60 questions / 10 random questions
Random questions, instant feedback, and review for missed questions.
View recommended Network Specialist resources →
In the OSI model, which layer is responsible for IP routing?
Answer: The network layer (layer 3)
IP routing belongs to the network layer; the data link layer handles same-segment delivery via MAC.
Which protocol is connectionless and skips retransmission, suiting low-latency communication?
Answer: UDP
UDP is connectionless without retransmission, suiting low-latency uses like voice and video streaming.
For the network 192.168.10.0/24, about how many addresses are assignable to hosts?
Answer: 254
A /24 has 8 host bits (256 total); excluding the network and broadcast addresses leaves 254 assignable.
What is combined with an IP address to determine whether two hosts are on the same network?
Answer: The subnet mask
The subnet mask separates the network and host portions of an IP address to determine the network.
Where does a host first send traffic destined for another network segment?
Answer: The default gateway
Traffic to another network is first forwarded to the default gateway (router).
Which method has network devices exchange route information and update routing tables automatically?
Answer: Dynamic routing (e.g., OSPF, BGP)
Dynamic routing exchanges route information via routing protocols and updates paths automatically, even on failures.
Which device learns MAC addresses and forwards frames within a segment to the correct port?
Answer: An L2 switch
An L2 switch learns a MAC table and forwards frames only to the destination port; a hub floods all ports.
Which technology logically divides one switch into multiple separate networks?
Answer: VLAN
VLANs logically segment a switch, separating broadcast domains without changing the physical layout.
Which protocol resolves a MAC address from an IP address within the same segment?
Answer: ARP
ARP resolves a MAC address from an IP address; DNS resolves between domain names and IP addresses.
Which system looks up the IP address for a domain name like www.example.com?
Answer: DNS
DNS is the name-resolution system that maps domain names to and from IP addresses.
Which protocol automatically distributes IP address, subnet mask, and default gateway to clients?
Answer: DHCP
DHCP automatically distributes network settings to clients, reducing manual effort and misconfiguration.
Which technology translates private IP addresses to global ones to enable internet access?
Answer: NAT / NAPT
NAT/NAPT translates between private and global addresses; NAPT also uses ports to share one global IP.
Which port number is standard for HTTPS communication?
Answer: 443
HTTPS uses 443, HTTP 80, SMTP 25, and FTP control 21 as well-known ports.
Which procedure establishes a TCP connection at the start of communication?
Answer: The three-way handshake
TCP establishes a connection with the SYN, SYN/ACK, ACK three-way handshake before exchanging data.
Which hardware-assigned identifier distinguishes devices at the data link layer?
Answer: MAC address
A MAC address is a unique identifier assigned to a NIC, used for frame delivery within a segment.
Which device distributes traffic across servers to balance load and improve availability and performance?
Answer: A load balancer
A load balancer distributes requests across servers, avoiding overload and single points of failure.
Which technology prioritizes delay-sensitive traffic like voice and video to control quality?
Answer: QoS
QoS assigns priorities and manages bandwidth and delay to maintain quality for important traffic.
In wireless LAN, which network identifier distinguishes access points?
Answer: SSID
An SSID is the wireless network name used to distinguish which access point to connect to.
Which technology connects sites over the internet with encryption to form a secure path?
Answer: VPN
A VPN creates an encrypted tunnel over the internet to securely connect sites or remote users.
Which server communicates externally on behalf of internal clients, providing access control and caching?
Answer: A proxy server
A proxy server communicates externally for clients, providing access control, caching, and logging.
Which system caches content on edge servers worldwide to deliver from a location near the user?
Answer: CDN
A CDN distributes content to edge servers and delivers it from near the user with low latency.
Which protocol does the ping command use to check network reachability?
Answer: ICMP
Ping uses ICMP echo request/reply to check reachability and round-trip time to a host.
Which protocol prevents broadcast storms from loops when switches are interconnected?
Answer: Spanning Tree Protocol (STP)
STP logically blocks part of redundant paths to prevent loops and broadcast storms.
Which protocol is used to monitor and manage the status of network devices?
Answer: SNMP
SNMP collects and monitors device status and traffic for network management.
What is the main reason for adopting IPv6?
Answer: To address IPv4 exhaustion and vastly expand available addresses
IPv6 uses 128-bit addresses to greatly expand address space, solving IPv4 exhaustion.
Which zone isolates public servers from the internal network to limit damage spread?
Answer: DMZ
A DMZ is a buffer zone isolating public servers from the internal network, used with firewalls to limit damage.
When evaluating speed, which metric represents the actual useful data throughput?
Answer: Throughput
Throughput is the actual useful data transferred per unit time, typically less than the theoretical bandwidth.
Which device or function controls allowing or blocking traffic at a network boundary based on rules?
