Font size
WorksheetsWeek 4: Network Availability, Security, and Troubleshooting
Total questions: 84
Worksheet time: 42mins
A sysadmin must allow remote command execution for a maintenance script on a Linux host but avoid interactive logins. Which SSH usage best fits that requirement?
ssh user@host and run commands manually
ssh -X user@host to forward X11 and run GUI apps
ssh user@host "bash /opt/maintenance.sh"
scp /opt/maintenance.sh user@host:/tmp then ssh user@host
Enable telnet for script execution
Your company policy requires non-interactive automated backups from serverA to serverB with no password prompts. Which is the most secure approach?
Store root password in cleartext and use sshpass
Generate an SSH key pair on serverA and add its public key to serverB’s authorized_keys with passphrase disabled for automation
Use telnet for faster transfer
Use HTTP PUT to send files to serverB
Run backups manually each night
An administrator sees many failed login attempts in /var/log/auth.log for SSH. What immediate change reduces risk while investigating?
Change from SSH to Telnet
Disable host key checking
Move SSH to a non-standard port and enable rate limiting / fail2ban
Add more users to obscure root account
Remove SSH keys from authorized_keys altogether
A mobile field engineer needs time-synced logs across routers and servers to diagnose an outage. Which is the best action?
Manually set the time on each device weekly
Configure NTP to use a local Stratum 1 server and ensure clients point to it
Disable time sync to avoid drift
Use the system BIOS clock only
Rely on DHCP lease times for log ordering
You want to ensure a remote admin’s SSH session is authenticated by both host and user. Which mechanism enforces that?
Only username/password login
Host public key verification plus user public key authentication (SSH with known_hosts and authorized_keys)
Telnet with IP filtering
Anonymous FTP login followed by local exec
LDAP read-only binding
During a network audit you find SNMP community strings set to default “public”. What immediate change would reduce risk while retaining SNMP reads?
Turn off SNMP entirely
Change the community string to a strong unique string and restrict SNMP access by ACL to management hosts (keep read-only)
Use SNMPv1 but on a different port
Use the same community string across all devices for simplicity
Replace SNMP with telnet polling
A router sends SNMP traps but your collector shows none. Which step best isolates the problem?
Reboot the router immediately
Verify UDP/162 is reachable from the router to the collector and that the community string matches
Switch to using syslog only
Change the router’s management IP randomly
Disable SNMP on the router and re-enable it hourly
A datacenter’s environmental sensors are reporting increasing chassis temperature on a core switch. What should you do first to preserve availability?
Ignore — temperatures fluctuate normally
Increase CPU load to test thermal thresholds
Investigate airflow and fan status, check ambient sensors and schedule cooling intervention while triggering high-severity alerting
Replace the switch immediately without investigation
Turn off SNMP monitoring to reduce load
Your monitoring dashboard shows periodic short spikes of high utilization on an uplink every 30 minutes. What is the best way to find culprit traffic?
Increase link speed without investigating
Run NetFlow/IPFIX on the uplink and examine top talkers for the spike intervals
Block all outbound traffic during spikes
Disable QoS so all traffic is treated equally
Reboot the router at the start of every spike
A new VoIP app reports poor call quality (jitter/latency). Which metric and tool pair will best measure the one-way latency and jitter for troubleshooting?
Use top to measure CPU
Use iperf for bulk throughput only
Use an RTP/VoIP monitoring tool or active probes that measure one-way latency and jitter (with synchronized clocks or probe pairs)
Use df -h to check disk space
Inspect ARP tables only
A junior admin enabled syslog over UDP to a central collector, but messages are missing during heavy load. What change increases reliability?
Switch the collector to HTTP
Use TCP syslog or a reliable transport (e.g., syslog over TLS) so messages aren’t dropped under load
Lower all device logging levels to debug
Send logs to multiple random hosts
Remove timestamps from logs
An SNMP MIB object OID shows CPU temperature on a device. Which SNMP operation returns that single value efficiently?
SNMP Walk for the whole MIB tree
SNMP Get for the specific OID
SNMP Set without consent
Polling via telnet
FTP the .mib file
A site experiences intermittent packet loss only on a particular interface. Which interface metric most directly indicates physical error problems?
