Free N10-009 Practice Test Questions and Answers (2026)

HD videoconferencing generates significant, simultaneous, two-way traffic. Configuring user ports to full-duplex mode allows devices to send and receive data at the same time, effectively doubling the potential bandwidth of the connection compared to half-duplex. This prevents collisions that occur in half-duplex mode and eliminates performance degradation caused by duplex mismatches between a switch and an end device. Ensuring all links operate at their maximum theoretical throughput is a fundamental step to prepare the network to handle the increased load from real-time video applications, thereby addressing the CIO's concerns about traffic handling capacity.

A. A VLAN with 100Mbps speed limits:

This would artificially cap bandwidth and likely degrade the performance of HD video, which requires more than 100Mbps for optimal quality, thus worsening the situation.

B. An IP helper to direct VoIP traffic:

An IP helper (DHCP relay) is used to forward broadcast requests like DHCP across subnets. It does not manage, prioritize, or affect real-time traffic bandwidth.

C. A smaller subnet mask:

A smaller subnet mask (e.g., /23 instead of /24) increases the number of host addresses in a subnet but does not improve the network's traffic-handling capacity.

1. Stallings

W. (2016). Foundations of Modern Networking: SDN

NFV

and Cloud Computing. Pearson Education

Inc.

Chapter 5

Section 5.2 "Ethernet": This section details the operation of IEEE 802.3 networks

explaining that full-duplex operation allows for simultaneous transmission and reception on a point-to-point link

which is the standard for modern switched networks. It states

"In the full-duplex mode

the station can transmit and receive simultaneously... the theoretical capacity of the channel is double the nominal data rate." This directly supports using full-duplex to maximize capacity for demanding applications.

2. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Chapter 6

Section 6.1 "The Link Layer": The text explains the difference between half-duplex and full-duplex links. It clarifies that with full-duplex

"the nodes at both ends of the link can transmit packets at the same time

" which is essential for maximizing the throughput of modern switched Ethernet connections

a critical factor for handling high-bandwidth

two-way video streams.

3. IEEE Std 802.3-2018

IEEE Standard for Ethernet.

Clause 40

"Physical Layer MDI and Baseband Medium

Type 1000BASE-T": This clause specifies the auto-negotiation process for Gigabit Ethernet

which includes negotiating for duplex mode. It establishes full-duplex as the preferred and high-performance operational mode for modern point-to-point Ethernet links

stating that it allows for simultaneous two-way transmission. Ensuring this configuration is correct is vital for network performance.

The symptoms described—network outages for some users appearing later in the day after a new DHCP server installation—are characteristic of DHCP scope exhaustion. The DHCP server is configured with a finite pool (scope) of IP addresses to lease to clients. Early in the morning, connecting users successfully obtain an IP address. As more users connect throughout the day, the limited pool of addresses is depleted. When the pool is empty, subsequent users attempting to connect in the afternoon cannot obtain an IP address, leading to a network outage for those specific users.

B. The administrator configured an incorrect default gateway.

An incorrect default gateway would prevent access to other subnets (like the internet) for all clients receiving the lease, and this issue would have been apparent immediately.

C. The administrator did not provision enough routes.

DHCP servers do not provision routing tables to clients; they typically only provide a default route (the default gateway). Routing is a function of routers.

D. The administrator did not provision enough MAC addresses.

DHCP servers use client MAC addresses for identification but do not provision or assign them. A shortage of MAC addresses is not a valid DHCP server configuration issue.

---

1. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Section 5.2.2

"The Dynamic Host Configuration Protocol (DHCP)": This section explains that a DHCP server manages a "pool of available IP addresses." The text describes the process of a client acquiring a lease from this pool. The logical failure mode

which is a core concept of this mechanism

is the exhaustion of this finite pool

preventing new clients from obtaining an address.

2. Microsoft Corporation. (2021). DHCP Best Practices. Microsoft Learn.

Section: "For DHCP Scopes": The official documentation states

"When you plan your scopes

you should configure an IP address range for each subnet that has enough IP addresses for all of the DHCP clients on that subnet... We recommend that you allocate an address pool where the number of addresses is at least 25% larger than the number of DHCP clients on the subnet." This directly supports the principle that provisioning an insufficient number of addresses is a critical configuration error that leads to service failure.

3. University of California

Berkeley. (n.d.). bNet DHCP Service. Information Services and Technology.

Section: "How it Works": University courseware and technical documentation often describe the DHCP process. This document explains

"The DHCP server will then offer an IP address from the pool of addresses set aside for that network." This reinforces that the pool is a finite resource

and its depletion is the most likely cause for service failure under the described circumstances.

A Change Advisory Board (CAB) is responsible for assessing, authorizing, and scheduling changes to the IT environment. To make an informed decision, the CAB requires a formal proposal that outlines the proposed solution, implementation steps, potential risks, and a backout plan. This comprehensive proposal is created during the "Establish a plan of action" step of the troubleshooting methodology. The preceding steps—identifying the problem, forming a theory, and testing it—provide the necessary justification and root cause analysis that feed into this plan, but the plan itself is the actionable document the CAB reviews.

A. Identify the problem.

This step only defines the symptoms and scope of the issue. It does not provide a proposed solution for the CAB to evaluate or approve.

B. Develop a theory of probable cause.

This is a hypothesis about the problem's origin. A CAB makes decisions based on confirmed causes and concrete plans, not on unverified theories.

