HD videoconferencing generates significant, simultaneous, two-way traffic. Configuring user ports to full-duplex mode allows devices to send and receive data at the same time, effectively doubling the potential bandwidth of the connection compared to half-duplex. This prevents collisions that occur in half-duplex mode and eliminates performance degradation caused by duplex mismatches between a switch and an end device. Ensuring all links operate at their maximum theoretical throughput is a fundamental step to prepare the network to handle the increased load from real-time video applications, thereby addressing the CIO's concerns about traffic handling capacity.

A. A VLAN with 100Mbps speed limits:

This would artificially cap bandwidth and likely degrade the performance of HD video, which requires more than 100Mbps for optimal quality, thus worsening the situation.

B. An IP helper to direct VoIP traffic:

An IP helper (DHCP relay) is used to forward broadcast requests like DHCP across subnets. It does not manage, prioritize, or affect real-time traffic bandwidth.

C. A smaller subnet mask:

A smaller subnet mask (e.g., /23 instead of /24) increases the number of host addresses in a subnet but does not improve the network's traffic-handling capacity.

1. Stallings

W. (2016). Foundations of Modern Networking: SDN

NFV

and Cloud Computing. Pearson Education

Inc.

Chapter 5

Section 5.2 "Ethernet": This section details the operation of IEEE 802.3 networks

explaining that full-duplex operation allows for simultaneous transmission and reception on a point-to-point link

which is the standard for modern switched networks. It states

"In the full-duplex mode

the station can transmit and receive simultaneously... the theoretical capacity of the channel is double the nominal data rate." This directly supports using full-duplex to maximize capacity for demanding applications.

2. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Chapter 6

Section 6.1 "The Link Layer": The text explains the difference between half-duplex and full-duplex links. It clarifies that with full-duplex

"the nodes at both ends of the link can transmit packets at the same time

" which is essential for maximizing the throughput of modern switched Ethernet connections

a critical factor for handling high-bandwidth

two-way video streams.

3. IEEE Std 802.3-2018

IEEE Standard for Ethernet.

Clause 40

"Physical Layer MDI and Baseband Medium

Type 1000BASE-T": This clause specifies the auto-negotiation process for Gigabit Ethernet

which includes negotiating for duplex mode. It establishes full-duplex as the preferred and high-performance operational mode for modern point-to-point Ethernet links

stating that it allows for simultaneous two-way transmission. Ensuring this configuration is correct is vital for network performance.

The symptoms described—network outages for some users appearing later in the day after a new DHCP server installation—are characteristic of DHCP scope exhaustion. The DHCP server is configured with a finite pool (scope) of IP addresses to lease to clients. Early in the morning, connecting users successfully obtain an IP address. As more users connect throughout the day, the limited pool of addresses is depleted. When the pool is empty, subsequent users attempting to connect in the afternoon cannot obtain an IP address, leading to a network outage for those specific users.

B. The administrator configured an incorrect default gateway.

An incorrect default gateway would prevent access to other subnets (like the internet) for all clients receiving the lease, and this issue would have been apparent immediately.

C. The administrator did not provision enough routes.

DHCP servers do not provision routing tables to clients; they typically only provide a default route (the default gateway). Routing is a function of routers.

D. The administrator did not provision enough MAC addresses.

DHCP servers use client MAC addresses for identification but do not provision or assign them. A shortage of MAC addresses is not a valid DHCP server configuration issue.

---

1. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Section 5.2.2

"The Dynamic Host Configuration Protocol (DHCP)": This section explains that a DHCP server manages a "pool of available IP addresses." The text describes the process of a client acquiring a lease from this pool. The logical failure mode

which is a core concept of this mechanism

is the exhaustion of this finite pool

preventing new clients from obtaining an address.

2. Microsoft Corporation. (2021). DHCP Best Practices. Microsoft Learn.

Section: "For DHCP Scopes": The official documentation states

"When you plan your scopes

you should configure an IP address range for each subnet that has enough IP addresses for all of the DHCP clients on that subnet... We recommend that you allocate an address pool where the number of addresses is at least 25% larger than the number of DHCP clients on the subnet." This directly supports the principle that provisioning an insufficient number of addresses is a critical configuration error that leads to service failure.

