At which OSI layer do cables, connectors, radio signals, and raw bits belong?

Layer 1 — Physical. It moves bits across the medium and defines electrical, optical, radio, connector, and signaling details.

A LAN needs forwarding by MAC address, while traffic between IP networks needs forwarding by destination IP. Which appliances fit each job?

A switch handles the LAN forwarding; a router connects the IP networks. A switch learns Layer 2 MAC addresses, while a router selects Layer 3 paths.

What does a virtual private cloud provide?

An isolated logical network in a cloud. You choose address ranges, subnets, routes, gateways, and traffic controls while logical boundaries separate tenants on shared provider infrastructure.

Which well-known ports does FTP use, and why are there two?

TCP 21 for control and TCP 20 for the traditional active-mode data channel. FTP is unencrypted; secure file transfer normally uses a different protocol such as SFTP.

When is single-mode fiber preferred over multimode fiber?

For longer distances and higher reach. Single-mode uses a smaller core and typically a laser source; multimode is common for shorter links and usually costs less at the endpoints.

What is the main operational tradeoff of a star topology?

A single access link failure usually affects one node, but failure of the central device can affect the whole star. Centralization also makes changes and fault isolation simpler.

Which three IPv4 ranges are reserved for private networks by RFC 1918?

10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Public routers should not treat these as globally routable destination space.

How do SDN, SD-WAN, and NFV differ?

SDN separates programmable control from data forwarding across a network. SD-WAN applies that approach to WAN overlays, using central policy and path conditions to steer traffic across transports. NFV runs network functions as software instead of tying each one to a dedicated appliance.

At which OSI layer are Ethernet frames, MAC addresses, and switching decisions handled?

Layer 2 — Data Link. It packages bits into frames and delivers them across a local link using hardware addresses and link-level control.

How does an IPS differ from an IDS in the traffic path?

An IPS sits inline and can block traffic; an IDS detects and alerts from observed traffic. Inline enforcement adds prevention but also makes availability and tuning more important.

In a typical VPC, how do a security group and a network ACL differ?

A security group filters traffic at a resource interface and is usually stateful; a network ACL filters at the subnet boundary and is stateless. Exact behavior is provider-specific, so verify the platform.

Which ports distinguish SSH/SFTP from Telnet?

SSH and SFTP use TCP 22; Telnet uses TCP 23. SSH encrypts the session, while Telnet sends the session without that protection.

What is a direct-attach copper cable in a data-center link?

A short twinax assembly with transceiver ends fixed to the cable. It is a low-power, low-latency option for nearby switches and servers, but its reach is limited.

Why does a spine-and-leaf fabric suit east-west data-center traffic?

Every leaf connects to every spine, giving a predictable small hop count between endpoints. Adding spines or leaves scales capacity without building a long hierarchical path.

A Windows host self-assigns 169.254.24.8/16. What does that suggest?

APIPA/link-local addressing. The host did not obtain its intended IPv4 configuration, commonly because DHCP was unavailable; the address works only on the local link.

How do VXLAN and data center interconnect relate?

VXLAN carries Layer 2 overlays across an IP underlay; data center interconnect (DCI) links separate data-center sites. A DCI design can extend selected VXLAN segments or exchange routed reachability between sites, but DCI is the inter-site function, not a synonym for VXLAN.

At which OSI layer do IP addressing and routing belong?

Layer 3 — Network. It provides logical addressing and selects paths across interconnected networks.

What is the difference between a forward proxy and a reverse proxy?

A forward proxy acts for clients reaching servers; a reverse proxy acts in front of servers receiving client requests. Both can mediate, filter, cache, or hide the systems behind them.

A private cloud subnet needs outbound internet access without accepting unsolicited inbound connections. Which gateway fits?

A NAT gateway. It translates outbound flows for private addresses and permits return traffic for those flows; an internet gateway alone does not make a private-addressed host reachable.

Which well-known ports map to SMTP and DNS?

SMTP uses TCP 25 for server-to-server mail transfer; DNS uses UDP or TCP 53. DNS commonly uses UDP for ordinary queries and TCP when required by size or operation.

Why is plenum-rated cable required in some air-handling spaces?

Its jacket is designed for stricter flame-spread and smoke requirements. Local fire and building codes decide where it is required; ordinary PVC-jacket cable may not be acceptable there.

What are the three layers in the classic three-tier campus design?

Access, distribution, and core. Access connects endpoints, distribution aggregates access and applies policy, and the core provides fast resilient transport between distribution blocks.

What does the IPv4 loopback range test?

The local host's IP stack. The range is 127.0.0.0/8, with 127.0.0.1 commonly used as localhost; packets never need to reach a physical network.

What trust assumption does zero trust architecture reject?

It rejects implicit trust based only on network location or ownership. Access is evaluated for the user, device, resource, and context, then limited to what policy allows.

At which OSI layer do TCP and UDP ports, segmentation, and end-to-end transport belong?

Layer 4 — Transport. It identifies application endpoints with ports and provides transport behavior such as reliable streams with TCP or datagrams with UDP.

How do NAS and SAN present storage differently?

NAS presents shared files over the network; a SAN presents block storage to hosts. NAS fits file sharing, while SAN-attached storage looks more like a locally attached disk to the server.

How do SaaS, PaaS, and IaaS divide customer responsibility?

SaaS supplies the finished application, PaaS supplies an application platform, and IaaS supplies virtualized compute/network/storage. Customer control and operational responsibility generally increase from SaaS to PaaS to IaaS.

Which ports map to DHCP, TFTP, and HTTP?

DHCP uses UDP 67/68, TFTP uses UDP 69, and HTTP uses TCP 80. DHCP separates server and client ports; TFTP is a simple unauthenticated transfer protocol.

What is the practical difference between SFP and QSFP form factors?

SFP is a small pluggable transceiver family for one link lane; QSFP groups four lanes in a compact module. The suffix and module specification, not the shape alone, determine supported speed and medium.

In data-center terminology, how do north-south and east-west traffic differ?

North-south traffic enters or leaves the data center; east-west traffic moves between internal systems. The distinction helps choose firewall, load-balancing, and fabric capacity placement.

A /27 IPv4 subnet has how many addresses and normally how many usable host addresses?

32 total and 30 normally usable. Five host bits remain, so 2^5 = 32; the network and broadcast addresses are not assigned to ordinary hosts.

How does SSE relate to SASE?

SSE is the cloud-delivered security-services portion; SASE combines those security services with wide-area networking. Implementations vary, but SASE joins connectivity and policy closer to users and resources.

At which OSI layer are sessions established, coordinated, and torn down?

Layer 5 — Session. The conceptual layer manages dialogs and checkpoints between applications, even though real protocol stacks often combine its work with other layers.

How do an autonomous access point and a controller-based access point differ?

An autonomous AP holds its own control configuration; a lightweight AP relies on a controller for centralized policy and coordination. Controller designs simplify consistent changes across many APs.

How do public, private, and hybrid cloud deployment models differ?

Public cloud uses provider-operated shared infrastructure, private cloud is dedicated to one organization, and hybrid connects private and public environments for a combined design.

Which ports map to NTP and SNMP?

NTP uses UDP 123. SNMP queries commonly use UDP 161, while notifications such as traps commonly use UDP 162.

Which common fiber connectors are push-pull, small-form-factor latch, bayonet, and multifiber?

SC is push-pull, LC is the smaller latched connector, ST uses a bayonet twist, and MPO carries multiple fibers in one connector. Always match polish, fiber type, and transceiver requirements too.

What makes a hybrid topology different from a mesh topology?

A hybrid combines two or more topology patterns; a mesh emphasizes multiple interconnections and alternate paths among nodes. A design can be both hybrid and partially meshed.

Which first-octet ranges identify the historical IPv4 classes A through E, and how do CIDR and VLSM differ from that model?

Class A is 1–126 with a default /8, Class B is 128–191 with /16, and Class C is 192–223 with /24; these were classful unicast ranges. Class D is 224–239 for multicast, while Class E is 240–255 and reserved. The 0/8 and 127/8 blocks are special. Modern CIDR uses explicit prefixes, and VLSM lets subnets use different prefix lengths instead of fixed class boundaries.

What operational problem does infrastructure as code solve?

It makes infrastructure definitions repeatable, reviewable, and versioned. Templates and automation reduce manual drift, while source control exposes changes, conflicts, and rollback history.

Which OSI layer handles data representation tasks such as format translation, compression, and encryption?

Layer 6 — Presentation. It describes how applications agree on representation, though modern protocol suites often place these functions inside application protocols or libraries.

How do cloud scalability and elasticity differ?

Scalability is the ability to handle growth by adding resources; elasticity adjusts resources up or down with demand. Elasticity emphasizes timely, often automatic, resizing.

Which ports map to LDAP, HTTPS, and SMB?

LDAP uses TCP/UDP 389, HTTPS uses TCP 443, and SMB commonly uses TCP 445. Encryption depends on the protocol and configuration, not merely on reaching a familiar port.

Which connector is typical for Ethernet twisted pair, and which two appear on common coax runs?

RJ45 is typical for Ethernet twisted pair; F-type and BNC are common coax connectors. RJ11 is smaller and is commonly associated with telephone cabling.

At which OSI layer do user-facing network services such as HTTP and DNS sit?

Layer 7 — Application. It is the top conceptual layer where network services are exposed to applications and users.

Why can a content delivery network reduce page latency?

It serves cacheable content from distributed edge locations closer to users. The shorter path and offloaded origin reduce delay and origin demand when caching rules fit the content.

Which ports map to Syslog, secure mail submission, and LDAPS in the N10-009 blueprint?

Syslog uses 514, secure SMTP submission uses 587, and LDAPS uses 636. Transport details can vary by implementation, so the blueprint associations are the exam-study anchor.

Why must Ethernet cable category and link speed be checked together?

A link can only meet its target speed and distance when the cable, connectors, termination, and interfaces support the same standard. A higher category label does not repair bad installation work.

Which ports map to SQL Server, RDP, and SIP?

SQL Server uses TCP 1433, RDP uses TCP/UDP 3389, and SIP uses 5060/5061. SIP 5061 is commonly associated with TLS-protected signaling.

When should a network use QoS rather than simply adding a VLAN?

