CompTIA Network+ N10-008 Jason Dion NET+ 008 Practice Exam #1

/25

Explanation:
To answer this question you must perform basic Subnetting Calculation (Or, remember your /CIDR to Hosts numbers.
105 Clients are needed in this Scenario, but you’ll also need an address for the Network and the Broadcast too.
This means you need 107 IP Addresses Total.

IP Addresses are assigned in multiples of 2.
1, 2, 4, 8, 16, 32, 64, 128, 256.

To symbolize a CIDR block with 128 IP Addresses, we would use 2 to the 7th which equals 128 or /25.

Rapid Elasticity

Explanation:
Rapid Elasticity can be a security threat to your org’s data due to data remanences. Data remanence is the residual representation of digital data that remains even after attempts have been made to remove or erase it. When a cloud resource is deprovisioned and returned to the cloud service provider, it can be issued to another organization for use. If the data was not properly erased from the underlying storage, it could be exposed to the other org. For this reason, all cloud-based storage drives should be encrypted by default to prevent data remanence from being read by others.

Metered Services are Pre-Paid, A-La-Carte, Pay-Per-Use, or committed offerings.

Resource Pooling refers to the concept that allows a virtual environment to allocate memory and processing capacity for a VMs use.

On-Demand refers to the fact that a consume can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider.

It becomes the default VLAN for untagged frames.

Explanation:
Trunk ports carry all traffic, regardless of VLAN number, between all Switches in a LAN. The VLAN designation for a Trunk port is its native or default VLAN. If the Trunk port has a native VLAN that differs from the tag placed on the frame as it entered the access port, the Switch leaves the tag on the frame and sends the tagged frame along to the next Switch or Switches. If the Trunk port’s native VLAN is the same as the access ports VLAN, then the Switch drops the tag and sends the untagged frame out of the Trunk port.

Configure VTP and 802.1q on the inter-Switch connections with Native VLAN 100
Configure VLSM for the IP Address range.

Explanation:
The 801.q standard is used to define VLAN Tagging (or Port Tagging) for Ethernet frames and the accompanying procedures to be used by Bridges and Switches in handling such frames. Traffic should be properly tagged when combined over a single trunk port to ensure they are not sent to the wrong VLAN by mistake. If VLAN Tagging is not enabled, all of the VLAN traffic will be sent to the native or default VLAN, VLAN 1. By default, VLAN 1 is enabled and all unused ports are assigned to it.

VLSM stands for Variable Length Subnet Mask where the subnet design uses more than one mask in the same network which means more than one mask is used for different subnets of a single class A, B, or C network.

Spanning Tree Protocol (STP) is a network protocol that builds a loop-free logical topology for Ethernet networks to prevent bridge loops and the broadcast storms that result from them. STP is defined in the IEEE 802.1d standard and

Rapid Reconfiguration of Spanning Tree is defined in the IEEE 802.1w standard.

The IEEE 802.1x standard is a network authentication protocol that opens ports for network access when an organization authenticates a user’s identity and authorizes them for access to the network. This defines port security. The user’s identity is determined based on their credentials or certificate, which is confirmed by the RADIUS server.

Performance Optimization

Explanation:
Performance Optimization can help a business improve the quality of its video and audio communications over the Internet by decreasing the size of the broadcast domain through the creation of VLANs. Each VLAN can contain the VoIP devices for a single department or business unit, and traffic is routed between the VLANs using Layer 3 Multilayer Switches to increase the performance of the voice communications systems.

Compliance Enforcement involves dividing up one Network into smaller sections to better control the flow of traffic across the Network and to restrict confidential data to a specific Network segment based on a specific regulation or contractual requirement, such as PCI DSS segmentation requirements.

Honeynet is an intentionally vulnerable Network segment that is used to observe and investigate the attack techniques of a hacker or adversary.

Separate Public/Private Networking involves segmenting the Network into two portions, public and private. This is often used in cloud architectures to protect private data.

205.12.35.0

Explanation:

In Classless Subnets, using variable length Subnet Mask (VLSM), the Network ID is the first IP address associated within an assigned range.

In this example, the CIDR Notation is /27, so each Subnet will contain 32 IP Addresses. This means that there are eight Networks in this Class C Range -

805. 12.35.0

806. 12.35.32

807. 12.35.64

808. 12.35.96

809. 12.35.128

810. 12.35.160

811. 12.35.192

812. 12.35.224

Since the IP address provided is 205.12.35.26, it will be in the 205.12.35.0/27 Network.

SNMP Walk

Explanation:
SNMP Walk can be used to determine if the counter is using 32 bits or 64 bits by querying the OID of the endpoint (Router Interface).