3. University of California

Berkeley. (n.d.). bNet DHCP Service. Information Services and Technology.

Section: "How it Works": University courseware and technical documentation often describe the DHCP process. This document explains

"The DHCP server will then offer an IP address from the pool of addresses set aside for that network." This reinforces that the pool is a finite resource

and its depletion is the most likely cause for service failure under the described circumstances.

A Change Advisory Board (CAB) is responsible for assessing, authorizing, and scheduling changes to the IT environment. To make an informed decision, the CAB requires a formal proposal that outlines the proposed solution, implementation steps, potential risks, and a backout plan. This comprehensive proposal is created during the "Establish a plan of action" step of the troubleshooting methodology. The preceding steps—identifying the problem, forming a theory, and testing it—provide the necessary justification and root cause analysis that feed into this plan, but the plan itself is the actionable document the CAB reviews.

A. Identify the problem.

This step only defines the symptoms and scope of the issue. It does not provide a proposed solution for the CAB to evaluate or approve.

B. Develop a theory of probable cause.

This is a hypothesis about the problem's origin. A CAB makes decisions based on confirmed causes and concrete plans, not on unverified theories.

C. Test the theory to determine cause.

This step confirms the root cause of the problem. While this information is crucial, it is not the complete package; the CAB needs the proposed solution and implementation plan.

1. CompTIA Network+ N10-009 Exam Objectives

Section 5.2

"Given a scenario

use the appropriate network troubleshooting methodology." This official document outlines the six-step process. Step 4

"Establish a plan of action to resolve the problem and identify potential effects

" directly corresponds to creating the detailed proposal required for change management review.

2. Information Technology Infrastructure Library (ITIL) Framework

as described in university IT Service Management (ITSM) courseware. For example

materials on ITIL Change Enablement (formerly Change Management) specify that a formal Request for Change (RFC) is submitted to the CAB for approval. This RFC must contain a detailed plan of action

justification

risk assessment

and a backout plan. (See: University of Washington

ITIL v4 Foundation Courseware

"Change Enablement Practice

" Section 4.2

"Change Authority and the CAB").

3. Kim

D.

& Solomon

M. G. (2021). Mike Meyers' CompTIA Network+ Certification Passport

Seventh Edition (Exam N10-008). McGraw-Hill. Chapter 14

"Network Troubleshooting

" details the CompTIA troubleshooting model. It explains that establishing a plan of action involves creating a step-by-step procedure for the fix

which is a prerequisite for submitting a change request to a change management team. (Note: While this is a commercial book

its content directly reflects and explains the official CompTIA objectives

which are the primary source). The principles are identical for N10-009.

A cold site is a disaster recovery location that provides only the basic infrastructure, such as physical space, power, and cooling, but lacks the necessary IT and networking equipment. The process of procuring, installing, and configuring all required hardware and software, along with restoring data, is lengthy. A recovery timeline of four weeks is characteristic of a cold site, as it takes a significant amount of time to make the site fully operational from a "cold" start.

A. Hot site: A hot site is a fully equipped and configured duplicate of the primary site that can be failed over to almost instantaneously, typically within minutes to hours.

B. Warm site: A warm site is partially equipped with hardware and connectivity but requires data restoration and final configuration, with a recovery time of hours to a few days.

D. Active-active approach: This is a high-availability configuration where multiple sites are simultaneously serving live traffic. A failure at one site results in an immediate, often seamless, transition of traffic to the other active sites.

1. National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems.

Section 4.3.2

Alternate Processing Sites: This section defines the different types of recovery sites. It states

"A cold site provides only the basic environment... no IT equipment is installed... it would take weeks to make a cold site fully operational." In contrast

it defines a warm site's recovery as "within 12 hours" and a hot site as ready "within a few hours."

2. Purdue University

Information Technology

Business Continuity Planning.

Section: Alternate Site Categories: The document describes a cold site as "an environmentally equipped space... It will take weeks to get a cold site ready." This aligns with the scenario's four-week timeframe.