Use QoS when traffic needs classification, queuing, or priority under contention. A VLAN separates broadcast domains; it does not by itself reserve bandwidth or prioritize delay-sensitive traffic.

What reliability features does TCP add that UDP does not?

TCP establishes a connection and provides ordered delivery, acknowledgments, retransmission, and flow control. UDP sends independent datagrams with less transport overhead and no delivery guarantee.

CompTIA Network+ N10-009 Flashcards: Concepts, Operations & Troubleshooting

Prepare for CompTIA Network+ N10-009 with 250 original cards covering all five domains through focused recall, configuration choices, operations decisions, security, and troubleshooting scenarios.

من إعداد Open Study Contributor

ادرس هذه الرزمة مجانًا

سيفتح تطبيق Flashcards لتبدأ الدراسة.

تفاصيل الرزمة

البطاقات: ٢٥٠ بطاقة
الإصدار: ١
تاريخ النشر: ١٢ سبتمبر ٢٠٢٦
آخر تحديث: ١٢ سبتمبر ٢٠٢٦
الترخيص: Common knowledge · CC0 1.0
لغات الجمهور: en
المادة: Computer networking
المستوى: Early-career IT networking
الوسوم: network-plus-n10-009, concepts, implementation, operations, security, troubleshooting

رزم مشابهة

حول هذه الرزمة

Study the current CompTIA Network+ N10-009 blueprint with 250 original English flashcards organized to match the official five-domain weighting. The deck moves from networking models, protocols, cloud, addressing, and media into routing, switching, wireless design, physical installation, operations, security, and troubleshooting.

Short recall cards anchor stable facts such as ports and address ranges. Scenario prompts then ask you to choose a configuration, interpret evidence, select a control or tool, and decide the next diagnostic action. Explanations state the answer first and add practical context without imitating multiple-choice exam items.

Scope and technical details were checked against primary references from IANA, the RFC Editor, IEEE, NIST, Microsoft, AWS, and Cisco. The original questions, answers, organization, and generated cover are released under CC0 1.0 to the extent applicable rights exist.

Separate reverse cards appear only when both recall directions are useful. The deck excludes mechanical acronym-to-expansion cards, every possible port-to-protocol reversal, redundant permutations of the same comparison, and hands-on mappings for packet inspection, cable handling, device configuration, or full performance-based practice; those skills need live equipment or labs.

This independent, unofficial study deck is not affiliated with, sponsored by, or endorsed by CompTIA. No real exam questions, answer keys, or verbatim objective text were copied, and the deck does not guarantee a passing result. Check the official N10-009 exam objectives for the authoritative requirements.

