N10-009 CompTIA Network+ Certification Exam Questions and Answers

The correct answer is B. An IDS is less disruptive during the initial deployment of the technology . An Intrusion Detection System (IDS) is designed to monitor and alert on suspicious activity, but it does not sit inline to actively block traffic the way an Intrusion Prevention System (IPS) does. Because of that, deploying an IDS usually has less immediate impact on production traffic. It can be introduced to observe network behavior and generate alerts without risking accidental interruption of legitimate communications.

That makes IDS a safer first step in many environments, especially when teams are still tuning signatures, thresholds, or alert rules. If an IPS is deployed too aggressively before it is properly tuned, it may block valid traffic and create service issues. An IDS avoids that risk because it focuses on visibility rather than enforcement.

The other options are weaker. A is not always guaranteed, since processing needs depend on implementation and traffic volume. C is not a defining advantage of IDS over IPS. D is also not reliable, because false positives can occur with either technology depending on configuration and signatures.

For Network+ study purposes, the standard advantage of IDS is that it is passive and less disruptive , especially during initial rollout and monitoring phases.

An evil twin is a rogue Wi-Fi access point that mimics a legitimate network. Attackers use it to intercept and manipulate traffic, making it an on-path (formerly MITM) attack opportunity.

Breakdown of Options:

A. Phishing – Tries to steal credentials through fake emails/websites but does not intercept network traffic.

B. Dumpster diving – Involves physical security breaches, not network interception.

C. Evil twin – ✅ Correct answer. A rogue Wi-Fi AP impersonates a real network, allowing traffic interception.

D. Tailgating – Involves physical access security, not network interception.

Nmap (Network Mapper) is a powerful network scanning tool used to discover hosts and services on a computer network. It can be used to identify which ports are open on a remote server, which can help diagnose access issues to services like a remote file server.

Port Scanning: Nmap can perform comprehensive port scans to determine which ports are open and what services are running on those ports.

Network Discovery: It provides detailed information about the host’s operating system, service versions, and network configuration.

Security Audits: Besides troubleshooting, Nmap is also used for security auditing and identifying potential vulnerabilities.

Network References:

CompTIA Network+ N10-007 Official Certification Guide: Covers network scanning tools and their uses.

Nmap Documentation: Official documentation provides extensive details on how to use Nmap for port scanning and network diagnostics.

Network+ Certification All-in-One Exam Guide: Discusses various network utilities, including Nmap, and their applications in network troubleshooting.

EIGRP (Enhanced Interior Gateway Routing Protocol) has a default administrative distance (AD) value of 90 for internal routes. The administrative distance is used to rate the trustworthiness of routing information received from different routing protocols. EIGRP, developed by Cisco, has an AD of 90, which is lower than that of RIP (120) and OSPF (110), making it more preferred if multiple protocols provide a route to the same destination.References: CompTIA Network+ study materials.

Verifying full system functionality occurs after implementing a fix. This step ensures the solution resolved the issue and that performance is back to expected levels. Comparing current throughput to baseline measurements is part of validation testing to confirm everything is within normal operational parameters.

A. Implement the solution applies the fix but does not confirm results.

C. Document findings happens at the end of troubleshooting.

D. Test the theory comes earlier, when trying to confirm the suspected cause.

References (CompTIA Network+ N10-009):

Domain: Network Troubleshooting — Troubleshooting methodology steps, baselines, verification testing.

LDAP over SSL (LDAPS) uses port 636 to provide secure, encrypted authentication for directory services.

Breakdown of Options:

A. SMTP (Simple Mail Transfer Protocol) – Uses port 25, not 636.

B. Syslog – Uses port 514 (UDP), not 636.

C. TFTP (Trivial File Transfer Protocol) – Uses port 69 (UDP), not 636.

D. LDAPS (Lightweight Directory Access Protocol Secure) – ✅ Correct answer. Uses port 636 for secure directory authentication.

The answer is D. BGP . When a company wants a redundant internet connection , especially across more than one external path or provider, Border Gateway Protocol (BGP) is the routing technology most commonly associated with that design. BGP is used between autonomous systems and is the standard protocol for making routing decisions across the internet or between an organization and one or more ISPs.

The other options are interior routing protocols. EIGRP , RIPv2 , and OSPF are generally used inside an organization to exchange routes within a private network environment. They are not the normal answer when the question specifically says internet connection redundancy . That wording points outward, beyond the internal LAN or campus routing domain.

In practical terms, BGP gives administrators a way to influence path selection, advertise network prefixes, and maintain reachability if one outside connection fails. That is why it appears in questions involving multihoming, ISP failover, or resilient edge connectivity. Since the scenario mentions redundant firewalls and a need for a redundant internet connection, the best match is the routing technology designed for external route exchange. For Network+, that technology is BGP .

Content filtering blocks access to restricted or malicious websites. When a user attempts to visit a site that violates company policies, they are redirected to a restriction page.

This is a common security measure to prevent employees from accessing phishing or malware-infected sites.

Content filters work by scanning URLs, keywords, or categories and blocking inappropriate or harmful content.

Option A (DLP - Data Loss Prevention): Focuses on preventing sensitive data leaks rather than blocking web access.

Option B (Captive portal): Used mainly in public Wi-Fi to authenticate users before granting access, not to restrict sites.

Option D (DNS sinkholing): Redirects malicious domain requests to a safe address but is not responsible for policy-based restrictions on general content.

? Reference: CompTIA Network+ (N10-009) Official Study Guide – Section: Security Solutions

If the IP phone works but the workstation doesn ' t, it indicates that the Voice VLAN is functioning correctly, but the Data VLAN (C) is either misconfigured or missing. The workstation typically connects through the phone, which tags voice and data traffic separately using VLANs.

A. Voice VLAN is for the IP phone, which is already working.

B. Native VLAN is for untagged traffic on trunk ports, but doesn’t control access directly.

D. Trunk port is more relevant to switch interconnections than individual workstation ports.

???? Reference:

CompTIA Network+ N10-009 Official Objectives: 2.3 – Given a scenario, configure and verify VLANs.

(Note: Ips will be change on each simulation task, so we have given example answer for the understanding)

To perform a network discovery by entering commands into the terminal, you can use the following steps:

Click on each switch to open its terminal window.

Enter the command show ip interface brief to display the IP addresses and statuses of the switch interfaces.

Enter the command show vlan brief to display the VLAN configurations and assignments of the switch interfaces.

Enter the command show cdp neighbors to display the information about the neighboring devices that are connected to the switch.

Fill in the missing information in the diagram using the drop-down menus provided.

Here is an example of how to fill in the missing information for Core Switch 1:

The IP address of Core Switch 1 is 192.168.1.1.

The VLAN configuration of Core Switch 1 is VLAN 1: 192.168.1.0/24, VLAN 2: 192.168.2.0/24, VLAN 3: 192.168.3.0/24.

The neighboring devices of Core Switch 1 are Access Switch 1 and Access Switch 2.

The interfaces that connect Core Switch 1 to Access Switch 1 are GigabitEthernet0/1 and GigabitEthernet0/2.

The interfaces that connect Core Switch 1 to Access Switch 2 are GigabitEthernet0/3 and GigabitEthernet0/4.

You can use the same steps to fill in the missing information for Access Switch 1 and Access Switch 2.

The Network layer (Layer 3 of the OSI model) can utilize the connectionless protocol IP (Internet Protocol) to send data packets independently without establishing a connection. This approach is typical for protocols like IP, which provide best-effort delivery rather than guaranteed delivery. The document explains:

“The OSI Network Layer is responsible for logical addressing and routing, and it can utilize connectionless protocols like IP to send packets without requiring a session setup. This layer does not guarantee packet delivery, relying on higher layers for error detection or correction if needed.”

A signal power of -97dB indicates a very weak signal, which can cause connectivity issues and slow speeds. Splitters on a coaxial line can degrade the signal quality further, so removing them can help improve the signal strength and overall connection quality.

Signal Quality: Splitters can reduce the signal strength by dividing the signal among multiple lines, which can be detrimental when the signal is already weak.

Direct Connection: Ensuring a direct connection from the modem to the incoming line can maximize signal quality and reduce potential points of failure.

Network References:

CompTIA Network+ N10-007 Official Certification Guide: Discusses troubleshooting connectivity issues and the impact of signal strength on network performance.

Cisco Networking Academy: Provides insights on maintaining optimal signal quality in network setups.

Network+ Certification All-in-One Exam Guide: Covers common network issues, including those related to signal degradation and ways to mitigate them.

A Content Delivery Network (CDN) stores cached versions of content in edge locations to deliver data faster and more reliably to users based on geographical proximity.

From Andrew Ramdayal’s guide:

“CDNs distribute content to multiple, geographically dispersed servers. This enhances performance and reliability for end-users by reducing latency and load times.”

A warm site is a compromise between a hot site and a cold site, providing a balance between cost and recovery time. It is partially equipped with the necessary hardware, software, and infrastructure, allowing for a quicker recovery compared to a cold site but at a lower cost than a hot site.

Recovery Time: Warm sites can be operational within hours to a day, making them suitable for non-critical applications that can tolerate short downtimes.

Cost-Effectiveness: Warm sites are more economical than hot sites as they do not require all systems to be fully operational at all times.

Network References:

CompTIA Network+ N10-007 Official Certification Guide: Discusses disaster recovery strategies and the different types of recovery sites.

Cisco Networking Academy: Provides training on disaster recovery planning and site selection.

Network+ Certification All-in-One Exam Guide: Explains the characteristics of hot, warm, and cold sites and their use cases in disaster recovery planning.

Warm sites offer a practical solution for maintaining business continuity for non-critical applications, balancing the need for availability with cost considerations.

A system has reachedend-of-supportwhen thevendor no longer provides patches, updates, or bug fixes. This significantly increases the risk of security vulnerabilities and is a major operational concern.

The best answer is B. 255.255.252.0 , which is a /22 mask. A Class B network starts with a default mask of 255.255.0.0 or /16 . The question says the administrator wants four equal subnets , which means borrowing 2 bits from the host portion, since 2 borrowed bits gives 2² = 4 subnets . That moves the mask from /16 to /18 if subnetting is based only on splitting the Class B into four equal parts.

However, the answer choices point toward the host requirement as the deciding factor. Each subnet needs to support about 1,000 hosts . A /22 leaves 10 host bits , which gives 2¹⁰ = 1024 total addresses , or 1022 usable hosts after subtracting the network and broadcast addresses. That fits the requirement. Among the options provided, 255.255.252.0 is the only mask that supports around 1,000 hosts per subnet.

The smaller masks, /24 and /25 , do not allow enough hosts. The default Class B mask, /16 , does not subnet the network at all. Based on the available choices and the host-capacity requirement, 255.255.252.0 is the correct exam answer.

EIGRP (Enhanced Interior Gateway Routing Protocol) is a Cisco proprietary advanced distance-vector routing protocol. While it operates within an Autonomous System (AS), it requires the AS number to be configured for routers to recognize each other as EIGRP neighbors.

OSPF (Open Shortest Path First) uses areas and routers must be in the same area to form adjacencies, but it doesn ' t require AS numbers in the same way.

FHRP (First Hop Redundancy Protocol) is not a routing protocol but a group of protocols (e.g., HSRP, VRRP) to ensure high availability at the default gateway level.

RIP (Routing Information Protocol) does not use autonomous system numbers.

???? Reference:

CompTIA Network+ N10-009 Official Objectives: 3.1 – Compare and contrast various routing technologies.