High CPU utilization on a remote server
Increased interface CRC errors and collisions reported by interface counters
Low disk IO on a firewall
DNS response time
Low memory on a switch
A streaming application requires consistent low latency and small jitter. Which DiffServ class should be used for its traffic?
Best Effort (BE)
Assured Forwarding (AF) only
Expedited Forwarding (EF) for low-latency, low-loss requirements
Network Control for all streaming endpoints
Random Early Detection (RED) only
Your school wants to prioritize VoIP but still allow students’ downloads. Which QoS mechanism will tag Ethernet frames for switch-port prioritization?
DSCP only, no mapping to layer 2
802.1p priority field (the 3-bit PCP in 802.1Q) mapped from DSCP to apply L2 prioritization
NAT translation table edits
Disabling spanning tree
TTL decrementing
A manager asks to reduce bursty backup traffic impact. Which traffic control technique reserves bandwidth for critical apps?
Traffic policing to drop exceeding packets and traffic shaping to smooth bursts and reserve bandwidth for critical traffic
Block all backups entirely
Increase application retries so traffic is spread
Configure smaller MTU on the link
Use static routes only
A file server reports slow transfers despite nominal interface utilization. Which “goodput vs throughput” explanation is most likely?
Throughput equals goodput always
Throughput is raw link rate; goodput is user data after protocol overhead and retransmissions - high retransmits or small packets can reduce goodput despite high throughput
Goodput increases when latency increases
Throughput is only CPU-related
Goodput is unrelated to retransmissions
Your VoIP calls fail when callers are on a remote subnet behind a NAT. Which NAT behaviour is most likely causing one-way audio?
Static NAT always causes this
PAT (NAPT) changing port mappings and not allowing proper SIP/ RTP pinholes without ALG or firewall pinhole rules, causing RTP not to traverse correctly
NAT never affects voice traffic
Using multiple public IPs is the issue
NAT modifies MAC addresses only
The NTP servers are misconfigured and clients show different timestamps. What symptom is most likely to cause certificate validation failures?
Disk quotas exceeded
Clients’ system times drift and certificate validation fails due to incorrect “Not Before/Not After” checks
DNS TTL values are wrong
VLAN mismatch
Switch port duplex errors
An SNMP agent supports only read-only access but you need to change an ACL remotely. Which change is needed on the device to allow remote config via SNMP?
Nothing - SNMP read-only can change config
Configure an SNMPv3 user with authenticated and encrypted read-write access (or enable SNMP RW community on restricted hosts)
Use telnet without authentication
Use FTP to upload a config file and reboot
Recreate the ACL locally on that site only
A backup scheduled job uses SCP and fails intermittently during network congestion. Which network QoS action will most directly improve reliability?
Mark backup traffic EF
Leave as Best Effort and hope for the best
Mark backups as low priority (Best Effort) and mark real-time traffic EF - ensure backups are deprioritized so critical services get bandwidth during congestion
Disable SSH encryption on SCP
Use Telnet copy instead
You must monitor interface utilization trends to plan upgrades. Which approach will give the most useful baseline?
Single instantaneous ifconfig snapshot
Collect historical interface utilization counters over time (1-minute, 5-minute averages) and store baselines for peak and average values for capacity planning
Only measure during business holidays
A new switch reports excessive “runt” frames. What layer/issue does this indicate and what likely remedy?
Layer 7 application misconfiguration
Physical layer framing problem - check duplex/MTU mismatches and cabling, and replace faulty NICs/cables
A DNS misconfiguration
Routing table overflow
High CPU on the switch
A remote site uses only UDP syslog. During a DoS the central collector misses critical alerts. What design change prevents loss of high-severity messages?
Only log to local files and never forward
Use an out-of-band secure, reliable logging transport (syslog over TLS or TCP) and configure priority filtering to always forward high-severity messages
Use UDP with higher ports only
Disable logging during DoS to conserve bandwidth
Send logs over ICMP to squeeze through
A sensor shows fluctuating voltage on a rack. Which consequence is most likely to affect availability?
Slight voltage changes never affect equipment
Voltage fluctuation can cause unexpected reboots or component stress; trigger alarms and failover to redundant power while investigating UPS/PDUs
Only the monitor will be impacted
It will cause DNS failures directly
It only affects software licenses
A technician wants to tunnel database traffic securely across an untrusted WAN. Which is the best approach?