Defense in Depth

Explanation:
Defense in Depth is the concept of layering various Network appliances and configurations to create a more secure and defensible architecture. In this scenario Dion Training appears to be using various Host-Based and Network-Based devices to ensure there are multiple security layers in the Network.

Conduct Real-Time monitoring of the phone’s activity and usage.

Explanation:
All four options are good, the BEST solution is to conduct real-time monitoring of the phone’s activity since it is a technical control that could quickly identify an issue. The other options are all administrative controls (Policies), which are useful but would not actually identify if the sensitive data was leaked from Jason’s phone.

CVE

Explanation:
Common Vulnerabilities and Exposures (CVE) is an element of the Security Content Automation Protocol (SCAP) that provides a standard nomenclature for describing security flaws or vulnerabilities.

SIEM is a solution that provides a Real-Time or near-real-time analysis of Security alerts generated by Network hardware and applications.

VPC is a private Network segment made available to a single cloud consume on a public cloud.

Sarbanes-Oxley Act (SOX) dictates requirements for storing and retaining documents relating to an organizations financial and business operations, including the type of ducments stored and their retention periods.

OSPF

Explanation:
OSPF (Open Shortest Path First) is known as a Classless Protocol. Classless Routing Protocols are those protocols that include the Subnet Mask information when the Routing Tables or updates are exchanged.

Other Classless Routing Protocols include:

• EIGRP (Enhanced Interior Gateway Routing Protocol)

• RIPv2 or newer (Routing Internet Protocol)

• IS-IS (Intermediate System to Intermediate System)

RIPv1 & IGRP (Interior Gateway Routing Protocol) are NOT Classless.

STP (Spanning Tree Protocol) is NOT a Routing Protocol, this is used to prevent Swtiching Loops in Bridges and Switches.

ISAKMP

Explanation:
ISAKMP is used in IPSec, which is commonly used in securing the Key Exchange during the establishment of a client-to-server VPN Connection.

TKIP (Temporal Key Integrity Protocol) is an encryption protocol included as part of the IEEE 802.11i standard for Wireless LANs (WLAN).

Kerberos is a computer Network Authentication protocol that works based on Tickets to allow Nodes communicating over a non-secure Network to prove their identiy to one another in a secure manner.

AES (Advanced Encryption Standard) is a symmetric Key Encryption and is not used for Key Exchanges.

T-1

Explanation:
T-1 connection provides guaranteed 1.544 Mbps of throughput.

Dial-Up, DSL, and Cable Broadband do NOT provide a guaranteed throughput rate. Instead, these services provide a variable throughput rate based on Network conditions and demand in the area of your business.

Rollover

Explanation:
Typically a Router or Switch’s Console Port is connected using a Rollover Cable, which has an RS-232 or DB-9 Port on one side of an RJ-45 on the other side.

RG-6 cable is a Coaxial Cable used to connect to a cable Modem or Television.

Ethernet Crossover Cable is a Network Cable used to connect two Ethernet Network devices directly.

Straight-Through is a type of twisted pair cable that is used in LAN to connect a computer to a Network Switch.

Spanning Tree

Explanation:
Question Key Word: “…redundant paths”

STP (Spanning Tree Protocol) is a Network Protocol that builds a logical loop-free Topology for Ethernet Networks. The basic function of STP is to prevent bridge loops and the broadcast radiation that results from them. If you have REDUNDANT links set up, it is important to utilize STP to prevent loops within the Network. If a loop occurs, the performance of the entire Network can be degraded due to Broadcast Storms.

Port Mirroing is used on a Network Switch to send a copy of Network packets seen on one Switch port to a Networking monitoring connection on another Switch port.

ARP Inspection or Dynamic ARP Inspection (DAI) is a security feature that validates Address Resolution Protocol (ARP) packets in a Network. DAI allows a Network admin to intercept, log, and discard ARP packets with invalid MAC address to IP Address bindings.

VLAN (Virtual Local Area Network) is any Broadcast Domain that is partitioned and isolated in a computer Network at the Data Link Layer (OSI Layer 2).

Port Mirroring, ARP Inspection, and VLANs do NOT add any REDUNDANCY to the Network.

Conduct a Baseline Review

Explanation:
Question Verbiage: I interpreted the question as if he already is using a Baseline and conducting a Baseline Review. But I think they key to the question is implying that he’s looking at the CURRENT baseline and needs to review it with previous Baselines based on the Explanation.

John should conduct a Baseline Review to compare the statistics he collected against the previous baseline. He can then use this information further to investigate the drop in the Server’s performance. A Baseline is a process for styding the Network at regular intervals to ensure that the Network is working as designed.

Install a Switch in the second-floor Networking closet to increase the Signal.

Explanation:
While a Repeater may be a good option here, a Swtich is more effective in this case since there are so many cables, and Repeaters usually only work for an individual cable.