===========

•Since this issue occurred after a configuration change on a Layer 3 switch, the most likely cause is misconfigured ACLs (Access Control Lists).

•ACLs control which traffic is allowed or denied, so an incorrect ACL may be blocking access to the file server.

•Why not the other options?

•Switching loop (B): A switching loop occurs at Layer 2 (not Layer 3) and causes network-wide broadcast storms, not just loss of access to a file server.

•Duplicate IP addresses (C): This would cause connectivity issues for the devices with the conflict, but not necessarily prevent all users from accessing the file server.

•Wrong default route (D): The default route is used for traffic leaving the local network. If users are unable to access an internal file server, this is unlikely to be the issue.

Band steering is a feature in wireless networks that encourages dual-band capable devices to connect to the 5GHz band instead of the 2.4GHz band.

Why Band Steering?

The 5GHz band supports higher speeds and less interference compared to 2.4GHz.

If a device supports both bands, the access point (AP) can " steer " it to connect to 5GHz instead of 2.4GHz.

This helps ensure users always connect to the fastest available network.

Incorrect Options:

B. Disabling the 5GHz SSID: Would force devices onto 2.4GHz, which is slower and more congested.

C. Adding a Captive Portal: Used for guest authentication, not for speed optimization.

D. Configuring MAC Filtering: Used for security, not for optimizing network speed.

The correct answer is C. Elasticity . In cloud computing, elasticity refers to the ability to increase or decrease resources quickly based on current demand . If workloads rise, more compute resources can be allocated. If demand drops, those resources can be reduced again. That is exactly what the question is describing.

This is slightly different from scalability . Scalability is the broader idea that a system can grow to handle more workload. Elasticity focuses more on the dynamic, on-demand adjustment of resources as conditions change. In exam questions, wording like “add or remove based on need” usually points straight to elasticity.

The other answer choices do not fit. Availability is about uptime and service access. Multitenancy refers to multiple customers sharing underlying cloud infrastructure while remaining logically separated. Neither describes rapid expansion and contraction of compute resources.

From a Network+ study perspective, elasticity is one of the core cloud characteristics to remember because it explains why cloud services are useful for workloads that are unpredictable or variable. Instead of permanently building for peak demand, organizations can consume more or less compute as required. That makes elasticity the best answer.

•The issue described is a network bottleneck due to increased traffic after a merger.

•A collapsed core architecture consolidates the core and distribution layers into a single layer to improve efficiency and reduce latency.

•Until the 40GB switch is acquired, Link Aggregation (LAG) (IEEE 802.3ad / LACP) can be used to combine multiple physical links into a single logical link, increasing bandwidth and reducing bottlenecks.

•FHRP (First Hop Redundancy Protocol) (A) is used for gateway redundancy, not link aggregation.

•Route selection metric changes (B) help with routing decisions but don’t address physical link congestion.

•Load balancers (C) distribute traffic for applications, not network links.

???? Reference: CompTIA Network+ N10-009 Official Documentation – Network Architecture and Performance Optimization.

When a network administrator installs a new Network Interface Card (NIC) and users are unable to reach the server, one of the common issues is the use of an incorrect cable type. Network cables must match the specifications required by the NIC and the network infrastructure (e.g., Cat5e, Cat6 for Ethernet).

NIC Compatibility: The new NIC might require a specific type of cable to function properly. Using a cable not rated for the NIC ' s required speeds or capabilities can result in connectivity issues.

Cable Standards: Different NICs and network devices might need different cabling standards (straight-through vs. crossover cables, or specific fiber optic types).

Connection Types: Ensuring that the cable connectors are appropriate for the NIC ports (e.g., RJ45 for Ethernet, LC connectors for fiber optics).

Network References:

CompTIA Network+ N10-007 Official Certification Guide: Discusses network cabling standards and NIC specifications.

Cisco Networking Academy: Provides insights into cabling and NIC configurations for optimal network performance.

Network+ Certification All-in-One Exam Guide: Offers comprehensive details on troubleshooting network connectivity issues, including cabling problems.

When dealing with troubleshooting and change management, the plan of action outlines the steps, risks, and mitigation strategies. A change advisory board (CAB) uses this documented plan to decide whether to approve the change.

A. Identify the problem is the first step in troubleshooting, not decision-making for CAB.

B. Develop a theory is diagnostic work, not planning.

C. Test the theory confirms causes but doesn’t provide actionable planning information.

References (CompTIA Network+ N10-009):

Domain: Network Operations — Change management, troubleshooting methodology, CAB processes.

A split-tunnel VPN allows a device to route some traffic through the VPN (typically corporate traffic) while sending other traffic (like general internet browsing) directly over the local internet connection. This reduces the load on the corporate network because not all traffic is routed through the VPN tunnel.

Site-to-site VPNs are for permanent links between locations.

Full-tunnel VPNs route all traffic through the VPN, increasing the bandwidth usage on the corporate network.

GRE (Generic Routing Encapsulation) is a tunneling protocol that doesn’t encrypt and doesn ' t reduce bandwidth usage by itself.

???? Reference:

CompTIA Network+ N10-009 Official Objectives: 3.3 – Given a scenario, configure and deploy common VPN technologies.

The correct answer is hub-and-spoke. In this design, the head office serves as the hub, and all satellite or branch offices (the spokes) connect directly to the hub using leased lines or VPNs. Communication between spokes typically passes through the hub, which centralizes connectivity and simplifies management.

A. Mesh involves every site connecting to every other site, which is more redundant but costly.

B. Point-to-point describes a single dedicated link between two sites, not a multi-site topology.

D. Star is often used in LAN switching, with all devices connecting to a central switch, but it’s not the WAN architecture typically used here.

Hub-and-spoke is a cost-effective WAN design, as fewer circuits are needed compared to full mesh. However, its main disadvantage is reliance on the hub site: if the hub goes down, inter-spoke communication fails.

References (CompTIA Network+ N10-009):

Domain: Networking Concepts — WAN topologies (hub-and-spoke, mesh, point-to-point).

The server’s subnet mask is 255.255.255.224 (/27), which covers IPs from 192.168.100.224 to 192.168.100.255. However, the router only recognizes 192.168.100.0/24, indicating a mismatch between the server’s subnet and the router ' s network.

Correct mask for the /24 network is 255.255.255.0, allowing 256 IPs from 192.168.100.0 to 192.168.100.255.

This mismatch would result in routing issues, especially with the gateway outside of the subnet range.

???? Reference:

CompTIA Network+ N10-009 Official Objectives: 5.2 – Given a scenario, troubleshoot common wired connectivity issues.

An Extended Service Set Identifier (ESSID) allows multiple access points to share the same SSID, enabling seamless roaming for users. This means that users can move between different access points within the same ESSID without losing connection or having to reauthenticate. This provides a better user experience, especially in large environments such as office buildings or campuses.References: CompTIA Network+ study materials. ​

To increase overall security after a recent breach, implementing least privilege network access and central policy management are effective strategies.

Least Privilege Network Access: This principle ensures that users and devices are granted only the access necessary to perform their functions, minimizing the potential for unauthorized access or breaches. By limiting permissions, the risk of an attacker gaining access to critical parts of the network is reduced.

Central Policy Management: Centralized management of security policies allows for consistent and streamlined implementation of security measures across the entire network. This helps in quickly responding to security incidents, ensuring compliance with security protocols, and reducing the chances of misconfigurations.

Network References:

CompTIA Network+ N10-007 Official Certification Guide: Discusses network security principles, including least privilege and policy management.

Cisco Networking Academy: Provides training on implementing security policies and access controls.

Network+ Certification All-in-One Exam Guide: Covers strategies for enhancing network security and managing policies effectively.

A cable tester is a tool that can help identify issues with the physical cabling, such as breaks or improper terminations, which may prevent the access point from reaching the internet.

=================

Changing the default password is a fundamental step in device hardening, as default credentials are widely known and published online, posing a significant security risk if not updated. The document notes:

“Default passwords are often known by attackers and published on the internet. Changing them to unique, strong passwords is a critical first step in securing network devices against unauthorized access.”

TheSession Layer(Layer 5 of the OSI Model) is responsible for setting up, managing, and tearing down sessions between applications. It maintains dialog control and synchronizes data exchange between systems.

An IP Helper (IP Helper Address) allows DHCP requests to pass through routers and reach a DHCP server on another network.

DHCP broadcasts are not forwarded across routers by default, so an IP Helper Address is needed to relay the request.

This is crucial for large networks where a single DHCP server serves multiple subnets.

Option B (Reservation): Ensures a specific IP address is assigned to a MAC address but does not relay DHCP across networks.

Option C (Exclusion): Prevents specific IP addresses from being assigned, but does not help with DHCP relay.

Option D (Scope): Defines the range of IP addresses available for DHCP clients but does not assist in cross-network communication.

? Reference: CompTIA Network+ (N10-009) Official Study Guide – Section: DHCP and IP Addressing

Private VLANs (PVLANs) are used to segment devices on the same subnet and switch so they cannot communicate with each other, while still accessing a shared resource like a router or gateway. This is often used in shared hosting or DMZ environments.

A. ACLs (Access Control Lists) control traffic between networks, not within the same VLAN.

B. Trunking carries multiple VLANs between switches but does not isolate devices.

C. Port security limits MAC addresses per port but doesn’t isolate communication between ports.

???? Reference:

CompTIA Network+ N10-009 Official Objectives: 3.4 – Compare and contrast access control methods.

The default gateway for a network should be an IP address within the subnet, but not the broadcast address. In this case:

IP: 192.163.1.15

Subnet Mask: 255.255.255.0

This means the network range is: 192.163.1.0 - 192.163.1.255

192.163.1.255 is the broadcast address for this subnet, so it cannot be used as a gateway.

Hence, the device fails to communicate outside its subnet because it ' s trying to use a broadcast address as its gateway.

✅ The issue is clearly with the gateway configuration.

A UPS (Uninterruptible Power Supply) provides backup power to devices during a power outage, allowing for continuous operation and protecting against sudden shutdowns that could cause data loss or equipment damage. The document confirms:

“A UPS (Uninterruptible Power Supply) is essential for maintaining power to critical devices during an outage, protecting data and ensuring continuous operation until power is restored or a safe shutdown can be performed.”

In a fiber patch panel, the SC (Subscriber Connector or Standard Connector) is commonly used because of its push-pull design and reliability in enterprise environments.

Breakdown of Options:

A. F-type – Used for coaxial cables (e.g., cable TV), not fiber.

B. RJ11 – Used for telephone lines, not fiber.

C. BNC – Used for coaxial connections, not fiber.

D. SC – ✅ Correct answer. A standard fiber optic connector used in patch panels.

A misaligned parabolic antenna can cause a significant increase in input errors because the signal is not properly focused or directed towards the receiving antenna, resulting in poor reception and data corruption. The document confirms:

“Misalignment of parabolic microwave antennas can lead to weak or incorrect signal reception, causing an increase in input errors and connectivity issues on the link.”

URL filtering can block access to websites based on their domain or country code TLDs (e.g., .cn, .ru). This is the correct method to block by location identifiers in URLs.

B. Content filtering blocks based on keywords or categories within websites, not country code.

C. DNS poisoning is an attack, not a control mechanism.

D. MAC filtering restricts devices, not websites.

References (CompTIA Network+ N10-009):

Domain: Network Security — Filtering technologies, URL vs content filtering.

A rogue DHCP server occurs when an unauthorized or misconfigured DHCP server assigns incorrect IP addresses, default gateways, or DNS settings to clients.

•In this scenario:

•The user can ping the gateway, meaning local network communication is working.

