Q1. A remote user is experiencing extremely slow file transfer speeds when accessing the company's main file server over the VPN. They report that accessing local network resources is unaffected, and their home internet connection speed test shows normal results. What is the MOST likely cause of the slow file transfers?
-
The VPN client software on the user's computer is outdated and needs to be updated.
-
The user's home router is experiencing a bufferbloat issue, causing general network congestion.
-
The VPN tunnel itself is experiencing high latency or limited bandwidth between the remote user and the company's network. ✓ Correct
-
The file server on the company network is experiencing disk I/O bottlenecks, slowing down all access.
Why: The correct answer is that the VPN tunnel is experiencing high latency or limited bandwidth. Since local network access is fine and the home internet speed test is normal, the issue is specifically related to the traffic traversing the VPN. The VPN tunnel represents the path between the remote user and the company's network, and bottlenecks along this path will directly impact performance for resources accessed through it. The VPN client software could be a contributing factor, but the tunnel itself is the primary path for the data. A bufferbloat issue at home would likely affect more than just VPN traffic. Disk I/O bottlenecks on the server would typically affect all users, not just remote VPN users.
Q2. A small business has two office locations connected by a dedicated leased line. They want to implement a solution that allows computers in both offices to access a shared application server located in the main office, while ensuring data transmitted between the offices is encrypted. Which of the following technologies BEST suits this requirement?
-
Multiprotocol Label Switching (MPLS)
-
Virtual Private Network (VPN) over the leased line ✓ Correct
-
Point-to-Point Protocol over Ethernet (PPPoE)
-
Domain Name System (DNS) forwarding
Why: The correct answer is VPN over the leased line. A VPN creates an encrypted tunnel over an existing network connection, providing secure communication between two points. Since the leased line already provides connectivity, adding a VPN ensures the encryption requirement is met. MPLS is a high-performance network technology but doesn't inherently provide encryption for traffic between locations unless specifically configured with encryption services, which is less direct than a VPN. PPPoE is typically used for establishing connections over DSL or other broadband technologies, not for securing leased lines between offices. DNS forwarding is related to name resolution and has no bearing on network encryption or connectivity between sites.
Q3. A network administrator is configuring a new DHCP server for a small network. They need to ensure that all client computers automatically receive an IP address, subnet mask, default gateway, and DNS server addresses. What is the MOST critical DHCP scope option that must be configured to allow clients to communicate with devices outside their local subnet?
-
DNS Server
-
Subnet Mask
-
Default Gateway ✓ Correct
-
IP Address Pool
Why: The correct answer is Default Gateway. The default gateway is the IP address of the router that connects the local subnet to other networks, including the internet. Without this configuration pushed by DHCP, clients would only be able to communicate with devices on their own subnet. The Subnet Mask defines the boundaries of the local network, the DNS Server allows for name resolution, and the IP Address Pool assigns addresses, all of which are important, but the default gateway is essential for inter-network communication.
Q4. A company is experiencing intermittent network performance issues. Users report that sometimes web pages load very slowly, and other times they experience complete connection timeouts. The IT department suspects a network device is failing, but wants to confirm this before replacing hardware. Which of the following actions would be the MOST effective FIRST step in diagnosing this issue?
-
Replace the company's main firewall with a new model.
-
Check the system logs and performance metrics of core network devices like routers and switches. ✓ Correct
-
Force clients to use a different DNS server for testing.
-
Manually assign static IP addresses to all client workstations.
Why: The correct answer is to check the system logs and performance metrics of core network devices. This approach directly addresses the suspicion of a failing network device by examining its operational status, error logs, and resource utilization (CPU, memory, traffic levels). Replacing the firewall is a drastic step that might not be necessary if the issue lies elsewhere. Forcing clients to use a different DNS server or assigning static IPs are troubleshooting steps for DNS or IP addressing issues, respectively, and are not the most direct way to diagnose a failing network device causing intermittent performance problems.
Q5. A technician is setting up a wireless access point (WAP) in a small office. They want to ensure that only authorized devices can connect to the network and that the wireless traffic is protected from eavesdropping. Which of the following security configurations provides the STRONGEST protection?
-
WPA2-PSK with a strong, complex passphrase
-
WEP with a shared key
-
MAC address filtering enabled, with no encryption
-
WPA3-Personal ✓ Correct
Why: The correct answer is WPA3-Personal. WPA3 is the latest wireless security protocol, offering significant improvements over WPA2, including stronger encryption, protection against brute-force attacks, and individualized data encryption even on open networks. WPA2-PSK with a strong passphrase is good but less secure than WPA3. WEP is severely outdated and easily cracked. MAC address filtering is easily bypassed by attackers and should not be relied upon as the sole security measure, especially without any encryption.