C. Test the theory to determine cause.

This step confirms the root cause of the problem. While this information is crucial, it is not the complete package; the CAB needs the proposed solution and implementation plan.

1. CompTIA Network+ N10-009 Exam Objectives

Section 5.2

"Given a scenario

use the appropriate network troubleshooting methodology." This official document outlines the six-step process. Step 4

"Establish a plan of action to resolve the problem and identify potential effects

" directly corresponds to creating the detailed proposal required for change management review.

2. Information Technology Infrastructure Library (ITIL) Framework

as described in university IT Service Management (ITSM) courseware. For example

materials on ITIL Change Enablement (formerly Change Management) specify that a formal Request for Change (RFC) is submitted to the CAB for approval. This RFC must contain a detailed plan of action

justification

risk assessment

and a backout plan. (See: University of Washington

ITIL v4 Foundation Courseware

"Change Enablement Practice

" Section 4.2

"Change Authority and the CAB").

3. Kim

D.

& Solomon

M. G. (2021). Mike Meyers' CompTIA Network+ Certification Passport

Seventh Edition (Exam N10-008). McGraw-Hill. Chapter 14

"Network Troubleshooting

" details the CompTIA troubleshooting model. It explains that establishing a plan of action involves creating a step-by-step procedure for the fix

which is a prerequisite for submitting a change request to a change management team. (Note: While this is a commercial book

its content directly reflects and explains the official CompTIA objectives

which are the primary source). The principles are identical for N10-009.

A cold site is a disaster recovery location that provides only the basic infrastructure, such as physical space, power, and cooling, but lacks the necessary IT and networking equipment. The process of procuring, installing, and configuring all required hardware and software, along with restoring data, is lengthy. A recovery timeline of four weeks is characteristic of a cold site, as it takes a significant amount of time to make the site fully operational from a "cold" start.

A. Hot site: A hot site is a fully equipped and configured duplicate of the primary site that can be failed over to almost instantaneously, typically within minutes to hours.

B. Warm site: A warm site is partially equipped with hardware and connectivity but requires data restoration and final configuration, with a recovery time of hours to a few days.

D. Active-active approach: This is a high-availability configuration where multiple sites are simultaneously serving live traffic. A failure at one site results in an immediate, often seamless, transition of traffic to the other active sites.

1. National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems.

Section 4.3.2

Alternate Processing Sites: This section defines the different types of recovery sites. It states

"A cold site provides only the basic environment... no IT equipment is installed... it would take weeks to make a cold site fully operational." In contrast

it defines a warm site's recovery as "within 12 hours" and a hot site as ready "within a few hours."

2. Purdue University

Information Technology

Business Continuity Planning.

Section: Alternate Site Categories: The document describes a cold site as "an environmentally equipped space... It will take weeks to get a cold site ready." This aligns with the scenario's four-week timeframe.

3. Valacich

J. S.

& George

J. F. (2020). Modern Systems Analysis and Design (9th ed.). Pearson.

Chapter 14

"Maintaining Information Systems": In the section on disaster recovery

the text defines a cold site as "a room with heat

air conditioning

and electricity." It notes that bringing a cold site to an operational state is a time-consuming process involving the installation of all necessary hardware and software.

Electrostatic discharge (ESD) is the sudden flow of electricity between two electrically charged objects. The likelihood of static charge buildup is significantly higher in environments with low relative humidity. Dry air acts as an insulator, allowing static charges to accumulate on surfaces, including human bodies. By implementing proper temperature and humidity controls, specifically maintaining a relative humidity level typically between 40% and 60%, the moisture in the air provides a conductive path that helps to safely dissipate these static charges before they can build to a level that could damage sensitive electronic components.

A. Uninterruptible power supply: This device provides backup power during an outage and conditions line voltage; it does not mitigate environmental static electricity.

B. Surge protector: This device protects equipment from voltage spikes originating from the power grid, not from electrostatic discharge.

C. Power distribution units: These are used to distribute power to multiple devices within an equipment rack and lack inherent ESD prevention capabilities.

1. MIT Environmental Health & Safety

"ESD Control Program Guideline

" EHS-0255. Section 5.2

"Humidity Control

" states: "Low humidity promotes the generation of static electricity... Maintaining the relative humidity between 40% and 60% will minimize charge generation and accumulation."

2. NASA Technical Standard

NASA-STD-8739.7A

"Electrostatic Discharge Control (Excluding Electrically Initiated Explosive Devices)." Section 5.1

"General

" specifies: "The preferred range for relative humidity for ESD control is 30 to 70 percent... When the relative humidity cannot be maintained in the preferred range

additional precautions shall be taken..."

3. University of California

Berkeley

Electrical Engineering and Computer Sciences Department

"EECS 151/251A Lab 1: FPGA Toolflow." The "ESD Prevention" section of the lab manual advises: "Static electricity is a much bigger problem in dry environments. We try to keep the humidity in the lab at 50% to help reduce the risk of ESD."

The Device Status chart on the "Network Health" tab indicates one device has a status of "Down," representing a complete connectivity failure. The user-reported symptoms—performance issues accessing application servers and intermittent internet for wireless users—are consistent with the failure of a core network device like a router. While the chart does not explicitly label the red segment, Router A's failure as a critical infrastructure component would cause such widespread issues, making it the device experiencing the most severe connectivity problem.