A Hub would similarly work but would introduce a signal collision domain for all 24 computers. This would drastically decrease the perfomance of the Network.

We wouldn’t want to introduce a Switch in each office, as this is a bad security practice and an inefficient use of resources. Easier to manage and administer a single, centralized Switch in the Network Closet.

VTP

Explanation:
VTP (VLAN Trunking Protocol) allows a VLAN created on one Switch to be propagated to other Switches in a group of Switches in a VTP domain.

STP (Spanning Tree Protocol) is a Layer 2 protocol that runs on Bridges and Switches to ensure that you do not create loops when you have redundant paths in your Network.

MPLS (MultiProtocol Label Switching) is a routing technique in telecommunications Networks that directs data from one node to the next based on short path labels rather than long Network Addresses, thus avoiding complex lookups in a Routing Table and speeding traffic flows.

PPTP (Point-to-Point Tunneling Protocol) is an obsolete method for implenting Virtual Private Networks (VPN).

MPLS, STP, PPTP are NOT used to share VLAN information like VTP and the 802.1q standards do.

Ensure PORT 53 is enabled on the Firewall.

Explanation:
Domain Name System (DNS) uses port 53 and is a hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network. When a client wants to access a website, it will make a request to the DNS server over port 53 to translate the domain name to its corresponding IP address. Since the technician is only able to access the servers using their IP addresses, this validates that the connectivity is functioning correctly but the DNS process is failing. The most likely reason for this is that port 53 is blocked at the firewall and is preventing the client from sending their requests to the DNS server.

NSLOOKUP command is used to query the domain name system (DNS) to obtain information about host addresses, mail exchanges, nameservers, and related information. The nslookup command has an interactive and non-interactive mode. The nslookup command will still need to communicate with a DNS server over port 53, though, to perform these lookups.

The ping command is used to test whether a given target is reachable across an IP network by sending an ICMP Echo Request packet and receiving an ICMP Echo Reply. Since the technician successfully used ping to communicate with the server using their IP addresses, this indicates that ICMP is not blocked by the firewall.

The HOST file is a text file containing domain names and IP addresses. The HOST file works like a local DNS lookup, but the technician would have to enter the domain name and IP for every website a user might want to access, making this an unacceptable option to solve this issue for the long term.

Bus

Explanation:
This network would resemble a physical BUS Network Topology because the Router connects directly to the Firewall, and the Firewall connects directly to the Computer. This would form a single line (or BUS) from one device to the next. A BUS topology uses a single cable that connects all the included nodes and the main cable acts as the backbone for the entire Network.

Ring topology connects every device to exactly two other neighboring devices to form a “circle”. Messages in a Ring topology travel in one direction and usually rely on a token to control the flow of information.

Star topology connects all of the other nodes to a central node, usually a Switch or a Hub. Star topology is the most popular Network topology in use on LANs.

Mesh topology connects every node directly to every other node. This creates a highly efficient and redundant Network, but it is expensive to build and maintain.

Switching Loop

Explanation:
Switching Loop is when there is more than one Layer 2 path exists between two endpoints. This can be prevented by using the STP (Spanning Tree Protocol = 802.1D).

CAT 6 and CAT5e are compatible with each other and can both operate at speeds up to 1000 Mbps (1 Gbps), so it is not an improper cable type issue.

Auto-Sensing Ports refers to a feature found in Network Adapters that allows them to automatically recognize the current local Network’s speed and adjust its own setting accordingly. This would not be an issue since the Switch can detect the appropriate speed to use with the CAT 6 and CAT5e cables.

Routes are used at Layer 3, but Switches are Layer 2 Devices. Therefore, Swtiches do not need to use a Route to pass traffic between each other.

WIFI

Explanation:
Question Key Words = “…upload large images of items to a centralized server”
802.11ac WIFI is a very fast high-speed WIFI Network capable of 1 Gbps speeds over 5 GHz spectrum and is perfect for uploading large image files quickly over a Wireless Local Area Network.

RFID (Radio Frequency Identification) uses electromagnetic fields to automatically identify and track tags attached to objects. The warehouse might want to also use RFID to allow for the accurate scanning of items using RFID Tags, RFID can’t upload large images of the items to a centralized server since it is limited to 2 KB of data per RFID tag.

Bluetooth is a short-range wireless technology standard that is used for exchanging data between fixed and mobile devices over short distances using UHF radio waves.

NFC (Near Field Communication) is a set of communication protocols for communication between two electric devices over a distance of 4 cm or less.

Business Continuity Plan

Explanation:
Business Continuity Plan is a document that outlines how a business will continue operating during an unplanned service disuption. It is more comprehensive than a disaster recovery plan and contains contingencies for business processes, assets, human capital and business partners, and essentially every other aspect of the business that might be affected.