Use plain TCP port forwarding across the internet
Create an SSH tunnel or VPN between endpoints to encrypt the traffic end-to-end
Use SNMP traps to send database packets
Use FTP in passive mode for all DB traffic
Rely on routing protocol encryption only
Your monitoring system needs to trigger an alarm only when a threshold is exceeded for 10 minutes consecutively. Which concept should you configure?
Single-sample alerting
Use threshold-based alerting with a debounce/hold period (alert when threshold exceeded for configured sustained interval) to reduce noisy alerts
Disable thresholds entirely
Use an immediate SMS for every small spike
Send only daily summaries
A newly installed application requires guaranteed bandwidth during global events. Which combination provides predictable delivery across an IP network?
Best Effort with random drops
Use DiffServ DSCP marking for the app and ensure network devices map DSCP to Layer 2 priority and implement queuing (EF or AF as appropriate) end-to-end
Use HTTP keep-alive only
Rely on static routing to prioritize traffic
Increase MTU everywhere
An engineer wants to see all log messages from multiple firewalls in one place. Which tool and protocol are appropriate?
NetFlow via UDP/9999
Central log collector with syslog (preferably TLS) and a SIEM to aggregate and correlate logs for event management
FTP logs to a web server every hour
SSH into each firewall manually and read logs
Use email alerts only
A device’s MIB doesn’t contain a needed custom sensor OID. What is the best practice for integrating it with SNMP monitoring?
Guess an OID and poll it
Extend the device’s MIB with a vendor-provided or custom MIB and register the new OID mapping in the monitoring system
Poll random OIDs until one works
Replace SNMP with telnet polling
Hardcode sensor values in the collector only
During a WAN maintenance window you need to ensure critical traffic still flows. What action should you take?
Disable all QoS to simplify routing
Configure QoS to prioritize critical traffic and schedule maintenance with traffic shaping and alternate routing where possible
Unplug the non-critical links only
Increase DNS TTLs only
Use default routing and hope for the best
Your monitoring shows increasing retransmissions on a TCP stream across a specific path. Which network problem is most probable?
High packet loss or corruption on the path (could be congestion, CRC errors, or faulty hardware) leading to retransmission — investigate physical and queuing issues
Wrong DNS configuration
Incorrect NTP servers
Firewall blocking ICMP only
Low disk space on client
A new campus video streaming service needs assessment for required link capacity. How do you calculate required bandwidth per stream?
Use only the codec name regardless of profile
Use the stream’s bitrate (e.g., 2 Mbps for HD) plus overhead for RTP/UDP/IP and account for concurrent users and headroom — sum concurrency × per-stream bitrate and overhead
Use twice the number of users as Mbps always
Use interface speed only
Count only the number of devices, ignore bitrate
A web server needs to prove its identity to visitors. Which PKI artifact provides that assurance?
Telnet banner text
A self-signed certificate always trusted by clients
A digital certificate issued and signed by a trusted CA, presented during TLS handshake
FTP credentials stored on the server
DNS A record only
A company wants single sign-on across internal apps with mutual authentication. Which protocol combination fits that requirement?
LDAP without secure transport
Kerberos for SSO with service tickets (KDC) to provide mutual authentication between clients and services
HTTP Basic Auth for each app
Telnet with password caching
FTP with anonymous login
An admin must provide multifactor authentication (MFA) for remote VPN access requiring “something you have” and “something you know.” Which pair is valid?
Password + IP address
Password + hardware token (OTP device)
Fingerprint only
Password + email subject line
Static password reused across sites
A developer needs to allow a service account to authenticate without interactive login on many servers. Which is the recommended secure pattern?
Store plaintext password in scripts executed by cron
Use an SSH key pair for the service account and manage keys with an agent or central secrets manager, following least privilege and rotation policies
Put the password in /etc/passwd shell field
Use Telnet with cleartext creds
Use the root account for all services
You must implement network access control with port-based authentication. Which standard offers this at the switch port level?