•However, they cannot access network resources, which suggests incorrect IP configuration (likely due to a rogue DHCP server assigning the wrong gateway or DNS).

•Why not the other options?

•VLAN hopping (A): This is an attack that exploits VLAN configurations to gain access to unauthorized VLANs. It would not typically cause multiple users to lose network access.

•Distributed DoS (C): A DDoS attack floods a network or service with traffic, but this issue is more likely misconfigured IP settings than an actual attack.

•Evil twin (D): This refers to a fraudulent Wi-Fi network mimicking a legitimate one. Since the users are on a wired network (ipconfig output checked), this is not applicable.

802.11ax, also known as Wi-Fi 6, is designed for high-density environments and improves device saturation and coverage compared to previous standards.

802.11ac: While it offers high throughput, it is not optimized for high-density environments as effectively as 802.11ax.

802.11ax (Wi-Fi 6): Introduces features like OFDMA, MU-MIMO, and BSS Coloring, which enhance performance in crowded environments, reduce latency, and increase the number of devices that can be connected simultaneously.

802.11g and 802.11n: Older standards that do not offer the same level of efficiency or support for high device density as 802.11ax.

Network References:

CompTIA Network+ N10-007 Official Certification Guide: Covers the 802.11 standards and their capabilities.

Cisco Networking Academy: Provides training on Wi-Fi technologies and best practices for high-density deployments.

Network+ Certification All-in-One Exam Guide: Discusses the various 802.11 standards and their applications in different environments.

Single-mode fiber is best suited for long-distance communication, often exceeding 10 km (6.2 miles). It ' s immune to EMI and offers high bandwidth — making it the ideal choice for connecting buildings across a city.

Coaxial (A) and Twinaxial (B) are used for shorter distances and specific use cases (e.g., storage or legacy systems).

Cat 5 (D) is limited to 100 meters and is not suitable for city-level interconnects.

✅ For long-distance, high-speed, and reliable communication between buildings, Single-mode fiber is the professional choice.

To redirect a network resource that has moved from a local network to a Software-as-a-Service (SaaS) solution, the network administrator needs to configure a DNS record that maps an alias to the new canonical name (hostname) of the SaaS provider’s server. The CNAME (Canonical Name) record is used to alias one domain name to another, effectively redirecting requests to the new hostname without needing to update the IP address directly. This is ideal for SaaS solutions, where the provider’s server hostname is used, and the IP address may change dynamically.

Why not TXT? A TXT record is used to store arbitrary text data, such as SPF records for email authentication or verification strings, not for redirecting resources.

Why not AAA? There is no such thing as an " AAA " record in DNS. This might be a typo for AAAA (IPv6 address record), but AAAA maps a hostname to an IPv6 address, not an alias.

Why not PTR? A PTR record is used for reverse DNS lookups (mapping an IP address to a hostname), not for redirecting a resource to a new hostname.

•A. Isolate smart devices to their own network segment: Network segmentation using VLANs or separate SSIDs ensures that smart devices (like speakers) are not on the same network as guests, preventing unauthorized control.

•E. Change the default credentials: Many IoT devices (e.g., smart speakers) come with default usernames and passwords. If these are not changed, unauthorized users can easily take control.

•Why not the other options?

•B. Configure IPS: IPS (Intrusion Prevention System) detects threats but cannot block specific guest actions on an IoT device.

•C. Install a new AP: A new access point does not solve the unauthorized control issue.

•D. Set up a syslog server: Helps with logging, but does not prevent unauthorized access.

•F. Configure GRE: Generic Routing Encapsulation (GRE) is used for VPN tunneling, which is irrelevant in this case.

WPA2/WPA3 mixed mode provides compatibility for older devices (that only support WPA2) while allowing newer devices to take advantage of stronger WPA3 encryption. This ensures maximum compatibility and security in a mixed-device environment.

A. WPA3 only is most secure but not compatible with legacy devices.

B. WPA2 only is secure but does not future-proof against WPA3-capable devices.

D. WPA/WPA2 mixed mode is weaker due to WPA (deprecated, insecure).

References (CompTIA Network+ N10-009):

Domain: Network Security — Wi-Fi encryption standards, WPA2 vs WPA3, mixed-mode compatibility.

The correct answer is C. Compatibility . A SIEM is only effective if it can successfully collect, normalize, and analyze data from the systems the organization relies on. Since the question specifically says the department wants the SIEM to ingest and analyze logs from all core devices , the most important factor is whether the SIEM is compatible with those devices, their log formats, and their supported methods of exporting events.

This includes support for common logging methods such as syslog , SNMP traps, API integrations, agent-based collection, and vendor-specific event formats. Even a SIEM with excellent features will not deliver value if it cannot properly receive and interpret logs from firewalls, routers, switches, servers, and security appliances already in use.

The other choices matter, but they come after compatibility. Ease of management is helpful for daily operations. Cost is always a practical concern. Features can improve visibility and automation. However, none of those benefits matter much if the SIEM cannot integrate with the organization’s actual environment.

For Network+ exam purposes, when log ingestion across many device types is the requirement, the top selection criterion is compatibility . Without that foundation, correlation, alerting, and security analysis will be incomplete.

Spanning Tree Protocol (STP) is designed to detect and prevent Layer 2 loops by blocking redundant paths. If loops are possible in the design, enabling STP ensures network stability.

B. Port security controls endpoint MAC addresses, not loops.

C. Speed limits address bandwidth, not loop prevention.

D. 802.1Q tagging allows VLAN separation but does not resolve loops.

References (CompTIA Network+ N10-009):

Domain: Network Operations — Loop prevention, spanning tree, switch design.

A Change Advisory Board (CAB) reviews and approves network changes. Before approval, they need a detailed action plan outlining the change, potential impacts, and mitigation strategies.

A Plan of Action includes risk assessments, rollback procedures, and deployment steps, which are critical for decision-making.

? Reference: CompTIA Network+ (N10-009) Official Study Guide – Section: Network Troubleshooting Methodologies

Shoulder surfing is a social engineering attack where attackers observe someone’s private information by looking over their shoulder or using tools like cameras to capture input.

From Andrew Ramdayal’s guide:

“Shoulder surfing is the act of watching someone enter confidential information, such as PINs or passwords, often using direct line-of-sight or surveillance equipment.”

The correct answer is D: Increase the scope to 10.8.100.50 – 10.8.100.175. According to the CompTIA Network+ N10-009 objectives, proper DHCP scope configuration is essential to ensure all hosts can obtain valid IP addresses and communicate beyond their local segment.

In this scenario, the DHCP scope is configured for 10.8.100.50 through 10.8.100.150, while a reservation range exists from 10.8.100.151 through 10.8.100.175. The network scan shows that IP addresses up to 10.8.100.175 are already in use. This indicates that some devices are either statically assigned addresses outside the active scope or are failing to receive valid DHCP leases, causing the new laptops to communicate only with each other—often a sign of APIPA or improper addressing.

To ensure full connectivity, the DHCP scope must be expanded to include the entire range of addresses that are actively in use, including the reserved addresses. Option D correctly extends the scope to 10.8.100.175 without overlapping lower addresses that may be statically assigned or intentionally excluded.

The Network+ objectives emphasize avoiding address conflicts and ensuring DHCP scopes align with real-world network usage. Expanding the scope to include all valid addresses ensures that all laptops can obtain proper IP configuration, default gateway information, and full network connectivity.

The correct metric is RTO (Recovery Time Objective). RTO defines the maximum acceptable time to restore services after a disruption, ensuring business continuity. For example, if the RTO is 4 hours, systems must be back online within that timeframe after an outage.

B. MTBF (Mean Time Between Failures) measures reliability by calculating the average time between hardware failures.

C. RPO (Recovery Point Objective) defines how much data loss (in terms of time, such as last backup point) is acceptable.

D. MTTR (Mean Time to Repair) measures the average time taken to fix a failure but is not a predefined business requirement like RTO.

Organizations define RTOs during disaster recovery planning to align IT recovery capabilities with business needs.

References (CompTIA Network+ N10-009):

Domain: Networking Concepts — Business continuity metrics (RTO, RPO, MTBF, MTTR).

A CNAME (Canonical Name) record is used in DNS to alias one domain name to another. This means that newapplication.comptia.org can be made to resolve to the same IP address as www.comptia.org by creating a CNAME record pointing newapplication.comptia.org to www.comptia.org. SOA (Start of Authority) is used for DNS zone information, MX (Mail Exchange) is for mail server records, and NS (Name Server) is for specifying authoritative DNS servers.

A full-tunnel VPN routes all of a user ' s network traffic through the corporate network. This means that the organization can inspect all network traffic for security and compliance purposes, as all data is tunneled through the VPN, allowing for comprehensive monitoring and inspection.References: CompTIA Network+ study materials.

Link Layer Discovery Protocol (LLDP) is a network protocol used for discovering devices and their capabilities on a local area network, primarily at the data link layer (Layer 2). It helps in identifying the connected switch and the specific port to which a device is connected. When troubleshooting a VoIP handset connection, the technician can use LLDP to determine the exact switch and port where the handset is connected. This protocol is widely used in network management to facilitate the discovery of network topology and simplify troubleshooting.

Other options such as IKE (Internet Key Exchange), VLAN (Virtual LAN), and netstat (network statistics) are not suitable for identifying the switch and port information. IKE is used in setting up secure IPsec connections, VLAN is used for segmenting networks, and netstat provides information about active connections and listening ports on a host but not for discovering switch port details.

Understanding 2.4GHz Interference:

The 2.4GHz frequency range is commonly used by many devices, including Wi-Fi, Bluetooth, and various industrial equipment. This can lead to interference and degraded performance.

Mitigation Strategies:

5GHz Frequency:

The 5GHz frequency band offers more channels and less interference compared to the 2.4GHz band. Devices operating on 5GHz are less likely to encounter interference from other devices, including industrial equipment.

Non-overlapping Channels:

In the 2.4GHz band, using non-overlapping channels (such as channels 1, 6, and 11) can help reduce interference. Non-overlapping channels do not interfere with each other, providing clearer communication paths for Wi-Fi signals.

Why Other Options are Less Effective:

Mesh Network: While useful for extending network coverage, a mesh network does not inherently address interference issues.

Omnidirectional Antenna: This type of antenna broadcasts signals in all directions but does not mitigate interference.

Captive Portal: A web page that users must view and interact with before accessing a network, unrelated to frequency interference.

Ad Hoc Network: A decentralized wireless network that does not address interference issues directly.

Implementation:

Switch Wi-Fi devices to the 5GHz band if supported by the network infrastructure and client devices.

Configure Wi-Fi access points to use non-overlapping channels within the 2.4GHz band to minimize interference.

The most likely issue is a duplex mismatch, which is a well-documented cause of collisions and poor network performance, as outlined in the CompTIA Network+ N10-009 troubleshooting objectives. A duplex mismatch occurs when one end of a network link is configured for full duplex while the other end is operating in half duplex. In half-duplex mode, devices must take turns transmitting and receiving data, which inherently allows for collisions. When paired with a full-duplex device—which expects simultaneous send and receive—collisions and retransmissions occur frequently.

The presence of collisions on a switch interface is a key diagnostic clue. Modern Ethernet switches operating correctly in full duplex should not experience collisions at all. When collisions are observed, it almost always points to a duplex configuration issue, often caused by manual speed/duplex settings on one device and auto-negotiation on the other.