بطاقات هذه الرزمة

البطاقة ١
السؤال
At which OSI layer do cables, connectors, radio signals, and raw bits belong?
الإجابة
Layer 1 — Physical. It moves bits across the medium and defines electrical, optical, radio, connector, and signaling details.
البطاقة ٢
السؤال
A LAN needs forwarding by MAC address, while traffic between IP networks needs forwarding by destination IP. Which appliances fit each job?
الإجابة
A switch handles the LAN forwarding; a router connects the IP networks. A switch learns Layer 2 MAC addresses, while a router selects Layer 3 paths.
البطاقة ٣
السؤال
What does a virtual private cloud provide?
الإجابة
An isolated logical network in a cloud. You choose address ranges, subnets, routes, gateways, and traffic controls while logical boundaries separate tenants on shared provider infrastructure.
البطاقة ٤
السؤال
Which well-known ports does FTP use, and why are there two?
الإجابة
TCP 21 for control and TCP 20 for the traditional active-mode data channel. FTP is unencrypted; secure file transfer normally uses a different protocol such as SFTP.
البطاقة ٥
السؤال
When is single-mode fiber preferred over multimode fiber?
الإجابة
For longer distances and higher reach. Single-mode uses a smaller core and typically a laser source; multimode is common for shorter links and usually costs less at the endpoints.
البطاقة ٦
السؤال
What is the main operational tradeoff of a star topology?
الإجابة
A single access link failure usually affects one node, but failure of the central device can affect the whole star. Centralization also makes changes and fault isolation simpler.
البطاقة ٧
السؤال
Which three IPv4 ranges are reserved for private networks by RFC 1918?
الإجابة
10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Public routers should not treat these as globally routable destination space.
البطاقة ٨
السؤال
How do SDN, SD-WAN, and NFV differ?
الإجابة
SDN separates programmable control from data forwarding across a network. SD-WAN applies that approach to WAN overlays, using central policy and path conditions to steer traffic across transports. NFV runs network functions as software instead of tying each one to a dedicated appliance.
البطاقة ٩
السؤال
At which OSI layer are Ethernet frames, MAC addresses, and switching decisions handled?
الإجابة
Layer 2 — Data Link. It packages bits into frames and delivers them across a local link using hardware addresses and link-level control.
البطاقة ١٠
السؤال
How does an IPS differ from an IDS in the traffic path?
الإجابة
An IPS sits inline and can block traffic; an IDS detects and alerts from observed traffic. Inline enforcement adds prevention but also makes availability and tuning more important.
البطاقة ١١
السؤال
In a typical VPC, how do a security group and a network ACL differ?
الإجابة
A security group filters traffic at a resource interface and is usually stateful; a network ACL filters at the subnet boundary and is stateless. Exact behavior is provider-specific, so verify the platform.
البطاقة ١٢
السؤال
Which ports distinguish SSH/SFTP from Telnet?
الإجابة
SSH and SFTP use TCP 22; Telnet uses TCP 23. SSH encrypts the session, while Telnet sends the session without that protection.
البطاقة ١٣
السؤال
What is a direct-attach copper cable in a data-center link?
الإجابة
A short twinax assembly with transceiver ends fixed to the cable. It is a low-power, low-latency option for nearby switches and servers, but its reach is limited.
البطاقة ١٤
السؤال
Why does a spine-and-leaf fabric suit east-west data-center traffic?
الإجابة
Every leaf connects to every spine, giving a predictable small hop count between endpoints. Adding spines or leaves scales capacity without building a long hierarchical path.
البطاقة ١٥
السؤال
A Windows host self-assigns 169.254.24.8/16. What does that suggest?
الإجابة
APIPA/link-local addressing. The host did not obtain its intended IPv4 configuration, commonly because DHCP was unavailable; the address works only on the local link.
البطاقة ١٦
السؤال
How do VXLAN and data center interconnect relate?
الإجابة
VXLAN carries Layer 2 overlays across an IP underlay; data center interconnect (DCI) links separate data-center sites. A DCI design can extend selected VXLAN segments or exchange routed reachability between sites, but DCI is the inter-site function, not a synonym for VXLAN.
البطاقة ١٧
السؤال
At which OSI layer do IP addressing and routing belong?
الإجابة
Layer 3 — Network. It provides logical addressing and selects paths across interconnected networks.
البطاقة ١٨
السؤال
What is the difference between a forward proxy and a reverse proxy?
الإجابة
A forward proxy acts for clients reaching servers; a reverse proxy acts in front of servers receiving client requests. Both can mediate, filter, cache, or hide the systems behind them.
البطاقة ١٩
السؤال
A private cloud subnet needs outbound internet access without accepting unsolicited inbound connections. Which gateway fits?
الإجابة
A NAT gateway. It translates outbound flows for private addresses and permits return traffic for those flows; an internet gateway alone does not make a private-addressed host reachable.
البطاقة ٢٠
السؤال
Which well-known ports map to SMTP and DNS?
الإجابة
SMTP uses TCP 25 for server-to-server mail transfer; DNS uses UDP or TCP 53. DNS commonly uses UDP for ordinary queries and TCP when required by size or operation.
البطاقة ٢١
السؤال
Why is plenum-rated cable required in some air-handling spaces?
الإجابة
Its jacket is designed for stricter flame-spread and smoke requirements. Local fire and building codes decide where it is required; ordinary PVC-jacket cable may not be acceptable there.
البطاقة ٢٢
السؤال
What are the three layers in the classic three-tier campus design?
الإجابة
Access, distribution, and core. Access connects endpoints, distribution aggregates access and applies policy, and the core provides fast resilient transport between distribution blocks.
البطاقة ٢٣
السؤال
What does the IPv4 loopback range test?
الإجابة
The local host's IP stack. The range is 127.0.0.0/8, with 127.0.0.1 commonly used as localhost; packets never need to reach a physical network.
البطاقة ٢٤
السؤال
What trust assumption does zero trust architecture reject?
الإجابة
It rejects implicit trust based only on network location or ownership. Access is evaluated for the user, device, resource, and context, then limited to what policy allows.
البطاقة ٢٥
السؤال
At which OSI layer do TCP and UDP ports, segmentation, and end-to-end transport belong?
الإجابة
Layer 4 — Transport. It identifies application endpoints with ports and provides transport behavior such as reliable streams with TCP or datagrams with UDP.
البطاقة ٢٦
السؤال
How do NAS and SAN present storage differently?
الإجابة
NAS presents shared files over the network; a SAN presents block storage to hosts. NAS fits file sharing, while SAN-attached storage looks more like a locally attached disk to the server.
البطاقة ٢٧
السؤال
How do SaaS, PaaS, and IaaS divide customer responsibility?
الإجابة
SaaS supplies the finished application, PaaS supplies an application platform, and IaaS supplies virtualized compute/network/storage. Customer control and operational responsibility generally increase from SaaS to PaaS to IaaS.
البطاقة ٢٨
السؤال
Which ports map to DHCP, TFTP, and HTTP?
الإجابة
DHCP uses UDP 67/68, TFTP uses UDP 69, and HTTP uses TCP 80. DHCP separates server and client ports; TFTP is a simple unauthenticated transfer protocol.
البطاقة ٢٩
السؤال
What is the practical difference between SFP and QSFP form factors?
الإجابة
SFP is a small pluggable transceiver family for one link lane; QSFP groups four lanes in a compact module. The suffix and module specification, not the shape alone, determine supported speed and medium.
البطاقة ٣٠
السؤال
In data-center terminology, how do north-south and east-west traffic differ?
الإجابة
North-south traffic enters or leaves the data center; east-west traffic moves between internal systems. The distinction helps choose firewall, load-balancing, and fabric capacity placement.
البطاقة ٣١
السؤال
A /27 IPv4 subnet has how many addresses and normally how many usable host addresses?
الإجابة
32 total and 30 normally usable. Five host bits remain, so 2^5 = 32; the network and broadcast addresses are not assigned to ordinary hosts.
البطاقة ٣٢
السؤال
How does SSE relate to SASE?
الإجابة
SSE is the cloud-delivered security-services portion; SASE combines those security services with wide-area networking. Implementations vary, but SASE joins connectivity and policy closer to users and resources.
البطاقة ٣٣
السؤال
At which OSI layer are sessions established, coordinated, and torn down?
الإجابة
Layer 5 — Session. The conceptual layer manages dialogs and checkpoints between applications, even though real protocol stacks often combine its work with other layers.
البطاقة ٣٤
السؤال
How do an autonomous access point and a controller-based access point differ?
الإجابة
An autonomous AP holds its own control configuration; a lightweight AP relies on a controller for centralized policy and coordination. Controller designs simplify consistent changes across many APs.
البطاقة ٣٥
السؤال
How do public, private, and hybrid cloud deployment models differ?
الإجابة
Public cloud uses provider-operated shared infrastructure, private cloud is dedicated to one organization, and hybrid connects private and public environments for a combined design.
البطاقة ٣٦
السؤال
Which ports map to NTP and SNMP?
الإجابة
NTP uses UDP 123. SNMP queries commonly use UDP 161, while notifications such as traps commonly use UDP 162.
البطاقة ٣٧
السؤال
Which common fiber connectors are push-pull, small-form-factor latch, bayonet, and multifiber?
الإجابة
SC is push-pull, LC is the smaller latched connector, ST uses a bayonet twist, and MPO carries multiple fibers in one connector. Always match polish, fiber type, and transceiver requirements too.
البطاقة ٣٨
السؤال
What makes a hybrid topology different from a mesh topology?
الإجابة
A hybrid combines two or more topology patterns; a mesh emphasizes multiple interconnections and alternate paths among nodes. A design can be both hybrid and partially meshed.
البطاقة ٣٩
السؤال
Which first-octet ranges identify the historical IPv4 classes A through E, and how do CIDR and VLSM differ from that model?
الإجابة
Class A is 1–126 with a default /8, Class B is 128–191 with /16, and Class C is 192–223 with /24; these were classful unicast ranges. Class D is 224–239 for multicast, while Class E is 240–255 and reserved. The 0/8 and 127/8 blocks are special. Modern CIDR uses explicit prefixes, and VLSM lets subnets use different prefix lengths instead of fixed class boundaries.
البطاقة ٤٠
السؤال
What operational problem does infrastructure as code solve?
الإجابة
It makes infrastructure definitions repeatable, reviewable, and versioned. Templates and automation reduce manual drift, while source control exposes changes, conflicts, and rollback history.
البطاقة ٤١
السؤال
Which OSI layer handles data representation tasks such as format translation, compression, and encryption?
الإجابة
Layer 6 — Presentation. It describes how applications agree on representation, though modern protocol suites often place these functions inside application protocols or libraries.
البطاقة ٤٢
السؤال
How do cloud scalability and elasticity differ?
الإجابة
Scalability is the ability to handle growth by adding resources; elasticity adjusts resources up or down with demand. Elasticity emphasizes timely, often automatic, resizing.
البطاقة ٤٣
السؤال
Which ports map to LDAP, HTTPS, and SMB?
الإجابة
LDAP uses TCP/UDP 389, HTTPS uses TCP 443, and SMB commonly uses TCP 445. Encryption depends on the protocol and configuration, not merely on reaching a familiar port.
البطاقة ٤٤
السؤال
Which connector is typical for Ethernet twisted pair, and which two appear on common coax runs?
الإجابة
RJ45 is typical for Ethernet twisted pair; F-type and BNC are common coax connectors. RJ11 is smaller and is commonly associated with telephone cabling.
البطاقة ٤٥
السؤال
At which OSI layer do user-facing network services such as HTTP and DNS sit?
الإجابة
Layer 7 — Application. It is the top conceptual layer where network services are exposed to applications and users.
البطاقة ٤٦
السؤال
Why can a content delivery network reduce page latency?
الإجابة
It serves cacheable content from distributed edge locations closer to users. The shorter path and offloaded origin reduce delay and origin demand when caching rules fit the content.
