CompTIA Network+ Practice Test (N10-009)

This statement is false. In a three-tier hierarchical model, security processes such as firewall management and intrusion detection are not primarily handled at the core layer. Instead, the core layer's main function is to provide fast and reliable connectivity across the network, focusing on high-speed switching and efficient data transport. Security processes are typically managed at the distribution layer, where security and policy-based network decisions are enforced, and at the perimeter or edge, where additional security appliances might be deployed.

A proxy server acts as an intermediary for requests from clients seeking resources on other servers. By receiving the client's request, forwarding it to the destination server, and returning the response, the proxy can also provide caching, content filtering, and IP address masking for privacy and security.

The TTL field in an IP packet limits how many Layer-3 hops the packet can traverse. Each router decrements the TTL by one, and when the value reaches zero, the router discards the packet and typically sends an ICMP Time-Exceeded message. This mechanism prevents packets from looping indefinitely. The other options describe different network mechanisms and do not match the TTL function.

Port security is a layer 2 traffic control feature used mainly to limit the number of MAC addresses allowed on a single port. This prevents unauthorized devices from accessing the network and mitigates risks like MAC flooding. Limiting bandwidth does not relate directly to security, and monitoring traffic patterns and transmitting data securely are functions more closely associated with network monitors and encryption protocols, respectively.

A scope in DHCP configuration defines a specific range of IP addresses that a DHCP server can allocate to client devices on a network. It is essential for the management and allocation of IP addresses in a dynamic network environment. Other options, like managing bandwidth allocation or assigning specific gateways, are not directly functions of DHCP scopes but could depend on how IP addresses are distributed or network access configurations.

Encapsulating protocols for tunneling across diverse networks is the primary application of GRE, making it useful for creating virtual point-to-point links over an IP internetwork. It enables the encapsulation of packets from one protocol suite within the datagram encapsulations of another protocol suite, facilitating connectivity across heterogeneous networks.

The correct answer is that one or more switch ports have been assigned to the wrong VLAN. VLANs (Virtual LANs) create logically separate networks on the same physical infrastructure. If a switch port used by a marketing department device is mistakenly assigned to the finance department's VLAN, that device will become part of the finance network segment, bypassing the intended security separation. A misconfigured default gateway or a routing loop would typically cause connectivity failures or performance degradation, not grant unintended access. While a missing access control list (ACL) on a router could also allow unwanted inter-VLAN traffic, the most fundamental cause for a device appearing in the wrong logical segment is an incorrect VLAN assignment on its switch port.

Traffic analysis data is the most relevant for performance monitoring because it provides insights into the volume and type of traffic flowing through a network. This information is crucial for assessing the network's efficiency, identifying bottlenecks, and understanding overall network health. Usage statistics, while related, more broadly cover the general use of the network without detailed traffic insights. Error logs are important for identifying problems but do not provide a comprehensive overview for performance metrics typically monitored for optimization. Security alerts focus specifically on potential security incidents, not performance metrics.

The correct answer is the primary DNS server. In a standard DNS configuration, the primary server holds the read/write copy of the zone file where all changes, additions, and deletions are made. Secondary DNS servers maintain a read-only copy of this zone file, which they receive from the primary server through a process called a zone transfer. Therefore, any modifications must be made on the primary server to be propagated to the secondaries. The other options are incorrect because secondary servers cannot be directly modified, and recursive or caching servers are not authoritative sources for the zone data.

The correct answer emphasizes the strategic use of a screened subnet to host services that are intended for public access, such as a web server, thus isolating them from the internal network. This setup acts as a buffer zone, reducing the risk of external attacks directly impacting the core internal network. The incorrect options, although plausible in different contexts, fail to capture the primary security function of a screened subnet as an intermediary that shields internal networks from direct exposure to public internet traffic.

A 'runt' is an Ethernet frame that is smaller than the minimum IEEE 802.3 frame size of 64 bytes. The presence of runts, which are often tracked by interface counters, typically indicates issues like collisions, duplex mismatches, or faulty hardware. Frames that exceed the maximum size are known as 'giants,' and distinguishing between these error types is critical for accurate network troubleshooting. A frame that meets the minimum size requirement is considered valid in that regard.