RSTP
IEEE 802.1X using EAP and an AAA server for authentication and dynamic VLAN assignment
IGMP snooping
DHCP only
BGP session authentication
A technician configures TACACS+ on a switch for administrative access. What advantage does TACACS+ provide over RADIUS for device administration?
TACACS+ uses UDP and is faster
TACACS+ separates authentication, authorization, and accounting and uses TCP for reliable transport and finer-grained command authorization
TACACS+ does not log commands
TACACS+ is only for wireless controllers
TACACS+ cannot be used with AAA
A company stores user credentials in LDAP. What must they do to secure credentials in transit during LDAP binds?
Use LDAP simple binds over plain TCP port 389 only
Use LDAPS (LDAP over TLS) or LDAP with StartTLS to encrypt credentials in transit
Increase DNS TTL
Use SNMP to read LDAP entries
Store passwords in hosts file
A server certificate shows “Invalid certificate: name mismatch” to clients. What is the most likely cause?
The server’s DNS A record is missing
The subject CN or SAN in the certificate does not match the hostname clients use to reach the server
The certificate is self-signed and expired always
The server’s MAC address changed
The time zone is UTC+1 only
A penetration tester reports a zero-day exploit on an unpatched service. Which immediate risk-management step is best?
Ignore it until a scheduled maintenance window months away
Apply vendor mitigations, isolate or block the vulnerable service where feasible, and prioritize patching after testing, while monitoring for indicators of compromise
Replace the hardware immediately with unknown hardware
Disable logging to avoid performance hits
Ask users to avoid using the internet
An organization wants to enforce least privilege for administrators. Which practice aligns with privileged access management?
Give all admins full domain admin rights for convenience
Use role-based accounts, temporary elevation (just-in-time), audit logging, and credential vaulting for privileged accounts
Share one admin password for all admins
Disable auditing to protect admin privacy
Store admin passwords in a shared Google Doc
A network sensor flags a possible compromise using IOC matches in logs across devices. Which SIEM capability helps reduce false positives by correlating events?
Forward logs without analysis
Use event correlation rules and context enrichment (user, host, asset criticality) to group related alerts and reduce noise
Delete old logs to improve performance
Only keep syslog severity 7 messages
Run correlation manually once a year
A wireless access point uses WPA2-Enterprise with 802.1X. Which backend service typically performs authentication?
DHCP server
RADIUS server (AAA) authenticating EAP credentials against a directory such as LDAP/Active Directory
FTP server
DNS server
NTP server
You must ensure email server TLS certificates are valid. Which operational task will most directly prevent certificate expiration outages?
Ignore expiry and hope clients accept warnings
Track certificate expiry dates in monitoring and automate renewal/installation via ACME or a certificate management process
Reduce TLS versions supported only
Delete the CA chain from the server
Use self-signed certs without tracking expiry
A help desk reports employees can’t authenticate using SSO after a domain controller outage. What SSO component dependency explains this?
SSO never depends on domain controllers
Kerberos-based SSO depends on KDC/AD availability to issue tickets; domain controller / KDC outage breaks ticket issuance and validation
RADIUS always overrides SSO
DNS is unrelated to SSO
LDAP never matters for SSO operations
A security engineer must ensure mutual authentication between a client and server. Which mechanism provides mutual proof of identity?
HTTP Basic authentication only
TLS with client certificates (mutual TLS) so both sides present and validate certificates issued by trusted CAs
Password stored in a cookie
Using SSH server key only
Open FTP connections
A server is using SHA-1 signed certificates which security flags show as weak. What should you do?
Keep SHA-1 certs as they’re still valid everywhere
Reissue certificates signed with modern hash algorithms (e.g., SHA-256) and remove deprecated algorithms from cipher suites
Switch to MD5 for speed
Remove TLS entirely
Change only the certificate subject name
An admin needs to ensure an application’s LDAP password verification is both secure and doesn’t store the password plaintext. What should they implement?
Store plaintext in a config file on a web server
Use hashed and salted password storage on the directory and use secure LDAP channels for bind verification; avoid reversible encryption where possible
Use Telnet for password checking
Use NTP to validate passwords
Use a public FTP share for passwords
An organization wants to limit lateral movement by compromised endpoints. Which architecture principle helps most?
