CompTIA Network+ Practice Test (N10-009)

The most effective backup strategy to minimize data loss is to save the configuration immediately after any change is made. This ensures the backed-up version is always the most current, preventing any loss of configuration changes. While daily backups are a strong practice, changes made after the daily backup would be lost if a failure occurred before the next one. Weekly and annual backups are not frequent enough for a dynamic environment and would likely result in significant configuration loss.

An Ad hoc network is best suited for this scenario because it allows devices to connect directly without needing a central router or server, facilitating peer-to-peer communication. Ad hoc networks are ideal for temporary situations where no existing network infrastructure is present, such as in remote field operations. This type of network avoids the complexity and dependencies related to more permanent network installations and provides the straightforward, direct device-to-device communication needed in this scenario. The other options involve infrastructure-based networks that require network hardware and setups that are not necessary or feasible for temporary and remote conditions like the one described.

An IDS is typically positioned out of band to passively monitor network traffic. It analyzes traffic copies and sends alerts when suspicious activity is detected but does not actively block packets. An IPS, by contrast, is placed inline and can automatically take preventive actions-such as dropping or rejecting malicious packets-to stop the threat in real time. Therefore, the only statement that correctly distinguishes these roles is the option describing an IDS as passive (alert-only) and an IPS as active (blocking).

A Clientless VPN is appropriate in this scenario because it allows users to access internal network resources through a web browser without requiring the installation of client software on their devices. This method is particularly effective for accessing specific applications securely, rather than the entire network. An SSL VPN typically facilitates this by securing the connection between the user's web browser and the network gateway. In contrast, a Full VPN client would require installing software on each device, which is not ideal for this requirement. VPN Passthrough is a feature on a router that allows outbound VPN connections from clients on the internal network; it does not provide inbound access to internal web applications for remote users. Lastly, an IPSec VPN also typically requires client software installation and is therefore not suitable for scenarios that demand a clientless setup.

The principle of least privilege states that a user, process, or system component should be granted only the minimum permissions necessary to complete its tasks. Applying this principle limits the potential damage from accidents or malicious actions because excess privileges are removed. Role-based access control, time-based authentication, and multifactor authentication are access-control or authentication methods, but none are specifically centered on minimizing privileges to only what is required.

Implementing automated synchronization between the live network configurations and the central repository ensures all changes are documented and versioned. This practice not only provides a history of changes for auditing purposes but also allows for quick rollbacks to previous configurations if necessary. Manual versioning is prone to human error and inconsistency, while periodic documentation can cause delays and lack real-time updates.

For connections spanning 15 kilometers, single mode fiber is the most suitable option. It is specifically designed for long distances as it uses a smaller core diameter that allows light to travel in a direct path, minimizing signal loss and delay. While multimode fiber could potentially be considered for shorter distances due to its ability to transmit data at high speeds, its larger core size leads to higher modal dispersion, making it less effective over long distances. The other options are copper-based cables, such as Cat 5e and STP, which are limited to a maximum length of 100 meters and are therefore unsuitable for a 15-kilometer link.

A Graphical User Interface (GUI) for a network device typically facilitates visual interaction with the device, allowing for easier monitoring and management tasks, such as viewing status indicators and statistics. This option contrasts with command-line interfaces that require command memorization and provide less immediate visual feedback.

The 'show route' command is specifically designed to display the routing table on a router. This command provides detailed information about all routes known to the router, including destination networks, next-hop addresses, and metrics, which is useful for troubleshooting routing issues. The other options, while useful for other diagnostic scenarios, do not provide the routing table information that the administrator needs in this situation.

The correct answer is 802.11h. This amendment to the 802.11 standard was specifically created to manage spectrum and power in the 5 GHz band to avoid interference with other systems, such as military, weather, or satellite radar. It accomplishes this using Dynamic Frequency Selection (DFS), which detects radar signals and moves the Wi-Fi network to a clear channel, and Transmit Power Control (TPC), which adjusts signal strength to the minimum necessary. 802.11i is incorrect as it deals with security enhancements (WPA2). 802.11e is incorrect because it focuses on Quality of Service (QoS) for traffic prioritization. 802.11ac is a wireless networking protocol, and while devices using it in the 5 GHz band must adhere to 802.11h regulations, 802.11h is the standard that specifically defines the DFS and TPC mechanisms.

SNMPv3 is the correct choice because it provides enhanced security features including authentication, encryption, and access control, which are not supported by earlier versions like SNMPv1 and SNMPv2c. SNMPv1 and SNMPv2c do not include mechanisms for securing SNMP traffic, making them less suitable for environments where security is a concern.

Static routing involves manual entry of routes into a network router's routing table by the network administrator. This method depends on pre-determined paths set by the admin and does not change unless manually updated. This contrasts with dynamic routing where routes are automatically updated based on changes in the network.

The BSSID uniquely identifies each access point in a WLAN. It is a 48-bit identifier that follows MAC address conventions and allows client devices and administrators to distinguish between multiple access points broadcasting the same SSID. The SSID, by contrast, is the user-visible network name. While the BSSID is included in beacon and management frames, its primary purpose is identification, not capacity planning or direct security enforcement.

Increasing the wireless coverage might not directly address the high number of clients disconnecting if the area coverage is already sufficient. Adjusting the data rates requires assessing if slow data rates are the actual cause of disassociation, which is not directly implied. Replacing the antenna would depend on whether the existing ones are faulty or unsuitable for the environment, which isn't suggested by the given scenario. Adding an additional access point addresses the issue by reducing the load on a single access point, thus likely decreasing the frequency of disconnections during peak hours. This aligns with managing network congestion and ensuring adequate service delivery for all connected clients.

ARP poisoning is performed by repeatedly sending forged ARP replies that bind the attacker's MAC address to the IP address of another device (commonly the gateway). Once the false mapping is cached, frames destined for that IP are delivered to the attacker, who can forward, modify, or drop them-creating a man-in-the-middle condition. MAC flooding (CAM-table overflow) overwhelms a switch with bogus MAC entries, encryption protects data rather than redirects it, and port-security configurations restrict device access; none of these describe how ARP poisoning functions.