البطاقة ٤٧
السؤال
Which ports map to Syslog, secure mail submission, and LDAPS in the N10-009 blueprint?
الإجابة
Syslog uses 514, secure SMTP submission uses 587, and LDAPS uses 636. Transport details can vary by implementation, so the blueprint associations are the exam-study anchor.
البطاقة ٤٨
السؤال
Why must Ethernet cable category and link speed be checked together?
الإجابة
A link can only meet its target speed and distance when the cable, connectors, termination, and interfaces support the same standard. A higher category label does not repair bad installation work.
البطاقة ٤٩
السؤال
Which ports map to SQL Server, RDP, and SIP?
الإجابة
SQL Server uses TCP 1433, RDP uses TCP/UDP 3389, and SIP uses 5060/5061. SIP 5061 is commonly associated with TLS-protected signaling.
البطاقة ٥٠
السؤال
When should a network use QoS rather than simply adding a VLAN?
الإجابة
Use QoS when traffic needs classification, queuing, or priority under contention. A VLAN separates broadcast domains; it does not by itself reserve bandwidth or prioritize delay-sensitive traffic.
البطاقة ٥١
السؤال
What reliability features does TCP add that UDP does not?
الإجابة
TCP establishes a connection and provides ordered delivery, acknowledgments, retransmission, and flow control. UDP sends independent datagrams with less transport overhead and no delivery guarantee.
البطاقة ٥٢
السؤال
What does ICMP provide to IP networks?
الإجابة
Control and error-reporting messages, including echo request/reply used by ping. ICMP supports diagnosis and network operation; it is not an application data transport like TCP or UDP.
البطاقة ٥٣
السؤال
What problem does GRE solve, and what does it not provide by itself?
الإجابة
GRE encapsulates one network-layer protocol inside another to form a tunnel. It does not provide encryption or integrity by itself, so protected designs pair it with a security mechanism such as IPsec.
البطاقة ٥٤
السؤال
In IPsec, what are the jobs of AH, ESP, and IKE?
الإجابة
AH authenticates packet data without encrypting the payload; ESP can provide confidentiality plus integrity/authentication; IKE negotiates security associations and keys.
البطاقة ٥٥
السؤال
How do unicast, multicast, broadcast, and anycast choose recipients?
الإجابة
Unicast targets one interface, multicast targets subscribed group members, broadcast targets the local IPv4 broadcast domain, and anycast reaches one member of a group—normally the closest by routing.
البطاقة ٥٦
السؤال
What happens when a router reduces an IP packet's TTL or hop limit to zero?
الإجابة
The router discards the packet and normally sends an ICMP time-exceeded message. This prevents a routing loop from circulating a packet forever and enables traceroute-style path discovery.
البطاقة ٥٧
السؤال
Why does IPv6 reduce pressure from IPv4 address exhaustion?
الإجابة
IPv6 expands addresses from 32 bits to 128 bits, providing vastly more unique address space. It also supports simpler autoconfiguration, but migration still requires routing, security, and application readiness.
البطاقة ٥٨
السؤال
How do dual stack, tunneling, and NAT64 help an IPv6 transition?
الإجابة
Dual stack runs IPv4 and IPv6 together, tunneling carries one protocol through the other network, and NAT64 translates between IPv6 clients and IPv4 services. Each solves a different compatibility gap.
البطاقة ٥٩
السؤال
When is a static route more suitable than a dynamic routing protocol?
الإجابة
When the path is simple, stable, and intentionally controlled, such as a default route from a small branch. Static routes add no routing-protocol traffic but require manual updates when topology changes.
البطاقة ٦٠
السؤال
What problem does a VLAN solve on a switched network?
الإجابة
It creates a separate Layer 2 broadcast domain on shared switching hardware. Devices in different VLANs need Layer 3 routing to communicate, even if they use the same physical switch.
البطاقة ٦١
السؤال
What tradeoff comes with using a wider Wi-Fi channel?
الإجابة
A wider channel can carry more data under good conditions but consumes more spectrum and leaves fewer nonoverlapping choices. In a crowded area, narrower channels can improve reuse and stability.
البطاقة ٦٢
السؤال
How do an MDF and an IDF differ in structured cabling?
الإجابة
The main distribution frame is the building's primary cross-connect and service-entry area; an intermediate distribution frame serves a floor or zone and uplinks to the MDF.
البطاقة ٦٣
السؤال
What do RIP, OSPF, EIGRP, and BGP broadly represent?
الإجابة
RIP is distance-vector, OSPF is link-state, EIGRP is an advanced distance-vector protocol, and BGP is a path-vector interdomain protocol. Their design scope and route-selection inputs differ.
البطاقة ٦٤
السؤال
What is a switched virtual interface used for?
الإجابة
An SVI gives a VLAN a Layer 3 interface on a multilayer switch. It can be the hosts' default gateway and route traffic between VLANs when routing is enabled.
البطاقة ٦٥
السؤال
How should 2.4 GHz, 5 GHz, and 6 GHz influence Wi-Fi design?
الإجابة
2.4 GHz usually reaches farther but has less clean spectrum; 5 GHz offers more channels and capacity with shorter reach; 6 GHz adds cleaner spectrum for supported clients but requires compatible radios and security settings.
البطاقة ٦٦
السؤال
What does one rack unit measure?
الإجابة
1U is 1.75 inches, or 44.45 millimeters, of vertical rack space. A 2U device occupies twice that height, but depth, power, cooling, and rail compatibility still need separate checks.
البطاقة ٦٧
السؤال
When several routes match a destination, which prefix does the router prefer first?
الإجابة
The longest matching prefix—the most specific route. Only after comparing equally specific candidates do protocol preference and metric normally decide among them.
البطاقة ٦٨
السؤال
What is the native VLAN on an 802.1Q trunk?
الإجابة
It is the VLAN associated with untagged frames on that trunk. Both ends should agree on it; a mismatch can leak traffic into the wrong broadcast domain and create confusing control-plane behavior.
البطاقة ٦٩
السؤال
What does band steering try to accomplish on a dual- or tri-band WLAN?
الإجابة
It encourages capable clients toward the preferred band, often 5 or 6 GHz, to reduce 2.4 GHz congestion. The client still influences the final association decision.
البطاقة ٧٠
السؤال
Why should network racks use a planned front-to-back airflow path?
الإجابة
It keeps cool intake air separate from hot exhaust and reduces recirculation. Correct device orientation, blanking panels, temperature monitoring, and unobstructed aisles all support the airflow plan.
البطاقة ٧١
السؤال
What does administrative distance compare on a router?
الإجابة
The trust preference of routes learned from different sources. Lower values are normally preferred, but the exact values are vendor-specific and are considered only after longest-prefix matching.
البطاقة ٧٢
السؤال
Why assign voice devices to a dedicated voice VLAN?
الإجابة
It separates voice traffic for policy, addressing, QoS marking, and security while allowing a phone and attached workstation to share one switch port. The switch and phone must agree on the configuration.
البطاقة ٧٣
السؤال
How do SSID, BSSID, and ESS differ?
الإجابة
The SSID is the human-facing wireless network name; the BSSID identifies a specific basic service set, commonly an AP radio; an ESS joins multiple cells under one logical WLAN for roaming.
البطاقة ٧٤
السؤال
Why terminate horizontal cabling on a patch panel instead of directly on switches?
الإجابة
Permanent cable stays fixed and labeled while short patch cords handle changes. This reduces wear on building cable and makes tracing, rearrangement, and documentation safer.
البطاقة ٧٥
السؤال
What does a routing metric decide?
الإجابة
It ranks candidate routes learned by the same routing process, using inputs such as cost, bandwidth, delay, or hop count. Lower is commonly better, but interpretation depends on the protocol.
البطاقة ٧٦
السؤال
What information does an 802.1Q tag add to an Ethernet frame?
الإجابة
It carries VLAN identification and priority information so multiple VLANs can share a trunk. The tag changes the frame format, so trunk peers must support and consistently configure it.
البطاقة ٧٧
السؤال
How does an infrastructure WLAN differ from an ad hoc WLAN and a mesh?
الإجابة
Infrastructure clients associate through APs; ad hoc peers connect directly; a mesh uses wireless links among infrastructure nodes to extend backhaul or coverage. Each topology has different scale and management tradeoffs.
البطاقة ٧٨
السؤال
How do a UPS and a PDU serve different rack-power needs?
الإجابة
A UPS provides temporary conditioned power during an outage; a PDU distributes available power to rack equipment. A metered or switched PDU may add monitoring or remote outlet control but is not a battery backup.
البطاقة ٧٩
السؤال
How do static NAT and port address translation differ?
الإجابة
Static NAT keeps a fixed one-to-one address mapping; PAT lets many inside flows share a public address by distinguishing them with transport ports. PAT conserves addresses but complicates unsolicited inbound access.
البطاقة ٨٠
السؤال
What does link aggregation provide, and what must it not be mistaken for?
الإجابة
It bundles compatible physical links into one logical link for added capacity and resilience. A single flow may still use one member, and both ends need a matching aggregation configuration.
البطاقة ٨١
السؤال
When is a point-to-point wireless link preferable to a broad coverage cell?
الإجابة
When two known sites need a focused bridge. Directional antennas can concentrate energy along the path, improving reach and reducing spill, but line-of-sight and Fresnel-zone clearance matter.
البطاقة ٨٢
السؤال
What must be checked before adding a high-power device to a rack PDU?
الإجابة
Input voltage, circuit and PDU capacity, connector type, redundancy plan, and the device's actual load. Keep continuous load within applicable electrical limits and avoid defeating redundant power paths.
البطاقة ٨٣
السؤال
What problem does a first-hop redundancy protocol solve?
الإجابة
It lets multiple routers present a shared virtual gateway address to hosts. If the active forwarder fails, another router can assume the virtual role without changing endpoint default gateways.
البطاقة ٨٤
السؤال
Why should Ethernet speed and duplex normally be configured consistently at both link ends?
الإجابة
A mismatch can cause poor throughput, late collisions, and interface errors even when the link appears up. Autonegotiation on both ends is usually safest unless the design explicitly requires matching manual settings.
البطاقة ٨٥
السؤال
How do WPA2 and WPA3 improve a WLAN compared with an open network?
الإجابة
They add authenticated encryption. WPA3 strengthens password-based authentication with SAE and requires protected management frames in standard deployments; client and AP compatibility still determines the usable mode.
البطاقة ٨٦
السؤال
Which physical controls protect a telecommunications room beyond its network configuration?
الإجابة
Locked access, cameras or access logs, fire protection, temperature and humidity monitoring, clean power, and leak detection. Physical and environmental failures bypass logical controls.
البطاقة ٨٧
السؤال
Why is BGP normally used between autonomous systems rather than as a small LAN's default routing protocol?
الإجابة
BGP exchanges reachability and path attributes between independently administered networks. It emphasizes policy and Internet-scale routing, which is unnecessary complexity for a small internal topology.
البطاقة ٨٨
السؤال
What failure does Spanning Tree Protocol prevent on redundant switched links?
الإجابة
Layer 2 loops. STP builds a loop-free logical tree and blocks redundant paths until needed, preventing broadcast storms and unstable MAC-table learning.
البطاقة ٨٩
السؤال
What should a guest WLAN isolate even when it uses a captive portal?
الإجابة
Guest clients from internal resources and usually from one another. A captive portal handles access or terms; it is not a substitute for segmentation, filtering, and protected management traffic.
البطاقة ٩٠
السؤال
What makes OSPF a link-state routing protocol?
الإجابة
Routers describe links, flood that topology information within an area, build a common link-state database, and calculate shortest paths. This differs from advertising only a distance and direction to routes.
