Q1. A small retail business is expanding and needs to connect its new branch office to its main headquarters, located 50 miles away. The connection must provide reliable, high-speed data transfer for point-of-sale systems and inventory management. The company wants to avoid the ongoing costs and complexities of managing dedicated leased lines. Which of the following Wide Area Network (WAN) technologies would BEST suit this scenario?
-
MPLS VPN
-
SD-WAN ✓ Correct
-
DSL
-
T1 Line
Why: SD-WAN is the best choice because it allows businesses to leverage multiple transport methods, including broadband internet, to connect branch offices, offering flexibility and cost savings over dedicated lines. It prioritizes application performance and can aggregate bandwidth. MPLS VPNs are often used for reliable private connectivity but can be more expensive and less flexible than SD-WAN. DSL is typically too slow and unreliable for business-critical branch office connectivity. A T1 line is a dedicated circuit but is expensive, has limited bandwidth, and is less flexible than SD-WAN.
Q2. A user reports that they are unable to access any external websites, but they can still access internal network resources. The user's computer is configured to obtain an IP address automatically. The network uses a single router to connect to the internet and also handles internal routing. Which of the following is the MOST likely cause of the problem?
-
The default gateway is misconfigured or unreachable. ✓ Correct
-
The DNS server is unable to resolve internal hostnames.
-
The workstation's IP address is in the wrong subnet.
-
The network interface card (NIC) has failed.
Why: The default gateway is the router interface that connects the local network to external networks. If it's misconfigured or the router is down, internal traffic can flow, but traffic destined for the internet will be dropped. A problem with internal hostname resolution wouldn't prevent access to external sites by IP address, and the issue specifically affects external access. Being on the wrong subnet would likely prevent internal access as well. A failed NIC would prevent all network connectivity.
Q3. A company is experiencing performance issues with its streaming video service delivered over the corporate network. The network uses a mix of voice and data traffic, and the video streams are frequently buffering. The IT department wants to ensure that video traffic receives priority over less time-sensitive data to improve the user experience. Which of the following Quality of Service (QoS) mechanisms should they implement FIRST?
-
Traffic Shaping
-
Packet Tagging (e.g., DSCP) ✓ Correct
-
Congestion Avoidance (e.g., RED)
-
Access Control Lists (ACLs)
Why: Packet Tagging, specifically using Differentiated Services Code Point (DSCP) values, is the foundational step in QoS implementation. It allows network devices to identify and classify different types of traffic (like streaming video) so they can be prioritized. Without proper tagging, other QoS mechanisms cannot effectively distinguish and manage the traffic. Traffic Shaping controls the rate of traffic, Congestion Avoidance aims to prevent drops during congestion, and ACLs are primarily for security and access control, not traffic prioritization.
Q4. A network administrator is designing a secure wireless network for a corporate office. The primary goal is to ensure strong encryption for data transmitted over the air and robust authentication for users trying to connect. The administrator wants to implement the most current and secure standard available for enterprise environments. Which of the following wireless security protocols BEST meets these requirements?
-
WPA2-PSK
-
WEP
-
WPA3-Enterprise ✓ Correct
-
WPA2-Enterprise
Why: WPA3-Enterprise offers the strongest security features, including enhanced encryption (GCMP-256), protection against offline dictionary attacks, and individualized data encryption. It also requires a RADIUS server for authentication, making it ideal for enterprise environments. WPA2-Enterprise is a strong predecessor but lacks some of the latest security enhancements found in WPA3. WPA2-PSK uses a pre-shared key, which is less secure than enterprise authentication, and WEP is considered obsolete and highly vulnerable.
Q5. A technician is troubleshooting intermittent connectivity issues for users in a building connected by both wired and wireless networks. Users on the wired network experience no problems, but wireless users report dropped connections and slow speeds. The wireless network utilizes multiple Access Points (APs) broadcasting the same SSID. Which of the following is the MOST likely cause of the wireless users' problems?
-
Co-channel interference between adjacent Access Points. ✓ Correct
-
Insufficient DHCP scope for wireless clients.
-
A misconfigured default gateway on the wireless clients.
-
High latency on the wired backbone.
Why: When multiple Access Points broadcast the same SSID on the same or overlapping channels (co-channel interference), wireless clients can experience dropped connections as they try to associate with the strongest signal or become confused by multiple signals. This is a common issue in dense wireless deployments. While insufficient DHCP scope or a misconfigured gateway could cause connectivity issues, they would likely affect both wired and wireless users or manifest differently. High latency on the wired backbone would impact all traffic, not just wireless.
Q6. A company has a network segment with several servers hosting critical applications. The IT department wants to implement a security measure that restricts which devices can communicate with these servers, allowing only authorized systems to connect. Which of the following network security controls should be implemented at the network layer to achieve this segmentation?
