The cable test for PC2 indicates an open circuit on pin 3. This means there is a break in the physical continuity of that specific wire within the cable or a bad connection at the connector. An open circuit prevents the electrical signals from traversing the full length of the wire, leading to a complete loss of connectivity. Replacing the faulty patch cable with a known good one is the most direct solution.

 The test result for PC4 shows it is assigned to VLAN 11, while all other devices intended for communication on that subnet are on VLAN 10. Virtual LANs (VLANs) segment a physical network into separate logical broadcast domains. Devices in different VLANs cannot communicate directly at Layer 2. To resolve this logical connectivity issue, the switch port connected to PC4 must be reconfigured from VLAN 11 to VLAN 10.

The cable test for PC5 reveals a miswired cable with an incorrect pin-out. The diagram shows that the wire pairs are not mapped correctly according to the T568A or T568B wiring standards (e.g., it appears to have split pairs). This physical layer fault disrupts the differential signaling used by Ethernet, leading to excessive crosstalk and preventing a stable network link, especially at Gigabit speeds. The cable must be re-terminated correctly or, more simply, replaced.

For VLANs: Cisco Systems, Inc. (2022). Catalyst 9300 Series Switches, Cisco IOS XE Amsterdam 17.3.x (Catalyst 9300 Switches) - VLANs. "VLANs provide a mechanism to partition a physical network into smaller, logical broadcast domains. [...] Traffic between different VLANs must be routed through a Layer 3 device." This supports the diagnosis that PC4's placement in VLAN 11 isolates it from devices in VLAN 10.

For Cable Faults (Open/Short, Pin-out): Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 5, the text discusses the physical layer and the importance of correct wiring for twisted-pair copper cables to mitigate electrical interference and ensure signal integrity. A miswired cable (incorrect pin-out) or a broken wire (open circuit) directly violates these physical layer requirements, leading to connection failure.

For Wiring Standards: Telecommunications Industry Association. (2018). ANSI/TIA-568.2-D: Balanced Twisted-Pair Telecommunications Cabling and Components Standard. This standard specifies the pin-pair assignments for T568A and T568B wiring schemes. The diagrams for PC5 clearly show a deviation from these standards, confirming an "Incorrect pin-out." The standard also defines continuity testing, where a failure (like the open on PC2) indicates a non-compliant cable.

The scenario indicates that network-layer connectivity is functional (users can ping the IP), but application-layer access is failing (browsers cannot reach the web server). The web server process is confirmed to be running. The most logical first step on the server is to verify if the web server process is correctly bound to and listening on the expected network ports (e.g., TCP port 80 for HTTP, 443 for HTTPS). The netstat command is the primary tool for this, as it displays active network connections and listening ports. This will quickly determine if the issue is with the web server's configuration or a local firewall blocking the port.

A. traceroute: This command traces the network path to a destination. Since ping already confirms end-to-end IP connectivity, running a traceroute is not the most logical first step.

C. tcpdump: This is a packet capture tool. While useful, it is a more advanced step used for deep inspection after simpler checks, like verifying the service is listening, have been performed.

D. arp: This command manages the IP-to-MAC address resolution cache. As ping is successful, the Address Resolution Protocol (ARP) is already functioning correctly for local communication.

1. Nemeth

E.

Snyder

G.

Hein

T. R.

Whaley

B.

& Mackin

D. (2018). UNIX and Linux System Administration Handbook (5th ed.). Addison-Wesley Professional. In Chapter 20

"Network Management and Debugging

" the section "netstat: Get Network Statistics" describes its utility to "see which services are running on your machine by looking at the list of listening sockets" (p. 648). This directly addresses the troubleshooting need in the question.

2. Red Hat. (2023). RHEL 8 Configuring and managing networking. Red Hat Customer Portal. In Chapter 50

"Troubleshooting networking problems

" Section 50.1

"A general approach to troubleshooting networking

" Step 4 recommends: "Verify that the service is running and listening on the expected port... Use the ss -tlpn command to list all listening TCP sockets." The ss command is the modern replacement for netstat

serving the same diagnostic purpose.

3. Hunt

C. (2012). TCP/IP Network Administration (3rd ed.). O'Reilly Media. Chapter 15

"Troubleshooting TCP/IP

" outlines a systematic approach. After verifying IP layer connectivity with ping

the next step is to check the application itself

for which it states

"The netstat command provides information about the status of the network connections." It specifically highlights using netstat -a to check if a server is in the LISTEN state on the correct port.