البطاقة ٩١
السؤال
Why can enabling jumbo frames on only part of a path break traffic?
الإجابة
Every relevant interface must support a compatible MTU. An oversized frame can be dropped where the path narrows, causing loss that may affect only larger packets and therefore look intermittent.
البطاقة ٩٢
السؤال
When is WPA-Enterprise preferred over a pre-shared key?
الإجابة
When users or devices need individual credentials, centralized policy, and revocation without changing one shared secret. It normally combines 802.1X/EAP with an authentication service such as RADIUS.
البطاقة ٩٣
السؤال
What operational tradeoff accompanies EIGRP in a multivendor network?
الإجابة
EIGRP can converge efficiently and use composite metrics, but support and behavior must be verified across the actual vendors. OSPF is a more common open-standard choice for broad interoperability.
البطاقة ٩٤
السؤال
Two departments share switches but must have separate broadcasts and policy. What should be configured first?
الإجابة
Separate VLANs for the departments, then Layer 3 gateways and explicit inter-VLAN policy where communication is required. Physical separation is not necessary for basic broadcast isolation.
البطاقة ٩٥
السؤال
How do omnidirectional and directional antennas change a wireless design?
الإجابة
An omnidirectional antenna spreads coverage broadly around it; a directional antenna concentrates energy into a narrower area. Placement, gain, polarization, and local power limits all affect the usable cell.
البطاقة ٩٦
السؤال
A routing table has 10.0.0.0/8, 10.4.0.0/16, and a default route. Which entry handles 10.4.7.9?
الإجابة
10.4.0.0/16 because it is the longest matching prefix. The /8 also matches, but the more specific /16 wins; the default is used only when no more specific entry matches.
البطاقة ٩٧
السؤال
Hosts on one side of a trunk appear in the wrong VLAN only for untagged traffic. What mismatch is most likely?
الإجابة
A native VLAN mismatch. Check both trunk endpoints, allowed VLANs, and whether the design expects untagged frames before changing the configuration.
البطاقة ٩٨
السؤال
When does a controller-based WLAN offer more value than autonomous APs?
الإجابة
When many APs need consistent configuration, radio coordination, roaming support, monitoring, and centralized policy. A small isolated site may accept autonomous management to avoid controller complexity.
البطاقة ٩٩
السؤال
Why configure a default static route at a single-exit branch?
الإجابة
It directs all otherwise unknown destinations toward the upstream router with one simple entry. The route should be monitored or paired with failover logic if the branch has another possible exit.
البطاقة ١٠٠
السؤال
A link aggregation loses one member but stays up. What should happen to traffic and capacity?
الإجابة
Traffic should be redistributed across the remaining members, while total available capacity falls. Verify the bundle state at both ends because a one-sided member can create loss or an unintended separate path.
البطاقة ١٠١
السؤال
Why are channels 1, 6, and 11 commonly chosen for 20 MHz 2.4 GHz Wi-Fi in many regulatory domains?
الإجابة
Their channel centers avoid overlap under the common 20 MHz plan, improving reuse compared with adjacent channels. Confirm local regulations and the actual channel width before applying that rule.
البطاقة ١٠٢
السؤال
What does router-on-a-stick require between a switch and router?
الإجابة
An 802.1Q trunk to router subinterfaces, with one subinterface and gateway address per VLAN. The single physical link can become a bandwidth and availability bottleneck.
البطاقة ١٠٣
السؤال
How does STP choose the root bridge and a switch's preferred path toward it?
الإجابة
The lowest bridge ID becomes root; non-root switches select the path with the lowest root path cost, then use tie-breakers if needed. Intentional bridge priorities make the topology predictable.
البطاقة ١٠٤
السؤال
A 6 GHz-capable WLAN has excellent spectrum but older clients cannot see it. What is the correct design response?
الإجابة
Keep a compatible 2.4 or 5 GHz service for older clients and use 6 GHz for capable devices. Do not weaken the 6 GHz security model merely to support legacy hardware.
البطاقة ١٠٥
السؤال
A router learns the same prefix from OSPF and a static route. Which two controls decide the winner after prefix length?
الإجابة
Administrative distance chooses between route sources; the relevant metric chooses among comparable routes within a source. Exact preference values and equal-cost behavior depend on the platform.
البطاقة ١٠٦
السؤال
Large storage transfers fail across one switch while small pings work. Which switching setting deserves comparison end to end?
الإجابة
The MTU/jumbo-frame setting. Compare host, switch, routed interface, and tunnel overhead across the full path; a single smaller segment can drop only the larger frames.
البطاقة ١٠٧
السؤال
What WLAN design choices support roaming across several access points?
الإجابة
Consistent SSID and security policy, adequate overlapping coverage, noninterfering channels, coordinated AP power, and a compatible distribution network. The client ultimately decides when to roam.
البطاقة ١٠٨
السؤال
A crowded office has many neighboring APs and unstable Wi-Fi. Why might reducing channel width help?
الإجابة
Narrower channels create more reusable channel choices and reduce overlap. Peak speed per client may fall, but total reliability and airtime efficiency can improve in a dense deployment.
البطاقة ١٠٩
السؤال
When should a network document use a logical diagram instead of a physical diagram?
الإجابة
Use a logical diagram for subnets, VLANs, routing, trust zones, and data paths; use a physical diagram for devices, ports, cables, rooms, and rack placement. Mature documentation often keeps both linked.
البطاقة ١١٠
السؤال
How do SNMP polling and an SNMP trap differ?
الإجابة
Polling is a manager's scheduled request for device data; a trap is an unsolicited device notification. A MIB describes managed objects; SNMPv3 can authenticate and protect messages, unlike community-string-based SNMPv2c.
البطاقة ١١١
السؤال
How do recovery point objective and recovery time objective differ?
الإجابة
RPO is the maximum acceptable data-loss interval; RTO is the target time to restore service. A four-hour RPO concerns data age, while a one-hour RTO concerns outage duration.
البطاقة ١١٢
السؤال
What is the difference between a DHCP scope and a reservation?
الإجابة
A scope defines the address pool and options for a subnet; a reservation maps a known client identifier to a chosen address. The reserved address should not also be freely offered to other clients.
البطاقة ١١٣
السؤال
When is a site-to-site VPN preferable to a client VPN?
الإجابة
Use site-to-site for persistent connectivity between networks through gateways; use a client VPN for individual endpoints. A full tunnel carries all client traffic, a split tunnel carries selected routes, and clientless access commonly exposes specific web applications.
البطاقة ١١٤
السؤال
What does a rack diagram answer that a cable map may not?
الإجابة
A rack diagram shows device placement, rack units, and often power layout; a cable map traces endpoints, ports, media, and paths. Together they reduce search time during changes and failures.
البطاقة ١١٥
السؤال
When is flow telemetry more useful than a full packet capture?
الإجابة
Flow records are better for broad, longer-term visibility into who talked to whom, how much, and when. Packet capture is better for protocol and payload detail but consumes more storage and may contain sensitive data.
البطاقة ١١٦
السؤال
How do MTBF and MTTR describe reliability?
الإجابة
Mean time between failures estimates how long a repairable system operates between failures; mean time to repair or restore estimates recovery duration. Higher MTBF and lower MTTR generally improve availability.
البطاقة ١١٧
السؤال
Why configure both DHCP exclusions and lease duration deliberately?
الإجابة
Exclusions keep infrastructure or statically assigned addresses out of the dynamic pool; lease duration controls how long clients retain assignments. Short leases recycle addresses faster but increase DHCP activity.
البطاقة ١١٨
السؤال
What is the operational tradeoff between SSH and a device's web GUI?
الإجابة
SSH is efficient, scriptable command-line access; a GUI can make discovery and complex views easier. Both require protected management paths, strong authentication, and change logging.
البطاقة ١١٩
السؤال
Which fields make a network asset inventory useful during an incident?
الإجابة
At minimum: unique asset ID, role, owner, location, model, serial number, software version, management address, support status, and dependencies. Accurate ownership and location shorten escalation and replacement time.
البطاقة ١٢٠
السؤال
Why establish a normal performance baseline before setting alerts?
الإجابة
A baseline shows expected patterns by time and workload, so thresholds can detect meaningful deviation. Without it, alerts tend to miss gradual degradation or fire on ordinary peaks.
البطاقة ١٢١
السؤال
How do cold, warm, and hot recovery sites differ?
الإجابة
A cold site supplies space and basics, a warm site has partial systems or replicated resources, and a hot site is kept near ready for rapid failover. Faster recovery normally costs more.
البطاقة ١٢٢
السؤال
Why is a DHCP relay needed when clients and the DHCP server are on different subnets?
الإجابة
Initial client broadcasts do not cross routers. The relay receives the local broadcast and forwards the request to the server with subnet context so the server can choose the correct scope.
البطاقة ١٢٣
السؤال
What makes an API useful for network-device management?
الإجابة
It provides structured, automatable operations for reading state and applying changes. Safe use requires authentication, authorization, version awareness, idempotency where supported, error handling, and audit records.
البطاقة ١٢٤
السؤال
What should IP address management record beyond a list of assigned addresses?
الإجابة
Subnets, prefixes, VLANs, gateways, reservations, DNS/DHCP relationships, owners, locations, status, and allocation history. IPAM helps prevent overlap and exposes stale assignments.
البطاقة ١٢٥
السؤال
Why centralize network logs in a SIEM or log platform?
الإجابة
Centralization preserves searchable history and correlates events across devices, identities, and time. It only works well when clocks, source identities, retention, parsing, and access controls are reliable.
٢٥٠ بطاقة
CompTIA Network+ N10-009 Flashcards: Concepts, Operations & Troubleshooting
ادرس هذه الرزمة مجانًا
سيفتح تطبيق Flashcards لتبدأ الدراسة.
البطاقة ١٢٦
السؤال
What distinguishes high availability from disaster recovery?
الإجابة
High availability reduces interruption through redundant components and automatic failover; disaster recovery restores service after a larger disruption. Active-active nodes share work, while active-passive designs keep a standby; neither replaces tested recovery.
البطاقة ١٢٧
السؤال
How does IPv6 SLAAC give a host an address?
الإجابة
The host uses router advertisements for prefix and network information, then forms an address and checks uniqueness. SLAAC does not necessarily supply every setting an organization wants, so DHCPv6 or other mechanisms may complement it.
البطاقة ١٢٨
السؤال
How do local console access and out-of-band management differ?
الإجابة
A local console connects directly to the device and usually requires someone on-site. Out-of-band management reaches a console server or dedicated management interface through a separate management network, so remote access can survive a production-path failure. Both paths still need strict access controls.
البطاقة ١٢٩
السؤال
What should a network service-level agreement make measurable?
الإجابة
Scope, availability or performance targets, measurement method, support hours, response and restoration targets, exclusions, escalation, reporting, and remedies. Vague promises are difficult to operate or enforce.
البطاقة ١٣٠
السؤال
Why configure a switch port mirror during packet analysis?
الإجابة
It copies selected ingress or egress traffic to an analyzer without placing the analyzer inline. Oversubscription, incorrect direction, or missing VLANs can make the capture incomplete.
البطاقة ١٣١
السؤال
What does a tabletop disaster-recovery exercise test?
الإجابة