-
Port Security on switch ports connected to the servers.
-
Intrusion Detection System (IDS) monitoring the segment.
-
Access Control Lists (ACLs) on the router or firewall interface. ✓ Correct
-
VLAN segregation of the server segment.
Why: ACLs are used to permit or deny traffic based on IP addresses, ports, and protocols, making them ideal for controlling communication between network segments and specific hosts. By applying ACLs on the router or firewall that routes traffic to and from the server segment, the administrator can precisely define which devices are allowed to communicate with the servers. Port security restricts access based on MAC addresses at the switch port level, an IDS detects malicious activity but doesn't inherently block it, and VLAN segregation provides logical separation but doesn't inherently control traffic flow between segments without ACLs or firewall rules.
Q7. A network administrator is tasked with securing a new web server that will be accessible from the internet. The server will host a public-facing website. To ensure that the connection between clients and the server is encrypted and authenticated, what is the BEST protocol to implement at the Transport layer for secure communication?
-
FTP
-
HTTP
-
TLS/SSL ✓ Correct
-
Telnet
Why: Transport Layer Security (TLS), and its predecessor Secure Sockets Layer (SSL), are cryptographic protocols designed to provide secure communication over a computer network. They encrypt data, ensure data integrity, and provide authentication, making them essential for securing web traffic (HTTPS). FTP, HTTP, and Telnet are all insecure protocols that transmit data in plaintext and are vulnerable to eavesdropping and manipulation.
Q8. A network administrator is tasked with segmenting a large enterprise network to improve performance and security. The company has departments for Sales, Engineering, and Human Resources, each requiring separate broadcast domains. Which networking concept is MOST appropriate for achieving this separation at Layer 2?
-
Subnetting
-
VLANs (Virtual Local Area Networks) ✓ Correct
-
WAN links
-
DNS zones
Why: VLANs are the most appropriate Layer 2 concept for segmenting a network into separate broadcast domains based on departments or functions. This improves performance by reducing broadcast traffic and enhances security by isolating traffic between segments. Subnetting is a Layer 3 concept used for IP address allocation and does not inherently create separate broadcast domains at Layer 2. WAN links connect geographically dispersed networks and are not directly related to internal network segmentation. DNS zones are for name resolution and operate at the Application Layer, not for Layer 2 segmentation.
Q9. A company is experiencing a significant increase in latency and packet loss on its main internet connection. The connection is a business-grade fiber optic link. Network monitoring tools show that the connection is consistently saturated during peak business hours, with traffic primarily consisting of large file transfers and video conferencing. Which of the following actions would MOST effectively address the saturation issue while prioritizing critical business functions?
-
Implement Quality of Service (QoS) policies to prioritize voice and video traffic and manage bandwidth. ✓ Correct
-
Upgrade the internet connection to a higher bandwidth circuit.
-
Implement a Content Delivery Network (CDN) for frequently accessed external resources.
-
Deploy a more powerful firewall to inspect traffic faster.
Why: QoS is designed precisely for this scenario, where bandwidth saturation is causing performance issues. By prioritizing latency-sensitive traffic like voice and video conferencing, it ensures critical business functions remain stable even when the link is busy. Upgrading the internet connection (option 2) is a valid solution to saturation but is often more costly and time-consuming than implementing QoS. A CDN (option 3) helps reduce external traffic load but doesn't directly address internal saturation from file transfers or the overall link capacity. A more powerful firewall (option 4) might slightly improve inspection speed but will not resolve the fundamental issue of link saturation.
Q10. A network administrator is setting up a new network for a startup. They need to assign unique IP addresses to each device on the network segment. The network is expected to grow to approximately 200 devices within the next year. Which IPv4 address class and subnet mask combination would be MOST efficient for this scenario, considering private IP addressing and future growth?
-
Class A private range (10.0.0.0) with a /24 subnet mask.
-
Class B private range (172.16.0.0) with a /16 subnet mask.
-
Class C private range (192.168.1.0) with a /24 subnet mask.
-
Class B private range (172.16.0.0) with a /22 subnet mask. ✓ Correct
Why: A /22 subnet mask on the Class B private range (172.16.0.0/22) provides 1022 usable host addresses (2^(32-22) - 2), which is more than enough for the projected 200 devices and allows for significant future growth. The Class C private range with a /24 mask (192.168.1.0/24) only provides 254 usable host addresses, which might be insufficient if the network grows beyond 254 devices and requires additional subnets. A Class A private range (10.0.0.0) with a /24 mask is highly inefficient as it wastes a vast number of IP addresses. Using a Class B private range with a /16 mask provides over 65,000 addresses, which is overkill and inefficient for only 200 devices.