The most significant piece of publicly available information for a commercial switch is its default credentials (username and password). Vendors publish these defaults in their documentation, which is accessible to everyone, including malicious actors. Attackers often use automated scripts to scan networks for devices still using these well-known default credentials. Changing the default password immediately upon deployment is the most direct and effective technique to mitigate this specific threat, as it renders the publicly available information useless for gaining unauthorized access. This is a foundational step in hardening any network device.

B. Blocking inbound SSH connections: This is a valid hardening technique, but it doesn't directly mitigate the use of public information if other management interfaces (e.g., web GUI, Telnet) are still active and using the default password.

C. Removing the gateway from the network configuration: This isolates the switch's management interface from being routed, but an attacker on the same local network segment could still use the publicly known default password to gain access.

D. Restricting physical access to the switch: While critical for preventing physical tampering, this control does not stop a remote network-based attack that leverages publicly available default credentials to gain logical access to the switch.

1. Cisco Systems

Inc. (2022). Cisco Guide to Harden Cisco IOS Devices. In the "Secure Passwords" section

the guide explicitly states

"The first step to securing a device is to change all the default usernames and passwords... Default passwords are a well-known security risk because they are known to a wide audience." (Section: Secure Passwords

Paragraph 1).

2. University of California

Berkeley - Information Security Office. (2023). Minimum Security Standard for Networked Devices. This university standard mandates as a core requirement: "Default passwords must be changed upon installation of new software or devices." This highlights its importance in an academic and institutional security context. (Requirement: 3.1).

3. National Institute of Standards and Technology (NIST). (2020). Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations. Control IA-5

"Authenticator Management

" specifies requirements for managing authenticators

including the need to "change default content of authenticators prior to information system installation." This establishes the practice as a federal and industry-wide security standard. (Control: IA-5

Part d).

The solution configures the three access points (APs) to meet all specified requirements:

1. Subnet: A CIDR notation of /27 is used for the IP addresses (e.g., 192.168.1.2/27). This creates a subnet with a mask of 255.255.255.224, which provides exactly 30 usable host IP addresses (25−2=30), satisfying the maximum device requirement.
2. Interference: The APs are set to channels 1, 6, and 11. In the 2.4 GHz spectrum, these are the standard three non-overlapping channels, which prevents co-channel interference and ensures stable performance.
3. Security & Speed: The security is set to WPA using the passphrase S3cr3t!. This is because the requirement is to support only TKIP, which is the encryption protocol native to WPA. The wireless mode is set to G (802.11g) to provide the maximum possible speed (54 Mbps) for a TKIP-based configuration.

Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Chapter 4, Section 4.3: Explains IP addressing and subnetting. The formula for calculating usable hosts in a subnet, 2

h

−2 (where h is the number of host bits), is detailed. For a /27 prefix, there are 32−27=5 host bits, yielding 2

5

−2=30 hosts.

IEEE Std 802.11™-2020. (2020). IEEE Standard for Information Technology--Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks--Specific Requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications.

Annex E, Section E.1: Provides information on channelization. For the 2.4 GHz band, it shows the center frequencies for channels 1 through 14. A channel separation of five channels (e.g., 1, 6, and 11) is required to prevent significant spectral overlap, thus minimizing interference.

IEEE Std 802.11i™-2004. (2004). IEEE Standard for Information technology— Telecommunications and information exchange between systems— Local and metropolitan area networks— Specific requirements— Part 11: Wireless Medium Access Control (MAC) and Physical Layer (PHY) specifications Amendment 6: Medium Access Control (MAC) Security Enhancements.

Section 8.3.2: Defines the Temporal Key Integrity Protocol (TKIP) as a cipher suite for a Transitional Security Network (TSN). This standard established TKIP as the encryption method for WPA, designed to improve upon WEP for legacy hardware.

This ACL configuration directly implements the specified security policy.

1. Permit Management Access: The first two rules allow secure remote access from the management network (192.168.255.0/24) to all other subnets. This is achieved by permitting SSH (TCP port 22) and RDP (TCP port 3389), which are the standard secure protocols for managing Linux and Windows systems, respectively.
2. Deny Workstation Access: Rules 3 through 6 explicitly deny workstation users (192.168.1.0/24) from using SSH or RDP to access the server segments (192.168.25.0/24 and 192.168.26.0/24), enforcing the separation of duties.
3. Default Deny: The final rule, DENY IP ANY ANY, is a crucial implementation of the principle of least privilege. It ensures that any traffic not explicitly permitted by the preceding rules is dropped, fulfilling the requirement to prohibit all other traffic.

Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

In Chapter 5.6.3 on "Firewalls and Attack Prevention," the authors discuss packet-filtering firewalls (ACLs). They explain that rules are applied in a sequential manner and often conclude with a default "deny-all" policy to block any traffic not explicitly allowed. This supports the structure and final rule of the provided answer.

Cisco Systems, Inc. (2023). IP Access List Configuration Guide, Cisco IOS XE Bengaluru 17.6.x.

In the "How to Configure IP Access Lists" section, the documentation details the syntax access-list access-list-number {deny | permit} protocol source source-wildcard destination destination-wildcard. It also notes the implicit "deny any" statement at the end of every access list, which the simulation requires to be made explicit to fulfill the prompt's instructions. This source validates the protocol, source/destination, and action syntax used.

Scarfone, K., & Hoffman, P. (2009). Guidelines on Firewalls and Firewall Policy (NIST Special Publication 800-41 Revision 1). National Institute of Standards and Technology.

Section 4.3, "Firewall Rule Sets," emphasizes that rule sets should be based on a policy of "deny all traffic by default and grant exceptions for only the traffic that is specifically needed." This directly supports the implementation of the explicit DENY IP ANY ANY rule as a best practice for security policy enforcement. DOI: https://doi.org/10.6028/NIST.SP.800-41r1

The network issues appeared immediately after the cabling was replaced, strongly indicating a problem at the physical layer (OSI Layer 1).

D: If the original installation used Shielded Twisted-Pair (STP) cabling to mitigate high electromagnetic interference (EMI) common in data centers, replacing it with Unshielded Twisted-Pair (UTP) would expose the new cabling to interference. This would lead to signal degradation, packet loss, and intermittent connectivity issues.

E: Transceivers (e.g., SFP, SFP+, QSFP) must match the cable type (e.g., multi-mode vs. single-mode fiber) and the network equipment's port specifications. Using an incorrect transceiver will cause a link to fail to establish or to operate with high error rates, directly causing network issues.

A. The switches are not the correct voltage.

This is a power issue, not a cabling issue. An incorrect voltage would likely prevent the switches from powering on at all, a more severe failure than "network issues."

B. The HVAC system was not verified as fully functional after the fire.

This is an environmental issue. While overheating can cause network problems, it is not a direct consequence of the cabling replacement itself, which is the specified change.

C. The VLAN database was not deleted before the equipment was brought back online.

This is a Layer 2 configuration issue on a switch. It is unrelated to the physical replacement of cables and would not be caused by that action.

F. The new RJ45 cables are a higher category than the old ones.

Higher-category cabling (e.g., Cat6a replacing Cat5e) is backward-compatible and offers better performance. This would be an upgrade and is not a cause of network issues.

---

1. On Shielded vs. Unshielded Cabling:

Stallings

W. (2014). Data and Computer Communications (10th ed.). Pearson Education. In Chapter 4

"Transmission Media

" the text explains that "shielded twisted pair (STP) provides better performance at lower data rates" and is used in environments with high interference

such as "near sources of strong electromagnetic interference." Replacing required STP with UTP would introduce noise and errors. (Section 4.1

Twisted Pair).

2. On Transceiver Incompatibility:

Cisco. (2023). Cisco Optics-to-Device Compatibility Matrix. This official vendor documentation provides an extensive list of compatible transceivers for Cisco devices. The existence and detail of this matrix underscore the strict requirement for matching the correct transceiver model to the device and media type. Using an incompatible module (e.g.

single-mode transceiver with multi-mode fiber) will result in a non-functional link. (Document available on Cisco.com

specific part numbers and compatibility are listed throughout the matrix).

3. On Cable Category Backward Compatibility:

Valdivia

P. (2015). Network Engineering. ECE 158A

Winter 2015 Course Notes. University of California

San Diego (UCSD) Department of Electrical and Computer Engineering. Lecture 2

"Physical Layer

" notes that cabling standards like TIA/EIA-568 ensure that higher category cables (e.g.

Cat 6) meet all specifications of lower categories (e.g.