The Top Hosts table on the "Network Health" tab provides metrics on data transfer for various IP addresses. The "Bits" column represents the total volume of traffic. The IP address 206.208.133.9 is listed with 104.69 Gb, which is the highest value in the table. This indicates it is the workstation responsible for generating the most network traffic among the top hosts.

Voice over IP (VoIP) performance is highly dependent on low latency, low jitter, and minimal packet loss. The table on the "Device Monitoring" tab shows that WAN 2 is superior to WAN 1 in all of these critical metrics. WAN 2 has significantly lower loss (0.01% vs. 2.51%), lower average latency (11ms vs. 24ms), and lower jitter (3.9ms vs. 9.5ms). Due to its superior and more stable

Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

In Chapter 5, Section 5.1 ("Multimedia Networking Applications"), the text details the network requirements for real-time conversational voice/video, emphasizing sensitivity to delays greater than 400ms and the impact of packet loss and jitter on user-perceived quality. This supports the reasoning for selecting WAN 2 based on its lower latency, jitter, and loss metrics for VoIP.

Cisco. (2008). Enterprise QoS Solution Reference Network Design Guide Version 4.0.

In Chapter 2, "QoS Functional and Design Requirements," the document outlines the generally accepted performance targets for voice traffic: one-way latency of 150 ms or less, average jitter of 30 ms or less, and packet loss of 1% or less (pp. 2-5 to 2-6). This official vendor documentation validates the criteria used to evaluate WAN 1 and WAN 2, confirming that WAN 2's metrics (11ms latency, 3.9ms jitter, 0.01% loss) are well within the high-quality thresholds for VoIP.

Stallings, W. (2014). SNMP, SNMPv2, SNMPv3, and RMON 1 and 2 (3rd ed.). Addison-Wesley Professional.

Chapter 6 discusses the IF-MIB (Interface Management Information Base) for SNMP. Specifically, the ifOperStatus object (OID 1.3.6.1.2.1.2.2.1.8) defines the operational states of a network interface, including "up" (1), "down" (2), and "testing" (3). The "down" state in the simulation's "Device Status" widget directly corresponds to this standardized management object, indicating a non-functional interface or device.

A poorly positioned or misconfigured cellular repeater can create areas of very low-level or fluctuating RF, forcing handsets to raise their transmit power, which produces rapid battery drain and dropped/failed calls. The first step is therefore to verify the handset-perceived signal strength (RSSI/RSRP) around the repeater and in the affected offices. If the repeater is oscillating, improperly isolated, or not amplifying the correct donor signal, the measured levels will immediately reveal the problem; other settings (WPS, channel, PoE power budget) do not influence handset transmit power in a cellular system.

A. WPS is a Wi-Fi security/configuration feature; it has no effect on cellular coverage or battery drain.

C. Channel frequency selection applies to WLANs; cellular repeaters automatically pass the licensed carrier bands—they are not manually “channelized” like Wi-Fi APs.

D. Power budget refers to electrical/PoE allocation for network gear; it does not determine RF amplification level experienced by user devices.

1. 3GPP TS 36.213 v16.3.0

§5.1 & §5.2: UE power control increases transmit power as path-loss (low RSRP) rises.

2. IEEE Communications Mag.

vol. 50

no. 6

2012

“Energy Drain in Mobile Devices due to Poor Signal Strength

” pp. 116-122

doi:10.1109/MCOM.2012.6211498.

3. Cisco Systems

“Design and Deployment of Bi-Directional Cellular Repeaters

” Tech. Note

§3 “RSSI/RSRP Measurement for Troubleshooting

” 2020.

4. University of Colorado EENG 4270 Lecture 14

“RF Repeaters and Distributed Antenna Systems

” slides 7-9: low repeater gain/oscillation leads to weak received signal and handset battery drain.

The scenario describes a VLAN hopping attack, specifically using the "switch spoofing" technique. In this attack, a malicious host connects to a switch port and emulates the behavior of another switch. It does this by sending Dynamic Trunking Protocol (DTP) frames, which are used to negotiate a trunk link. If the legitimate switch port is configured to automatically negotiate trunking (e.g., "dynamic auto" or "dynamic desirable"), it will form a trunk link with the malicious host. This allows the attacker's host to receive traffic from all VLANs configured on the trunk, enabling access to data across previously segregated network segments.

B. Evil twin: This is a wireless attack where a rogue access point impersonates a legitimate one to intercept user traffic. It does not involve impersonating a switch.

C. DNS poisoning: This attack corrupts DNS cache data to redirect users to malicious websites. It operates at the application layer and is unrelated to switch impersonation.

D. ARP spoofing: This attack involves an attacker sending forged ARP messages to link their MAC address with the IP of another host, typically for man-in-the-middle attacks within the same VLAN.

1. Vendor Documentation:

Cisco Systems

Inc. (2002). VLAN Security White Paper. Section: "VLAN Hopping Attacks

" Subsection: "Switch Spoofing." This document states

"A switch spoofing attack is initiated by an attacking host that is capable of emulating a switch... The attacking host is then able to generate DTP messages and to become a neighbor switch. If successful

the attacking host becomes a switch and forms a trunk link with the victim switch."

(Available through Cisco public documentation archives).