Disaster Recovery plan is a document, structured approach that documents how an organization can quickly resume work after an unplanned incident. These unplanned incidents include things like Natural Disasters, Power Outages, Cyber Attacks, and other disruptive events.

Incident Response Plan contains a set of instructions to help our Network and System admins detect, respond to, and recover from Network Security incidents. These types of plans address issues like Cybercrime, data loss, and Service Outtages that threaten daily work.

Tickets used to identify Authenticated Users

Explanation:
Kerberos is ALL ABOUT Tickets. Kerberos uses a system of Tickets to allow nodes to communicate over a non-secure Network and securely prove their identity. Kerberos is a computer Network Authentication protocol that works based on Tickets to allow nodes communicating over a non-secure Network to prove their identity to one another in a secure mananger. Kerberos is used in Windows Active Directory domains for authentication.

RADIUS (Remote Authentication Dial-In User Service) is used to manage remote and wireless Authentication Infrstructure. Users supply Authentication information to RADIUS Client devices, such as a Wireless Access Point. The Client device then passes the Authentication data to an AAA (Authentication, Authorization, and Accounting) server that processes the Request. – DOES NOT USE TICKETS.

Jitter

Explanation:
Jitter = is a Network condition that occurs when a time delay in the sending of data packets over a Network connection occurs. Jitter is a big problem for any real-time applications you may be supporting on your Networks, like video conferences, voice-over IP, and virtual desktop infrastructure clients.

Latency = is the measure of time that it takes for data to reach its destination across a Network. Usually, we measure Network Latency as the round-trip time from a workstation to the distant end and back.

Throughput = is an actual measure of how much data is successfully transferred across a given Network.

Bandwidth = is the max rate of data transfer across a given Network.

Change Management Documentation

Explanation:
Since everything worked before the Server Upgrade and doesn't now, it would be a good idea to FIRST look at the CHange Management Documentation that authorized the Change/Upgrade. This should include the specific details of what was changed and what things may have been affected by the change. This is the best place to start when determining what changed since yesterday. Change Management is a systemic approach to dealing with the transition or transformation of an organization's goals, processes, or technologies.

Use the same SSIDs on different channels with AP isolation.

Explanation:
For users to be able to seamlessly migrate between the two bulidings, both Access Points (AP) must use the same SSIDs.
To prevent frequency interference though, each device needs to select a different and non-overlapping channel to utilize.
Finally, the AP isolation should be enabled. AP isolation is a technique for preventing mobile devices connected to an AP from communicating directly with each other.

1

Explanation:
The severity levels range from 0 to 7, with 0 being the most severe and seven being the least severe.

Level 0 is used for an Emergency and is considered the most sever condition because the system has become unstable.
Level 1 is used for an Alert Condition and means that there is a condition that should be corrected immediately.
Level 2 is used for a Critical Condition, and it means that there is a failure in the system's primary application and it requires immediate attention.
Level 3 is used for an Error Condition, and means that something is happening to the system that is preventing the proper function.
Level 4 is used for warning conditions and it may indicate that an error will occur if action is not taken soon.
Level 5 is used for notice conditions and it means that the events are unusual, but they are not error conditions.
Level 6 is used for information conditions and it is a normal operating message that requires NO ACTION.
Level 7 is used for debugging conditions and is just information that is useful to devs as they are debugging their Networks and Apps.

Video Surveillance

Explanation:
If she were trying to prevent access from occuring, the other three options would provide that. Still, they cannot detect unauthorized access in the event that an attacker stole a valid Smart Card or Access Badge.

A Biometric Lock is any lock that can be activated by biometric features, such as fingerprint, voiceprint, or retina scan. Biometric locks make it more difficult for someone to counterfeit the key used to open the lock or a user's account.

Smart Card, Chip Card, PIV Card, or Integrated Circuit Card is a physical, electronic authorization device used to control access to a resource. It is typically a plastic credit card sized card with an embedded integrated circuit chip.

dig

Explanation:
DIG = command is used to query the Domain Name SYstem (DNS) to obtain information about host addresses, mail exchanges, nameservers, and related information.

ARP = command is used to view and modify the local Address Resolution Protocol (ARP) cache of a device, which contains recently resolved MAC addresses of IP hosts on the Network.

TCPDUMP = is a text-based packet capture and analysis tool that can capture packets and display the contents of a packet capture (PCAP) file.

IPCONFIG = is used on Windows Devices to display the current TCP/IP Network configuration and refresh the DHCP and DNS settings on a given host.