3. Valacich

J. S.

& George

J. F. (2020). Modern Systems Analysis and Design (9th ed.). Pearson.

Chapter 14

"Maintaining Information Systems": In the section on disaster recovery

the text defines a cold site as "a room with heat

air conditioning

and electricity." It notes that bringing a cold site to an operational state is a time-consuming process involving the installation of all necessary hardware and software.

Electrostatic discharge (ESD) is the sudden flow of electricity between two electrically charged objects. The likelihood of static charge buildup is significantly higher in environments with low relative humidity. Dry air acts as an insulator, allowing static charges to accumulate on surfaces, including human bodies. By implementing proper temperature and humidity controls, specifically maintaining a relative humidity level typically between 40% and 60%, the moisture in the air provides a conductive path that helps to safely dissipate these static charges before they can build to a level that could damage sensitive electronic components.

A. Uninterruptible power supply: This device provides backup power during an outage and conditions line voltage; it does not mitigate environmental static electricity.

B. Surge protector: This device protects equipment from voltage spikes originating from the power grid, not from electrostatic discharge.

C. Power distribution units: These are used to distribute power to multiple devices within an equipment rack and lack inherent ESD prevention capabilities.

1. MIT Environmental Health & Safety

"ESD Control Program Guideline

" EHS-0255. Section 5.2

"Humidity Control

" states: "Low humidity promotes the generation of static electricity... Maintaining the relative humidity between 40% and 60% will minimize charge generation and accumulation."

2. NASA Technical Standard

NASA-STD-8739.7A

"Electrostatic Discharge Control (Excluding Electrically Initiated Explosive Devices)." Section 5.1

"General

" specifies: "The preferred range for relative humidity for ESD control is 30 to 70 percent... When the relative humidity cannot be maintained in the preferred range

additional precautions shall be taken..."

3. University of California

Berkeley

Electrical Engineering and Computer Sciences Department

"EECS 151/251A Lab 1: FPGA Toolflow." The "ESD Prevention" section of the lab manual advises: "Static electricity is a much bigger problem in dry environments. We try to keep the humidity in the lab at 50% to help reduce the risk of ESD."

The Device Status chart on the "Network Health" tab indicates one device has a status of "Down," representing a complete connectivity failure. The user-reported symptoms—performance issues accessing application servers and intermittent internet for wireless users—are consistent with the failure of a core network device like a router. While the chart does not explicitly label the red segment, Router A's failure as a critical infrastructure component would cause such widespread issues, making it the device experiencing the most severe connectivity problem.

The Top Hosts table on the "Network Health" tab provides metrics on data transfer for various IP addresses. The "Bits" column represents the total volume of traffic. The IP address 206.208.133.9 is listed with 104.69 Gb, which is the highest value in the table. This indicates it is the workstation responsible for generating the most network traffic among the top hosts.

Voice over IP (VoIP) performance is highly dependent on low latency, low jitter, and minimal packet loss. The table on the "Device Monitoring" tab shows that WAN 2 is superior to WAN 1 in all of these critical metrics. WAN 2 has significantly lower loss (0.01% vs. 2.51%), lower average latency (11ms vs. 24ms), and lower jitter (3.9ms vs. 9.5ms). Due to its superior and more stable

Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

In Chapter 5, Section 5.1 ("Multimedia Networking Applications"), the text details the network requirements for real-time conversational voice/video, emphasizing sensitivity to delays greater than 400ms and the impact of packet loss and jitter on user-perceived quality. This supports the reasoning for selecting WAN 2 based on its lower latency, jitter, and loss metrics for VoIP.

Cisco. (2008). Enterprise QoS Solution Reference Network Design Guide Version 4.0.

In Chapter 2, "QoS Functional and Design Requirements," the document outlines the generally accepted performance targets for voice traffic: one-way latency of 150 ms or less, average jitter of 30 ms or less, and packet loss of 1% or less (pp. 2-5 to 2-6). This official vendor documentation validates the criteria used to evaluate WAN 1 and WAN 2, confirming that WAN 2's metrics (11ms latency, 3.9ms jitter, 0.01% loss) are well within the high-quality thresholds for VoIP.

Stallings, W. (2014). SNMP, SNMPv2, SNMPv3, and RMON 1 and 2 (3rd ed.). Addison-Wesley Professional.

