Q1. A growing startup company is experiencing significant network slowdowns during peak business hours, particularly when multiple users are accessing shared cloud-based applications. The IT team has observed that network utilization on the main internet uplink frequently reaches 95%. Which of the following actions should the network administrator take FIRST to address the performance degradation?
-
Implement Quality of Service (QoS) policies to prioritize critical application traffic.
-
Upgrade the internet connection to a higher bandwidth tier. ✓ Correct
-
Configure a content filter to block non-business related websites.
-
Replace all end-user workstations with newer models.
Why: The primary issue is network utilization reaching 95% during peak hours, directly indicating a bandwidth bottleneck on the internet uplink. Upgrading the internet connection is the most direct and effective solution to alleviate this saturation. While QoS can help manage existing bandwidth, it cannot create more bandwidth when the link is consistently maxed out. Content filtering might slightly reduce utilization but is unlikely to solve a 95% saturation issue, and replacing workstations does not address the network's capacity problem.
Q2. A user reports that they can connect to the company's internal network resources, such as file shares and printers, but cannot access any external websites. The user's workstation is configured to obtain an IP address automatically via DHCP. The network administrator has verified that other users on the same subnet are experiencing the same problem. What is the MOST likely cause of this issue?
-
The default gateway address is incorrect or unreachable. ✓ Correct
-
The DNS server address assigned by DHCP is incorrect or unreachable.
-
The user's network interface card (NIC) has failed.
-
There is a physical cabling issue between the user's workstation and the switch.
Why: When a user can access internal resources but not external ones, it strongly suggests a problem with routing traffic outside the local network. The default gateway is responsible for forwarding traffic to other networks, including the internet. If it's incorrect or unreachable, external sites will be inaccessible. While a DNS issue would prevent name resolution, users could still potentially access external sites via IP address if the gateway was functional. A failed NIC or cabling issue would likely result in no connectivity at all, or at least affect internal access as well.
Q3. A network technician is setting up a new server that will host a web application accessible from the internet. The company's firewall is configured to allow inbound traffic only to specific servers and ports. Which of the following firewall rules should the technician request to be implemented to allow users to access the web application?
-
Allow inbound TCP traffic on port 443 to the web server's IP address. ✓ Correct
-
Allow outbound UDP traffic on port 53 from the web server's IP address.
-
Allow inbound TCP traffic on port 22 to the web server's IP address.
-
Allow outbound TCP traffic on port 80 to any destination IP address.
Why: Web applications accessed from the internet typically use HTTPS, which runs over TCP port 443. Allowing inbound TCP traffic on this port to the web server's IP address is essential for external users to connect. Port 22 (SSH) is used for secure remote administration, not web access. Port 80 (HTTP) is for unencrypted web traffic, which is less common and less secure for public applications. Allowing outbound UDP port 53 is for DNS lookups, which the server needs, but the primary requirement for external access to the web application itself is inbound traffic on the correct web port.
Q4. A network administrator is tasked with isolating different departments within a company onto separate network segments for security and traffic management. The company uses a managed switch infrastructure. Which of the following technologies should the administrator implement to achieve this segmentation on a single physical switch?
-
Virtual Local Area Networks (VLANs) ✓ Correct
-
Subnetting IPv4 addresses
-
Spanning Tree Protocol (STP)
-
Link Aggregation Control Protocol (LACP)
Why: VLANs are the standard method for segmenting a single physical switch into multiple logical broadcast domains, effectively isolating different departments or user groups. Subnetting is an IP addressing scheme that logically divides a network but doesn't inherently segment traffic at the Layer 2 switch level in the way VLANs do. STP is used to prevent network loops and does not provide segmentation. LACP is used for link aggregation to increase bandwidth and redundancy, not for network segmentation.
Q5. During a network performance audit, a technician notices that a critical server experiences high latency and occasional packet loss, especially during periods of heavy file transfer activity from multiple clients. The server's network interface card (NIC) has a negotiated speed of 1 Gbps, and the switch port it connects to also shows a 1 Gbps link. However, the switch is also experiencing high utilization on its uplink port to the core router. What is the MOST likely bottleneck causing the server's performance issues?
-
The uplink port on the switch is saturated. ✓ Correct
-
The server's NIC is faulty and negotiating a suboptimal speed.
-
The IP address conflict between the server and a client.
-
The firewall is misconfigured and dropping packets.
Why: The scenario describes high utilization on the switch's uplink port, coupled with performance issues on a server connected to that switch. This indicates that while the server and its immediate switch port might be fine, the aggregate traffic from the switch (including the server's traffic) is exceeding the capacity of the uplink to the core router, causing congestion and thus latency and packet loss. A faulty NIC would likely show a lower negotiated speed or other errors, and an IP conflict or firewall issue would typically cause more widespread or distinct connectivity problems rather than performance degradation tied to heavy traffic.