DSL

Network Diagrams

RDP (Remote Desktop Protocol)

Explanation:
RDP (remote desktop protocol) is a Windows feature that allows a remote user to initiate a connection at any time and sign on to the local machine using an authorized account. This connection allows a Windows administrator to see and control what is on a remote computer's screen. RDP authentication and session data are always encrypted. This means that a malicious user with access to the same network cannot intercept credentials or interfere or capture anything transmitted during the session.

Secure Shell (SSH) uses port 22 to securely create communication sessions over the Internet for remote access to a server or system.

Telnet uses port 23 to provide a bidirectional interactive text-oriented communication facility using a virtual terminal connection but sends its data in plaintext making it an insecure protocol.

Virtual Network Computing (VNC) is a cross-platform screen sharing system that was created to remotely control another computer from a distance by a remote user from a secondary device as though they were sitting right in front of it.

Brute Force occurs within 11,000 combinations.

Explanation:
The most prominent attack against WPS0-enabled wireless networks involves brute-forcing the 8-digit PIN that client uses to enroll their devices without knowing the pre-shared key. WPS checks each half of the PIN individually, reducing the number of possible combinations from a maximum of 100,000,000 to only 11,000. This only takes a few minutes to crack on most modern computers, as long as the WAP doesn't have a lockout after a certain number of failures. The lockout mechanism may also be triggered based on the client's MAC, so you can often spoof MAC to bypass this defense.

Loopback

802.3af

Explanation:
PoE = 802.3af

STP (Spanning Tree Protocol) = 802.1d

LACP (Link Aggregation Control Protocol) = 802.3ad

Network Authentication Protocol = 802.1x (RADIUS/Enterprise/Port-Based Network Access Control (PNAC))

Wavelength Mismatch

Explanation:
Wavelength Mismatch occurs when two different transceivers are used at each end of the cable. For example, if one SFP uses a 1310nm transceiver and the other end uses a 850 nm transceiver, they will be unable to communicate properly and the link will remain down.

Duplex Mismatch is a condition where two connected devices operate in different duplex modes, that is, one operates in half-duplex while the other one operates in full-duplex. The effect of a duplex mismatch is a link that operates inefficiently.

All networking cables have a limited supported distance. For example, copper cables must be less than 100 meters. Single-mode fiber cables can be up to 40 kilometers, therefore the issue is not a distance limitation in this scenario.

The link is established before an IP address is assigned by DHCP. In this scenario, the link is not being established, therefore it cannot be a wrong IP address being assigned to the interfaces.

Honeypot

Acronym:
CVE = Common Vulnerabilities and Exposures

Perform a Site Survey

Insider Threat

Acronym:
APT = Advanced Persistent Threat is a type of threat actor that can obtain, maintain, and diversify access to Network systems using exploits and malware.

Virtual Switch

WPA2 (WIFI Protected Access v2)

CODEC

Explanation:
The term "codec" is a concatenation of "encoder" and "decoder.” In video conferencing, a codec is a software (or can be hardware) that compresses (encodes) raw video data before it is transmitted over a network. Generally, audio/video conferencing systems utilize the H.323 protocol with various codecs like H.263 and H.264 to operate.

A 56k modem is a legacy device, also called a dial-up modem. These devices are too slow to allow an IP-based video conferencing system deployment.

RS-232 is a standard protocol used for serial communication, and is too slow to support IP-based video conferencing systems.

Near Field Communication (NFC) is a set of short-range wireless technologies, typically requiring a distance of 4cm or less to initiate a connection. NFC is not used with IP-based video conferencing systems.

Remote Access Policy

Explanation:
Remote Access Policy is a document which outlines and defines acceptable methods of remotely connecting to the internal network.

Password Policy is a set of rules created to improve computer security by motivating users to create dependable, secure passwords and then store and utilize them properly. This document promotes strong passwords by specifying a minimum password length, complexity requirements, requiring periodic password changes, and placing limits on the reuse of passwords.

Acceptable Use Policy (AUP) is a set of rules applied by the owner, creator, or administrator of a network, website, or service, that restrict the ways in which the network, website, or system may be used and sets guidelines as to how it should be used.

Data Loss Prevention Policy is a document that defines how organizations can share and protect data. It guides how data can be used in decision-making without it being exposed to anyone who should not have access to it. The goal of a data loss prevention policy is to minimize accidental or malicious data loss.

Social Engineering

Duplicate IP Addresses

Screened Subnet

Hybrid

MTU (Maximum Transmission Unit)

Explanation:
MTU is the largest unit that can be transmitted across a network. If the MTU is set at a value above 1500, the network is configured to support jumbo frames.

A media access control address is a unique identifier assigned to a network interface controller for use as a network address in communications within a network segment.

Management information base (MIB) is a collection of definitions which define the properties of the managed object within the device to be managed (such as a router, switch, etc.).