A wrong speed setting may prevent link establishment entirely or cause errors, but it does not typically result in collisions. Jumbo frames can cause packet drops or fragmentation issues, not collisions. An incorrect VLAN configuration affects logical segmentation and connectivity but operates at Layer 2 and does not generate collisions.

CompTIA Network+ emphasizes duplex mismatch as a classic and frequently tested troubleshooting scenario. Correcting it—usually by enabling auto-negotiation on both ends—restores normal, collision-free communication.

Importance of Proper Termination:

Cat 8 cabling requires precise termination practices to ensure signal integrity and reduce interference. One common requirement is to wrap the end connections in copper tape to maintain shielding and reduce electromagnetic interference (EMI).

Interference Troubleshooting:

Interference in high-frequency cables like Cat 8 can be caused by improper shielding or grounding. Checking the end connections for proper wrapping in copper tape is a crucial step.

Why Other Options are Less Likely:

Passthrough modular crimping plugs: Not specifically related to interference issues and are typically used for ease of cable assembly.

Connecting RX/TX wires to different pins: Would likely result in no connection or incorrect data transmission rather than interference.

Running a speed test on a device that can only achieve 100Mbps speeds: This would not diagnose interference and would not provide relevant information for Cat 8 cabling rated for higher speeds.

Corrective Actions:

Verify that all end connections are properly wrapped with copper tape before termination.

Ensure that the shielding is continuous and properly grounded throughout the installation.

Retest the cabling for interference after making corrections.

Asymmetrical routing occurs when packets take different paths to and from the destination, leading to instability in network communication. The use of two different MPLS providers with OSPF can lead to this type of routing issue, especially if the paths aren ' t carefully configured and managed. This can cause unexpected routing behaviors and instability in a dual-WAN setup. (Reference: CompTIA Network+ Study Guide, Chapter on Network Routing)

802.1X is a port-based Network Access Control (NAC) method that enforces authentication before allowing access to the network. It uses a RADIUS server for identity verification and policy enforcement, ensuring only authorized users/devices gain access.

A. Standard ACL filters traffic by IP, not identity.

B. MAC filtering controls devices by hardware address but can be spoofed.

D. SSO (Single Sign-On) provides user convenience across services, not network-level access control.

References (CompTIA Network+ N10-009):

Domain: Network Security — NAC, 802.1X authentication, identity-based access.

The correct answer is D. Hot site. In CompTIA Network+ N10-009, disaster recovery and business continuity concepts include understanding recovery site types and how quickly they can restore operations after a major outage or catastrophe. A hot site provides the fastest recovery because it is a fully operational alternate location with the necessary network infrastructure, hardware, systems, connectivity, and often replicated data already available. Since the environment is prepared and ready to assume production workloads, organizations can fail over to a hot site with minimal downtime.

A warm site is partially prepared and may have network connectivity and some hardware in place, but it usually requires additional configuration, data restoration, or system activation before services can fully resume. A cold site provides only basic facilities, such as space, power, and cooling, but lacks most operational equipment and therefore has the longest recovery time. Asynchronous replication is a data replication method where changes are copied after they occur, but it is not itself a complete recovery location and may involve some data loss depending on timing.

Because the question asks which option allows the fastest recovery during a catastrophe, the best choice is a hot site.

Port security is a Layer 2 security feature that restricts the number of devices connecting to a network switch port. It helps prevent unauthorized devices, such as an unmanaged switch, from being connected to the network.

How Port Security Works:

Limits the number of MAC addresses that can connect to a port.

Can shut down or restrict the port if an unauthorized device is detected.

Prevents users from plugging in unauthorized networking equipment (e.g., unmanaged switches, hubs).

Incorrect Options:

A. Screened Subnet: A screened subnet (DMZ) is used for isolating external-facing servers, not for controlling unauthorized network connections.

B. 802.1X: Provides authentication for devices but requires a RADIUS server, which is a more complex solution than port security.

C. MAC Filtering: Controls which MAC addresses can connect but is difficult to manage and can be spoofed.

Full duplex mode allows devices to send and receive data simultaneously, improving network performance and reducing congestion, which is critical for VoIP and video conferencing.

Breakdown of Options:

A. A VLAN with 100Mbps speed limits – VLANs segment traffic but limiting speeds to 100Mbps would worsen video performance.

B. An IP helper to direct VoIP traffic – IP helper is used for DHCP relay, not for VoIP optimization.

C. A smaller subnet mask – A smaller subnet reduces IP address availability but does not improve network performance.

D. Full duplex on all user ports – Correct answer. Full duplex eliminates collisions, allowing better VoIP and video performance.

The best answer is C. Link aggregation . The requirements point directly to combining multiple physical links into one logical connection. Link aggregation provides higher total bandwidth , supports redundancy if one member link fails, and simplifies administration because the bundle is managed as a single logical interface instead of several separate ones.

Another important clue is vendor interoperability . Standards-based link aggregation, such as LACP , is designed to work across different vendors when supported properly. That makes it a strong match for inter-data-center switch environments where equipment may not all come from the same manufacturer.

The other choices do not satisfy the full requirement list. Spanning tree helps prevent loops, but it can block redundant links instead of actively using them for extra bandwidth. Setting interface speeds to 10GB increases speed per port, but it does not by itself provide the logical bundling, simplified management, or redundancy benefits described. Jumbo frames can improve efficiency for some traffic types, but they are not the right answer for bandwidth aggregation and resilient uplinks.

Because the question asks for a solution that improves throughput, keeps redundancy, remains cost effective, and is easier to manage, link aggregation is the strongest fit.

The first step in any troubleshooting process is to identify the problem. This includes gathering information from the user, reviewing logs, and observing the symptoms. In this case, identifying the scope and nature of the issue (e.g., signs of ransomware) is critical before forming any theories or plans.

From Andrew Ramdayal’s guide:

“The troubleshooting methodology begins with identifying the problem. This step involves questioning users, identifying user changes, and determining the symptoms.”

The best answer is C. Insufficient bandwidth . The pattern in the question matters more than anything else. The company moved to a hosted VoIP and video solution , which means voice and video traffic now depend heavily on the site’s internet connection. The problems begin mid-morning and continue into the afternoon , which strongly suggests the link becomes congested during the busiest usage period of the day.

That also explains why users see dropped calls, broken video, and slow internet access all at the same time. Real-time applications like VoIP and video are very sensitive to delay, jitter, and packet loss. When bandwidth is limited or saturated, those services are usually the first to show noticeable symptoms.

The fact that remote users do not report the same issue is another major clue. If the application platform itself were failing, remote users would likely be affected too. Since the issue seems limited to the main site, the bottleneck is most likely the local office’s WAN or internet connection rather than the hosted service.

The other options are weaker. Roaming misconfiguration is more of a wireless mobility issue, signal degradation is too vague for this traffic pattern, and a miswired cable would not usually appear only during peak business hours. This points to insufficient bandwidth .

Comprehensive and Detailed Explanation (paraphrased, aligned to N10-009):

SSH provides secure, scriptable remote access used by automation/orchestration tools (e.g., leveraging CLI, NETCONF over SSH, or Ansible modules) to push configurations at scale.

A. RDP is primarily for Windows GUI sessions and is not commonly used for network device automation.

B. Telnet can be scripted but is insecure (plaintext); modern best practice is to use SSH.

D. GUI access is typically manual and not ideal for scalable, repeatable automation.

References (CompTIA Network+ N10-009):

Domain: Network Operations — Configuration management, automation/orchestration, secure management protocols (SSH vs. Telnet), change at scale.

===========

A = 192.168.10.0/26

B = 192.168.1.0/23

C = 10.0.0.1/18

Using the choices shown in the screenshot, the best-fit subnet selections are based on host growth requirements first, then segmentation .

For Company A , the current device count is 32 . With 20% growth , that becomes about 39 devices . A /27 only supports 30 usable hosts , so it is too small. A /26 supports 62 usable hosts , so 192.168.10.0/26 is the correct choice.

For Company B , the current device count is 100 . With 20% growth , that becomes 120 devices . The smallest correct subnet would normally be a /25 with 126 usable hosts , but that option is not shown. From the available choices, 192.168.1.0/23 is the smallest subnet that still supports more than 120 hosts, so that is the best answer.

For Company C , the current device count is 10,000 . With 20% growth , it needs space for 12,000 hosts . A /18 provides 16,382 usable hosts , while a /19 is not available and a /21 or /22 would be far too small. Therefore, 10.0.0.1/18 is the correct selection.

One important note: the dropdown choices shown do not actually let all three companies be placed into a single true Class B network block. So these answers are the best valid selections from the provided options .

Bottlenecking occurs when a device in the network (such as an IPS) cannot process traffic efficiently, resulting in a dramatic drop in throughput. The significant difference between the firewall ' s speed (48.8 Mbps down) and the end-user devices’ speeds (4.8 - 5.2 Mbps down) indicates a bottleneck caused by the IPS.

•Why not the other options?

•Packet loss (A) – Would typically cause connection timeouts, not just slow speeds.

•Channel overlap (C) – Affects only wireless networks, but the wired desktop is also experiencing slow speeds.

•Network congestion (D) – Would show fluctuations in both upload and download speeds, but upload speeds remain unaffected.

An incorrect pinout on the patch cable could prevent network connectivity due to mismatched wiring. Even if the cables are the correct length and type, a pinout issue can cause continuity problems and prevent data transmission. Proper crimping with the correct pinout is essential for network cables to function. (Reference: CompTIA Network+ Study Guide, Chapter on Network Media and Topologies)

The correct answer is Ad hoc because it allows wireless devices to communicate directly with one another without requiring a centralized access point or additional infrastructure. According to CompTIA Network+ (N10-009) objectives under wireless networking concepts, an ad hoc network (also known as an Independent Basic Service Set, or IBSS) enables peer-to-peer wireless communication.

This type of network is ideal for temporary or quick setups where only a small number of devices need to connect. In an ad hoc configuration, each device connects directly to others, making it simple and fast to deploy without requiring switches, routers, or wireless access points.

Spine and leaf (Option B) is a data center architecture designed for high scalability and redundancy, not small wireless setups. Point-to-point (Option C) refers to a direct connection between two devices only, which would not support five devices efficiently. Mesh (Option D) allows multiple nodes to interconnect and provide redundancy, but it is more complex and typically requires compatible infrastructure devices.

Therefore, for a quick setup with five wireless devices, an ad hoc network is the most appropriate choice.

802.1X is a port-based network access control (PNAC) protocol that provides an authentication mechanism to devices wishing to connect to a LAN or WLAN. It is widely used for secure network access, ensuring that only authenticated devices can access the network, whether they are connecting via wired or wireless means. 802.1X works in conjunction with an authentication server, such as RADIUS, to validate the credentials of devices trying to connect.References: CompTIA Network+ study materials.

MAC flooding overwhelms a switch’s CAM (Content Addressable Memory) table by sending a flood of frames with spoofed MAC addresses. Once the CAM table overflows, the switch cannot learn legitimate MAC addresses and defaults to flooding all frames out all ports, effectively turning it into a hub. This allows an attacker to capture traffic not originally destined for their port.

A. ARP poisoning corrupts ARP tables to redirect traffic but does not overflow the CAM table.

B. Evil twin is a wireless rogue AP attack, unrelated to switch behavior.

D. DNS spoofing redirects domain queries, not Layer 2 switching.

References (CompTIA Network+ N10-009):

Domain: Network Security — Switch security, CAM table attacks, MAC flooding.

Clientless VPNs allow users to access network resources through a secure web portal using a browser, with no VPN software needed. This is ideal for occasional access to internal resources via HTTPS.