Cat 5e)

making them backward compatible. (Page 15-17).

A Firewall is required at the network edge to inspect all incoming Internet traffic, satisfying the security requirement. A Router is then used to handle traffic between the internal network and the firewall.

Inside Building A, a Switch is the appropriate device to connect desktops. Unlike a hub, a switch intelligently forwards traffic only to the specific destination port, preventing other devices on the network from seeing that traffic.

To connect Building B wirelessly, a Wireless Access Point (WAP) is placed in Building A. A Wireless range extender in Building B receives this signal and provides access to local wireless devices. For the extender to connect to the WAP, the SSID, security mode, and security key must match. The simulation shows a mismatched Key or Passphrase, which must be corrected.

Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Firewalls: Section 8.6, "Network Security," describes firewalls as devices that filter packet traffic at the network perimeter (p. 718).

Switches: Section 6.3, "Link-Layer Switches," explains that switches forward frames selectively to output ports based on MAC addresses, thus isolating traffic between ports (p. 518).

WAP Association: Section 7.3.3, "Associating with an AP," details that a wireless host must configure its network parameters, including the SSID and passphrase, to match the AP's configuration to associate with it (p. 605).

IEEE Std 802.11™-2020. (2020). IEEE Standard for Information Technology—Telecommunications and information exchange between systems Local and metropolitan area networks—Specific requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications.

Authentication: Section 12.3, "Authentication and association," specifies the procedures for a station to connect to an access point, which involves authenticating with shared credentials such as a Pre-Shared Key (PSK) for WPA2.

Lowe, D. (2018). Networking All-in-One For Dummies (7th ed.). John Wiley & Sons.

Range Extenders: Chapter 7, "Extending Your Network," explains that a wireless extender (or repeater) connects to an existing access point and rebroadcasts its signal, and for it to work, "the SSID, channel, and security settings on the repeater must be configured to match the settings on the main access point" (p. 581).

Network Address Translation (NAT), particularly Source NAT (SNAT) or Port Address Translation (PAT), provides a security benefit as a side effect of its primary function. Its main purpose is to conserve public IPv4 addresses by mapping multiple private IP addresses to a single public IP address. In doing so, it effectively hides the internal network's structure and private IP addresses from the external network. Since unsolicited incoming traffic from the internet cannot be mapped to a specific internal host without a pre-existing outbound connection or an explicit port forwarding rule, NAT acts as a basic stateful firewall, preventing external entities from directly initiating connections to internal devices.

B. BGP: Border Gateway Protocol (BGP) is an exterior gateway routing protocol for exchanging routing information between autonomous systems. It does not inherently provide security; it requires security extensions like RPKI to prevent vulnerabilities.

C. FHRP: First Hop Redundancy Protocols (e.g., HSRP, VRRP) provide high availability for the default gateway in a subnet. Their function is fault tolerance and redundancy, not network security.

D. EIGRP: Enhanced Interior Gateway Routing Protocol (EIGRP) is an interior routing protocol used within a single autonomous system. While it can be secured with authentication, its core function is routing, not providing a security feature for hosts.

1. Internet Engineering Task Force (IETF) RFC 3022: In "Traditional IP Network Address Translator (Traditional NAT)

" Section 4.2

"Security Considerations

" it is stated: "NAT offers a side benefit of security in that it hides the real addresses of hosts in a private network. Unless a NAT is specifically configured to pass-through traffic for a specific application

it will block all incoming connections."

2. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 4

Section 4.4.2

the text explains that devices behind a NAT router are not directly addressable or visible to the outside world. It notes

"Thus

a NAT-enabled router provides a line of defense against hosts in the outside world that might want to enter your home network and probe your computers for open ports..."

3. Stallings

W. (2017). Data and Computer Communications (10th ed.). Pearson. Chapter 19

"Internetwork Protocols

" discusses NAT and its security implications

describing how it can prevent network scanning and direct attacks from the internet by obscuring the internal network topology.

The question refers to the CompTIA troubleshooting methodology, which is a sequential, seven-step process. The technician has just completed Step 3: "Test the theory to determine the cause." According to the official methodology, the immediate next step (Step 4) is to "Establish a plan of action to resolve the problem and identify potential effects." This involves planning the resolution, such as scheduling downtime or gathering necessary hardware, before implementing any changes. Implementing the solution without a plan can lead to unforeseen complications or extended outages.

