support cryptographic authentication or encryption of management traffic.
• B. SNMPv2c offered performance improvements and additional protocol operations over version 1, but it still utilizes the community-based security model (indicated by the 'c'). It lacks the ability to encrypt data or provide secure authentication.
• C. SNMPv3 is the version that introduces the User-based Security Model (USM), providing a robust security framework. It supports message integrity, authentication (using MD5 or SHA), and confidentiality/privacy (using encryption like DES or AES) of management data.
• D. SNMPv4 is not a standard version of the protocol. SNMPv3 is currently the most advanced and secure version used in modern networking environments.

Correct answer: B — Impact analysis

• A. A rollback plan is a strategy used to revert to the previous state in the event that an upgrade or change fails. While it is a crucial part of the change management process, it describes recovery steps rather than the initial assessment of business disruption and downtime.
• B. An impact analysis evaluates the potential effects of a proposed change on business operations and network availability. Documenting potential downtime and specifically how it affects the accounting department's end-of-month processing is a primary component of impact analysis, as it identifies risks and dependencies.
• C. A standard operating procedure (SOP) is a set of documented, repeatable, step-by-step instructions for routine operations. While it might define how to perform a firmware upgrade generally, it does not assess the specific risks or business consequences of a particular scheduled event.
• D. An asset disposal plan outlines the procedures for the secure and environmentally friendly retirement of hardware, including data sanitization. It is unrelated to assessing the operational impact of a software or firmware upgrade on active production equipment.

Correct answer: B — Use a rollover cable to connect to the console port

• A. A client-to-site VPN is an in-band management method. Even if a VPN tunnel is successfully established, the administrator would still eventually need to initiate a VTY session (SSH/Telnet) to the router's internal IP to fix the configuration, which remains blocked by the ACL.
• B. Using a rollover cable to connect to the console port provides out-of-band (OOB) management. Console access uses a direct physical connection that bypasses the network interfaces and any Access Control Lists (ACLs) applied to VTY (virtual) lines, making it the most effective way to recover from a remote lockout.
• C. Accessing the router's web GUI via HTTPS is an in-band management method. If the ACL is intended to block management traffic, HTTPS would likely be blocked as well. Furthermore, many enterprise routers do not have the web interface enabled by default for security reasons.
• D. A REST API POST request relies on network reachability to the management plane. If inbound VTY traffic is blocked, it is highly probable that other network-based management paths, including API endpoints, are also restricted by the misconfiguration.

Correct answers: B, D — It actively dictates how the device processes current network traffic.; It resides in volatile memory (RAM) and is lost if the device loses power.

• A. This statement refers to the startup configuration. While the startup configuration is loaded into RAM upon boot to become the production configuration, the production (running) config itself is not stored in NVRAM.
• B. The production configuration (often called the running configuration) is the active set of instructions that dictates real-time behavior, including interface settings, routing protocols, and security rules.
• C. A standardized template used for new deployments is known as a baseline or golden configuration. While a production configuration should be based on a template, the live config is the unique operational state of a specific device.
• D. The production configuration resides in volatile memory (RAM). If the device reboots or loses power before the configuration is manually saved to non-volatile memory (the startup-config), all current changes will be lost.
• E. Historical archives are backups or snapshots of previous configurations kept for recovery purposes. The production configuration is the current, live operational state of the device.

Correct answers: A, B — AAAA; PTR

• A. Correct. The AAAA (quad-A) record maps a hostname to a 128-bit IPv6 address. It is the IPv6 equivalent of the A record used for IPv4.
• B. Correct. The PTR (Pointer) record is used for reverse DNS lookups, which resolve an IP address (either IPv4 or IPv6) back to a hostname. These records are found in reverse lookup zones.
• C. Incorrect. The A (Address) record is used specifically to map a hostname to a 32-bit IPv4 address, not an IPv6 address.
• D. Incorrect. The SRV (Service) record is used to define the location (hostname and port number) of specific services like VoIP or directory services, not for basic hostname-to-IP mapping.
• E. Incorrect. The CNAME (Canonical Name) record is used to create an alias from one domain name to another; it does not map directly to an IP address.
• F. Incorrect. The MX (Mail Exchange) record directs email to a specific mail server for the domain and is not used for hostname-to-IP resolution or reverse lookups.