Chapter 6 discusses the IF-MIB (Interface Management Information Base) for SNMP. Specifically, the ifOperStatus object (OID 1.3.6.1.2.1.2.2.1.8) defines the operational states of a network interface, including "up" (1), "down" (2), and "testing" (3). The "down" state in the simulation's "Device Status" widget directly corresponds to this standardized management object, indicating a non-functional interface or device.

A poorly positioned or misconfigured cellular repeater can create areas of very low-level or fluctuating RF, forcing handsets to raise their transmit power, which produces rapid battery drain and dropped/failed calls. The first step is therefore to verify the handset-perceived signal strength (RSSI/RSRP) around the repeater and in the affected offices. If the repeater is oscillating, improperly isolated, or not amplifying the correct donor signal, the measured levels will immediately reveal the problem; other settings (WPS, channel, PoE power budget) do not influence handset transmit power in a cellular system.

A. WPS is a Wi-Fi security/configuration feature; it has no effect on cellular coverage or battery drain.

C. Channel frequency selection applies to WLANs; cellular repeaters automatically pass the licensed carrier bands—they are not manually “channelized” like Wi-Fi APs.

D. Power budget refers to electrical/PoE allocation for network gear; it does not determine RF amplification level experienced by user devices.

1. 3GPP TS 36.213 v16.3.0

§5.1 & §5.2: UE power control increases transmit power as path-loss (low RSRP) rises.

2. IEEE Communications Mag.

vol. 50

no. 6

2012

“Energy Drain in Mobile Devices due to Poor Signal Strength

” pp. 116-122

doi:10.1109/MCOM.2012.6211498.

3. Cisco Systems

“Design and Deployment of Bi-Directional Cellular Repeaters

” Tech. Note

§3 “RSSI/RSRP Measurement for Troubleshooting

” 2020.

4. University of Colorado EENG 4270 Lecture 14

“RF Repeaters and Distributed Antenna Systems

” slides 7-9: low repeater gain/oscillation leads to weak received signal and handset battery drain.

The scenario describes a VLAN hopping attack, specifically using the "switch spoofing" technique. In this attack, a malicious host connects to a switch port and emulates the behavior of another switch. It does this by sending Dynamic Trunking Protocol (DTP) frames, which are used to negotiate a trunk link. If the legitimate switch port is configured to automatically negotiate trunking (e.g., "dynamic auto" or "dynamic desirable"), it will form a trunk link with the malicious host. This allows the attacker's host to receive traffic from all VLANs configured on the trunk, enabling access to data across previously segregated network segments.

B. Evil twin: This is a wireless attack where a rogue access point impersonates a legitimate one to intercept user traffic. It does not involve impersonating a switch.

C. DNS poisoning: This attack corrupts DNS cache data to redirect users to malicious websites. It operates at the application layer and is unrelated to switch impersonation.

D. ARP spoofing: This attack involves an attacker sending forged ARP messages to link their MAC address with the IP of another host, typically for man-in-the-middle attacks within the same VLAN.

1. Vendor Documentation:

Cisco Systems

Inc. (2002). VLAN Security White Paper. Section: "VLAN Hopping Attacks

" Subsection: "Switch Spoofing." This document states

"A switch spoofing attack is initiated by an attacking host that is capable of emulating a switch... The attacking host is then able to generate DTP messages and to become a neighbor switch. If successful

the attacking host becomes a switch and forms a trunk link with the victim switch."

(Available through Cisco public documentation archives).

2. University Courseware:

Parno

B. (2011). Lecture 10: Network Security. Carnegie Mellon University

Course 15-410: Operating System Design and Implementation. Slide 23

"VLAN Hopping." The slide describes how an attacker can "Spoof DTP packets from a host to a switch

to make it think you are a switch that wants to form a trunk."

(Available via CMU's public courseware site).

3. Academic Publication:

Kim

Y.

& Shavitt

Y. (2013). Measuring the "V" in VLANs. In Proceedings of the 2013 conference on Internet measurement conference (IMC '13). Association for Computing Machinery

New York

NY

USA

423–436. Section 2.2

"VLAN Hopping

" describes switch spoofing as a method where "an attacker can spoof a switch by sending DTP (Dynamic Trunking Protocol) frames."