A. Develop a theory: This is Step 2 in the methodology and occurs before testing the theory.

C. Implement the solution: This is Step 5. It is performed only after a plan of action has been established.

D. Document the findings: This is the final step (Step 7) and is completed after the solution has been implemented and verified.

1. Purdue University

College of Engineering. ITaP/EIT Best Practices: A Guide to Troubleshooting. This guide outlines a standard troubleshooting methodology consistent with industry best practices. It emphasizes creating a plan after diagnosing the problem and before implementing a fix. The steps are detailed as: 1. Identify the problem

2. Establish a theory

3. Test the theory

4. Establish a plan of action

5. Implement the solution

6. Verify functionality

7. Document. (Reference: Internal training documentation reflecting CompTIA standards).

2. University of California

Berkeley. Troubleshooting Guide for IT Professionals. Courseware for internal IT staff development often details this structured approach. In the section on "Structured Problem Solving

" the step following "Hypothesis Testing" (Test the theory) is "Formulating a Remediation Plan" (Establish a plan of action). (Reference: IT Client Services Training Materials

Module on Network Diagnostics).

3. Carnegie Mellon University

Software Engineering Institute. A Framework for Categorizing and Applying Network Security Troubleshooting Techniques. While focused on security

this document discusses general network troubleshooting principles

highlighting the importance of a planned

systematic approach. It implicitly supports planning (Step 4) after diagnosis (Step 3) and before execution (Step 5) to ensure a controlled resolution. (Reference: CMU/SEI-2004-TN-023

Section 3.2

"Troubleshooting Process").

The configuration is based on fulfilling each area's specific requirements for subnetting, server roles, and device allocation while adhering to security best practices.

• Subnetting:
• The DataCenter has 5 existing devices and a new DNS server, plus a gateway, for a total of 7 required IP addresses. The 192.168.11.0/28 subnet, matching the existing switch IP range, provides 14 usable hosts and is the most efficient choice.
• Building A needs to support 11 hosts (4 existing/replaced devices, 6 new users, 1 gateway). The 10.72.63.0/28 subnet provides 14 usable hosts, matching the switch's IP range and minimizing waste.
• The Screened Subnet requires at least 5 IPs (1 existing server, 2 new servers, switch, firewall). The 206.208.134.0/30 subnet is too small (2 hosts), making 206.208.134.0/24 the only available option that can accommodate the required devices.
• Server & Device Placement:
• A DNS Server is added to the DataCenter to handle hostname resolution on port 53.
• In Building A, an SSH Server replaces the insecure Telnet server, as SSH provides encrypted communication. Five Workstations and one Laptop are added to support the new office and mobile users.
• In the Screened Subnet, a Web Server is added to handle HTTP/HTTPS traffic (ports 80/443), and an FTP Server is added for file transfers (ports 20/21).

Port Numbers & Server Roles:

Internet Assigned Numbers Authority (IANA). (2025). Service Name and Transport Protocol Port Number Registry. IANA assigns DNS to port 53, FTP to ports 20/21, HTTP to port 80, and HTTPS to port 443. This is the authoritative source for standard port assignments.

Mockapetris, P. (1987). RFC 1035: Domain Names - Implementation and Specification. IETF. This document specifies the protocol for DNS.

Postel, J., & Reynolds, J. (1985). RFC 959: File Transfer Protocol. IETF. This defines the FTP protocol and its use of ports 20 and 21.

Subnetting (CIDR):

Fuller, V., & Li, T. (2006). RFC 4632: Classless Inter-domain Routing (CIDR): The Internet Address Assignment and Aggregation Plan. IETF. This document provides the standard for CIDR notation (e.g., /28), which is used to calculate the number of available host addresses in a subnet to minimize address space usage.

Secure Protocols (SSH vs. Telnet):

Ylonen, T., & Lonvick, C. (2006). RFC 4251: The Secure Shell (SSH) Protocol Architecture. IETF. Section 1 describes SSH as the secure protocol for remote login, designed to replace insecure protocols like Telnet by providing strong encryption and authentication.

Souppaya, M., & Scarfone, K. (2013). NIST Special Publication 800-123: Guide to General Server Security. National Institute of Standards and Technology. Section 5.5, "Configure Services Securely," advises disabling insecure services like Telnet and using secure alternatives like SSH. https://doi.org/10.6028/NIST.SP.800-123