People walk through a realistic incident to expose unclear roles, missing contacts, dependency gaps, and decision bottlenecks. It validates the plan's logic but does not prove that systems can actually fail over.
البطاقة ١٣٢
السؤال
What do the common DNS records A, AAAA, CNAME, MX, TXT, NS, and PTR store?
الإجابة
A stores an IPv4 address; AAAA stores IPv6; CNAME aliases another name; MX names a mail exchanger; TXT stores text used for policies or verification; NS names an authoritative server for a zone; and PTR maps an address-domain entry back to a name.
البطاقة ١٣٣
السؤال
Why route administrator access through a jump box?
الإجابة
It concentrates entry into a hardened, monitored system with controlled tools and network reach. The jump box becomes high value, so patching, MFA, session logging, and limited privileges are essential.
البطاقة ١٣٤
السؤال
Why perform both predictive and post-deployment wireless surveys?
الإجابة
Predictive work estimates AP placement from models; the post-deployment survey measures real coverage, interference, and capacity. Walls, occupants, neighboring networks, and device behavior make field validation necessary.
البطاقة ١٣٥
السؤال
Which environmental readings should network monitoring collect in equipment spaces?
الإجابة
Temperature, humidity, power state and load, UPS health, fan status, smoke or fire signals, and water or door sensors where relevant. Thresholds should reflect the equipment and facility design.
البطاقة ١٣٦
السؤال
Why is a successful backup job not enough evidence of recoverability?
الإجابة
A backup can be incomplete, corrupted, inaccessible, or too slow to restore. Periodic restore tests verify data, credentials, procedures, dependencies, and whether recovery meets RPO and RTO.
البطاقة ١٣٧
السؤال
How do forward and reverse DNS zones differ, and how do primary, secondary, authoritative, and recursive roles fit?
الإجابة
A forward zone maps names to data such as addresses; a reverse zone uses PTR records to map addresses back to names. A primary holds the locally maintained zone data, while a secondary receives its copy through zone transfer; both can answer authoritatively for that zone. A recursive resolver follows referrals or uses cache, so its reply to a client is normally non-authoritative.
البطاقة ١٣٨
السؤال
What is the operational difference between end-of-life and end-of-support?
الإجابة
End-of-life marks a product's retirement from the vendor lifecycle; end-of-support marks when fixes or assistance stop. Exact vendor definitions vary, so record the dates and replacement risk for each asset.
البطاقة ١٣٩
السؤال
How should alert thresholds avoid both missed incidents and alert fatigue?
الإجابة
Base them on normal behavior, business impact, duration, and rate of change; use warning and critical levels plus suppression for known maintenance. Revisit thresholds after topology or workload changes.
البطاقة ١٤٠
السؤال
What must be planned before relying on a generator for network continuity?
الإجابة
Fuel, automatic transfer, startup time, load capacity, maintenance, exhaust and safety, refueling access, and UPS runtime until generation stabilizes. Regular load testing reveals failures that idle checks miss.
البطاقة ١٤١
السؤال
What protection does DNSSEC add, and what does it not add?
الإجابة
DNSSEC lets resolvers validate that signed DNS data is authentic and unmodified. It does not encrypt the query or hide the requested name; encrypted transports address that separate concern.
البطاقة ١٤٢
السؤال
What should a network change record contain before implementation?
الإجابة
Purpose, owner, affected systems, risk and impact, prerequisites, implementation steps, validation, maintenance window, communications, approvals, and rollback criteria. Afterwards, record the observed result.
البطاقة ١٤٣
السؤال
Why can a device show uptime while its service is unavailable?
الإجابة
Uptime only says the device or process has remained running. Availability includes whether users can successfully reach and use the service across all required dependencies.
البطاقة ١٤٤
السؤال
Why does disaster recovery require role succession and more than one trained operator?
الإجابة
The primary owner may be unavailable during the event. Named backups, accessible runbooks, delegated authority, and practice reduce key-person risk and prevent recovery from waiting on one individual.
البطاقة ١٤٥
السؤال
How do DNS over HTTPS and DNS over TLS protect lookups?
الإجابة
Both encrypt DNS between a client and a resolver: DoH uses HTTPS, while DoT uses a dedicated TLS service. Neither guarantees that the resolver's upstream data is correct; DNSSEC validation addresses authenticity.
البطاقة ١٤٦
السؤال
Why keep known-good network configuration backups outside the device?
الإجابة
A device failure, compromise, or bad change can destroy the running configuration. Versioned external copies support comparison, replacement, rollback, and evidence of who changed what.
البطاقة ١٤٧
السؤال
How do ad hoc and scheduled network discovery differ?
الإجابة
Ad hoc discovery is an authorized, on-demand scan for an immediate question. Scheduled discovery repeats automatically at defined intervals to keep inventory and topology data current. Either approach needs a clear scope and scan-load limits.
البطاقة ١٤٨
السؤال
What is a golden configuration, and how is it different from a performance baseline?
الإجابة
A golden configuration is an approved desired device state; a performance baseline records normal measured behavior. One detects configuration drift, while the other helps spot operational deviation.
البطاقة ١٤٩
السؤال
Which wireless metrics reveal congestion even when signal strength is good?
الإجابة
Channel utilization, retransmissions, noise, error rate, client count, airtime consumption, and latency. A strong signal does not guarantee free airtime or low interference.
البطاقة ١٥٠
السؤال
What should be documented when a network device is decommissioned?
الإجابة
Approval, service dependencies removed, configuration and logs retained as required, data sanitization, licenses, inventory status, IP/DNS updates, physical disposition, and the date and responsible owner.
البطاقة ١٥١
السؤال
Why is synchronized time essential when correlating Syslog events?
الإجابة
Investigators need a trustworthy sequence across devices. If clocks or time zones differ, related events appear out of order; synchronized sources and normalized timestamps make correlation defensible.
البطاقة ١٥٢
السؤال
How should configuration drift be handled after it is detected?
الإجابة
Compare the live state with the approved source, identify whether the difference was authorized, assess impact, then reconcile through change control. Blindly overwriting drift can remove a necessary emergency change.
البطاقة ١٥٣
السؤال
When is a network TAP or packet broker preferable to a simple switch mirror?
الإجابة
For persistent, higher-fidelity visibility or aggregation across links. TAPs and brokers can reduce dependence on switch resources, while a mirror port is simpler for bounded troubleshooting.
البطاقة ١٥٤
السؤال
A technician moves a patch cord during an outage. Which documentation must be updated before the work is considered complete?
الإجابة
The affected port and cable map, device or rack diagram if topology changed, labels, change record, and any IPAM or inventory relationship. Physical reality and documentation must agree for the next incident.
البطاقة ١٥٥
السؤال
How do NTP, PTP, and Network Time Security address time synchronization?
الإجابة
NTP provides general network time, PTP targets much tighter synchronization on suitable networks, and NTS adds cryptographic protection to NTP exchanges. Choose precision and security for the actual use case.
البطاقة ١٥٦
السؤال
What do confidentiality, integrity, and availability protect?
الإجابة
Confidentiality limits disclosure, integrity protects correctness and authorized change, and availability keeps systems usable when needed. Security decisions often trade among all three.
البطاقة ١٥٧
السؤال
How does a distributed denial-of-service attack differ from a single-source DoS attack?
الإجابة
A DDoS attack coordinates traffic or work from many sources, making simple source blocking less effective. Both aim to exhaust capacity or state so legitimate users lose service.
البطاقة ١٥٨
السؤال
Which first hardening steps reduce a new network device's attack surface?
الإجابة
Change default credentials, patch supported software, disable unused services and ports, restrict management access, use secure protocols, enable logging and time sync, and back up the approved configuration.
البطاقة ١٥٩
السؤال
How do data at rest, in transit, and in use differ?
الإجابة
At rest is stored, in transit is moving between systems, and in use is actively processed. Disk encryption, transport encryption, and runtime access controls protect different states.
البطاقة ١٦٠
السؤال
What role does a certificate authority play in PKI?
الإجابة
It signs certificates that bind public keys to identities under defined validation rules. Clients must trust the issuing chain and still check name, validity period, usage, and revocation status.
البطاقة ١٦١
السؤال
How can an attacker attempt VLAN hopping?
الإجابة
By abusing trunk negotiation or crafted tagging to reach a VLAN not intended for the access port. Disable unnecessary trunk negotiation, explicitly configure access ports, restrict allowed VLANs, and choose native VLANs carefully.
البطاقة ١٦٢
السؤال
How do NAC and 802.1X work together at a network edge?
الإجابة
802.1X controls port access using a supplicant, authenticator, and authentication server; NAC applies broader identity, device posture, and access policy. Failed endpoints may be denied or placed in a restricted segment.
البطاقة ١٦٣
السؤال
Why is MFA stronger than a password alone?
الإجابة
It requires evidence from different factor types, such as knowledge plus possession or inherence. Two passwords are not two factors, and phishing-resistant methods provide stronger protection than easily relayed codes.
البطاقة ١٦٤
السؤال
What benefit does single sign-on provide, and what new risk does it concentrate?
الإجابة
SSO reduces repeated logins and centralizes identity policy, but compromise or outage of the identity provider can affect many applications. Strong MFA, availability, logging, and limited sessions matter.
البطاقة ١٦٥
السؤال
What happens during a MAC flooding attack against a switch?
الإجابة
The attacker sends many source MAC addresses to pressure the forwarding table. If the switch begins flooding unknown unicast frames, traffic may be exposed or service degraded; port security and rate controls help.
البطاقة ١٦٦
السؤال
What can switch port security enforce?
الإجابة
It can limit which or how many MAC addresses appear on an access port and choose an action for violations. It reduces casual misuse but does not authenticate a human or prove a device is trustworthy.
البطاقة ١٦٧
السؤال
When is TACACS+ often preferred to RADIUS for device administration?
الإجابة
When granular command authorization and separate accounting for administrator actions are important. RADIUS is widely used for network access; exact encryption, transport, and vendor support should be verified.
البطاقة ١٦٨
السؤال
How do LDAP and SAML serve different identity roles?
الإجابة
LDAP accesses directory data and authentication services; SAML exchanges signed assertions for federated web sign-on. They can coexist, with an identity provider reading a directory before issuing an assertion.
البطاقة ١٦٩
السؤال
How does ARP spoofing enable an on-path position on a LAN?
الإجابة
Forged ARP messages associate the attacker's MAC address with another host's IPv4 address, often the gateway. Victims then send frames through the attacker, who can relay, inspect, modify, or drop them.
البطاقة ١٧٠
السؤال
Why is MAC filtering a weak primary access control?
الإجابة
MAC addresses are visible on the local medium and can be spoofed. Filtering can support inventory or basic policy, but authenticated access such as 802.1X provides stronger identity evidence.
البطاقة ١٧١
السؤال
How do least privilege and role-based access control reinforce each other?
الإجابة
Least privilege limits access to what work requires; RBAC grants permissions through defined job roles. Roles should be narrow, reviewed, time-bounded when practical, and separated for conflicting duties.
البطاقة ١٧٢
السؤال
How does TOTP differ from time-of-day access rules and geofencing?
الإجابة