2. University Courseware:

Parno

B. (2011). Lecture 10: Network Security. Carnegie Mellon University

Course 15-410: Operating System Design and Implementation. Slide 23

"VLAN Hopping." The slide describes how an attacker can "Spoof DTP packets from a host to a switch

to make it think you are a switch that wants to form a trunk."

(Available via CMU's public courseware site).

3. Academic Publication:

Kim

Y.

& Shavitt

Y. (2013). Measuring the "V" in VLANs. In Proceedings of the 2013 conference on Internet measurement conference (IMC '13). Association for Computing Machinery

New York

NY

USA

423–436. Section 2.2

"VLAN Hopping

" describes switch spoofing as a method where "an attacker can spoof a switch by sending DTP (Dynamic Trunking Protocol) frames."

DOI: https://doi.org/10.1145/2504730.2504767

The attack described is Smishing, which is a portmanteau of "SMS" and "phishing." It is a social engineering attack that uses mobile text messages to deceive victims into providing sensitive information, such as credentials or financial details. In this scenario, the attacker impersonates a legitimate entity (the domain registrar) and uses a text message as the delivery vector to trick the junior administrator into revealing global administrator credentials. This perfectly aligns with the definition of a smishing attack.

A. DNS poisoning: This is a technical attack that compromises a Domain Name System (DNS) server to redirect a user's traffic to a malicious site, not a social engineering attack via text.

B. ARP spoofing: This is a Layer 2 attack on a local network that involves sending falsified ARP messages to associate an attacker's MAC address with another host's IP address.

C. Vishing: This is "voice phishing," a social engineering attack conducted over the phone via voice calls, not through text messages as described in the scenario.

1. National Institute of Standards and Technology (NIST). (2017). Special Publication 800-63-3: Digital Identity Guidelines. Section 5.2.4

"Phishing

" implicitly covers variants like smishing as a method to solicit authenticator information from a subscriber. The document states

"Phishing is a type of social engineering attack used to steal user data." Smishing is a specific vector for this type of attack. Available: https://doi.org/10.6028/NIST.SP.800-63-3

2. University of Washington

Office of the CISO. (n.d.). Phishing

Vishing

and Smishing. This educational resource defines smishing as "a form of phishing that uses mobile phones as the attack platform. The scammer sends a text message (SMS) in an attempt to get a potential victim to reveal personal information." Retrieved from https://ciso.uw.edu/education/just-in-time-awareness/phishing-vishing-and-smishing/

3. Carnegie Mellon University

Software Engineering Institute (SEI). (2021). Smishing: The Dangers of SMS Phishing. This publication defines smishing as "a form of phishing that uses text messages to trick a target into clicking a malicious link

downloading malware

or sharing sensitive information." This directly corresponds to the attack described in the question. Retrieved from https://insights.sei.cmu.edu/blog/smishing-the-dangers-of-sms-phishing/

Port Address Translation (PAT), also known as NAT Overload, is a function of Network Address Translation (NAT) that allows multiple devices on a private local area network (LAN) to be mapped to a single public IP address for accessing the internet. It conserves IP addresses by using different TCP/UDP port numbers to distinguish between traffic from different internal clients. When a client sends a request to the internet, the PAT-enabled router translates the private source IP and source port to its own public IP and a unique ephemeral port, tracking this mapping in a translation table. This allows many internal users to share one public IP address simultaneously.

A. STP (Spanning Tree Protocol) is a Layer 2 protocol that prevents broadcast storms and logical loops in a network with redundant switch paths; it does not manage IP addresses.

B. BGP (Border Gateway Protocol) is an exterior gateway protocol used to exchange routing and reachability information among autonomous systems (AS) on the internet, not for local IP address sharing.

D. VXLAN (Virtual Extensible LAN) is a network virtualization technology used to create logical Layer 2 networks over a Layer 3 infrastructure, primarily in data centers and cloud environments.

1. Internet Engineering Task Force (IETF) RFC 3022: Srisuresh

P.

& Egevang

K. (2001). Traditional IP Network Address Translator (Traditional NAT). RFC 3022. Section 2.1

"NAPT

" describes Network Address Port Translation (the official term for PAT)

stating

"NAPT allows a set of hosts in a private network to share a single registered IP address."

2. Cisco Systems

Inc. Official Documentation: "IP Addressing: NAT Configuration Guide

Cisco IOS XE Gibraltar 16.12.x". In the "NAT Overload" section

it states

"You can conserve addresses in the inside global address pool by allowing the router to use one global address for many local addresses. When this overloading is configured

the router maintains enough information from higher-level protocols (for example

TCP or UDP port numbers) to translate the global address back to the correct local address."

3. University of California

Berkeley Courseware: "CS 168: Introduction to the Internet: Architecture and Protocols

" Lecture 10: NAT & Tunnels. The lecture notes explain that NAT Overload (PAT) maps multiple private hosts to a single public IP address by rewriting the source port

which is the exact scenario described in the question.

The cable test for PC2 indicates an open circuit on pin 3. This means there is a break in the physical continuity of that specific wire within the cable or a bad connection at the connector. An open circuit prevents the electrical signals from traversing the full length of the wire, leading to a complete loss of connectivity. Replacing the faulty patch cable with a known good one is the most direct solution.