Answer: A firewall
A firewall allows or blocks traffic based on rules, protecting the network boundary.
You want to carry multiple VLANs over a single link between switches. Which configuration is generally appropriate?
Answer: A VLAN trunk using IEEE 802.1Q
A VLAN trunk tags frames with VLAN IDs and carries multiple VLANs over one physical link, commonly between switches or to virtualization platforms.
In an internal network, you want traffic to automatically switch to an alternate path when a link fails. Which design is appropriate?
Answer: Use dynamic routing such as OSPF and design route convergence
Dynamic routing such as OSPF lets routers exchange route information and converge to alternate paths after topology changes.
Which routing protocol is typically used to exchange internet routing information between autonomous systems?
Answer: BGP
BGP is an exterior gateway protocol used for routing between autonomous systems, controlling route policies between ISPs and in multihomed connections.
To avoid a single point of failure in the default gateway, you want two routers to share a virtual IP. Which technology is appropriate?
Answer: VRRP
VRRP lets multiple routers share a virtual IP address, allowing a standby router to take over the default gateway when the active router fails.
For website name resolution, you want an alias name to point to a canonical name. Which DNS record is appropriate?
Answer: CNAME record
A CNAME record maps an alias to a canonical name, often used to point a service hostname to another official hostname.
What is the main effect of shortening a DNS TTL?
Answer: Caches retain records for less time, making changes propagate faster
DNS TTL is the cache validity period. A shorter TTL can speed up record changes, while increasing DNS query volume.
Multiple wireless access points use the same SSID, but client roaming is unstable. Which viewpoint should be checked?
Answer: Check signal strength, channel design, AP placement, and authentication consistency
Wireless roaming depends on signal overlap, channel interference, AP placement, authentication and encryption consistency, and client behavior. Both design and measurement matter.
Users report the network is slow, but monitoring shows no link outage. Which metrics should be checked next?
Answer: Latency, packet loss, jitter, interface errors, and bandwidth utilization
When the network is slow, check not only outages but also latency, loss, jitter, errors, and congestion. Application and DNS delays may also need isolation.
What is the most appropriate purpose of checking a server certificate in HTTPS?
Answer: Verify the server's authenticity and establish the basis for encrypted communication
HTTPS uses TLS to validate the server certificate, confirm the server identity, and establish encryption keys, reducing eavesdropping and impersonation risks.
You want to verify users connecting from outside to internal systems without trusting them only by network location. Which concept is appropriate?
Answer: Use zero trust to continuously verify users, devices, and access conditions
Zero trust does not rely only on network boundaries; it continuously evaluates identity, device state, MFA, destination, and risk, granting least-privilege access.
What is the most appropriate main purpose of using NAT?
Answer: Translate between private and public IP addresses so internal clients can communicate externally
NAT translates IP addresses, allowing internal networks using private addresses to communicate with external networks such as the internet.
When publishing a web application, you want to route traffic at Layer 7 based on URLs or cookies. Which device or function is appropriate?
Answer: Layer 7 load balancer
A Layer 7 load balancer can route requests to suitable backends using application-layer information such as HTTP headers, URL paths, and cookies.
A dual-stack web service had an IPv6 path failure, but some clients fell back to IPv4, hiding the issue from monitoring. What is the best prevention?
Answer: Monitor IPv4 and IPv6 separately from outside and compare DNS, paths, and response times
In dual stack, fallback can mask a failure in one protocol. Separate DNS, connectivity, and latency checks for IPv4 and IPv6 expose partial failures.
More PCs use IPv6 temporary addresses, so an IP address alone no longer identifies a device consistently. What is the best operational improvement?
Answer: Correlate 802.1X identities, device certificates, and address assignment logs
With temporary addresses and MAC randomization, operations should correlate authenticated user and device identities with addresses used at a given time.
Small transfers work, but large HTTPS responses stall. A firewall broadly blocks ICMPv6 on the path. What cause should be suspected?
Answer: Path MTU discovery is failing because Packet Too Big messages cannot arrive
IPv6 routers do not fragment packets in transit; ICMPv6 Packet Too Big tells the sender the path MTU. Blocking it can create an MTU black hole for large packets.
An OSPF network with many sites has growing route count and LSA processing load. Which design improvement is most appropriate?
Answer: Use hierarchical areas and an address plan that permits summarization at boundaries
OSPF areas contain LSDB and failure impact. Contiguous addressing and summarization at ABRs reduce routing-table and LSA scale.
A network uses BGP with two ISPs and wants ISP-A preferred for outbound traffic. Which common attribute is used inside its AS?
Answer: Set a higher LOCAL_PREF on routes learned from ISP-A
LOCAL_PREF expresses outbound route preference within an AS, with higher values preferred. It is applied as policy to received routes.