A. Proxy is a gateway for accessing web content, not a VPN.

C. Site-to-site VPN connects entire networks, not individual users.

D. Direct Connect usually refers to dedicated cloud connections, not VPNs.

???? Reference:

CompTIA Network+ N10-009 Official Objectives: 3.3 – Given a scenario, configure and deploy common VPN technologies.

Fax machines use analog phone lines, which are connected using RJ11 connectors. These are standard telephone connectors with 4 or 6 positions and are used for POTS (Plain Old Telephone Service) lines.

F-type is used for coaxial cables (e.g., TV and cable modems).

RJ45 is used for Ethernet network connections.

SC (Subscriber Connector) is used for fiber optic connections, not analog telephone lines.

???? Reference:

CompTIA Network+ N10-009 Official Objectives: 2.4 – Compare and contrast common network connectors.

===========

The giveaway here is the 169.254.x.x address. That is an APIPA address, which Windows assigns to itself when it asks for an IP address from DHCP and does not get one. Since there is also no default gateway and no DHCP server listed, the laptop clearly failed to obtain normal network settings.

Out of the choices, address pool exhaustion makes the most sense. If the DHCP scope has run out of available addresses, the client cannot lease one, so it falls back to an automatic private address. At that point, the device may still think its network adapter is working, but it will not be able to reach internal resources like the company intranet because it does not have valid Layer 3 settings for that network.

The other answers do not fit the output. A short lease duration could cause frequent renewals, but it would not normally explain an APIPA address by itself. An IIS problem would affect the web server, not the client’s local IP configuration. An IDS issue also would not cause the workstation to self-assign 169.254.0.5. This is a DHCP addressing problem, and the best answer is C .

Jumbo frames are Ethernet frames with a payload greater than the standard 1,500 bytes. Using jumbo frames reduces the number of frames transmitted over the network, thereby reducing the overhead associated with frame headers and processing. The document explains:

“Jumbo frames are used in storage networks to reduce device overhead by lowering the number of frames required for data transfer, which can increase overall throughput and performance.”

Definition of GDPR:

General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy for all individuals within the European Union and the European Economic Area. It also addresses the transfer of personal data outside the EU and EEA areas.

Scope and Objectives:

GDPR aims to give individuals control over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU.

It enforces rules about data protection, requiring companies to protect the personal data and privacy of EU citizens for transactions that occur within EU member states.

Comparison with Other Options:

SCADA (Supervisory Control and Data Acquisition): Refers to control systems used in industrial and infrastructure processes, not related to personal data protection.

SAML (Security Assertion Markup Language): A standard for exchanging authentication and authorization data between parties, not specifically for personal data protection.

PCI DSS (Payment Card Industry Data Security Standard): A set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information maintain a secure environment, not specific to personal data protection in Europe.

Key Provisions:

GDPR includes provisions for data processing, data subject rights, obligations of data controllers and processors, and penalties for non-compliance.

The correct answer is Switch because the question references a new logical layout segmenting the network using tagging, which indicates VLAN (Virtual Local Area Network) configuration. VLAN tagging (IEEE 802.1Q) is performed on switches to logically separate broadcast domains within the same physical infrastructure.

According to CompTIA Network+ (N10-009) objectives under switching technologies, VLANs are used to improve security, reduce broadcast traffic, and logically segment network traffic. When VLAN tagging is misconfigured—such as incorrect trunk ports, access port assignments, or mismatched VLAN IDs—devices may lose connectivity to required network resources.

Since the issue began after changes involving tagging, the most likely cause is an incorrect switch configuration, such as improper VLAN assignments or trunking settings.

An access point (Option A) may use VLANs for SSID segmentation, but core tagging configuration is handled at the switch. A firewall (Option B) filters traffic but does not control VLAN tagging at Layer 2 in typical deployments. A load balancer (Option D) distributes traffic among servers and is unrelated to VLAN segmentation.

Therefore, reviewing the switch configuration is the appropriate action to restore connectivity.

To ensure voice and data traffic are properly prioritized for an IP phone, the administrator should modify (configure) QoS. In Network+ (N10-009), QoS is the primary mechanism used to prioritize latency-sensitive traffic such as VoIP. By classifying and marking voice frames/packets (often using DSCP/CoS values) and applying priority queuing, the network ensures voice traffic experiences minimal delay and jitter even when links are congested. This is essential for call quality because voice is highly sensitive to variation in delivery time and packet loss.

802.1Q tagging is important for VLAN separation (and many IP phone deployments use a voice VLAN), but VLAN tagging alone does not guarantee prioritization; it separates traffic, while QoS provides preferential treatment. Full duplex can reduce collisions on Ethernet links, but it does not implement traffic prioritization policies. Changing the native VLAN is a trunking/security configuration detail and not the correct action to prioritize voice versus data. In practice, networks often use both a voice VLAN (802.1Q) and QoS, but for the explicit requirement of prioritization, QoS is the correct answer.

A CNAME (Canonical Name) record maps an alias to the correct fully qualified domain name (FQDN). If a user is redirected to the wrong hostname, correcting or updating the CNAME ensures the alias points to the proper domain.

B. PTR record maps IP to hostname (reverse DNS), not forward website resolution.

C. NTP relates to time sync, irrelevant to DNS resolution.

D. TXT record stores metadata like SPF or DKIM info, not used for hostname aliasing.

References (CompTIA Network+ N10-009):

Domain: Network Standards, Protocols, and Implementations — DNS record types (A, AAAA, CNAME, PTR, TXT).

Switches in sealed enclosures are at risk of overheating because airflow is restricted. The temperature factor is critical since heat buildup can damage components, shorten device lifespan, and cause outages. Proper cooling or ventilation must be ensured.

A. Fire suppression is important for data centers but not the primary concern in a sealed box.

B. Power budget applies to PoE allocations, not environmental safety.

D. Humidity matters, but overheating is far more immediate in sealed environments.

References (CompTIA Network+ N10-009):

Domain: Network Infrastructure — Environmental considerations, switch installation, temperature control.

Broadcast traffic is sent to all nodes on the network. In a broadcast, a single packet is transmitted to all devices in the network segment. This is commonly used for tasks like ARP (Address Resolution Protocol) requests.

Broadcast Domain: All devices within the same broadcast domain will receive broadcast traffic.

Network Types: Ethernet networks commonly use broadcast traffic for certain functions, including network discovery and addressing.

IPv4 Broadcast: An IPv4 broadcast address (e.g., 255.255.255.255) ensures the packet is sent to all devices on the network.

Network References:

CompTIA Network+ N10-007 Official Certification Guide: Explains network traffic types, including broadcast, unicast, and multicast.

Cisco Networking Academy: Provides training on network communication methods and traffic types.

Network+ Certification All-in-One Exam Guide: Discusses different types of network traffic and their uses in various network scenarios.

Broadcast traffic is essential for network operations that require communication with all nodes, such as ARP requests or DHCP discovery messages.

OSPF (Open Shortest Path First) is a link-state routing protocol that uses the Dijkstra algorithm, also known as the shortest path first (SPF) algorithm, to determine the most efficient routes.

From Andrew Ramdayal’s guide:

“OSPF is a link-state routing protocol that provides fast, efficient path selection using the shortest path first (SPF) algorithm.”

A split-tunnel VPN allows some traffic to be routed through the VPN while other traffic goes directly to the internet. This setup offers several advantages, with a primary one being cost-effectiveness due to cloud-based traffic not consuming company bandwidth.

Bandwidth Utilization: Split-tunnel VPNs reduce the amount of traffic passing through the company ' s network, freeing up bandwidth for other uses.

Performance: By allowing internet-bound traffic to bypass the VPN, it can reduce latency and improve the performance for users accessing cloud services directly.

Cost Savings: Reduced load on the company ' s VPN infrastructure can lead to lower costs in terms of both hardware and bandwidth.

Network References:

CompTIA Network+ N10-007 Official Certification Guide: Covers VPN types, including split-tunnel configurations and their advantages.

Cisco Networking Academy: Discusses VPN technologies and the benefits of split-tunneling.

Network+ Certification All-in-One Exam Guide: Provides detailed information on VPN setups, including the cost-effectiveness of split-tunnel VPNs.

By allowing cloud-based traffic to flow outside the company’s network, a split-tunnel VPN optimizes resource usage and enhances the overall network performance without incurring extra costs for bandwidth.

An evil twin attack occurs when an attacker creates a fraudulent AP with an SSID very similar (or identical) to the legitimate one. Users may accidentally connect, allowing the attacker to capture traffic and credentials.

A. On-path is the consequence of connecting to the evil twin, not the initial attack itself.

B. Rogue AP is any unauthorized access point, but the key here is the malicious mimicry of a legitimate SSID — specifically an evil twin.

D. Tailgating is a physical social engineering attack, unrelated to Wi-Fi.

References (CompTIA Network+ N10-009):

Domain: Network Security — Wireless threats (rogue APs, evil twins).

The correct answer is Modify the CNAME record because a CNAME (Canonical Name) record maps one domain name (alias) to another domain name. If a user enters www.abc.com but is redirected to www.cba.com, it is likely that the DNS configuration includes an incorrect CNAME entry pointing abc.com to cba.com. Updating or correcting the CNAME record ensures the alias resolves to the intended host.

According to CompTIA Network+ (N10-009) objectives covering DNS record types, a CNAME record is used to alias one domain name to another, commonly for load balancing, CDN services, or website redirection.

A PTR record (Option B) is used for reverse DNS lookups (IP address to hostname) and does not control forward name resolution for websites. NTP settings (Option C) are used for time synchronization and have no impact on DNS resolution. A TXT record (Option D) stores descriptive text information (such as SPF, DKIM, or domain verification data) and does not affect website redirection.

Therefore, correcting the CNAME record resolves the issue and ensures users reach the correct website.

Once the theory has been tested and confirmed, the next step is to implement the solution based on the CompTIA troubleshooting model.

CompTIA Troubleshooting Model:

Identify the problem.

Establish a theory of probable cause.

Test the theory.

Establish a plan of action and implement the solution. ✅ (Correct step)

Verify full system functionality.

Document findings, actions, and outcomes.

Breakdown of Options:

A. Develop a theory – The theory has already been developed and tested.

B. Establish a plan of action – This happens before implementation, but since the issue is confirmed, it ' s time to act.

C. Implement the solution – Correct answer. The problem is confirmed, so the fix should be applied.

D. Document the findings – Documentation is the final step, not the next one.

The correct appliance is a router, which is specifically designed to interconnect multiple networks and forward packets based on IP addresses. Routers operate at Layer 3 (Network layer) of the OSI model and make intelligent forwarding decisions to ensure data reaches the correct destination network.

A. Firewall can also forward traffic, but its primary function is security, not routing efficiency.

C. Layer 2 switches connect devices within the same LAN but do not forward packets between different networks without routing capability.

D. Load balancers distribute traffic among servers but are not general-purpose routers.

Modern enterprise routers are optimized to minimize latency by using fast switching and hardware acceleration, making them ideal for interconnecting logical networks securely and efficiently.

References (CompTIA Network+ N10-009):

Domain: Network Infrastructure — Routers, Layer 3 devices, inter-network communication.

If the company’s SSID is not visible in some areas while other networks are still visible, the most likely cause is insufficient wireless coverage. The wireless signal does not reach those areas, meaning additional access points or signal boosters may be required.

Breakdown of Options:

A. Interference or channel overlap – Would cause slow or unstable connections, but the SSID should still be visible.

B. Insufficient wireless coverage – ✅ Correct answer. If the SSID is not appearing, the signal is too weak in that area.

C. Roaming misconfiguration – Would cause devices to stay on weaker APs instead of switching, but the SSID should still be visible.