Q6. A remote user is consistently unable to connect to the company's internal network via the established VPN. The user reports seeing an 'Authentication Failed' error message. All other remote users are connecting successfully. The network administrator has confirmed that the user's VPN client software is up to date and the correct VPN server address is configured. What is the MOST likely cause of this specific user's problem?
-
Incorrect VPN username or password. ✓ Correct
-
The user's computer clock is significantly out of sync with the server.
-
A firewall on the user's local network is blocking VPN traffic.
-
The VPN server is not reachable from the user's current location.
Why: An 'Authentication Failed' error message specifically points to an issue with the credentials provided during the VPN connection attempt. Since all other users are connecting successfully and the client software/server address are confirmed, the most logical reason for this specific user's failure is an incorrect username or password. While a clock sync issue, local firewall, or network reachability problem *could* cause VPN issues, they typically manifest differently (e.g., timeouts, connection refused, or no response) and are less likely to result in a direct authentication failure for a single user when others are fine.
Q7. A network administrator is reviewing network logs and discovers evidence of unauthorized devices attempting to connect to the wired network using MAC addresses spoofed from legitimate devices. The company wants to implement a security measure at the switch level to mitigate this threat. Which of the following features should the administrator configure on the affected switch ports?
-
Port Security ✓ Correct
-
VLAN Trunking
-
Spanning Tree Protocol Root Guard
-
DHCP Snooping
Why: Port Security is a feature that limits the number of MAC addresses allowed on a specific switch port and can be configured to bind specific MAC addresses to ports, preventing MAC spoofing and unauthorized device connections. VLAN Trunking is used to carry traffic for multiple VLANs over a single link. Spanning Tree Protocol Root Guard prevents unauthorized switches from becoming the root bridge, and DHCP Snooping helps prevent rogue DHCP servers but doesn't directly address MAC spoofing for device authentication on a port.
Q8. A company is experiencing intermittent connectivity issues where users in one department report slow access to a specific internal application server. Network monitoring tools show normal traffic levels for other services and servers. The application server is connected to a 1 Gbps port on a switch, and the switch uplink to the core is also functioning normally. The application team suspects a network issue, but the general network health appears stable. Which of the following is the MOST likely cause for this isolated performance problem?
-
Duplex mismatch between the server's NIC and the switch port. ✓ Correct
-
A broadcast storm originating from the application server.
-
Incorrect subnet mask on the application server.
-
A failing RAM module in the application server.
Why: A duplex mismatch (e.g., one side set to full-duplex and the other to half-duplex) is a common cause of intermittent connectivity and poor performance, especially during heavy traffic, even if link lights indicate a connection. It leads to frequent collisions and retransmissions. While a broadcast storm could cause widespread issues, it's less likely to be isolated to a single server's performance without affecting other devices on the same segment more broadly. An incorrect subnet mask would likely cause complete connectivity loss, not just slow performance. A failing RAM module is a hardware issue internal to the server, not typically diagnosed as a network performance problem in this context.
Q9. A network administrator is tasked with optimizing the performance of a busy enterprise network experiencing high latency during peak hours. The network utilizes several routers and switches to connect multiple departments and a data center. Users are reporting delays when accessing shared resources and applications hosted in the data center. Which of the following actions would MOST effectively address the high latency issue?
-
Implement a Content Delivery Network (CDN) for all internal applications.
-
Upgrade all network interface cards (NICs) to 10 Gbps.
-
Perform traffic analysis and implement Quality of Service (QoS) policies to prioritize critical application traffic. ✓ Correct
-
Replace all existing CAT 5e cabling with CAT 7 cabling throughout the enterprise.
Why: The correct answer is to perform traffic analysis and implement QoS policies. This allows the network administrator to identify the types of traffic causing congestion and prioritize essential data, thereby reducing latency for critical applications and resources. Upgrading NICs and cabling might help with bandwidth, but won't solve latency issues caused by congestion or suboptimal traffic prioritization. A CDN is typically used for external content delivery and would not be the primary solution for internal resource access latency.
Q10. A company's cybersecurity team has detected unusual outbound traffic patterns from several workstations, indicating a potential botnet infection. The traffic consists of numerous small, unsolicited packets originating from internal client machines and destined for various external IP addresses. The goal is to contain the spread and identify the affected systems FIRST. What should be the immediate FIRST step?
-
Reconfigure the firewall to block all outbound traffic on UDP port 68.
-
Initiate a full network scan using an endpoint detection and response (EDR) solution.
-
Isolate the suspected workstations from the rest of the network. ✓ Correct
-
Disable DHCP services on the network until the issue is resolved.
Why: The most critical FIRST step in this scenario is to isolate the suspected workstations from the network to prevent further spread of the botnet infection and to stop them from attacking external systems. While initiating an EDR scan is important for identification, it should follow isolation to contain the threat. Reconfiguring the firewall for a specific port is too narrow and might not address the full scope of the botnet's communication, and disabling DHCP would disrupt essential network operations for all users, not just the infected ones.