Flat network, single VLAN for everything
Defense in Depth with network segmentation, NAC, microsegmentation, and least-privilege host access controls
Share admin credentials widely for fast recovery
Disable firewalls to increase throughput
Use single sign-on for everything without segmentation
A user’s account is repeatedly failing login attempts and locked out. Which investigation step will best identify whether the cause is a brute-force attack or a user issue?
Immediately delete the account
Review authentication logs for source IPs/timestamps, check for repeated attempts from one or multiple IPs, and correlate with recent password changes or service usage
Reinstall the authentication server
Reset network cables
Turn off auditing to stop alerts
A certificate revocation list (CRL) check is failing for a public-facing service. Which is the most likely cause of client trust failure?
Client is not using TLS
CRL or OCSP responder is unreachable or the certificate was revoked - causing clients to fail validation if CRL/OCSP checks are required
DNS A record missing only
NTP is off by 1 minute always
MAC address mismatch
You need to secure SSH private keys used by multiple automation jobs. Which approach is best for key management?
Put the private key on every server with no passphrase
Use a secrets manager to store keys and provide ephemeral credentials to jobs, rotate keys regularly, and restrict access by role
Email private keys to team members
Check keys into version control without encryption
Use the same private key for all users forever
During a vulnerability scan you find legacy SMBv1 enabled on a file server. What change reduces risk most quickly?
Ignore it since SMBv1 is harmless
Disable SMBv1, ensure SMBv2/3 is enabled and hardened, and apply host-level compensating controls if immediate service interruption is a risk
Re-enable anonymous access to mitigate scanning noise
Change the server’s MAC address only
Move the server to the DMZ without updating protocols
An enterprise wants to control supplier access to certain systems. Which vendor assessment activity reduces supply-chain risk?
Grant suppliers full admin rights to speed onboarding
Perform security maturity assessments, require minimal privileges, enforce contractual security requirements, and validate onboarding security posture periodically
Share a single shared password with all suppliers
Use FTP for vendor uploads only
Exclude vendors from audits to avoid conflict
An IDS using signature-based detection is failing to detect a new polymorphic attack. Which addition improves detection?
Turn off IDS to reduce noise
Add anomaly-based detection and behavioural analytics alongside signature-based rules to detect previously unseen variations
Use static signatures for everything and never update them
Remove logging to reduce storage use
Only rely on firewall rules for detection
A user complains that authentication now requires an OTP device they don’t have. How should you process their request while keeping security posture?
Reset all MFA tokens for everyone
Use an established help-desk verification process to re-issue or temporarily approve alternate MFA after identity verification (with logging and temporary expiry)
Remove MFA from all accounts to be helpful
Share another user’s OTP device
Revoke the user account entirely without checking identity
A service platform integrates with an external IdP for SAML SSO but fails to authenticate some users. Which misconfiguration is most likely?
The IdP is not required for SAML
SAML assertions’ audience or entityID does not match the SP configuration, or certificate/signature trust mismatch exists — causing assertion rejection
Telnet port blocked
DNS TTL too low only
NTP drift of 10 seconds always
A team wants to use password hashing with PBKDF2, bcrypt, or Argon2. Why choose these over plain hashing like MD5?
They are faster and easier to compute
They are computationally expensive and include salt/work factor, making brute-force attacks much harder compared to fast hashes like MD5
They remove the need for TLS
They allow reversible encryption of passwords
They store passwords in plain text for recovery
An application uses mutual TLS but connection fails. Which mismatch most often causes mutual TLS failures?
Server and client have matching certificates
The server trusts the issuing CA for the client certificate and the client trusts the server CA; failure occurs when CA chains are missing or the client certificate is expired/ revoked or not presented - verify trust chains and certificate validity
Mutual TLS uses UDP only so firewalls block it
DNS delegation missing is primary cause always
NTP never affects mutual TLS
A security policy requires logs to be retained for 365 days for compliance. What SIEM configuration best supports this while controlling storage costs?
Delete logs after 7 days to save space
Tiered storage: keep hot searchable logs for a short period, archive older logs to compressed, cost-effective storage and enforce retention policies with access controls
Keep everything on local syslog sever without compression
Send logs to printers for physical retention
Only keep event counts, not detailed logs
A user’s smartcard-based authentication fails after they moved offices. Which root cause should you check first?
