Q1. A company has deployed several Access Points (APs) across its campus for a corporate wireless network. Users are reporting inconsistent connectivity, with some devices frequently dropping from the network while others maintain a stable connection. The wireless network uses WPA2-Enterprise authentication. The IT department suspects an issue with the wireless controllers or AP configuration. What is the MOST likely cause of these intermittent connectivity issues?
-
Incorrectly configured DHCP scopes for wireless clients.
-
Overlapping RF channels between adjacent access points. ✓ Correct
-
A failure in the RADIUS server's authentication services.
-
Subnet mask misconfigurations on the wireless client devices.
Why: Overlapping RF channels between adjacent access points is a common cause of inconsistent wireless connectivity, leading to interference and dropped connections as clients try to roam between APs. While DHCP scope issues or subnet mask misconfigurations would typically result in a complete inability to obtain an IP address or connect to the network rather than intermittent drops, and RADIUS server issues would prevent authentication altogether, RF interference is a known culprit for the described symptoms. Proper channel planning is crucial for dense AP deployments.
Q2. A network administrator is tasked with segmenting a large corporate network into smaller, more manageable broadcast domains to improve performance and security. The company uses a Layer 3 switch as its core network device. Which of the following actions should the administrator perform FIRST to achieve network segmentation?
-
Configure static ARP entries on all hosts within each segment.
-
Create multiple VLANs and assign appropriate IP subnets to each VLAN. ✓ Correct
-
Implement Access Control Lists (ACLs) on the firewall to restrict inter-VLAN traffic.
-
Deploy a proxy server to manage client access to external resources.
Why: The very first step in segmenting a network using VLANs and a Layer 3 switch is to create the VLANs themselves and assign an IP subnet to each one, effectively defining the broadcast domains. ACLs are a subsequent step to control traffic *between* these segments, not to create them. Static ARP entries are not a standard or efficient way to manage segmentation, and a proxy server is unrelated to the fundamental process of creating network segments.
Q3. A network technician is setting up a new network segment for a development team. This segment needs to be isolated from the main corporate network for security reasons, but the developers still need access to the internet. The network infrastructure includes a core Layer 3 switch and a perimeter firewall. What is the MOST effective way to implement this isolation while allowing internet access?
-
Configure a separate physical switch and connect it directly to the internet uplink.
-
Create a new VLAN for the development team and configure the firewall to allow specific inbound and outbound traffic between the VLAN and the internet. ✓ Correct
-
Implement NAT on the core Layer 3 switch for the development team's subnet.
-
Assign a public IP address range to the development team's subnet and route it directly to the firewall.
Why: Creating a new VLAN for the development team and then using the firewall to control traffic between this VLAN and the internet is the standard and most effective method for network segmentation and controlled access. This approach allows for granular policy enforcement. Connecting a separate switch directly to the internet uplink bypasses critical security controls, and implementing NAT on the L3 switch is not its primary function for security segmentation. Assigning public IP addresses directly to internal segments is a security risk and unnecessary when NAT can be handled by the firewall.
Q4. A company is experiencing significant network latency for users accessing applications hosted on a server in a different physical location, connected via a 10 Gbps leased line. The latency is inconsistent and spikes during peak hours. Network monitoring tools show that the leased line utilization is only at 40% during these periods. Which of the following is the MOST likely cause of the high latency?
-
A faulty Network Interface Card (NIC) on the server.
-
Congestion or high latency on a network segment *before* the leased line. ✓ Correct
-
The leased line speed is insufficient for the application's traffic.
-
An incorrect MTU size configured on the server's NIC.
Why: Even with a high-speed leased line, if the network segments leading *to* that leased line are congested or experiencing latency, the overall performance will suffer. The leased line itself may have ample capacity (40% utilization indicates this), but if traffic is delayed getting *to* it, latency will increase. A faulty NIC or incorrect MTU would typically cause more consistent or different types of connectivity issues, not necessarily latency spikes tied to peak hours on a line with available capacity. The leased line speed is unlikely to be the bottleneck if utilization is only 40%.
Q5. A network administrator is deploying a new VoIP phone system and needs to ensure that voice traffic receives priority over less time-sensitive data traffic to guarantee call quality. The network uses managed switches and routers that support Quality of Service (QoS). Which QoS mechanism should the administrator configure FIRST to achieve this prioritization?
-
Traffic Shaping
-
Congestion Avoidance (e.g., RED)
-
Classification and Marking ✓ Correct
-
Rate Limiting
Why: Classification and Marking is the foundational step for implementing QoS. You must first identify (classify) the VoIP traffic (e.g., based on protocol, port, or DSCP values) and then mark it with a specific tag (like a DSCP value) so that downstream devices can recognize and prioritize it. Traffic Shaping, Congestion Avoidance, and Rate Limiting are mechanisms that *act* on traffic once it has been classified and marked, but without the initial classification and marking, these mechanisms wouldn't know which traffic to prioritize.
Q6. A company has recently experienced a security breach where unauthorized users gained access to sensitive internal documents. The investigation revealed that an attacker exploited a vulnerability in an outdated server software. The network uses a perimeter firewall and internal segmentation with VLANs. What is the MOST effective defense-in-depth strategy to prevent similar future breaches originating from compromised internal systems?
-
Implement Intrusion Detection/Prevention Systems (IDPS) on the network segments containing sensitive servers. ✓ Correct
-
Mandate strong password policies and regular security awareness training for all employees.
-
Deploy Network Access Control (NAC) to ensure only authorized and up-to-date devices can connect.
-
Configure strict egress filtering rules on the firewall to limit outbound communication from internal servers.