A time-based one-time password (TOTP) derives a short-lived authentication code from a shared secret and the current time. Time-of-day rules and geofencing restrict access by schedule or location; they add context but do not prove identity. TOTP only adds another authentication factor when it is paired with a different factor.
البطاقة ١٧٣
السؤال
What is DNS cache poisoning?
الإجابة
It inserts a false DNS answer into a resolver's cache so later clients are directed incorrectly. Source validation, randomization, secure resolver operation, and DNSSEC validation reduce the risk.
البطاقة ١٧٤
السؤال
What makes encryption-key management as important as the cipher?
الإجابة
Keys must be generated, stored, distributed, rotated, revoked, recovered, and destroyed securely. A strong algorithm cannot protect data if keys are exposed, reused carelessly, or unavailable during recovery.
البطاقة ١٧٥
السؤال
How do threat, vulnerability, exploit, and risk relate?
الإجابة
A threat could cause harm, a vulnerability is a weakness, an exploit uses a weakness, and risk combines likelihood with impact. Controls reduce likelihood, impact, or both.
البطاقة ١٧٦
السؤال
Why do data locality and compliance affect network architecture?
الإجابة
Rules or contracts may restrict where data is stored, processed, inspected, or transferred. Network paths, cloud regions, logging, encryption, retention, and third parties must match those obligations.
البطاقة ١٧٧
السؤال
What symptoms suggest a rogue DHCP server?
الإجابة
Clients receive an unexpected gateway, DNS server, subnet, or lease and may lose access or route through an attacker. DHCP snooping, switch-port tracing, and comparison with the authorized scope help isolate it.
البطاقة ١٧٨
السؤال
What is the difference between a standard ACL and application-aware filtering?
الإجابة
A standard IPv4 ACL matches only the source IP address. An extended ACL can also match the destination address, IP protocol, and TCP or UDP ports. Application-aware filtering uses higher-layer context to identify applications, even when ports alone are ambiguous. Rule order and inbound or outbound direction still determine what the policy actually permits or denies.
البطاقة ١٧٩
السؤال
How does network segmentation reduce the blast radius of a compromise?
الإجابة
It separates systems into policy boundaries and permits only required flows between them. Effective segmentation needs enforcement, logging, route control, and tests that prove unintended paths are closed.
البطاقة ١٨٠
السؤال
How does an evil twin differ from any unauthorized access point?
الإجابة
An evil twin impersonates a trusted WLAN to lure clients; a rogue AP is any unauthorized AP, even without impersonation. Validate BSSIDs, certificates, location, and wired switch connections before responding.
البطاقة ١٨١
السؤال
What can URL and content filtering enforce that an IP-only rule cannot?
الإجابة
Policy based on requested domains, categories, or inspected application content. Encryption and privacy constraints can limit visibility, so filtering must be designed with endpoint, DNS, proxy, and legal controls.
البطاقة ١٨٢
السؤال
Which physical controls deter or reveal unauthorized entry to a network room?
الإجابة
Locks or badge access, visitor controls, cameras, door alarms, tamper seals, secure racks, and access logs. Controls should also preserve safe emergency access.
البطاقة ١٨٣
السؤال
What can an on-path attacker do even without fully taking a service offline?
الإجابة
Observe, delay, replay, modify, redirect, or selectively drop traffic. Mutual authentication, authenticated encryption, secure name resolution, and path monitoring limit the opportunity and impact.
البطاقة ١٨٤
السؤال
How should trusted, untrusted, and management security zones differ?
الإجابة
Each zone should have explicit allowed flows based on function and risk. The untrusted zone receives minimal access, trusted zones are not implicitly unrestricted, and management paths are tightly limited and monitored.
البطاقة ١٨٥
السؤال
What is the defensive purpose of a honeypot?
الإجابة
It is a decoy intended to attract and observe suspicious activity, creating high-signal alerts and intelligence. It must be isolated and monitored so it cannot become a pivot into production.
البطاقة ١٨٦
السؤال
Why can phishing bypass otherwise strong network controls?
الإجابة
It manipulates a person into granting access, revealing credentials, or running content through an allowed path. Training, phishing-resistant MFA, filtering, least privilege, and clear reporting reduce the risk.
البطاقة ١٨٧
السؤال
What is the purpose of a screened subnet, often called a DMZ?
الإجابة
It places public-facing services in a separate policy zone between untrusted and internal networks. Compromise of an exposed service should not grant direct access to protected internal systems.
البطاقة ١٨٨
السؤال
Why use defense in depth instead of relying on one security appliance?
الإجابة
Multiple independent controls across identity, endpoint, network, application, data, and recovery reduce single-point failure. Layers should address different attack stages and produce usable evidence.
البطاقة ١٨٩
السؤال
How can malware create a network symptom rather than only an endpoint symptom?
الإجابة
It may scan, beacon, exfiltrate, spread, consume bandwidth, alter DNS or proxy settings, or launch attacks. Correlate endpoint alerts with flows, DNS, authentication, and packet evidence.
البطاقة ١٩٠
السؤال
A firewall rule allows any source to a management port. What is the safer replacement?
الإجابة
Allow only approved administration sources through the protected management path, require strong authentication, log access, and deny other traffic. Preserve tested emergency access without exposing the port broadly.
البطاقة ١٩١
السؤال
What should a technician collect before proposing a cause for a network problem?
الإجابة
Symptoms, scope, timing, recent changes, affected and unaffected users, error messages, topology, baselines, and reproduction steps. Start by identifying the problem without assuming the first report is the root cause.
البطاقة ١٩٢
السؤال
A newly patched Ethernet port has no link. Which physical checks come before changing switch software?
الإجابة
Confirm the correct ports and cable type, seat both connectors, inspect damage and link lights, test the patch cord, and compare speed/media support. Replace one known-bad or uncertain component at a time.
البطاقة ١٩٣
السؤال
A Windows client shows 169.254.61.20 and cannot reach its gateway. What should be investigated first?
الإجابة
DHCP delivery: link/VLAN membership, relay configuration, server reachability, scope capacity, and authorization. The link-local address is evidence that the intended IPv4 lease was not obtained.
البطاقة ١٩٤
السؤال
What does a successful ping prove, and what does it leave unproven?
الإجابة
It proves an ICMP echo exchange succeeded between the tested endpoints at that moment. It does not prove DNS, the application port, authentication, throughput, or every path works.
البطاقة ١٩٥
السؤال
Users at the edge of a room report slow Wi-Fi and retries. Which RF measurements should be compared?
الإجابة
Received signal, noise floor, signal-to-noise ratio, retransmissions, data rates, and channel utilization. Low SNR, not distance alone, is the actionable radio symptom.
البطاقة ١٩٦
السؤال
After identifying a problem, how should a troubleshooting theory be formed?
الإجابة
List plausible causes and rank them by evidence, probability, risk, and ease of testing. A top-down, bottom-up, or divide-and-conquer layer approach can narrow scope; correlation and recent change are clues, not proof.
البطاقة ١٩٧
السؤال
A fiber link is down after installing new optics. Which compatibility details must match?
الإجابة
Wavelength, fiber type, reach, speed, connector and polish, lane format, and device support. Also compare transmit power and receiver sensitivity against the expected link loss.
البطاقة ١٩٨
السؤال
A user can reach a server by IP address but not by name. Which service is the leading suspect?
الإجابة
DNS. Check the client's hosts file, resolver settings, exact record, suffix/search behavior, cache, authoritative data, and resolver reachability before changing routes.
البطاقة ١٩٩
السؤال
What does traceroute reveal that ping normally does not?
الإجابة
It elicits responses from successive hop-limit values to estimate the routed path and where responses stop or change. Missing replies do not always mean forwarding stops because devices may filter or deprioritize probes.
البطاقة ٢٠٠
السؤال
Wi-Fi performance collapses when a nearby non-Wi-Fi device operates. What class of fault fits?
الإجابة
Non-802.11 interference. Use spectrum and WLAN measurements to correlate noise with the event, then remove, relocate, shield, or change band/channel rather than merely adding AP power.
البطاقة ٢٠١
السؤال
What makes a troubleshooting test useful rather than merely disruptive?
الإجابة
It should isolate one theory, have a predicted result, minimize risk, preserve evidence, and define how to reverse the change. If the theory fails, establish a new theory from the result.
البطاقة ٢٠٢
السؤال
A point-to-point link stays down even though the cable or optics match both interfaces. Which TX/RX fault should you check?
الإجابة
Check for transposed transmit and receive paths: each endpoint's TX must reach the other endpoint's RX. Correct the pair or fiber strands as the interfaces require, then confirm the path with a wiremap or fiber continuity check. Auto-MDI/MDIX can mask some copper pair swaps, but not every wiring or polarity fault.
البطاقة ٢٠٣
السؤال
Only one remote subnet is unreachable, while other routed destinations work. What should be compared?
الإجابة
The destination prefix, next hop, route source and metric, return route, relevant ACLs, and any route filtering. A broad default route can hide a missing specific route in one direction.
البطاقة ٢٠٤
السؤال
How do nslookup and dig help isolate a name-resolution problem?
الإجابة
They query DNS and show records, response status, and the responding server; dig normally exposes more protocol detail. Query both the configured resolver and an authoritative source to locate stale or missing data.
البطاقة ٢٠٥
السؤال
Many APs use overlapping channels at high power. Which symptom is likely despite strong signal bars?
الإجابة
High contention, retries, and poor airtime efficiency. Reduce overlap through channel and power planning; strong received signal does not remove co-channel or adjacent-channel competition.
البطاقة ٢٠٦
السؤال
What belongs in a troubleshooting action plan before a risky change?
الإجابة
Exact steps, owner, timing, dependencies, user and security impact, backups, validation, rollback triggers, communications, and required approval. The plan turns a likely cause into a controlled intervention.
البطاقة ٢٠٧
السؤال
What do increasing CRC errors, runts, and giants suggest on an Ethernet interface?
الإجابة
A Layer 1 or Layer 2 framing problem such as damaged media, interference, duplex trouble, bad hardware, or an MTU/frame-size issue. Compare show-interface counters at both ends and follow the time pattern before replacing equipment.
البطاقة ٢٠٨
السؤال
A host reaches local peers but nothing outside its subnet. Which setting should be checked first?
الإجابة
Its default gateway address and reachability. Then verify subnet mask/prefix, VLAN, ARP or neighbor resolution, gateway interface status, routing, and policy.
البطاقة ٢٠٩
السؤال
Which host commands expose current IP addressing on Windows and Linux?
الإجابة
Windows commonly uses ipconfig; Linux commonly uses ip address from the iproute2 suite, while ifconfig may exist on older systems. Inspect address, prefix, interface state, and default route together.
البطاقة ٢١٠
السؤال
Clients near one AP see good signal but severe adjacent-channel interference. What should change?
الإجابة
Move the APs to a valid nonoverlapping channel plan, reconsider channel width, and tune transmit power. Confirm with a survey because simply choosing a numerically different channel may still overlap.
البطاقة ٢١١
السؤال
When should a technician escalate instead of implementing a likely fix alone?
الإجابة
When authority, expertise, access, vendor support, safety, risk, or outage impact exceeds the technician's scope. Escalate with evidence, tests performed, current impact, and a clear proposed next step.
البطاقة ٢١٢
السؤال