D. Client disassociation issues – This would disconnect users, but they should still see the network.

Out-of-band (OOB) managementallows administrators to manage devices remotely even if the primary network is down. This is especially useful when physical access to the server is not possible. OOB management often uses a separate management interface, ensuring access regardless of the server ' s operational state.

The correct answer is Presentation, which is Layer 6 of the OSI model. According to the CompTIA Network+ N10-009 objectives, the Presentation layer is responsible for data formatting, compression, and encryption, ensuring that data sent from the application layer of one system can be properly interpreted by the receiving system.

End-to-end encryption refers to encrypting data before transmission and decrypting it only at the final destination, preventing intermediaries from accessing the plaintext data. In the OSI model, this encryption and decryption function is logically placed at the Presentation layer, which sits between the Application and Session layers. This layer transforms data into a standardized format and applies security mechanisms such as encryption algorithms.

While modern implementations like TLS/SSL often operate across multiple layers in real-world networking stacks, the Network+ exam adheres to the conceptual OSI model when testing knowledge. From an OSI perspective, encryption is explicitly associated with the Presentation layer.

The Application layer provides network services to end-user applications, the Session layer manages session establishment and teardown, and the Transport layer focuses on segmentation, flow control, and reliability. None of these layers are primarily responsible for encryption within the OSI framework.

CompTIA emphasizes understanding these conceptual responsibilities, making Presentation the correct and expected answer.

The correct answer is Autonomous system path because BGP (Border Gateway Protocol) prevents routing loops by using the AS_PATH attribute. According to CompTIA Network+ (N10-009) objectives under routing protocols, BGP is a path vector protocol used to exchange routing information between autonomous systems (AS) on the internet.

When a BGP router advertises a route, it includes its autonomous system number (ASN) in the AS_PATH attribute. As the route passes through additional autonomous systems, each AS appends its own ASN to the path. If a BGP router receives a route advertisement that already contains its own ASN in the AS_PATH list, it recognizes this as a loop and rejects the route. This mechanism effectively prevents routing loops across large-scale networks such as the internet.

Option B (Peer autonomous system) refers to neighboring BGP routers but does not describe the loop prevention mechanism. Option C (Autonomous system length) relates to path selection metrics, as shorter AS_PATH lengths are generally preferred, but this is not the loop avoidance function itself. Option D (Public autonomous system) is not a loop prevention mechanism.

Therefore, BGP uses the AS_PATH attribute for loop avoidance.

The correct answer is A. ESSID . An ESSID (Extended Service Set Identifier) is used when multiple wireless access points are configured to present the same wireless network name (SSID) across a larger coverage area, such as an entire building or campus floor. This allows users to move from one location to another while remaining connected to what appears to be a single wireless network. In practice, this supports seamless roaming between APs when they are properly configured with the same SSID, compatible security settings, and coordinated channel planning.

The other options do not fit the requirement. Wireless mesh is a topology that allows APs to connect to one another wirelessly, but it does not by itself describe using one common WLAN name across all APs. Band steering pushes dual-band clients toward the 5 GHz or 6 GHz band for better performance; it is not about creating one building-wide WLAN name. WPA3 is a wireless security standard and relates to encryption and authentication, not SSID design.

The key phrase in the question is “a single wireless LAN name across the entire building” , which points directly to an ESSID deployment.

When signal strength is poor, mobile devices constantly boost their transmission power in an attempt to maintain a stable connection. This results in dropped calls/data and rapid battery drain. Since a repeater was installed, misalignment or misconfiguration could be degrading the signal strength.

A. WPS applies to Wi-Fi, not cellular repeaters.

C. Channel frequency might matter for interference, but signal strength is the most direct cause of the described symptoms.

D. Power budget applies to PoE and wired devices, not mobile phones.

References (CompTIA Network+ N10-009):

Domain: Network Troubleshooting — Wireless/cellular troubleshooting, signal strength impact, user symptoms (battery drain, poor connectivity).

The correct answer is A. Nmap. Nmap (Network Mapper) is a powerful network scanning and reconnaissance tool specifically designed to gather detailed information about hosts on a network. According to CompTIA Network+ N10-009 objectives, Nmap can be used to identify open ports, running services, and even the operating system of a target device through techniques such as TCP/UDP scanning and OS fingerprinting.

This makes Nmap the best choice when a systems administrator needs a comprehensive view of a server’s exposure and configuration. It can enumerate services (e.g., HTTP, SSH), detect service versions, and determine which ports are open, closed, or filtered.

The other options are more limited in scope. Traceroute is used to map the path packets take across a network and identify latency or routing issues, but it does not provide service or OS details. Netstat shows active connections and listening ports on a local machine but does not perform remote OS detection or full service enumeration. Ping simply tests connectivity and reachability using ICMP and does not provide detailed system information.

Therefore, Nmap is the most appropriate and comprehensive tool for this requirement.

RTO stands for Recovery Time Objective, which defines the maximum acceptable amount of time that a system, application, or function can be down after a failure or disaster. It helps prioritize which systems need to be recovered first based on their importance to business operations.

SLA (Service Level Agreement) refers to an agreement between a service provider and a customer regarding expected performance and availability, but it does not dictate recovery order.

MTBF (Mean Time Between Failures) is a measure of reliability and time between hardware or system failures.

SIEM (Security Information and Event Management) is a centralized tool for logging and alerting but not relevant to DR recovery prioritization.

???? Reference:

CompTIA Network+ N10-009 Official Objectives: 4.4 – Summarize business continuity and disaster recovery concepts.

===========

Security Assertion Markup Language (SAML) is an XML-based standard used for exchanging authentication and authorization data between parties, particularly between an identity provider (IdP) and a service provider (SP). SAML is commonly used in Single Sign-On (SSO) solutions to pass sensitive user information, such as login credentials and attributes, securely between the identity provider and the service provider.

SAML (Security Assertion Markup Language): Facilitates web-based authentication and authorization, allowing users to access multiple services with a single set of credentials.

XML-based: Uses XML to encode the authentication and authorization data, ensuring secure transmission of user information.

Identity Federation: Enables secure sharing of identity information across different security domains, making it ideal for enterprise SSO solutions.

Network References:

CompTIA Network+ N10-007 Official Certification Guide: Covers authentication protocols, including SAML.

Cisco Networking Academy: Provides training on identity management and federation technologies.

Network+ Certification All-in-One Exam Guide: Explains SAML and its role in secure identity management and SSO.

The laptop is most likely using the 2.4GHz frequency band. According to the CompTIA Network+ N10-009 objectives, the 2.4GHz band is particularly susceptible to electromagnetic interference (EMI) from common household and office devices, including microwave ovens, cordless phones, Bluetooth devices, and baby monitors. Microwave ovens operate at approximately 2.45GHz, which overlaps directly with the 2.4GHz Wi-Fi spectrum. When the microwave is powered on, it emits interference that can significantly degrade or completely disrupt nearby wireless communications operating in this band.

The 5GHz and 6GHz bands operate at much higher frequencies and do not overlap with microwave emissions, making them far less prone to this type of interference. While higher-frequency bands have shorter range and lower wall penetration, they provide cleaner channels and improved performance in dense environments. The 900MHz band is not used by standard Wi-Fi networks defined in the Network+ objectives and is more commonly associated with legacy cordless phones and certain IoT or proprietary wireless technologies.

Network+ troubleshooting guidance emphasizes identifying environmental interference sources when diagnosing intermittent wireless connectivity. A common mitigation strategy is to migrate affected devices to the 5GHz or 6GHz bands or reposition access points away from interference sources like break room appliances.

A firewall is the best example of an appliance that can sit between network segments and permit or deny traffic flows based on security policy. In Network+ terms, firewalls enforce segmentation controls by applying rules that match on items such as source/destination IP, ports, protocols, and (with next-generation firewalls) even applications. This makes a firewall a common choice for directing allowed traffic between specific segments (for example, allowing users in a workstation VLAN to reach only certain ports on a server VLAN, while blocking everything else). This function is core to network security architecture and is frequently paired with concepts like network segmentation, ACL-style rule sets, and creating security zones.

An IDS (intrusion detection system) primarily monitors traffic and generates alerts on suspicious activity; it does not typically control or “direct allowed traffic” unless it is specifically an IPS (prevention) with inline blocking. An unmanaged switch operates at Layer 2 and forwards frames within a broadcast domain; it does not provide policy-based filtering between security segments. Therefore, the correct answer is Firewall.

The loopback address 127.0.0.1 is used to test the TCP/IP stack of the local machine. Pinging this address confirms whether the local system ' s networking stack is functioning correctly.

=================

Comprehensive and Detailed Explanation (aligned to N10-009):

An ad hoc wireless network allows devices to connect directly to each other without an access point. This is suitable for small, temporary setups like two laptops and a printer.

A. Mesh requires multiple nodes forming a larger distributed network.

B. Infrastructure requires an AP, which is not available here.

D. Point-to-point is typically for long-distance wireless links between two fixed endpoints.

References (CompTIA Network+ N10-009):

Domain: Networking Concepts — Wireless network types: infrastructure, ad hoc, mesh.

NAT (Network Address Translation) allows multiple private IP addresses to share a single public IP when accessing the internet. This conserves public IPs and provides basic security by hiding internal addresses.

B. BGP is a routing protocol.

C. OSPF is a link-state IGP.

D. FHRP provides redundant gateways, not IP sharing.

References (CompTIA Network+ N10-009):

Domain: Networking Concepts — NAT, PAT, private-to-public IP mapping.

Dynamic routing is most beneficial in a growing/changing network because it can automatically learn, adapt, and update routes as the topology changes. In Network+ (N10-009) routing objectives, dynamic routing protocols exchange routing information between routers and recalculate paths when links go down, new networks are added, or metrics change. This reduces the operational burden and the risk of human error that increases as the environment scales. With dynamic routing, adding a new subnet or branch often requires far fewer manual updates because routers propagate new route information automatically, and convergence mechanisms help restore connectivity after failures.

Option A can be partly true in large environments, but the core “best reason” emphasized for dynamic routing is the automatic adaptation to topology changes. Option B is incorrect—dynamic routing may introduce additional security considerations (route filtering, authentication, neighbor control). Option C is not a defining advantage; monitoring visibility depends on tools/telemetry rather than routing type. Therefore, the strongest and most correct reason is automatic changes and updates in network topology.

===========

Understanding the Vulnerability:

Vulnerabilities in the router CPU can be exploited to cause performance degradation, unauthorized access, or other security issues.

Firmware Update:

Firmware Role: The firmware is low-level software that controls the hardware of a device. Updating the firmware can address vulnerabilities by providing patches and enhancements from the manufacturer.

Procedure: Download the latest firmware from the vendor’s website, follow the manufacturer ' s instructions to apply the update, and verify that the update resolves the vulnerability.

Comparison with Other Options:

Replace the System Board: This is a costly and often unnecessary step if the issue can be resolved with a firmware update.

Patch the OS: Patching the OS is relevant for devices with a full operating system but not directly applicable to addressing a CPU vulnerability on a router.

Isolate the System: Temporarily isolating the system can mitigate immediate risk but does not resolve the underlying vulnerability.

Best Practice:

Regularly check for and apply firmware updates to ensure that network devices are protected against known vulnerabilities.