The smartcard is unrelated to location
Check the switch port’s 802.1X network access policy, VLAN assignments, and RADIUS reachability - network access could be blocking the authentication process
DNS A records for the user are wrong
CRL always blocks smartcards at new locations
DHCP lease time expired only
A new web app requires secrets for DB connections. Which secret storage approach is most secure for ephemeral cloud workloads?
Store DB passwords in container images
Use a cloud secrets manager to inject ephemeral credentials to workloads using IAM roles or short-lived tokens instead of baked-in static secrets
Put credentials in code comments
Save secrets in ~/.ssh/authorized_keys
You need to log who ran privileged commands on network devices. Which technique provides the clearest audit trail?
Share the enable password among admins
Use TACACS+ with per-user accounts and command accounting enabled so each admin has unique authentication and actions are logged centrally
Use local enable passwords only and no logging
Disable command logging to protect privacy
Use SNMP to capture command history only
A web service’s TLS configuration still supports TLS 1.0, causing compliance errors. Which remediation is correct?
Keep TLS 1.0 enabled and ignore warnings
Disable TLS 1.0/1.1, enable only TLS 1.2+ with secure ciphers, test compatibility, and update clients where necessary
Switch to plain HTTP for speed
Only change cipher order and leave TLS versions unchanged
Remove certificate entirely
A company wants to host a public webserver but isolate it from internal systems. What architecture best accomplishes this?
Put the webserver on the internal LAN with no firewall
Place the webserver in a DMZ/perimeter network behind a screened subnet with filtering between DMZ and internal network and strict ACLs to limit lateral access
Host the server on every internal desktop
Expose the database directly to the internet only
Use the same VLAN for DMZ and internal users
A firewall administrator receives a support ticket: internal users cannot reach an external service on TCP/443. Which log evidence will most directly confirm the firewall is blocking traffic?
DNS logs only
Firewall deny records showing source IP, destination IP/port (TCP/443) and matching ACL rule with timestamps corresponding to failed attempts
CPU usage graphs of the firewall only
DHCP lease logs
SNMP traps from the server only
A junior engineer wrote firewall rules that accept all outbound traffic then deny all inbound. Which principle is violated for inbound server exposure?
Principle of least privilege for inbound services - rules should be explicit to only permit required inbound services and restrict others
Principle of maximum uptime only
NAT must be applied to inbound rules always
DHCP must be used for firewall rules
Use telnet for firewall testing only
After enabling a web application firewall (WAF), legitimate POST requests are blocked. What is the proper remediation path?
Disable the WAF permanently
Tune WAF rule set or create an exception/profile for that application’s legitimate POST patterns, test, and then deploy carefully
Set WAF to block everything implicitly
Allow all traffic to bypass the WAF for speed
Move the app to a legacy server without TLS
An IPS placed behind a firewall shows alerts for suspicious traffic that the firewall allowed. What lesson about placement and defense-in-depth does this illustrate?
IPS should be publicly visible to attackers
Layered defenses detect what upstream devices miss—place IDS/IPS in monitoring positions behind perimeter defenses to catch evasions and internal threats as part of defense-in-depth
One device is sufficient always
IPS can replace patching entirely
Firewall logs are always unnecessary
A NAT device uses PAT and two internal hosts connect to the same external server on the same port. How does the NAT maintain separate connections?
NAT cannot handle this situation
It maps each internal host:port pair to the same public IP with different ephemeral source ports (NAPT), distinguishing flows by the 5-tuple including port numbers
It duplicates packets with different MAC addresses only
It uses DNS to multiplex connections
It blocks the second host automatically
A misconfigured DHCP server handed out an incorrect gateway IP causing internet outage for a subnet. What DHCP config change prevents this in future?
Disable DHCP entirely
Create a scoped DHCP pool with correct default gateway (router) option and restrict which server can respond (DHCP snooping on switches) to prevent rogue servers from offering wrong options
Increase DHCP lease time to 10 years
Use DNS to assign default gateway
Use static ARP entries for all hosts only
A DNS zone shows stale A records after server moves. Which operation corrects cached client records fastest?