Correct answer: A — Cable map

• A. A cable map (or cabling diagram) documents physical cabling paths and port-to-port connections, such as from a wall jack to a patch panel and then to a specific switch. It is the most efficient resource for tracing physical Layer 1 connections in an infrastructure.
• B. A logical diagram illustrates how data flows through a network, including IP addresses, subnets, and VLANs. It does not provide the physical wiring paths or cable termination details required to trace a specific wall jack to a port.
• C. A wireless site survey is used to assess Wi-Fi coverage, signal strength, and access point placement. It is not intended for tracing wired connections between physical wall jacks and network equipment.
• D. An asset inventory lists hardware components, such as serial numbers, models, and general locations for tracking purposes. While it tracks devices, it lacks the specific physical connection mappings needed to trace a cable path.

Correct answer: C — MTBF

• A. MTTR (Mean Time to Repair) measures the average amount of time required to repair a device or system and restore it to functionality after a failure. While important for service restoration planning, it does not indicate the expected lifespan or reliability of the hardware before a failure occurs.
• B. RPO (Recovery Point Objective) is a disaster recovery metric that defines the maximum acceptable amount of data loss measured in time (e.g., losing 4 hours of data). It is used to determine backup frequency rather than the physical reliability of network hardware.
• C. MTBF (Mean Time Between Failures) is the primary metric used to measure the reliability and predicted operating time of a hardware component before it fails. A higher MTBF indicates that the switch is expected to run for a longer period, making it the most relevant metric for the engineer's goal.
• D. RTO (Recovery Time Objective) is the maximum tolerable duration of time that a system can be down after a failure before it must be restored. It is a business continuity metric focused on recovery speed rather than the hardware's resistance to failure.

Correct answers: A, C — Update the asset management database to reflect the retired status.; Erase all device configurations and factory reset the hardware.

• A. Updating the asset management database is a critical administrative step in life-cycle management. It ensures that inventory tracking is accurate for auditing, financial depreciation, and infrastructure planning, signaling that the asset is no longer in active service.
• B. Renewing vendor support contracts is a task for active hardware to ensure continued technical support and replacement services. It is unnecessary for devices that are being removed from the network.
• C. Erasing configurations and performing a factory reset is a vital security component of the decommissioning process. This sanitization ensures that sensitive data, such as credentials, IP schemes, and proprietary configurations, is not exposed when the hardware is disposed of or repurposed.
• D. Upgrading firmware is a maintenance task performed on active equipment to resolve bugs or security vulnerabilities. There is no benefit to upgrading a device that is being retired.
• E. Placing devices in a warm site is a disaster recovery (DR) or business continuity strategy. Retired assets are generally not used for failover unless they are being formally repurposed as cold/warm standby gear, which is separate from the retirement phase.

Correct answer: A — Move the smart devices to a dedicated IoT VLAN that only permits outbound internet access for vendor updates.

• A. Placing smart TVs and thermostats into a dedicated IoT VLAN provides logical isolation from sensitive internal resources like file servers and domain controllers. Limiting the VLAN to only necessary outbound internet access for vendor updates follows the principle of least privilege and significantly reduces the internal attack surface.
• B. While static IP addresses may simplify device identification and tracking, they do not provide network segmentation. The devices would remain on the corporate subnet and would still be able to communicate with internal systems unless additional access control lists (ACLs) were applied.
• C. SCADA (Supervisory Control and Data Acquisition) networks are specifically designed for industrial control systems and operational technology. Placing general office IoT devices on a SCADA network is inappropriate and could introduce security and operational risks to critical infrastructure.
• D. Mobile Device Management (MDM) is used to manage and secure portable user devices like smartphones and tablets. Smart TVs and thermostats do not typically support MDM enrollment, and this method does not address the requirement for network-level segmentation.

Correct answer: C — Threat

• A. Incorrect. A vulnerability refers to a weakness, flaw, or gap in a system, process, or architecture that could be exploited. The ransomware syndicate is the external entity seeking to abuse weaknesses, not the weakness itself.
• B. Incorrect. An exploit is the specific method, code, or technique used to take advantage of a vulnerability. While the syndicate may utilize exploits (such as the phishing emails), the syndicate itself is the actor, not the method.
• C. Correct. In security terminology, a threat is any potential danger or adverse situation that could cause harm to an asset or organization. A ransomware syndicate is a 'threat actor'—an entity with the intent and capability to carry out attacks.
• D. Incorrect. Risk is the potential for loss or damage, typically calculated as the likelihood of a threat exploiting a vulnerability multiplied by the impact. While the syndicate increases the organization's risk profile, the syndicate itself is categorized as a threat.