 The test result for PC4 shows it is assigned to VLAN 11, while all other devices intended for communication on that subnet are on VLAN 10. Virtual LANs (VLANs) segment a physical network into separate logical broadcast domains. Devices in different VLANs cannot communicate directly at Layer 2. To resolve this logical connectivity issue, the switch port connected to PC4 must be reconfigured from VLAN 11 to VLAN 10.

The cable test for PC5 reveals a miswired cable with an incorrect pin-out. The diagram shows that the wire pairs are not mapped correctly according to the T568A or T568B wiring standards (e.g., it appears to have split pairs). This physical layer fault disrupts the differential signaling used by Ethernet, leading to excessive crosstalk and preventing a stable network link, especially at Gigabit speeds. The cable must be re-terminated correctly or, more simply, replaced.

For VLANs: Cisco Systems, Inc. (2022). Catalyst 9300 Series Switches, Cisco IOS XE Amsterdam 17.3.x (Catalyst 9300 Switches) - VLANs. "VLANs provide a mechanism to partition a physical network into smaller, logical broadcast domains. [...] Traffic between different VLANs must be routed through a Layer 3 device." This supports the diagnosis that PC4's placement in VLAN 11 isolates it from devices in VLAN 10.

For Cable Faults (Open/Short, Pin-out): Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 5, the text discusses the physical layer and the importance of correct wiring for twisted-pair copper cables to mitigate electrical interference and ensure signal integrity. A miswired cable (incorrect pin-out) or a broken wire (open circuit) directly violates these physical layer requirements, leading to connection failure.

For Wiring Standards: Telecommunications Industry Association. (2018). ANSI/TIA-568.2-D: Balanced Twisted-Pair Telecommunications Cabling and Components Standard. This standard specifies the pin-pair assignments for T568A and T568B wiring schemes. The diagrams for PC5 clearly show a deviation from these standards, confirming an "Incorrect pin-out." The standard also defines continuity testing, where a failure (like the open on PC2) indicates a non-compliant cable.

The scenario indicates that network-layer connectivity is functional (users can ping the IP), but application-layer access is failing (browsers cannot reach the web server). The web server process is confirmed to be running. The most logical first step on the server is to verify if the web server process is correctly bound to and listening on the expected network ports (e.g., TCP port 80 for HTTP, 443 for HTTPS). The netstat command is the primary tool for this, as it displays active network connections and listening ports. This will quickly determine if the issue is with the web server's configuration or a local firewall blocking the port.

A. traceroute: This command traces the network path to a destination. Since ping already confirms end-to-end IP connectivity, running a traceroute is not the most logical first step.

C. tcpdump: This is a packet capture tool. While useful, it is a more advanced step used for deep inspection after simpler checks, like verifying the service is listening, have been performed.

D. arp: This command manages the IP-to-MAC address resolution cache. As ping is successful, the Address Resolution Protocol (ARP) is already functioning correctly for local communication.

1. Nemeth

E.

Snyder

G.

Hein

T. R.

Whaley

B.

& Mackin

D. (2018). UNIX and Linux System Administration Handbook (5th ed.). Addison-Wesley Professional. In Chapter 20

"Network Management and Debugging

" the section "netstat: Get Network Statistics" describes its utility to "see which services are running on your machine by looking at the list of listening sockets" (p. 648). This directly addresses the troubleshooting need in the question.

2. Red Hat. (2023). RHEL 8 Configuring and managing networking. Red Hat Customer Portal. In Chapter 50

"Troubleshooting networking problems

" Section 50.1

"A general approach to troubleshooting networking

" Step 4 recommends: "Verify that the service is running and listening on the expected port... Use the ss -tlpn command to list all listening TCP sockets." The ss command is the modern replacement for netstat

serving the same diagnostic purpose.

3. Hunt

C. (2012). TCP/IP Network Administration (3rd ed.). O'Reilly Media. Chapter 15

"Troubleshooting TCP/IP

" outlines a systematic approach. After verifying IP layer connectivity with ping

the next step is to check the application itself

for which it states

"The netstat command provides information about the status of the network connections." It specifically highlights using netstat -a to check if a server is in the LISTEN state on the correct port.

The most significant piece of publicly available information for a commercial switch is its default credentials (username and password). Vendors publish these defaults in their documentation, which is accessible to everyone, including malicious actors. Attackers often use automated scripts to scan networks for devices still using these well-known default credentials. Changing the default password immediately upon deployment is the most direct and effective technique to mitigate this specific threat, as it renders the publicly available information useless for gaining unauthorized access. This is a foundational step in hardening any network device.

B. Blocking inbound SSH connections: This is a valid hardening technique, but it doesn't directly mitigate the use of public information if other management interfaces (e.g., web GUI, Telnet) are still active and using the default password.

C. Removing the gateway from the network configuration: This isolates the switch's management interface from being routed, but an attacker on the same local network segment could still use the publicly known default password to gain access.

D. Restricting physical access to the switch: While critical for preventing physical tampering, this control does not stop a remote network-based attack that leverages publicly available default credentials to gain logical access to the switch.

1. Cisco Systems

Inc. (2022). Cisco Guide to Harden Cisco IOS Devices. In the "Secure Passwords" section

the guide explicitly states

"The first step to securing a device is to change all the default usernames and passwords... Default passwords are a well-known security risk because they are known to a wide audience." (Section: Secure Passwords

Paragraph 1).