Wait for default TTL to expire over days
Lower TTL before migration, then after migration force clients to flush caches or update authoritative records; use SOA serial increment and possibly ipconfig /flushdns on clients in urgent cases
Delete the entire zone to force rebuild
Change mail server records only
Reboot all clients physically
Users complain about an intermittent broadcast storm affecting the network. Which switch feature is most appropriate to limit its effect?
Disable spanning tree to stop storms
Use storm control or broadcast/multicast suppression and investigate root cause (looping ports or faulty NICs), plus ensure STP is correctly configured
Use ACLs on the core to block broadcasts globally
Increase MTU to absorb storms
Turn off SNMP traps to stop alerts
A NATed host is running a game server that requires incoming ports forwarded. After configuring static NAT and port forwarding, players still can’t connect. What should you verify next?
That the server’s local firewall allows the service on that port and the server’s default gateway points to the NAT device
That the server runs telnet
That DNS suffixes are correct only
That the server is on the same VLAN as the internet edge always
That NTP is synchronized only
A router interface shows changing duplex mismatch errors after moved to new switch. What’s the best fix?
Leave autonegotiation off everywhere
Set both ends to autonegotiate or explicitly configure matching duplex and speed on both ends (prefer autonegotiation where possible) to eliminate mismatch and related errors
Configure different MTUs on each end
Change IP addresses only
Disable the interface to avoid errors
A server behind a firewall uses HTTPS but firewall blocks based on SNI. What change allows access?
Disable TLS on the server
Ensure firewall SNI inspection allows the server’s hostname or add an allow rule based on destination IP/port or create a TLS inspection exception for that host if deep inspection interferes
Use telnet as fallback
Change DNS TTL to zero only
Reconfigure client DHCP to ignore gateways
A network shows many ARP table entries for same IP with different MACs - symptoms of which attack, and what immediate mitigation is recommended?
DNS poisoning; mitigation: flush DNS cache only
ARP spoofing/poisoning; mitigation: enable dynamic ARP inspection (DAI) or port-security and use static ARP entries for critical hosts, plus monitor for anomalies
VLAN hopping; mitigation: change MTU only
DHCP exhaustion only; mitigation: increase scope size
RSTP misconfiguration; mitigation: disable spanning tree
After upgrading a firewall’s firmware, multiple legitimate services stop working. Which troubleshooting step is best first?
Roll back immediately without analysis
Check the firewall change logs and rule set diffs as firmware may have changed default behaviours (e.g., default deny, NAT behaviour) and then test rules in simulation or staged environment before rolling back or adjusting rules
Wipe the config and start fresh always
Reboot the entire network to fix defaults
Disable logging to improve throughput
A DHCP relay (ip helper) was configured on a router but clients still don’t get IPs. Which item is most likely missing?
The router’s DNS entries
The router needs a ip helper-address configured on the interface for the client subnet pointing to the DHCP server, and you must ensure UDP ports 67/68 and gateway ACLs are correct
SNMP community string mismatch
The switch port being trunked only causes DHCP problems always
The server must be in the same VLAN physically always
A web server’s certificate shows as untrusted for clients but works internally. Which combination best describes the likely cause and fix?
Public CA revoked all certs worldwide - no fix
Server uses a certificate signed by an internal CA not trusted by public clients; publish the server under a public CA-signed certificate or ensure client trust chain includes the internal CA for internal clients only
DNS PTR record missing only
Firewall blocking TCP/80 only
NTP is off by 60 seconds only
A router’s interface shows high discard counters when a trunk carries voice VLAN and data VLAN. Which config step reduces discards for voice?
Put voice and data on same VLAN always
Ensure QoS marking and queue scheduling are configured to prioritize voice (EF) and that interface policing/shaping doesn’t unfairly drop high-priority voice packets; reserve bandwidth for voice class
Increase DHCP lease time only
Disable STP to speed up convergence
Use SNMP to set interface to monitoring only
A host on VLAN 10 can’t reach a server on VLAN 20; ping by IP works but name resolution fails. What’s the most likely network-level issue?
ARP for the server is broken across VLANs
DNS servers assigned to clients are incorrect for cross-VLAN resolution—verify DHCP options and inter-VLAN routing to ensure correct DNS reachability
ACLs are blocking ICMP between VLANs only
MTU mismatch between VLANs