Correct answers: A, C — The ability to permanently delete a user's personal data upon request.; Ensuring personal data is processed lawfully, fairly, and transparently.

• A. This requirement aligns with the General Data Protection Regulation (GDPR) 'right to erasure' (or right to be forgotten), which mandates that organizations must be able to permanently delete an individual's personal data upon their request when certain conditions are met.
• B. While encrypting sensitive information is a best practice and may be part of an overall security strategy, storing credit card data in an encrypted format is specifically a requirement of PCI DSS (Payment Card Industry Data Security Standard) rather than a core mandate of European privacy regulations like GDPR.
• C. This is a foundational principle of the GDPR. It requires that all personal data belonging to EU citizens be processed lawfully, fairly, and in a transparent manner regarding the data subject, ensuring they are informed about how their data is used.
• D. High network uptime targets (such as 99.999%) are operational goals typically defined in Service Level Agreements (SLAs). While important for business continuity and availability, they are not legal mandates under European privacy compliance frameworks.
• E. Physical air gaps are extreme network isolation measures used for highly sensitive or classified systems. GDPR requires 'appropriate technical and organizational measures' to ensure security, but it does not mandate specific physical architecture like air-gapping.
• F. Government security clearances are specific to national security, defense, or government-sector roles and are not a general requirement for private-sector organizations processing European customer data under privacy regulations.

Correct answer: B — TOTP token

• A. Incorrect. A biometric scanner is an authentication factor based on 'something you are' (e.g., fingerprint, iris, or facial recognition). It does not generate time-based numerical codes.
• B. Correct. A Time-based One-Time Password (TOTP) token generates a temporary, rotating code (usually every 30-60 seconds) based on a shared secret key and the current time. It is a common 'something you have' factor used in MFA.
• C. Incorrect. A smart card is a physical device containing a chip used for authentication ('something you have'). While it is a form of MFA, it does not typically generate rotating time-based codes like a TOTP token.
• D. Incorrect. A password is a static knowledge-based factor ('something you know'). It remains the same until manually changed and is not time-sensitive or rotating.
• E. Incorrect. Geofencing is a location-based security mechanism ('somewhere you are') that restricts access based on geographical boundaries. It is not an authentication token that produces codes.
• F. Incorrect. Single Sign-On (SSO) is an authentication process that allows a user to access multiple applications with a single set of credentials. It is an access management concept, not a specific token type or MFA factor.

Correct answers: A, D — Tailgating; Shoulder surfing

• A. Tailgating (or piggybacking) occurs when an unauthorized person gains entry by following an authorized person through a secured door, often relying on the authorized person's politeness to hold the door open. This directly matches the scenario of employees holding badge-access doors for delivery personnel.
• B. Phishing involves tricking users into revealing information through deceptive electronic communications, such as emails, SMS, or websites. This scenario describes physical vulnerabilities rather than digital credential theft.
• C. Dumpster diving refers to searching through trash or discarded waste for sensitive information that was not properly destroyed. No discarded materials are mentioned in this scenario.
• D. Shoulder surfing is the act of observing sensitive information by looking over someone's shoulder or viewing their screen from a distance. Visitors in the lobby viewing the receptionist's monitor to see internal directories is a classic example of this attack.
• E. An evil twin is a rogue wireless access point that mimics a legitimate one to capture network traffic. The scenario focuses on physical access and visual observation, not wireless network impersonation.
• F. An on-path attack (formerly known as Man-in-the-Middle) occurs when an attacker intercepts or alters communications between two parties on a network. There is no interception of network traffic described in this physical audit.

Correct answer: B — On the same internal subnet as the employee workstations.

• A. Placing a honeypot in the external DMZ exposes it to a high volume of public internet noise and automated scanning. While this can gather intelligence on external threats, it is ineffective at detecting lateral movement by an attacker who has already successfully penetrated the internal network.
• B. Positioning a decoy on the same internal subnet as employee workstations makes it a highly realistic target for attackers performing reconnaissance or lateral movement after a perimeter breach. This placement is optimal for detecting insider threats and post-compromise activity.
• C. Placing a decoy outside the perimeter firewall results in extreme exposure to indiscriminate global scanning. This configuration offers no visibility into internal attacker behavior and provides very little actionable data for securing the corporate internal environment.
• D. The out-of-band management network is isolated for administrative and maintenance traffic. Because it is not part of the standard production data paths, an attacker is much less likely to encounter it during initial lateral movement compared to a workstation or server subnet.