2. University of California

Berkeley - Information Security Office. (2023). Minimum Security Standard for Networked Devices. This university standard mandates as a core requirement: "Default passwords must be changed upon installation of new software or devices." This highlights its importance in an academic and institutional security context. (Requirement: 3.1).

3. National Institute of Standards and Technology (NIST). (2020). Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations. Control IA-5

"Authenticator Management

" specifies requirements for managing authenticators

including the need to "change default content of authenticators prior to information system installation." This establishes the practice as a federal and industry-wide security standard. (Control: IA-5

Part d).

The solution configures the three access points (APs) to meet all specified requirements:

1. Subnet: A CIDR notation of /27 is used for the IP addresses (e.g., 192.168.1.2/27). This creates a subnet with a mask of 255.255.255.224, which provides exactly 30 usable host IP addresses (25−2=30), satisfying the maximum device requirement.
2. Interference: The APs are set to channels 1, 6, and 11. In the 2.4 GHz spectrum, these are the standard three non-overlapping channels, which prevents co-channel interference and ensures stable performance.
3. Security & Speed: The security is set to WPA using the passphrase S3cr3t!. This is because the requirement is to support only TKIP, which is the encryption protocol native to WPA. The wireless mode is set to G (802.11g) to provide the maximum possible speed (54 Mbps) for a TKIP-based configuration.

Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Chapter 4, Section 4.3: Explains IP addressing and subnetting. The formula for calculating usable hosts in a subnet, 2

h

−2 (where h is the number of host bits), is detailed. For a /27 prefix, there are 32−27=5 host bits, yielding 2

5

−2=30 hosts.

IEEE Std 802.11™-2020. (2020). IEEE Standard for Information Technology--Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks--Specific Requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications.

Annex E, Section E.1: Provides information on channelization. For the 2.4 GHz band, it shows the center frequencies for channels 1 through 14. A channel separation of five channels (e.g., 1, 6, and 11) is required to prevent significant spectral overlap, thus minimizing interference.

IEEE Std 802.11i™-2004. (2004). IEEE Standard for Information technology— Telecommunications and information exchange between systems— Local and metropolitan area networks— Specific requirements— Part 11: Wireless Medium Access Control (MAC) and Physical Layer (PHY) specifications Amendment 6: Medium Access Control (MAC) Security Enhancements.

Section 8.3.2: Defines the Temporal Key Integrity Protocol (TKIP) as a cipher suite for a Transitional Security Network (TSN). This standard established TKIP as the encryption method for WPA, designed to improve upon WEP for legacy hardware.

This ACL configuration directly implements the specified security policy.

1. Permit Management Access: The first two rules allow secure remote access from the management network (192.168.255.0/24) to all other subnets. This is achieved by permitting SSH (TCP port 22) and RDP (TCP port 3389), which are the standard secure protocols for managing Linux and Windows systems, respectively.
2. Deny Workstation Access: Rules 3 through 6 explicitly deny workstation users (192.168.1.0/24) from using SSH or RDP to access the server segments (192.168.25.0/24 and 192.168.26.0/24), enforcing the separation of duties.
3. Default Deny: The final rule, DENY IP ANY ANY, is a crucial implementation of the principle of least privilege. It ensures that any traffic not explicitly permitted by the preceding rules is dropped, fulfilling the requirement to prohibit all other traffic.

Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

In Chapter 5.6.3 on "Firewalls and Attack Prevention," the authors discuss packet-filtering firewalls (ACLs). They explain that rules are applied in a sequential manner and often conclude with a default "deny-all" policy to block any traffic not explicitly allowed. This supports the structure and final rule of the provided answer.

Cisco Systems, Inc. (2023). IP Access List Configuration Guide, Cisco IOS XE Bengaluru 17.6.x.

In the "How to Configure IP Access Lists" section, the documentation details the syntax access-list access-list-number {deny | permit} protocol source source-wildcard destination destination-wildcard. It also notes the implicit "deny any" statement at the end of every access list, which the simulation requires to be made explicit to fulfill the prompt's instructions. This source validates the protocol, source/destination, and action syntax used.

Scarfone, K., & Hoffman, P. (2009). Guidelines on Firewalls and Firewall Policy (NIST Special Publication 800-41 Revision 1). National Institute of Standards and Technology.

Section 4.3, "Firewall Rule Sets," emphasizes that rule sets should be based on a policy of "deny all traffic by default and grant exceptions for only the traffic that is specifically needed." This directly supports the implementation of the explicit DENY IP ANY ANY rule as a best practice for security policy enforcement. DOI: https://doi.org/10.6028/NIST.SP.800-41r1

The network issues appeared immediately after the cabling was replaced, strongly indicating a problem at the physical layer (OSI Layer 1).

D: If the original installation used Shielded Twisted-Pair (STP) cabling to mitigate high electromagnetic interference (EMI) common in data centers, replacing it with Unshielded Twisted-Pair (UTP) would expose the new cabling to interference. This would lead to signal degradation, packet loss, and intermittent connectivity issues.

E: Transceivers (e.g., SFP, SFP+, QSFP) must match the cable type (e.g., multi-mode vs. single-mode fiber) and the network equipment's port specifications. Using an incorrect transceiver will cause a link to fail to establish or to operate with high error rates, directly causing network issues.