An intrusion prevention system (IPS) is a form of network security that works to detect and prevent identified threats.

Password Policy

RADIUS

Explanation:
RADIUS is used to manage credentials for network devices centrally. Remote Authentication Dial-In User Service is a networking protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service.

TACACS+ is an older username and login system that uses authentication to determine access, while RADIUS combines authorization AND authentication. For this question, either RADIUS or TACACS would be an acceptable answer.

Kerberos is a computer network authentication protocol that works based on tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Kerberos is used in Windows Active Directory domains for authentication.

The domain name system (DNS) protocol is the protocol used to provide names for an IP address based on their mappings in a database using TCP/UDP port 53.

The file transfer protocol (FTP) is the protocol used to transfer files across the internet over ports 20 and 21.

Private SaaS

Explanation:
SaaS (Software as a Service) is a cloud model whereby a service provider provides a software service and makes the service available to customers over the Internet. Examples of SaaS solutions include Microsoft Office 365, Microsoft Exchange Online, and Google Docs.

Because of the concerns with sensitive corporate information being processed by the SaaS, Dion Training should ensure a Private SaaS is chosen. A private cloud is a particular model of cloud computing that involves a distinct and secure cloud-based environment in which only the specified client (Dion Training in this case) can operate.

A public cloud contains services offered by third-party providers over the public Internet and is available to anyone who wants to use or purchase them. They may be free or sold on-demand, allowing customers to pay only per usage for the CPU cycles, storage, or bandwidth they consume.

A community cloud is a collaborative effort in which infrastructure is shared between several organizations from a specific community with common concerns (security, compliance, jurisdiction, etc.), whether managed internally or by a third-party and hosted internally or externally.

A hybrid cloud uses a mix of on-premises, private cloud, and third-party, public cloud services with orchestration between these platforms. This typically involves a connection from an on-premises data center to a public cloud.

Identify the Problem

Explanation:
The troubleshooting steps are to
(1) Identify the problem,
(2) Establish a theory of probable cause,
(3) Test the theory to determine the cause,
(4) Establish a plan of action to resolve the problem and identify potential effects,
(5) Implement the solution or escalate as necessary,
(6) Verify full system functionality and if applicable implement preventative measures, and
(7) Document findings, actions, outcomes, and lessons learned.

At this point, the technician does not have enough information to clearly identify the problem. The technician should continue to identify the problem by gathering information, questioning the user, identifying the symptoms, determining if anything has changed, and attempting to duplicate the problem to verify the issue. Once the problem is clearly identified, the technician will establish a theory of probable cause and continue their troubleshooting efforts.

NAT has not been configured on the border Firewall

Explanation:
The most likely cause is that the NAT has not been properly configured on the border firewall. This would cause the internal network users to access the web servers still (since internal traffic doesn't have to transit the firewall), but would still prevent Internet users from accessing the webserver.

The subnet mask provided of 255.255.254.0 represents a /23 CIDR network, therefore the IP and the gateway are on the same subnet and the gateway is not the issue.

The layer 3 switch cannot be the issue either, because if it blocked port 80 then the internal users would have been blocked, too.

The web server does not need to access the DNS server, since the webserver is the target being accessed and not the system initiating the connection.

802.1d

Explanation:

802. 802. 1d = Spanning Tree Protocol (STP)

803. 803. 1q = VLANs

RIPv2 is a distance-vector Routing Protocol for local and WAN, and does not prevent or avoid loops by default.
OSPF is Open Shortest Path First, is a Layer 3 Link-State Routing Protocol that was developed for IP Networks based on Shortest Path First.
RIP and OSPF rely on Split Horizon and Route Poisoning to avoid Layer 3 Loops.

CSMA/CD (Carrier Sense Multiple Access with Collision Detection)

25, 161

Explanation:
SMTP = 25 (Simple Mail Transfer Protocol) Server to Server Email
SNMP = 161/162 (Simple Network Management Protocol)
Telnet = 23
SMB = 445 (Server Message Block)
RDP = 3389 (Remote Desktop Protocol)
HTTPS = 443 (Hypertext Transfer Protocol via SSL/TLS)

Private Cloud

Rogue DHCP Server

Split-Horizon is Misconfigured

Explanation:
Split horizon is a method used by distance vector protocols to prevent network routing loops. With split horizon, if a router receives routing information from another router, the first router will not broadcast that information back to the second router, thus preventing routing loops from occurring. If it is misconfigured, the routers could suffer a routing loop which would produce the error message received when trying to communicate with each other.

The other options would not cause a communication error between the three internal routers when testing the connectivity using their IP addresses.

A Denial-of-Service (DoS) attack is an attack meant to shut down a machine or network, making it inaccessible to its intended users.