Correct answer: A — Place the server in a screened subnet.

• A. A screened subnet (traditionally known as a DMZ or Demilitarized Zone) places public-facing services in a separate, isolated network segment between the external internet and the internal corporate network. This architectural design uses firewalls to control traffic flow, ensuring that even if the web server is compromised, the attacker is restricted from pivoting or moving laterally into the trusted internal environment.
• B. MAC filtering is a Layer 2 security method that permits or denies access based on a device's hardware address. While it controls device access to a network, it does not provide the logical segmentation or isolation needed to prevent a threat actor from pivoting across network boundaries after a successful compromise.
• C. A captive portal is an authentication mechanism used to force users to interact with a web page before granting network access, commonly seen in guest Wi-Fi scenarios. It does not provide structural network isolation or prevent lateral movement within an infrastructure.
• D. Placing a public-facing server in the internal trusted zone is a security risk. If the server were compromised, the threat actor would have immediate access to internal corporate resources without any intervening security boundaries, making pivoting much easier.

Correct answers: A, B — PTZ cameras; Fisheye/Panoramic cameras

• A. PTZ (Pan-Tilt-Zoom) cameras are designed to move along two axes and adjust focal length. They are the ideal choice for actively tracking a person or object in real-time as they move across a room, either via manual control or automated tracking software.
• B. Fisheye or Panoramic cameras use specialized lenses or multiple sensors to provide a continuous 360-degree field of view. This allows for total situational awareness in an open-plan NOC and ensures there are no blind spots, satisfying the second requirement.
• C. Fixed focal length cameras have a static field of view that cannot be changed without physically moving the camera. They are unable to actively track moving subjects and would require multiple units to cover a large area, which still might result in blind spots.
• D. Infrared (IR) cameras provide visibility in low-light or zero-light conditions. While this is a valuable feature for security, it is a sensor capability rather than a camera type that provides active tracking or wide-angle 360-degree coverage.
• E. License Plate Recognition (LPR) cameras are highly specialized tools used to capture and read vehicle license plates. They are intended for parking lots or roadways and are not suitable for indoor room surveillance or tracking individuals.

Correct answer: A — Re-establish a new theory of probable cause.

• A. Correct. According to the CompTIA troubleshooting methodology, if a theory is tested and fails to resolve the issue, the technician must return to step 2 and re-establish a new theory of probable cause (or escalate if necessary). This iterative process continues until the root cause is identified.
• B. Incorrect. Documenting findings and closing the ticket is the final step of the methodology. It is only performed after the issue is resolved and system functionality is verified. Closing the ticket while the problem persists is improper procedure.
• C. Incorrect. Establishing a plan of action to implement a solution is step 4, which occurs after a theory has been successfully tested and confirmed. Since replacing the cable failed, a new cause must be found before creating a plan of action for a different fix.
• D. Incorrect. Verification of full system functionality is step 5, performed after a solution has been implemented. Because the packet drops are still occurring, the technician has not successfully resolved the issue and cannot yet verify functionality.

Correct answer: A — High jitter

• A. High jitter is the variation in packet arrival times. In real-time applications like VoIP, packets must arrive in a steady stream to be reassembled correctly. When jitter is high, packets arrive at irregular intervals or out of sequence, causing the DSP (Digital Signal Processor) to struggle, which results in 'robotic' sounding audio and shuffled syllables.
• B. Complete packet loss would result in dropped calls, total silence, or significant gaps in the conversation. Since the calls remain connected and the symptoms involve the quality and order of the sound, complete packet loss is not the cause.
• C. Crosstalk is a type of electromagnetic interference occurring between adjacent copper wires. While it can cause signal degradation or errors at the physical layer, it typically manifests as noise or data errors rather than the specific out-of-order packet delivery characteristic of network-layer jitter.
• D. Bandwidth saturation occurs when the volume of traffic exceeds the capacity of the link. While this often leads to congestion and can increase jitter or latency, the specific symptom of syllables arriving out of order is the primary definition of jitter. Bandwidth issues would more likely lead to dropped packets and clipping.