A switch interface is administratively up but protocol down or error-disabled. What should be checked?
الإجابة
The disable reason, physical link, transceiver or cable, remote port, speed/duplex, VLAN or aggregation policy, and logs. Clear the condition only after correcting the cause.
البطاقة ٢١٣
السؤال
A website loads partially, but large transfers through a tunnel stall. Which path property is a strong suspect?
الإجابة
An MTU or path-MTU problem. Compare interface and tunnel overhead, test with controlled packet sizes, and correct the narrow segment rather than relying on accidental fragmentation.
البطاقة ٢١٤
السؤال
What do arp and ip neigh reveal during local reachability troubleshooting?
الإجابة
They show cached IPv4 ARP or IPv6 neighbor mappings and states. A missing, incomplete, or unexpected mapping can point to VLAN, duplicate-address, gateway, or spoofing problems.
البطاقة ٢١٥
السؤال
A phone call drops as a user walks between APs. Which design evidence should be reviewed?
الإجابة
Coverage overlap, SNR, AP power, channel plan, authentication delay, roaming events, controller logs, and client behavior. The client chooses when to roam, so a single AP's signal view is insufficient.
البطاقة ٢١٦
السؤال
How should a technician verify that a network fix solved the real problem?
الإجابة
Repeat the original failure condition, confirm normal service and performance, check related systems, monitor for recurrence, and ask affected users. Add preventive controls if the root cause can recur.
البطاقة ٢١٧
السؤال
Several new PoE cameras will not power up, but data links work. What capacity should be checked?
الإجابة
The switch's total PoE budget and each port's negotiated power class, plus cabling and device standard compatibility. Available port count does not guarantee enough electrical power.
البطاقة ٢١٨
السؤال
Interface utilization stays near capacity during user complaints. Which fault fits, and what evidence is needed?
الإجابة
Congestion fits. Confirm queue drops, flow sources, traffic class, time pattern, and baseline before adding bandwidth; a loop, backup job, attack, or missing QoS may be the underlying cause.
البطاقة ٢١٩
السؤال
How do netstat or ss and Nmap answer different endpoint questions?
الإجابة
Netstat or ss shows the local host's listening sockets and connections; Nmap probes targets to discover exposed hosts, ports, or services. Scan only systems you are authorized to assess.
البطاقة ٢٢٠
السؤال
A user cannot find the corporate WLAN but sees nearby networks. What should be verified?
الإجابة
Correct SSID, band and client capability, AP radio state, WLAN-to-AP assignment, broadcast policy, location coverage, and regulatory channel support. Hidden SSIDs can complicate discovery but are not security.
البطاقة ٢٢١
السؤال
What should the final troubleshooting record preserve?
الإجابة
Symptoms and scope, timeline, evidence, root cause, tests, changes, rollback or validation, affected assets, people notified, final outcome, and preventive follow-up. Avoid undocumented guesses presented as fact.
البطاقة ٢٢٢
السؤال
One side of an Ethernet link is full duplex and the other behaves as half duplex. What symptoms can result?
الإجابة
Low throughput, late collisions on the half-duplex side, FCS errors, and highly uneven performance. Align autonegotiation or matching manual settings at both ends.
البطاقة ٢٢٣
السؤال
Voice becomes choppy only when large downloads start. Which policy failure should be examined?
الإجابة
QoS classification, marking, queuing, shaping, and trust boundaries. Confirm that congestion actually exists on the relevant egress link and that voice retains its markings end to end.
البطاقة ٢٢٤
السؤال
What does the route command or ip route output help verify?
الإجابة
The host or router's known prefixes, next hops, interfaces, defaults, and sometimes source or metric. Compare the chosen route with the destination and expected return path.
البطاقة ٢٢٥
السؤال
A client sees the secure SSID but repeatedly fails to join. Which evidence separates authentication from radio trouble?
الإجابة
Association and authentication logs, certificate time and trust, RADIUS results, EAP method, account state, and whether another known-good client joins at the same spot. Strong signal alone does not prove credentials work.
البطاقة ٢٢٦
السؤال
Why should troubleshooting change one variable at a time when practical?
الإجابة
It preserves causal evidence: if the result changes, the technician can relate it to one intervention. When urgency requires a grouped rollback, document the bundle and test components later.
البطاقة ٢٢٧
السؤال
A replacement transceiver fits the port but the link stays down. Why is form factor alone insufficient?
الإجابة
The module must match speed, wavelength, reach, fiber or copper medium, lane/breakout format, and device support at both ends. Check diagnostics and vendor compatibility rather than only connector shape.
البطاقة ٢٢٨
السؤال
Which measurements distinguish delay, variable delay, and missing traffic?
الإجابة
Latency measures delay, jitter measures variation, and packet-loss rate measures missing packets. A controlled speed test estimates throughput; collect results over time because averages can hide brief service-breaking spikes.
البطاقة ٢٢٩
السؤال
When should tcpdump or Wireshark be used in a troubleshooting sequence?
الإجابة
When packet-level evidence can distinguish protocol behavior, retransmission, resets, negotiation, or policy. Capture at the right point with a narrow filter, protect sensitive payloads, and compare timestamps.
البطاقة ٢٣٠
السؤال
Two Wi-Fi clients hear an AP but not each other and collide when transmitting. What RF issue fits?
الإجابة
The hidden-node problem. RTS/CTS behavior, AP placement, cell size, band/channel design, or relocating clients can reduce collisions; adding transmit power indiscriminately may worsen contention.
البطاقة ٢٣١
السؤال
A long copper run links at a lower speed and shows errors. Which distance-related faults should be considered?
الإجابة
Excessive insertion loss, crosstalk, poor termination, damaged pairs, electromagnetic interference, or a run beyond the standard's channel length. Certify the permanent link rather than trusting continuity alone.
البطاقة ٢٣٢
السؤال
Users in one VLAN cannot reach a service, while users in another VLAN can. What should be compared?
الإجابة
VLAN membership, trunk allowance, SVI or gateway state, subnet and DHCP options, inter-VLAN route, ACL or firewall policy, and the service's return path.
البطاقة ٢٣٣
السؤال
When does a toner probe help more than a cable certifier?
الإجابة
When locating an unlabeled copper cable or its far-end port. A certifier measures whether a link meets performance standards; a toner primarily helps trace identity and path.
البطاقة ٢٣٤
السؤال
A lecture hall WLAN works empty but fails when full. Which design limit is most likely?
الإجابة
Capacity or airtime, not simple coverage. Measure concurrent clients, channel utilization, data rates, retries, application demand, uplink capacity, and AP distribution under real load.
البطاقة ٢٣٥
السؤال
A fiber link's receive power gradually drops over weeks. Which physical causes fit?
الإجابة
Dirty or damaged connectors, a loosening bend, stressed cable, aging optics, or a changing patch path. Inspect and clean correctly, then compare optical power with the link budget and earlier baseline.
البطاقة ٢٣٦
السؤال
A service works from most networks but not one source subnet. Which policy fault is likely?
الإجابة
An ACL or firewall rule with the wrong source, destination, port, direction, order, or state assumption. Read hit counters and logs, and verify the return path before broadening access.
البطاقة ٢٣٧
السؤال
What does an optical power meter measure during fiber troubleshooting?
الإجابة
An optical meter measures received power, usually in dBm; a visual fault locator injects visible light to expose nearby breaks or bends. Compare measured power with receiver limits and the link budget.
البطاقة ٢٣٨
السؤال
A dual-band client clings to distant 2.4 GHz despite a nearby 5 GHz AP. What should be tuned?
الإجابة
Coverage, AP transmit power, band steering, minimum data rates, roaming thresholds if exposed, and client drivers. Preserve adequate 2.4 GHz service for devices that genuinely require it.
البطاقة ٢٣٩
السؤال
A cable passes simple continuity but performs poorly at gigabit speed. Which wiring fault may remain?
الإجابة
A split pair or excessive crosstalk can preserve pin-to-pin continuity while violating pair geometry. Use a qualification or certification tester that measures performance, not only wiremap continuity.
البطاقة ٢٤٠
السؤال
Certificates fail on many devices immediately after a time-source outage. What is the likely connection?
الإجابة
Incorrect clocks can make valid certificates appear not yet valid or expired and can break time-sensitive authentication. Restore a trusted time hierarchy, then verify timezone display separately from UTC time.
البطاقة ٢٤١
السؤال
What should a protocol analyzer's capture location be chosen to prove?
الإجابة
Whether packets enter, cross, or leave a suspected boundary and how they change. Captures on both sides can distinguish endpoint behavior, loss, translation, filtering, and asymmetric routing.
البطاقة ٢٤٢
السؤال
A point-to-point wireless bridge becomes unstable after an antenna is moved. What should be rechecked?
الإجابة
Alignment, polarization, mounting, cable and connector loss, line-of-sight, Fresnel clearance, received signal, noise, channel, and local transmit-power limits.
البطاقة ٢٤٣
السؤال
A switch network suddenly floods broadcasts and MAC addresses flap between ports. What physical or Layer 2 fault fits?
الإجابة
A switching loop, possibly from an unintended cable or failed STP protection. Contain the loop, preserve evidence, trace the ports, then correct topology and loop-prevention controls.
البطاقة ٢٤٤
السؤال
Two hosts intermittently lose connectivity and report the same IPv4 address. What should be checked?
الإجابة
A duplicate address from conflicting static assignments, a stale reservation, or an unauthorized DHCP server. Trace both MAC addresses, correct the source, and refresh neighbor and lease state.
البطاقة ٢٤٥
السؤال
How can LLDP or a vendor discovery protocol speed physical topology troubleshooting?
الإجابة
It reports directly connected device identity, port, capabilities, and sometimes VLAN or power details. Treat discovery data as evidence to verify, because it may be disabled, stale, or spoofed.
البطاقة ٢٤٦
السؤال
A 5 GHz AP changes channel or pauses after detecting radar. Is that necessarily a fault?
الإجابة
No. Dynamic Frequency Selection requires affected channels to detect radar and vacate when necessary. Check DFS events, regulatory domain, channel plan, and client support before blaming hardware.
البطاقة ٢٤٧
السؤال
During an STP loop investigation, which port roles and states should you expect?
الإجابة
Each non-root switch selects one root port, each segment selects one designated port, and redundant paths can use alternate or backup ports. Classic 802.1D states are blocking, listening, learning, forwarding, and disabled; RSTP uses discarding, learning, and forwarding. Verify the intended root bridge because its placement determines the roles.
البطاقة ٢٤٨
السؤال
Internal clients reach the internet, but a new inbound service is unreachable through NAT. What should be verified?
الإجابة
The static or port-forward mapping, public address, listening service, firewall policy, return route, overlapping ports, and upstream filtering. Outbound PAT working does not prove unsolicited inbound translation exists.
البطاقة ٢٤٩
السؤال
Traceroute repeats a small set of routers until the hop limit expires. What fault does that pattern suggest?
الإجابة
A routing loop. Compare the relevant prefixes, next hops, redistribution, defaults, and recent changes on the repeating routers, then correct the inconsistent route information.
البطاقة ٢٥٠
السؤال
A guest joins Wi-Fi and receives an address but cannot browse until opening a plain HTTP site. What should be tested?
الإجابة
Captive-portal detection and redirection, DNS, portal reachability, certificate behavior, allowed preauthentication traffic, client isolation, and completion state. The radio and DHCP path already appear functional.

Abstract network core linked to cloud, wireless, switching, storage, and diagnostic nodes in navy, cyan, and coral.

٢٥٠ بطاقة