The Domain Name System (DNS) uses port 53 and is a hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network and maps a domain name to an IP address.

Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized authentication, authorization, and accounting (AAA) management for users who connect and use a network service.

VLAN (Virtual Local Area Network)

tracert

Explanation:
Tracert is a command-line utility used to trace an IP packet's path as it moves from its source to its destination. While using ping will tell you if the remote website is reachable or not, it will not tell you where the connection is broken. Tracert performs a series of ICMP echo requests to determine which device in the connection path is not responding appropriately. This will help to identify if the connectivity issue lies within your intranet or is a problem with the ISP's connection.

The nslookup tool is used to troubleshoot DNS issues.

The netstat tool is used to display network statistics and active connections.

The ping tool is used to test an end-to-end connection, but it will not provide any data on the hops found in the connection.

Port Scanner

Explanation:
A port scanner is used to determine which ports and services are open and available for communication on a target system. The port scanner will scan the server and display any open ports. If the technician finds that port 443 (HTTPS) is open and all other ports are closed, then they know the server has been properly hardened.

A NetFlow analyzer is used to perform monitoring, troubleshooting, inspection, interpretation, and synthesis of network traffic flow data.

An IP scanner is used to monitor a network's IP address space in real-time and identify any devices connected to the network.

The nslookup command is used to query the domain name system (DNS) to obtain information about host addresses, mail exchanges, nameservers, and related information. The nslookup command has an interactive and non-interactive mode.

MAC Filtering

Hot Sites or Cold Sites

Explanation:
Question Key Words: "…catastrophic disaster such as a Fire, Tornado, or Earthquake"
Which indicates that the site impacted by these catastrophic disasters would be total damaged and unusable, which implies that it would have to be a solution provided off site, or all together an alternate Site which goes to the uses of Hot, Warm, Cold Sites.

Generators, Fire Supression and UPS/Battery Backups do nothing against catastrophic diasters such as Tornado/Earthquakes.

Coaxial to Fiber

Explanation:
Question Key Words: "…RG-6 cable to the existing singlemode cable…"
Singlemode = Fiber
RG-6 = Coaxial

APIPA (Automatic Private IP Addressing)

PTR

Explanation:
DNS Record Types to know:

• A = Maps a host name to an IPv4 Address

• AAAA = Maps a host name to an IPv6 Address

• CNAME = Maps an Additional host name to an existing host Record

• PTR = are used for Reverse DNS Lookups

• MX = maps a mail server name to a domain

• SVR = specifies location data, IE: port numbers for specified services.

• TXT = provides the ability to associate other services, sometimes your mail service, to your domain

• SOA = stores important information about the DNS zone for your domain, each zone must have an SOA record

DHCP = Dynamic Host Configuration Protocol, NOT a DNS Record type.
LDAP = Lightweight Directory Access Protocol, NOT a DNS Record type.
TTL = Time To Live, NOT a DNS Record type.

The bend radius of the cable has been exceeded.

Explanation:
The most likely explanation for this issue is the coiled up the excess cable was wound too tightly and exceeded the bend radius for the cable. Bend radius is the measure of how sharply a cable can safely bend without causing damage by creating micro cracks on the glass fibers. By tightly coiling the cable, the cable may have broken or cracked the fiber connected to the transmit portion of the SFP.

It is unlikely that the SFP failed since only the transmit portion is registering as weak.

If you used the wrong type of cable (MTRJ vs. ST), you would not have been able to connect it to the SFP module as it wouldn't fit.

Similarly, if you used an MMF instead of an SMF cable, you would not receive a weak connection but would instead get no connection.

Rollback Plan

netstat

Explanation:
Netstat (network statistics) is a command-line network utility tool that displays network connections for the Transmission Control Protocol (incoming and outgoing), routing tables, and several network interface and network protocol statistics. It is useful when determining if a workstation is attempting outbound connections due to malware (beaconing activity) or has ports open and listening for inbound connections.

The tracert command is used on Windows devices to show details about the path that a packet takes from a host to a target and displays information about each hop in the path.

The arp command is used to view and modify the local address resolution protocol (ARP) cache of a device, which contains recently resolved MAC addresses of IP hosts on the network.

The route command is used to create, view, or modify manual entries in the network routing tables of a computer or server.

/26

Explanation:
Since the Sales department needs 55 devices plus a network ID and broadcast IP, it will require 57 IP addresses. The smallest subnet that can fit 57 IPs is a /26 (64 IPs).
A /26 will borrow 2 host bits and assign those to the network portion of the subnet mask.
This would create a subnet with 2^6 available host IP addresses, or 64 total IP addresses.
Of the 64 IP addresses, there are 62 available for clients to use, one for the network ID, and one for the broadcast address.