The correct answer is A. To support voltage requirements for devices in an IDF. In the CompTIA Network+ N10-009 objectives, network infrastructure includes power systems such as Uninterruptible Power Supplies (UPS) and Power Distribution Units (PDU), which are critical components in both MDF (Main Distribution Frame) and IDF (Intermediate Distribution Frame) environments.

A UPS provides temporary backup power during electrical outages and also conditions power by protecting against surges, spikes, and voltage fluctuations. This ensures that sensitive network equipment such as switches, routers, and servers can continue operating or safely shut down. A PDU, on the other hand, distributes electrical power to multiple devices within a rack, ensuring that all equipment receives the appropriate voltage and sufficient power capacity.

Option B is incorrect because while PDUs can help distribute power, they do not directly manage or optimize power consumption. Option C refers to networking devices like switches, not power equipment. Option D relates to environmental controls such as HVAC systems, not UPS or PDU devices.

Therefore, the primary purpose of UPS and PDU systems is to ensure stable and adequate power delivery to network devices, particularly in environments like IDFs.

In the CompTIA Network+ (N10-009) troubleshooting methodology, the step that follows verifying full system functionality (confirming the issue is resolved and validating with the user/requirements) is documenting findings, actions, and outcomes. Documentation is a required closing step because it captures what the original symptoms were, what troubleshooting steps were performed, what root cause was identified (if found), what remediation was applied, and what validation confirmed success. This record supports operational continuity by enabling faster resolution if the issue recurs, improving knowledge transfer across teams, and meeting organizational change-control or compliance requirements.

The other options fall in different parts of the methodology. Attempting to replicate the problem is typically performed earlier—after identifying symptoms and before or during isolation—to confirm the issue and help narrow scope. Implementing the plan occurs before verification; you implement the selected solution or escalation plan and then test/verify. Escalating the issue occurs when the technician lacks access, expertise, time, or evidence to proceed, and it can happen during troubleshooting—but it is not the standard step that comes after verifying resolution.

These four terms—avoidance, acceptance, mitigation, and transfer—are strategies used in risk management.

From Andrew Ramdayal’s guide:

“Risk in security refers to the potential for loss, damage, or destruction of assets or data due to a threat exploiting a vulnerability. Risk management strategies include avoidance, acceptance, mitigation, and transfer.”

A jump box is a hardened system that provides secure access to isolated or sensitive devices on a separate network.

Breakdown of Options:

A. Jump box – ✅ Correct answer. Acts as a middle point for secure remote access.

B. API gateway – Used for managing API calls, not remote access to isolated devices.

C. Secure Shell (SSH) – Requires direct connectivity, which may not be available for an isolated device.

D. Clientless VPN – Allows web-based VPN access, but does not guarantee access to isolated devices.

The correct answer is B. MAC filtering. MAC filtering is a straightforward method of restricting network access by allowing only specific device MAC (Media Access Control) addresses to connect to a wireless network. In a small, stable environment with fewer than ten devices and no expected changes, this approach is simple to implement and manage.

Each network interface card (NIC) has a unique MAC address, and wireless access points can be configured with a whitelist of approved addresses. Devices not on the list are denied access, effectively limiting connectivity to only authorized laptops. This aligns with CompTIA Network+ guidance for basic access control mechanisms in small or low-complexity networks.

Other options are less suitable in this scenario. ACLs (Access Control Lists) are typically used on routers and switches to control traffic flow based on IP addresses or protocols, not specifically device access to a wireless network. NAC (Network Access Control) provides more advanced authentication and posture assessment but is more complex and unnecessary for a small, static environment. Trusted zones refer to network segmentation concepts rather than device-level access control.

Thus, MAC filtering provides the simplest and most appropriate solution.

•Too much overlap on the same channel (all devices on channel 11) causes interference, leading to retransmissions and high latency.

•Same SSIDs (A) are expected in mesh networks.

•Device compatibility (C) would show different symptoms.

•Node power (D) affects coverage, not congestion.

???? Reference: CompTIA Network+ N10-009 Official Documentation – Wireless Troubleshooting & Signal Interference.

Understanding the 169.254.x.x Address:

An IPv4 address in the range of 169.254.x.x is an Automatic Private IP Addressing (APIPA) address, assigned when a DHCP server is unavailable.

DHCP Server Offline:

APIPA Assignment: When a device cannot obtain an IP address from a DHCP server, it assigns itself an APIPA address to enable local network communication. This allows communication with other devices on the same local subnet but not with external networks.

Resolution: Ensure the DHCP server is operational. Check for connectivity issues between the virtual machine and the DHCP server, and verify the DHCP server settings.

Comparison with Other Options:

The subnet mask is incorrect: The subnet mask 255.255.0.0 is appropriate for the 169.254.x.x range and does not prevent external access by itself.

The IP address is an RFC1918 private address: RFC1918 addresses are private IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x) but 169.254.x.x is not one of them.

The DNS server is unreachable: While this could affect name resolution, it would not prevent the assignment of a non-APIPA address or local network communication.

Troubleshooting Steps:

Verify the DHCP server’s status and connectivity.

Restart the DHCP service if necessary.

Renew the IP lease on the virtual machine using commands such as ipconfig /renew (Windows) or dhclient (Linux).

BGP (Border Gateway Protocol) uses an Autonomous System (AS) number for its operations. An AS is a collection of IP networks and routers under the control of a single organization that presents a common routing policy to the Internet. BGP is used to exchange routing information between different ASes on the Internet, making it the only protocol among the listed options that uses an AS number.References: CompTIA Network+ study materials and RFC 4271.

Link aggregation (also known as port trunking or EtherChannel) combines multiple network connections in parallel to increase throughput and provide redundancy. When two switches are connected with multiple links without any additional configuration, a Layer 2 loop may occur. Link aggregation prevents these loops by treating the multiple connections as a single logical link, using a protocol such as LACP (Link Aggregation Control Protocol).

From Andrew Ramdayal’s guide:

“Link aggregation allows you to combine multiple network connections to increase the bandwidth and provide redundancy. It helps prevent Layer 2 loops when connecting switches with multiple links by making them operate as a single logical interface.”

It is common for an access port to have both a voice VLAN and a data VLAN. A voice VLAN separates voice traffic from regular data traffic, ensuring better quality and security for voice communications.

=================

Network segmentation involves dividing a network into smaller segments or subnets. This is particularly important when integrating OT (Operational Technology) devices to ensure that these devices are isolated from other parts of the network. Segmentation helps protect the OT devices from potential threats and minimizes the impact of any security incidents. It also helps manage traffic and improves overall network performance.References: CompTIA Network+ study materials.

An API (Application Programming Interface) is the best choice when a development team needs to integrate a device’s reporting data directly into custom software. In Network+ (N10-009) objectives, network operations commonly include device management, monitoring, and automation, and APIs are a key method for programmatic access to operational data (often via REST/HTTPS with structured formats like JSON). This enables the internal support application to pull dashboards, health metrics, events, configuration details, and reporting outputs in a controlled, developer-friendly way.

SNMPv2c is primarily used for network monitoring and polling counters/alerts, but it is less secure (community strings) and is not as flexible for modern application integration as an API. A MIB is not a data-access “feature” by itself; it’s the schema/definitions SNMP uses to describe managed objects. A SIEM is a separate security analytics platform that collects and correlates logs/events—useful for security operations, but not the direct interface a custom support tool would typically call to retrieve device reporting data.

IPsec (Internet Protocol Security) is the most secure way to provide site-to-site connectivity. It provides robust security services, such as data integrity, authentication, and encryption, ensuringthat data sent across the network is protected from interception and tampering. Unlike other options, IPsec operates at the network layer and can secure all traffic that crosses the IP network, making it the most comprehensive and secure choice for site-to-site VPNs.References: CompTIA Network+ study materials and NIST Special Publication 800-77.

Multi-factor authentication (MFA) requires two or more different categories of authentication factors:

Something you know (password, PIN)

Something you have (smart card, hardware token)

Something you are (biometric)

The only valid second factor here is a hard token (e.g., a key fob generating one-time codes).

A. PIN is still “something you know,” the same category as a password.

B. Favorite color is a weak knowledge-based factor, not a true second factor.

D. Mother’s maiden name is also “something you know” and insecure.

References (CompTIA Network+ N10-009):

Domain: Network Security — Authentication methods, MFA factor categories.

A baseline establishes normal performance levels for network utilization, latency, jitter, and other metrics. After a merger, traffic patterns change, so a new baseline is needed to recalibrate monitoring thresholds and avoid excessive false alerts.

A. SLA defines performance agreements with customers but doesn’t adjust alerting.

B. Network diagrams show topology, not traffic norms.

D. Heat maps show wireless coverage, not utilization baselines.

References (CompTIA Network+ N10-009):

Domain: Network Operations — Baselines, monitoring, alerting, performance tuning.

Ascreened subnet, also known as aDMZ (Demilitarized Zone), is aboundary networkthat separates an organization ' s internal network from external-facing systems. It is used to host public services like web or email servers while protecting internal systems from exposure.

Changing default admin passwords is a fundamental first step in device hardening to prevent unauthorized access.

For 45 hosts, the minimum subnet size must allow at least 46 usable addresses (1 each for network and broadcast addresses).

A /26 subnet provides 64 addresses, 62 usable — suitable.

A /27 subnet gives only 30 usable — insufficient.

A /25 offers 126 usable — more than needed.

A /28 provides just 14 — too small.

So, the most efficient subnet with minimal wastage is /26.

From Andrew Ramdayal’s guide:

“When designing subnets, always choose the smallest subnet mask that still accommodates all hosts. A /26 provides 62 usable host addresses, suitable for networks with about 50 hosts.”

Port 22 is used for Secure Shell (SSH), which enables encrypted remote login and command execution on network devices.

Port 23 = Telnet (unencrypted)

Port 80 = HTTP

Port 123 = NTP

From Andrew Ramdayal’s guide:

“SSH uses port 22 to provide secure command-line access to devices such as switches and routers. Unlike Telnet (port 23), SSH encrypts session traffic, making it the preferred method for remote administration.”

A full-tunnel VPN forces a remote user’s traffic—including access to public internet resources—to traverse the corporate VPN tunnel and egress from the organization’s network. This is commonly required to ensure consistent enforcement of corporate security controls such as web filtering, IDS/IPS inspection, DLP policies, logging, and access control. In Network+ terms, full-tunnel VPNing routes the user’s default gateway through the VPN, meaning both internal traffic (to corporate subnets) and external traffic (to internet destinations) is sent through the encrypted tunnel.

By contrast, a split-tunnel VPN (not listed) would send only corporate-bound traffic through the VPN while allowing internet traffic to go directly out the user’s local ISP—reducing corporate bandwidth usage but also reducing centralized inspection and control. Clientless VPN usually refers to browser-based access to specific internal applications without a full network tunnel for all traffic. Site-to-site VPN connects entire networks to each other (e.g., branch office to HQ) rather than an individual remote user. SSE (Security Service Edge) is a cloud security framework/service model, not the classic VPN configuration described in the question. Hence, full-tunnel is the correct answer.

If a SQL server is allowing FTP access to all users, the most direct and best practice action is to disable unused services/ports on the server itself. Network+ (N10-009) security objectives emphasize host hardening and the principle of least functionality: only required services should be running and listening. If FTP is not required for the SQL server’s role, stopping and disabling the FTP service (and closing the associated ports on the host firewall) reduces the attack surface regardless of network firewall rules. This approach ensures the server cannot be reached via FTP even if it is placed on a different network segment or if upstream controls are misconfigured later.