Correct answers: A, C — route; pathping

• A. Correct. The 'route' command (specifically 'route print') is used on Windows systems to view and manage the local IP routing table, which is the first requirement of the scenario.
• B. Incorrect. 'nslookup' is a tool used for querying the Domain Name System (DNS) to find IP addresses or domain name mappings. It does not provide routing information.
• C. Correct. 'pathping' is a Windows utility that combines the functionality of ping and traceroute (tracert). It provides details on network latency and packet loss at every hop along the path to a destination.
• D. Incorrect. 'arp' is used to view and manage the Address Resolution Protocol (ARP) cache, which maps Layer 3 IP addresses to Layer 2 MAC addresses on the local segment.
• E. Incorrect. 'nmap' is a network scanning and security auditing tool. While it is highly versatile for discovery, it is not the native tool used for viewing local routing tables or standard hop-by-hop latency measurement in Windows.
• F. Incorrect. Although 'netstat -r' can be used to display the routing table, 'route' is the more specific and standard command for managing and viewing the table. Furthermore, netstat does not offer the combined ping/traceroute functionality required.

Correct answer: A — The branch router is missing a default route.

• A. Correct. A default route (0.0.0.0/0) is required for a router to know where to send traffic destined for networks it doesn't have a specific path for, such as the corporate headquarters or the internet. The absence of static or dynamic routes in the routing table confirms that the router is unable to forward packets beyond its directly connected local interfaces.
• B. Incorrect. Since users can ping the local router and access local file servers, they have valid IP addresses. DHCP exhaustion would prevent new devices from obtaining an IP but would not affect the router's routing table or cause existing connected users to lose access to external routes.
• C. Incorrect. If switchports were configured in the wrong VLAN, users would typically be unable to reach the local file servers or the local router's LAN interface. Since local connectivity is functioning correctly, VLAN misconfiguration is unlikely.
• D. Incorrect. While STP can block ports to prevent loops, the specific symptom mentioned—that the routing table only contains directly connected networks—points to a layer 3 configuration issue rather than a layer 2 spanning tree issue. STP would not explain the lack of routing logic for remote destinations.

Correct answer: A — The DHCP server's address pool is exhausted.

• A. Workstations with IP addresses starting with 169.254.x.x are using APIPA (Automatic Private IP Addressing), which occurs when a DHCP client cannot obtain an address from a server. Because employees who arrived earlier in the day were able to connect successfully, it indicates the DHCP server is functional but has likely exhausted its pool of available leases for subsequent users.
• B. An incorrectly configured default gateway would not cause a device to self-assign an APIPA address. In this scenario, the workstation would still receive a valid IP address from the DHCP server but would be unable to communicate with devices on external networks or different subnets.
• C. If a DNS server is unreachable, workstations will still receive valid IP addresses from the DHCP server. The failure would be limited to hostname resolution (e.g., being unable to browse the web via URLs), rather than failing to obtain a network configuration entirely.
• D. An IP address conflict occurs when two devices are assigned the same IP. This typically affects only the specific devices involved in the conflict and results in error messages or intermittent connectivity for those devices; it does not cause a group of users to default to APIPA addresses.

Correct answer: A — Auto-negotiation failure

• A. Correct. Auto-negotiation is the process where two connected devices share capabilities to select the highest performance parameters. If this process fails, or if one side is hard-coded and the other is set to auto-negotiate, the interface will often default to a lower speed and half-duplex mode. This is a classic symptom of a duplex mismatch or negotiation failure on a copper Ethernet link.
• B. Incorrect. Transposed TX/RX wires (commonly found in incorrect crossover cables) are usually corrected automatically by Auto-MDIX on modern Gigabit hardware. If Auto-MDIX is not supported or disabled, the link would typically fail to establish entirely (Link Down) rather than operating at 100 Mbps half-duplex.
• C. Incorrect. A transceiver mismatch (such as using incompatible SFP modules or mismatched optical wavelengths) generally prevents the link from establishing at all or causes significant signal errors and CRC failures. It is not the standard cause for a copper link falling back to 100 Mbps half-duplex.
• D. Incorrect. PoE (Power over Ethernet) overload affects the delivery of power to devices like VoIP phones or Access Points. It would cause a powered device to shut down, reboot, or fail to power on, but it does not dictate the negotiated data transmission speed or duplex settings of the Ethernet interface.