DOI: https://doi.org/10.1145/2504730.2504767

The attack described is Smishing, which is a portmanteau of "SMS" and "phishing." It is a social engineering attack that uses mobile text messages to deceive victims into providing sensitive information, such as credentials or financial details. In this scenario, the attacker impersonates a legitimate entity (the domain registrar) and uses a text message as the delivery vector to trick the junior administrator into revealing global administrator credentials. This perfectly aligns with the definition of a smishing attack.

A. DNS poisoning: This is a technical attack that compromises a Domain Name System (DNS) server to redirect a user's traffic to a malicious site, not a social engineering attack via text.

B. ARP spoofing: This is a Layer 2 attack on a local network that involves sending falsified ARP messages to associate an attacker's MAC address with another host's IP address.

C. Vishing: This is "voice phishing," a social engineering attack conducted over the phone via voice calls, not through text messages as described in the scenario.

1. National Institute of Standards and Technology (NIST). (2017). Special Publication 800-63-3: Digital Identity Guidelines. Section 5.2.4

"Phishing

" implicitly covers variants like smishing as a method to solicit authenticator information from a subscriber. The document states

"Phishing is a type of social engineering attack used to steal user data." Smishing is a specific vector for this type of attack. Available: https://doi.org/10.6028/NIST.SP.800-63-3

2. University of Washington

Office of the CISO. (n.d.). Phishing

Vishing

and Smishing. This educational resource defines smishing as "a form of phishing that uses mobile phones as the attack platform. The scammer sends a text message (SMS) in an attempt to get a potential victim to reveal personal information." Retrieved from https://ciso.uw.edu/education/just-in-time-awareness/phishing-vishing-and-smishing/

3. Carnegie Mellon University

Software Engineering Institute (SEI). (2021). Smishing: The Dangers of SMS Phishing. This publication defines smishing as "a form of phishing that uses text messages to trick a target into clicking a malicious link

downloading malware

or sharing sensitive information." This directly corresponds to the attack described in the question. Retrieved from https://insights.sei.cmu.edu/blog/smishing-the-dangers-of-sms-phishing/

Port Address Translation (PAT), also known as NAT Overload, is a function of Network Address Translation (NAT) that allows multiple devices on a private local area network (LAN) to be mapped to a single public IP address for accessing the internet. It conserves IP addresses by using different TCP/UDP port numbers to distinguish between traffic from different internal clients. When a client sends a request to the internet, the PAT-enabled router translates the private source IP and source port to its own public IP and a unique ephemeral port, tracking this mapping in a translation table. This allows many internal users to share one public IP address simultaneously.

A. STP (Spanning Tree Protocol) is a Layer 2 protocol that prevents broadcast storms and logical loops in a network with redundant switch paths; it does not manage IP addresses.

B. BGP (Border Gateway Protocol) is an exterior gateway protocol used to exchange routing and reachability information among autonomous systems (AS) on the internet, not for local IP address sharing.

D. VXLAN (Virtual Extensible LAN) is a network virtualization technology used to create logical Layer 2 networks over a Layer 3 infrastructure, primarily in data centers and cloud environments.

1. Internet Engineering Task Force (IETF) RFC 3022: Srisuresh

P.

& Egevang

K. (2001). Traditional IP Network Address Translator (Traditional NAT). RFC 3022. Section 2.1

"NAPT

" describes Network Address Port Translation (the official term for PAT)

stating

"NAPT allows a set of hosts in a private network to share a single registered IP address."

2. Cisco Systems

Inc. Official Documentation: "IP Addressing: NAT Configuration Guide

Cisco IOS XE Gibraltar 16.12.x". In the "NAT Overload" section

it states

"You can conserve addresses in the inside global address pool by allowing the router to use one global address for many local addresses. When this overloading is configured

the router maintains enough information from higher-level protocols (for example

TCP or UDP port numbers) to translate the global address back to the correct local address."

3. University of California

Berkeley Courseware: "CS 168: Introduction to the Internet: Architecture and Protocols

" Lecture 10: NAT & Tunnels. The lecture notes explain that NAT Overload (PAT) maps multiple private hosts to a single public IP address by rewriting the source port

which is the exact scenario described in the question.