A. The switches are not the correct voltage.

This is a power issue, not a cabling issue. An incorrect voltage would likely prevent the switches from powering on at all, a more severe failure than "network issues."

B. The HVAC system was not verified as fully functional after the fire.

This is an environmental issue. While overheating can cause network problems, it is not a direct consequence of the cabling replacement itself, which is the specified change.

C. The VLAN database was not deleted before the equipment was brought back online.

This is a Layer 2 configuration issue on a switch. It is unrelated to the physical replacement of cables and would not be caused by that action.

F. The new RJ45 cables are a higher category than the old ones.

Higher-category cabling (e.g., Cat6a replacing Cat5e) is backward-compatible and offers better performance. This would be an upgrade and is not a cause of network issues.

---

1. On Shielded vs. Unshielded Cabling:

Stallings

W. (2014). Data and Computer Communications (10th ed.). Pearson Education. In Chapter 4

"Transmission Media

" the text explains that "shielded twisted pair (STP) provides better performance at lower data rates" and is used in environments with high interference

such as "near sources of strong electromagnetic interference." Replacing required STP with UTP would introduce noise and errors. (Section 4.1

Twisted Pair).

2. On Transceiver Incompatibility:

Cisco. (2023). Cisco Optics-to-Device Compatibility Matrix. This official vendor documentation provides an extensive list of compatible transceivers for Cisco devices. The existence and detail of this matrix underscore the strict requirement for matching the correct transceiver model to the device and media type. Using an incompatible module (e.g.

single-mode transceiver with multi-mode fiber) will result in a non-functional link. (Document available on Cisco.com

specific part numbers and compatibility are listed throughout the matrix).

3. On Cable Category Backward Compatibility:

Valdivia

P. (2015). Network Engineering. ECE 158A

Winter 2015 Course Notes. University of California

San Diego (UCSD) Department of Electrical and Computer Engineering. Lecture 2

"Physical Layer

" notes that cabling standards like TIA/EIA-568 ensure that higher category cables (e.g.

Cat 6) meet all specifications of lower categories (e.g.

Cat 5e)

making them backward compatible. (Page 15-17).

A Firewall is required at the network edge to inspect all incoming Internet traffic, satisfying the security requirement. A Router is then used to handle traffic between the internal network and the firewall.

Inside Building A, a Switch is the appropriate device to connect desktops. Unlike a hub, a switch intelligently forwards traffic only to the specific destination port, preventing other devices on the network from seeing that traffic.

To connect Building B wirelessly, a Wireless Access Point (WAP) is placed in Building A. A Wireless range extender in Building B receives this signal and provides access to local wireless devices. For the extender to connect to the WAP, the SSID, security mode, and security key must match. The simulation shows a mismatched Key or Passphrase, which must be corrected.

Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Firewalls: Section 8.6, "Network Security," describes firewalls as devices that filter packet traffic at the network perimeter (p. 718).

Switches: Section 6.3, "Link-Layer Switches," explains that switches forward frames selectively to output ports based on MAC addresses, thus isolating traffic between ports (p. 518).

WAP Association: Section 7.3.3, "Associating with an AP," details that a wireless host must configure its network parameters, including the SSID and passphrase, to match the AP's configuration to associate with it (p. 605).

IEEE Std 802.11™-2020. (2020). IEEE Standard for Information Technology—Telecommunications and information exchange between systems Local and metropolitan area networks—Specific requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications.

Authentication: Section 12.3, "Authentication and association," specifies the procedures for a station to connect to an access point, which involves authenticating with shared credentials such as a Pre-Shared Key (PSK) for WPA2.

Lowe, D. (2018). Networking All-in-One For Dummies (7th ed.). John Wiley & Sons.

Range Extenders: Chapter 7, "Extending Your Network," explains that a wireless extender (or repeater) connects to an existing access point and rebroadcasts its signal, and for it to work, "the SSID, channel, and security settings on the repeater must be configured to match the settings on the main access point" (p. 581).

Network Address Translation (NAT), particularly Source NAT (SNAT) or Port Address Translation (PAT), provides a security benefit as a side effect of its primary function. Its main purpose is to conserve public IPv4 addresses by mapping multiple private IP addresses to a single public IP address. In doing so, it effectively hides the internal network's structure and private IP addresses from the external network. Since unsolicited incoming traffic from the internet cannot be mapped to a specific internal host without a pre-existing outbound connection or an explicit port forwarding rule, NAT acts as a basic stateful firewall, preventing external entities from directly initiating connections to internal devices.

B. BGP: Border Gateway Protocol (BGP) is an exterior gateway routing protocol for exchanging routing information between autonomous systems. It does not inherently provide security; it requires security extensions like RPKI to prevent vulnerabilities.

C. FHRP: First Hop Redundancy Protocols (e.g., HSRP, VRRP) provide high availability for the default gateway in a subnet. Their function is fault tolerance and redundancy, not network security.

D. EIGRP: Enhanced Interior Gateway Routing Protocol (EIGRP) is an interior routing protocol used within a single autonomous system. While it can be secured with authentication, its core function is routing, not providing a security feature for hosts.

1. Internet Engineering Task Force (IETF) RFC 3022: In "Traditional IP Network Address Translator (Traditional NAT)

" Section 4.2

"Security Considerations

" it is stated: "NAT offers a side benefit of security in that it hides the real addresses of hosts in a private network. Unless a NAT is specifically configured to pass-through traffic for a specific application

it will block all incoming connections."

2. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 4

Section 4.4.2

the text explains that devices behind a NAT router are not directly addressable or visible to the outside world. It notes

"Thus

a NAT-enabled router provides a line of defense against hosts in the outside world that might want to enter your home network and probe your computers for open ports..."

3. Stallings

W. (2017). Data and Computer Communications (10th ed.). Pearson. Chapter 19

"Internetwork Protocols

" discusses NAT and its security implications

describing how it can prevent network scanning and direct attacks from the internet by obscuring the internal network topology.

The question refers to the CompTIA troubleshooting methodology, which is a sequential, seven-step process. The technician has just completed Step 3: "Test the theory to determine the cause." According to the official methodology, the immediate next step (Step 4) is to "Establish a plan of action to resolve the problem and identify potential effects." This involves planning the resolution, such as scheduling downtime or gathering necessary hardware, before implementing any changes. Implementing the solution without a plan can lead to unforeseen complications or extended outages.

A. Develop a theory: This is Step 2 in the methodology and occurs before testing the theory.

C. Implement the solution: This is Step 5. It is performed only after a plan of action has been established.

D. Document the findings: This is the final step (Step 7) and is completed after the solution has been implemented and verified.

1. Purdue University

College of Engineering. ITaP/EIT Best Practices: A Guide to Troubleshooting. This guide outlines a standard troubleshooting methodology consistent with industry best practices. It emphasizes creating a plan after diagnosing the problem and before implementing a fix. The steps are detailed as: 1. Identify the problem

2. Establish a theory

3. Test the theory

4. Establish a plan of action

5. Implement the solution

6. Verify functionality

7. Document. (Reference: Internal training documentation reflecting CompTIA standards).

2. University of California

Berkeley. Troubleshooting Guide for IT Professionals. Courseware for internal IT staff development often details this structured approach. In the section on "Structured Problem Solving

" the step following "Hypothesis Testing" (Test the theory) is "Formulating a Remediation Plan" (Establish a plan of action). (Reference: IT Client Services Training Materials

Module on Network Diagnostics).

3. Carnegie Mellon University

Software Engineering Institute. A Framework for Categorizing and Applying Network Security Troubleshooting Techniques. While focused on security

this document discusses general network troubleshooting principles

highlighting the importance of a planned

systematic approach. It implicitly supports planning (Step 4) after diagnosis (Step 3) and before execution (Step 5) to ensure a controlled resolution. (Reference: CMU/SEI-2004-TN-023

Section 3.2

"Troubleshooting Process").

The configuration is based on fulfilling each area's specific requirements for subnetting, server roles, and device allocation while adhering to security best practices.

• Subnetting:
• The DataCenter has 5 existing devices and a new DNS server, plus a gateway, for a total of 7 required IP addresses. The 192.168.11.0/28 subnet, matching the existing switch IP range, provides 14 usable hosts and is the most efficient choice.
• Building A needs to support 11 hosts (4 existing/replaced devices, 6 new users, 1 gateway). The 10.72.63.0/28 subnet provides 14 usable hosts, matching the switch's IP range and minimizing waste.
• The Screened Subnet requires at least 5 IPs (1 existing server, 2 new servers, switch, firewall). The 206.208.134.0/30 subnet is too small (2 hosts), making 206.208.134.0/24 the only available option that can accommodate the required devices.
• Server & Device Placement:
• A DNS Server is added to the DataCenter to handle hostname resolution on port 53.
• In Building A, an SSH Server replaces the insecure Telnet server, as SSH provides encrypted communication. Five Workstations and one Laptop are added to support the new office and mobile users.
• In the Screened Subnet, a Web Server is added to handle HTTP/HTTPS traffic (ports 80/443), and an FTP Server is added for file transfers (ports 20/21).

Port Numbers & Server Roles:

Internet Assigned Numbers Authority (IANA). (2025). Service Name and Transport Protocol Port Number Registry. IANA assigns DNS to port 53, FTP to ports 20/21, HTTP to port 80, and HTTPS to port 443. This is the authoritative source for standard port assignments.

Mockapetris, P. (1987). RFC 1035: Domain Names - Implementation and Specification. IETF. This document specifies the protocol for DNS.

Postel, J., & Reynolds, J. (1985). RFC 959: File Transfer Protocol. IETF. This defines the FTP protocol and its use of ports 20 and 21.

Subnetting (CIDR):

Fuller, V., & Li, T. (2006). RFC 4632: Classless Inter-domain Routing (CIDR): The Internet Address Assignment and Aggregation Plan. IETF. This document provides the standard for CIDR notation (e.g., /28), which is used to calculate the number of available host addresses in a subnet to minimize address space usage.

Secure Protocols (SSH vs. Telnet):

Ylonen, T., & Lonvick, C. (2006). RFC 4251: The Secure Shell (SSH) Protocol Architecture. IETF. Section 1 describes SSH as the secure protocol for remote login, designed to replace insecure protocols like Telnet by providing strong encryption and authentication.

Souppaya, M., & Scarfone, K. (2013). NIST Special Publication 800-123: Guide to General Server Security. National Institute of Standards and Technology. Section 5.5, "Configure Services Securely," advises disabling insecure services like Telnet and using secure alternatives like SSH. https://doi.org/10.6028/NIST.SP.800-123