A company wants to detect and limit route hijacking where its prefix is announced by the wrong AS. Which mechanism is most appropriate?
Answer: Publish an RPKI ROA and perform route origin validation on received routes
A ROA identifies the authorized origin AS and maximum prefix length. Receivers can reject or de-preference invalid origin announcements based on RPKI validation.
Redundant routers create asymmetric paths, and one stateful firewall drops return traffic. What is the best mitigation?
Answer: Make paths symmetric or synchronize session state between redundant firewalls
Stateful inspection records connection state, so return traffic reaching another device may appear unestablished. Symmetric routing or state synchronization resolves the mismatch.
Two links between a server and switch were bundled, but traffic is unstable in one direction. What should be checked first in the LACP configuration?
Answer: Consistency of LAG, member speed, VLANs, and LACP mode at both ends
With LACP, both ends must recognize the same logical channel, and member speed, VLAN, duplex, and related settings must match. Physical link errors should also be checked.
Clients in a different VLAN across a router need addresses from a central DHCP server. Which function is required?
Answer: Use a DHCP relay to forward broadcast requests to the server
Initial DHCP requests are broadcasts and normally do not cross routers. A relay on the segment gateway forwards them by unicast to the central server.
An enterprise LAN needs to block rogue DHCP servers and ARP spoofing. Which access-switch feature combination is most appropriate?
Answer: DHCP snooping and Dynamic ARP Inspection
DHCP snooping blocks server responses on untrusted ports and records bindings. Dynamic ARP Inspection uses those bindings to validate ARP messages.
A wired LAN must block unmanaged devices and assign VLANs based on user and device authentication. Which design is most appropriate?
Answer: Network access control using 802.1X, RADIUS, and device certificates
802.1X restricts traffic before authentication, and RADIUS results can assign VLANs or ACLs. Certificate authentication helps identify managed devices.
A resolver must verify that a DNS answer was not altered and was signed by the zone owner. Which mechanism should be used?
Answer: DNSSEC signature validation
DNSSEC uses public-key signatures to validate DNS data authenticity and integrity. It does not itself encrypt the transport or hide query contents.
DNS sites worldwide advertise the same IP address so users reach a nearby healthy site. Which technology is appropriate?
Answer: BGP anycast
Anycast lets multiple sites advertise the same prefix so routing selects a nearby site. Withdrawing an advertisement steers traffic away from a failed site.
HTTP/3 was enabled, but only some networks cannot connect and fall back to HTTP/2. What should be checked first?
Answer: Whether UDP port 443 used by QUIC is allowed along the path
HTTP/3 runs over QUIC, normally on UDP 443. If a firewall or proxy blocks UDP, browsers may fall back to HTTP/2 over TCP.
A site-to-site IPsec VPN fails only when the path crosses a NAT device. Which mechanism should be checked?
Answer: NAT Traversal encapsulating ESP in UDP port 4500
Because NAT changes IP addresses, native ESP may not traverse it. NAT-T detects NAT and encapsulates IPsec traffic in UDP port 4500.
An internal video stream must reach many clients while reducing duplicate source and link traffic. Which method is appropriate?
Answer: Use multicast, with IGMP for host membership and PIM for router forwarding
Multicast replicates a stream only where needed. IGMP manages receiver membership, while PIM and related protocols build distribution trees between routers.
Multiple data centers need many tenant Layer 2 segments over a Layer 3 fabric, with MAC reachability distributed by a control plane. Which design is appropriate?
Answer: Use VXLAN as the data plane and EVPN as the control plane
VXLAN encapsulates many logical segments over Layer 3 using VNIs. EVPN uses BGP to distribute MAC and IP reachability and reduce flooding.
Branch traffic to SaaS, data centers, and cloud should use multiple links by application according to quality and cost. Which technology is appropriate?
Answer: Use SD-WAN to measure link quality and select paths by policy
SD-WAN continuously measures latency, loss, and jitter and dynamically selects internet or private paths according to application and business policy.
Only traffic to one server has many retransmissions. Device counters are inconclusive, so actual packets need detailed inspection. Which method is most appropriate?
Answer: Mirror the traffic with SPAN or a network TAP and analyze packets with synchronized timestamps
SPAN or TAP capture allows inspection of TCP sequence, ACKs, retransmissions, RTT, windows, and ICMP. Synchronized clocks and observation points help isolate the affected segment.
QoS prioritizes voice internally, but the traffic is not prioritized after entering the carrier WAN. Which troubleshooting step is most appropriate?
Answer: Check DSCP preservation or remarking at the boundary and the carrier's class mapping
DSCP values may be cleared or remapped at a provider boundary. Verify contracted class mapping, trust boundaries, queue counters, and bandwidth guarantees segment by segment.