Why: Implementing IDPS specifically on segments containing sensitive servers is the most direct defense-in-depth measure against threats that have already bypassed perimeter defenses or originated internally, as suggested by the scenario. While strong passwords, training, NAC, and egress filtering are all valuable security measures, an IDPS is specifically designed to detect and potentially block malicious activity occurring *within* the network, especially on critical assets. The scenario implies an internal compromise or exploit of an internal system, making internal monitoring crucial.
Q7. A financial services company is migrating its on-premises data center to a cloud provider to host its customer-facing trading platform. The new architecture will involve multiple virtual private clouds (VPCs) for different services (e.g., web servers, application servers, databases) and will require secure, high-bandwidth communication between them, as well as with the on-premises offices. Which of the following implementation strategies would BEST ensure the required connectivity and security between the cloud VPCs and the on-premises environment?
-
Establish individual IPSec VPN tunnels from each on-premises office router directly to each cloud VPC gateway.
-
Implement a cloud-native transit gateway or virtual WAN solution to centrally manage routing and connectivity between VPCs and on-premises networks. ✓ Correct
-
Configure static default routes on all internal servers in the cloud VPCs to point to the internet gateway.
-
Utilize a proxy server in each cloud VPC to mediate all traffic between VPCs and on-premises locations.
Why: A transit gateway or virtual WAN is the most scalable and manageable solution for connecting multiple VPCs and on-premises networks in a cloud environment. It acts as a central hub, simplifying routing and security policy management. Establishing individual VPN tunnels (distractor A) would become unmanageable with many VPCs and locations, leading to a complex mesh. Configuring static default routes to the internet gateway (distractor C) bypasses the need for secure inter-VPC and on-premises connectivity and exposes internal traffic unnecessarily. Using a proxy server (distractor D) is not the primary mechanism for establishing network-level connectivity and routing between distributed environments.
Q8. A network administrator is tasked with segmenting a large corporate network into smaller, more manageable broadcast domains to improve performance and security. The company uses a mix of VoIP phones, standard workstations, and servers. The administrator wants to isolate VoIP traffic to ensure Quality of Service (QoS) can be effectively applied. Which of the following actions should the administrator take FIRST?
-
Configure Access Control Lists (ACLs) on the core router to filter VoIP traffic.
-
Implement VLANs on the switches, assigning separate VLANs for workstations, servers, and VoIP phones, and configure inter-VLAN routing. ✓ Correct
-
Deploy a dedicated firewall between the workstation subnet and the VoIP subnet.
-
Enable Spanning Tree Protocol (STP) on all network switches.
Why: Implementing VLANs is the fundamental first step to segmenting the network into separate broadcast domains and isolating traffic types like VoIP. This allows for better control, security, and the ability to apply QoS policies specific to the VoIP VLAN. While ACLs (distractor A) can filter traffic, they operate *after* traffic has entered a broadcast domain and are not the primary method for segmentation. A dedicated firewall (distractor C) provides security but doesn't inherently segment broadcast domains; it controls traffic *between* segments. STP (distractor D) is crucial for preventing loops in switched networks but does not address traffic segmentation or broadcast domain management.
Q9. A growing e-commerce company is experiencing increased latency and packet loss during peak traffic hours, impacting customer experience. Network monitoring tools show that the internet bandwidth utilization is consistently at 95% during these times, but internal network traffic shows no congestion. The company has a primary internet connection through a single ISP. What is the MOST likely cause of the performance degradation?
-
The company's internal DNS server is overloaded.
-
The firewall is unable to handle the volume of traffic inspection.
-
The available internet bandwidth is insufficient for the peak demand. ✓ Correct
-
A duplex mismatch is occurring on the core switch.
Why: The monitoring data clearly indicates that the internet connection is saturated at 95% utilization during peak hours, directly correlating with latency and packet loss. This suggests the primary bottleneck is the available internet bandwidth. An overloaded DNS server (distractor A) might cause slow name resolution but wouldn't necessarily saturate the internet connection itself. A firewall (distractor B) could be a bottleneck, but the primary symptom here is bandwidth saturation, not necessarily deep packet inspection failure. A duplex mismatch (distractor D) typically causes connectivity issues or significant performance degradation on a specific link, not a consistent saturation of the overall internet connection.
Q10. A network technician is deploying a new server in a DMZ (Demilitarized Zone) that will host a public-facing web application. The company's security policy requires that this server only be accessible from the internet on port 443 (HTTPS) and only able to initiate connections to the internal application server on port 8443. Which of the following firewall rulesets is REQUIRED to enforce this policy?
-
Allow inbound traffic from the internet to the DMZ web server on port 443; Allow outbound traffic from the DMZ web server to the internal app server on port 8443. ✓ Correct
-
Allow inbound traffic from the internet to the DMZ web server on port 443; Allow inbound traffic from the internal app server to the DMZ web server on port 8443.
-
Allow outbound traffic from the DMZ web server to the internet on port 443; Allow outbound traffic from the DMZ web server to the internal app server on port 8443.
-
Allow inbound traffic from the internet to the DMZ web server on all ports; Allow outbound traffic from the DMZ web server to the internal app server on port 8443.
Why: To meet the requirements, two rules are essential: first, allowing external users to connect to the web server via HTTPS (inbound to DMZ on port 443), and second, allowing the web server to connect to the internal application server for necessary data (outbound from DMZ to internal on port 8443). Distractor B incorrectly allows inbound traffic *from* the internal server *to* the DMZ server, which is not specified as a requirement and could be a security risk. Distractor C incorrectly allows outbound traffic *to* the internet on port 443, which is generally not how inbound web services operate and is redundant if inbound is already allowed. Distractor D is too permissive, allowing all inbound traffic from the internet to the DMZ server, violating the principle of least privilege.