Q6. A user reports that they can connect to the office Wi-Fi network, but they are unable to access the internet or any internal network resources. The Wi-Fi signal strength is reported as excellent. The user's IP address is 169.254.10.55. What is the MOST likely cause of this connectivity issue?
-
The wireless access point has lost its connection to the main network switch.
-
The DHCP server is offline or not responding to client requests. ✓ Correct
-
The user's wireless adapter driver is corrupted.
-
The user has connected to the wrong Wi-Fi network SSID.
Why: The correct answer is that the DHCP server is offline or not responding. The IP address 169.254.x.x is an Automatic Private IP Addressing (APIPA) address, which is assigned by the operating system when a device cannot reach a DHCP server to obtain an IP address. This indicates a failure in the DHCP process, preventing the device from getting a valid IP, subnet mask, default gateway, and DNS server information needed for network and internet access. While the WAP could be disconnected, it would likely result in no connection at all. Driver issues usually manifest differently. Connecting to the wrong SSID might cause inability to access resources but typically wouldn't result in an APIPA address unless that network also lacks DHCP.
Q7. A network technician is cabling a new office where several workstations sit 130 meters from the nearest wiring closet. The design requires 1 Gbps throughput and immunity to electromagnetic interference from nearby industrial motors. Which cabling choice BEST satisfies these requirements?
-
Multimode fiber optic cable with LC connectors ✓ Correct
-
Cat 6a UTP cable with RJ45 connectors
-
Cat 5e STP cable with RJ45 connectors
-
RG-6 coaxial cable with F-type connectors
Why: Fiber optic cabling is immune to electromagnetic interference and easily exceeds the 100-meter copper limit, making it the correct choice at 130 meters near industrial motors. Cat 6a and Cat 5e are both copper twisted-pair standards limited to 100 meters, so they fail the distance requirement even though Cat 6a supports higher speeds and STP offers some shielding. RG-6 coaxial is used for cable/broadband distribution, not switched Gigabit Ethernet drops to workstations, so it does not fit the design.
Q8. An administrator is deploying VoIP phones and access points across a campus and wants to avoid running separate electrical wiring to each device. The devices draw up to 25.5W each. Which technology should the administrator implement on the switching infrastructure to BEST meet this need?
-
PoE+ (802.3at) switches ✓ Correct
-
PoE (802.3af) switches
-
A dedicated UPS at each device
-
QoS traffic shaping
Why: PoE+ (802.3at) delivers up to about 25.5W of usable power to a device over the data cable, matching the 25.5W draw and eliminating separate power runs. Standard PoE (802.3af) tops out around 15.4W supplied (about 12.95W usable), which is insufficient for the stated 25.5W load. A UPS at each device would still require separate power wiring, defeating the goal, and QoS only prioritizes traffic and delivers no electrical power at all.
Q9. A small business wants its guest Wi-Fi network to hand out addresses automatically and resolve internet domain names, while keeping guests isolated from the internal LAN on the same physical router. Which combination of features should the technician enable to BEST achieve this?
-
A separate SSID with a guest VLAN, plus DHCP and DNS forwarding on that subnet ✓ Correct
-
Static IP assignment on each guest device with a shared subnet mask
-
Port forwarding rules mapped to the guest devices
-
MAC address filtering with a single flat network
Why: A separate SSID mapped to a guest VLAN provides logical isolation from the internal LAN, while DHCP hands out addresses automatically and DNS forwarding lets guests resolve internet names — meeting every stated requirement. Static IP assignment contradicts the automatic-addressing goal and a shared subnet provides no isolation. Port forwarding exposes internal services rather than isolating guests, and MAC filtering on a single flat network provides no true segmentation and no automatic addressing or name resolution.
Q10. A company is standardizing its internal addressing and needs a private IPv4 range that provides the largest single contiguous address space for a growing multi-site network. Which private address block should the network designer select to BEST support maximum future expansion?
-
10.0.0.0/8 ✓ Correct
-
172.16.0.0/12
-
192.168.0.0/16
-
169.254.0.0/16
Why: The 10.0.0.0/8 block is the largest RFC 1918 private range, offering roughly 16.7 million addresses and the most room for multi-site growth. The 172.16.0.0/12 range is smaller (about 1 million addresses) and 192.168.0.0/16 smaller still (about 65,000), so neither maximizes expansion. 169.254.0.0/16 is the APIPA/link-local range assigned automatically when DHCP fails and is not a routable private block for planned addressing.