South

Explanation:
North-South traffic or communication refers to traffic that Enters or Leaves the Data Center from a System physically residing outside the Datacenter.

North Traffic is traffic exiting the datacenter.
South Traffic is traffic entering the data center from the outside.

East-West traffic or communication refers to data flow within the datacenter.

The Spanning Tree Protocol uses PBDU to detect loops in Network topologies.

Explanation:
The Spanning Tree Protocol (STP) is a network protocol that builds a loop-free logical topology for Ethernet networks to prevent bridge loops and the broadcast storms that result from them. The Spanning Tree Protocol operates at Layer 2 of the OSI model to detect switching loops. STP is defined in the IEEE 802.1d standard.

The Link Aggregation Control Protocol (LACP) enables you to assign multiple physical links to a logical interface that will appear as a single link to a route processor. LACP is used to combine multiple network connections in parallel to increase throughput beyond what a single connection could sustain and to provide redundancy in case one of the links should fail. LACP is defined in the IEEE 802.3ad standard.

Split Horizon is used by Routing Protocols at Layer 3 to prevent Routing loops, and it does not affect Switching loops.

Hub

Explanation:
A hub is a layer 1 device and operates at the physical layer.
Cables, Hubs, Repeaters, and Wireless Access Points are all examples of Layer 1, or Physical Layer, devices.
The Physical Layer defines electrical and physical specifications for devices.
The Physical Layer defines the relationship between a device and a transmission medium, such as a copper or optical cable.

A Bridge is a Layer 2 device.
A Switch is a Layer 2 device, but Multilayer Switches (VLANs) operate on Layer 3 as well.
A Firewall is a Layer 3 through Layer 7 device, depending on the type of Firewall.

SOA (Start of Authority)

Explanation:
Start of Authority (SOA) resource record indicates which Domain Name Server (DNS) is the best source of information for the specified domain.

AAAA record associates your domain name with an IPv6 address.

A record associates your domain name with an IPv4 address.

MX record is used for outgoing (SMTP) and incoming (POP3/IMAP) traffic.

Zero-Day

10.10.10.255

Explanation:
In classless subnets using variable-length subnet mask (VLSM), the broadcast address is the last IP address associated within an assigned range. In this example, the CIDR notation is /25, so each subnet will contain 128 IP addresses. Since the IP address provided is 10.10.10.200, the broadcast address will be 10.10.10.255.

UC Gateway

TLS (Transport Layer Security)

Anycast

Explanation:
Broadcast only works with IPv4

Multicast, Anycast, Unicast works with IPv6.

Multicast and Unicast works with both IPv4 and IPv6.

Implement Load Balancing and provide High Availability

SCADA/ICS

Explanation:
Supervisory Control and Data Acquisition (SCADA)/Industrial Control Systems (ICS) are used in manufacturing and assembly-line networks.
SCADA systems are used by industrial organizations and companies in the public and private sectors to control and maintain efficiency, distribute data for smarter decisions, and communicate system issues to help mitigate downtime.
Industrial control system (ICS) is a collective term used to describe different types of control systems and associated instrumentation, which includes the devices, systems, networks, and controls used to operate and/or automate industrial processes.

Network Function Virtualization (NFV) is a way to reduce cost and accelerate service deployment for network operators by decoupling functions like a firewall or encryption from dedicated hardware and moving them to virtual servers.

Enhanced Interior Gateway Routing Protocol (EIGRP) is an advanced distance-vector routing protocol that is used on a computer network for automating routing decisions and configuration.

Channel Service Unit/Data Service Unit (CSU/DSU) is a hardware device about the size of an external modem that converts digital data frames from the communications technology used on a local area network (LAN) into frames appropriate to a wide-area network (WAN) and vice versa.

25

Explanation:
Question Key Words: "….server cannot send emails to another server…"
SMTP = Simple Mail Transfer Protocol, PORT 25, is Mail Transfer between Servers.

110 = POP3, Protocol for Receiving Mail
143 = IMAP, Protocol for Receiving and Organizing Mail

22 = SSH (Secure Shell) has nothing to do with Mail.

Verify system functionality

AUP

Acronyms:

AUP = Acceptable Use Policy

MOU = Memorandum of Understanding

NDA = Non Disclosure Agreement

SLA = Service Level Agreement

DMZ

Acronyms:

VPN = Virtual Private Network

EAP = Extensible Authentication Protocol

VNC = Virtual Network Computing

DMZ = Demilitarization Zone

Identify the problem

Open

(Dion suggests that this is part of a PBQ that you may see on the NET+ 008 where you will be asked to drag and drop the Correct Encryption into the AP's that are displayed in a Picture. So know your Wireless Encryptions!!!)