The correct answer is 802.11h. This amendment to the 802.11 standard was specifically created to manage spectrum and power in the 5 GHz band to avoid interference with other systems, such as military, weather, or satellite radar. It accomplishes this using Dynamic Frequency Selection (DFS), which detects radar signals and moves the Wi-Fi network to a clear channel, and Transmit Power Control (TPC), which adjusts signal strength to the minimum necessary. 802.11i is incorrect as it deals with security enhancements (WPA2). 802.11e is incorrect because it focuses on Quality of Service (QoS) for traffic prioritization. 802.11ac is a wireless networking protocol, and while devices using it in the 5 GHz band must adhere to 802.11h regulations, 802.11h is the standard that specifically defines the DFS and TPC mechanisms.

Multifactor authentication (MFA) significantly increases network security by requiring more than one form of verification. This method makes it more challenging for unauthorized users to gain access even if they have compromised one credential type, such as a password. This reduces the likelihood of unauthorized access, compared to using only passwords. Other answers are partly correct but do not fully align with the primary intent of MFA to enhance access security by layering verification methods.

Time-based one-time passwords (TOTP) rely on a shared secret and the present time to generate a unique code every set interval (commonly 30 seconds). After that period, the code cannot be reused, sharply limiting the window in which an attacker could exploit it. Event-based HOTP tokens change only when triggered, static PINs never change, and fingerprint scans are biometric factors rather than time-dependent codes.

The correct approach in a zero trust architecture is to implement policy-based authorization. In zero trust models, access decisions are based not on the physical or network location of a user, but on a set of policies that consider various context factors, such as the user's identity and the device's security status. This method ensures tight control over who can access specific resources, making the network more secure against various threats.

The correct answer is 'To prevent switching loops in a broadcast domain'. Spanning Tree Protocol (STP) is essential in a layered network to prevent loops, which can create broadcast storms and destabilize network communications. While improving performance and expanding network coverage are beneficial outcomes of many network protocols, they are not the primary functions of the spanning tree protocol. As for managing collision domains, that is primarily addressed by switching devices and protocols at a different layer.

The correct answer is Gather information. According to the CompTIA troubleshooting methodology, the first step is to identify the problem, which begins with gathering comprehensive information. This includes determining the scope of the issue (e.g., who is affected, what services are unavailable) and identifying commonalities, such as the users' physical location. The other actions represent steps taken later in the process. Replacing cables or running a virus scan would be part of implementing a solution or testing a theory, which should not be done without prior investigation. Asking specifically about new software is a valid question, but it's a subset of the broader initial step of gathering all relevant information to form a complete picture of the problem.

Telnet commonly uses port 23 for its operations. This is crucial for network technicians to know because while configuring firewalls and network policies, distinguishing between ports used by different services ensures proper traffic flow and security measures. Port 22 is used by SSH, which is a secure alternative to Telnet. Ports 21 and 25 are typically used by FTP and SMTP, respectively, which serve different functions.

TCP port 636 is reserved for LDAP over SSL/TLS (LDAPS). When a client connects to this port, the LDAP session is automatically encrypted with SSL or TLS before any directory queries or credentials are transmitted, protecting the confidentiality and integrity of the data. HTTPS instead uses port 443 for secure web traffic, multimedia messaging protocols use other ports, and secure file-transfer protocols use ports such as 22 (SFTP) or 989/990 (FTPS), so those options are incorrect.

Single-mode fiber optic cable is ideal for long-distance communications, supporting distances over 10 kilometers with high bandwidth and minimal signal loss. Multimode fiber optic cable is designed for shorter distances, typically up to 2 kilometers, due to modal dispersion. Category 6 twisted pair cable and coaxial cable are also limited in distance and bandwidth compared to single-mode fiber, making them unsuitable for a 10-kilometer connection.