Changing default passwords is important, but it does not address the unnecessary exposure of an unneeded service. Deleting NGFW rules that allow all FTP traffic could help at the perimeter, but it may unintentionally break legitimate FTP usage elsewhere and still doesn’t guarantee the server isn’t reachable from internal networks. Switch ACLs along SQL traffic paths are indirect and easy to misapply; they also add operational complexity and may not cover all access paths. The best “only required services are allowed” control is to disable the unused service/ports on the server.

===========

Definition of Jumbo Frames:

Jumbo frames are Ethernet frames with more than 1500 bytes of payload, typically up to 9000 bytes. They are used to improve network performance by reducing the overhead caused by smaller frames.

Why Switches Support Jumbo Frames:

Switches are network devices designed to manage data packets and can be configured to support jumbo frames. This capability enhances throughput and efficiency, particularly in high-performance networks and data centers.

Incompatibility of Other Devices:

Access Point: Primarily handles wireless communications and does not typically support jumbo frames.

Bridge: Connects different network segments but usually operates at standard Ethernet frame sizes.

Hub: A simple network device that transmits packets to all ports without distinguishing between devices, incapable of handling jumbo frames.

Practical Application:

Enabling jumbo frames on switches helps in environments where large data transfers are common, such as in storage area networks (SANs) or large-scale virtualized environments.

EIGRP(Enhanced Interior Gateway Routing Protocol) supports bothIPv4 and IPv6. While OSPFv3 is specific to IPv6 and RIPv2 only supports IPv4, EIGRP was extended to handle dual-stack environments efficiently.

Quality of Service (QoS) is used to prioritize certain types of traffic to ensure critical applications receive the bandwidth, low latency, and low jitter they need—especially during congestion. Network+ objectives cover QoS concepts such as classification, marking, queuing, and policing/shaping to manage how traffic is handled on interfaces and across links. If the requirement is to prioritize “classified services and applications,” QoS policies can match traffic using ports, protocols, DSCP markings, VLAN tags, or application identifiers and then place that traffic into higher-priority queues or reserve bandwidth for it. Load balancing distributes traffic across multiple servers/paths but does not inherently prioritize one class of traffic over another on congested links. TTL (time to live) is an IP header field used to prevent routing loops and is unrelated to prioritization. A CDN improves content delivery and caching for distributed users, but it is not a traffic-prioritization mechanism within an organization’s network. Therefore, QoS is the correct technology for prioritizing specific services and applications.

If the three new employees can communicate with each other’s devices, that strongly suggests their local Layer 2/Layer 3 connectivity is working (same VLAN/subnet, switching is fine, and they have IP addressing that allows local communication). The fact that they cannot access company resources (often on other subnets, servers, or the internet via internal routing) points to a problem with how these new endpoints are being addressed or routed beyond their local segment.

The most likely shared root cause affecting only “new employees” is DHCP scope/pool configuration. If the DHCP pool is exhausted, mis-scoped, or handing out incorrect options (such as an incorrect default gateway, wrong subnet mask, or an address range tied to an isolated VLAN), users could still talk locally but fail to reach resources outside their subnet. Modifying the DHCP server pool (expanding the scope, correcting the scope network, or ensuring the correct options are assigned) would resolve this with minimal changes.

A gateway routing table issue would typically affect many users, not just three new ones. DNS misconfiguration on the router would more commonly cause name-resolution problems, not block all resource access (and wouldn’t be isolated to only new employees). A workstation firewall would not usually prevent access to “company resources” in a way that consistently affects three new devices while still allowing peer connectivity.

Inconsistent arrival of RTP (Real-Time Protocol) packets indicates jitter or latency variation. A protocol analyzer (packet sniffer, e.g., Wireshark) can capture and analyze RTP streams, showing delay, jitter, and packet loss statistics.

A. Toner and probe locates cable runs, not packet analysis.

C. Cable tester checks wiring faults, not packet timing.

D. Spectrum reader is for identifying wireless interference, not analyzing RTP traffic.

References (CompTIA Network+ N10-009):

Domain: Network Troubleshooting — Protocol analyzers, VoIP troubleshooting, jitter analysis.

When a host fails to obtain an IP address from a DHCP server, it assigns itself an APIPA (Automatic Private IP Addressing) address in the 169.254.x.x range, commonly described as a “self-assigned IP.” This prevents communication outside the local link, including reaching the default gateway.

B. RFC1918 addresses are private ranges (10.x.x.x, 172.16–31.x.x, 192.168.x.x), but these are not self-assigned.

C. If the TCP/IP stack were disabled, the host wouldn’t have any IP at all.

D. If a static IP were assigned, it would show a configured value, not self-assigned.

References (CompTIA Network+ N10-009):

Domain: Network Troubleshooting — IP addressing issues, DHCP failures, APIPA behavior.

AnAccess Control List (ACL)configured on theedge firewallis the correct and most effective solution tofilter inbound traffic. The administrator can allow TCP port 443 (HTTPS) and deny all other traffic. This is a classic firewall configuration for securing public-facing servers.

The correct choice is B. Using a single public IP . PAT (Port Address Translation) is a form of NAT that allows many internal private IP addresses to share one public IP address by tracking sessions with port numbers. This is one of the most common edge-network designs for homes, small offices, and many enterprise branch environments.

The reason PAT is so useful is that it conserves public IPv4 addresses. Internal hosts keep their private addressing, and when they access external resources, the firewall or router translates those connections so they appear to come from one public address, while still keeping each session unique through port mapping.

The other options are unrelated to PAT’s primary purpose. BGP is a routing protocol for route exchange between networks. Redundant ISPs deal with resiliency and multihoming, not port-based address translation. A dual-stack IP scheme means running IPv4 and IPv6 together, which is separate from the NAT/PAT function.

This question is really asking what situation most naturally calls for PAT. When an organization wants multiple internal devices to reach the internet without assigning each device its own public IPv4 address, PAT is the standard solution. That makes using a single public IP the best answer.

Quality of Service (QoS) is crucial for real-time services like video conferencing. It prioritizes voice and video packets over less critical traffic (like file downloads), reducing latency, jitter, and packet loss.

B. Network signal may apply to wireless, but it ' s not specific to video issues.

C. Time to live (TTL) affects packet lifespan, not performance or quality.

D. Load balancing manages traffic across multiple paths but doesn’t prioritize real-time traffic like QoS does.

???? Reference:

CompTIA Network+ N10-009 Official Objectives: 3.6 – Explain the characteristics of network topologies and types.

Microwaves are known to interfere with the 2.4GHz frequency, which is the same frequency used by many wireless networks. This can cause signal degradation and intermittent connectivity issues, especially if the WAP is placed near such devices.

=================

The most common protocol for secure VPNs is IPsec (Internet Protocol Security). IPsec provides confidentiality, integrity, and authentication for VPN traffic, typically using ESP (Encapsulating Security Payload). It is used in both site-to-site and remote access VPNs.

B. GRE encapsulates traffic but does not provide encryption.

C. BGP is a routing protocol, not a VPN technology.

D. SSH can be used for secure tunneling but is not the standard for VPN deployment.

IPsec is the industry standard because it operates at Layer 3, securing IP traffic regardless of the application, making it highly versatile.

References (CompTIA Network+ N10-009):

Domain: Network Security — VPN protocols, IPsec, ESP.

To determine where slowness is occurring—especially if an upstream router is suspected—the best tools are ping and tracert/traceroute. Network+ (N10-009) troubleshooting objectives emphasize using these to test connectivity, latency, and the path packets take through the network. Ping measures reachability and round-trip time; rising latency or packet loss can indicate congestion or a failing link/device. Tracert identifies each hop along the route and reports per-hop response times, helping pinpoint whether delays begin at a specific hop (for example, the default gateway, the upstream router, or a provider edge). This allows the engineer to localize the problem area and decide whether the issue is internal, at the upstream router, or beyond.

nslookup and dig are DNS tools; they diagnose name resolution, not general network slowness location. Nmap focuses on scanning ports/hosts, and a “speed tester” measures throughput but does not locate the failing hop. tcpdump and protocol analyzer can reveal retransmissions, windowing, or application behavior, but they are not the fastest first-choice tools for locating an upstream routing/performance bottleneck across hops. Hence, tracert and ping are the correct pair.

The correct answer is B. traceroute. Traceroute is a diagnostic command used to track the path that packets take from a source device to a destination across an IP network. It identifies each hop (router or intermediary device) along the route and measures the time it takes for packets to travel between them. This makes it particularly useful for determining where communication is failing or being restricted.

In this scenario, the administrator suspects that other network devices may be restricting traffic, such as routers, firewalls, or access control devices. Traceroute helps pinpoint exactly where packets stop or experience delays, indicating a potential filtering or blocking point in the network path.

The other options are less appropriate. ipconfig is used to view or manage a device’s local IP configuration and does not test packet flow across the network. Nmap is a scanning tool used to identify open ports and services, not to trace packet paths. Ping verifies basic connectivity but does not provide insight into intermediate devices or where traffic may be blocked.

According to CompTIA Network+ objectives, traceroute is the best tool for identifying routing issues and determining whether network devices are restricting traffic.

BNC connectors are commonly used for coaxial cables, including those connecting to external antennas in Wi-Fi, radio, and surveillance systems.

Breakdown of Options:

A. BNC – Correct answer. Used for coaxial cables in wireless and antenna connections.

B. ST – Used for fiber optic cables, not antennas.

C. LC – A fiber optic connector, not for antennas.

D. MPO – Used for multi-fiber optic cables, not RF antennas.

When extending a network beyond the primary equipment location, additional access/distribution switches are typically placed in an IDF (Intermediate Distribution Frame). Network+ (N10-009) infrastructure objectives differentiate between the MDF and IDF: the MDF is the main, central wiring/equipment location (often where core switches, routers, WAN demarcation, and main cross-connects reside). As a building grows or spans multiple floors/areas, an IDF is used as a secondary wiring closet to reduce cable runs, provide local switching, and aggregate user access connections back to the MDF using backbone cabling (often fiber). This supports scalability, cable management, and performance by keeping horizontal runs within recommended distance limits.

VPC (Virtual Private Cloud) is a cloud networking construct, not a physical wiring location. VXLAN is an overlay tunneling technology used in virtualized/data center networks, not where you physically install switches. The question specifically references extending the network beyond the primary equipment location, which is a classic use case for deploying an IDF to host additional switches closer to endpoint areas while uplinking back to the MDF.

A toner and probe tool, also known as a tone generator and probe, is used to trace and identify individual cables within a bundle or to locate the termination points of cables in wiring closets and patch panels. It generates a tone that can be picked up by the probe, helping technicians quickly and accurately identify and label wall plates and wiring. This is the best tool for identifying proper wiring in the Intermediate Distribution Frame (IDF). References: CompTIA Network+ Exam Objectives and official study guides.

Introduction to Security Zones:

Security zones are logical segments within a network designed to enforce security policies and control access. They help in segregating and securing different parts of the network.

Types of Security Zones:

Trusted Zone: This is the most secure zone, typically used for internal corporate networks where only trusted users have access.

Extranet: This zone allows controlled access to external partners, vendors, or customers.

VPN (Virtual Private Network): While VPNs are used to create secure connections over the internet, they are not a security zone themselves.

Public Zone: This zone is the least secure and is typically used for public-facing services accessible by anyone.

Trusted Zone Implementation:

The trusted zone is configured to include internal corporate users and resources. Access controls, firewalls, and other security measures ensure that only authorized personnel can access this zone.

Internal network segments, such as the finance department, HR, and other critical functions, are usually placed in the trusted zone.

Example Configuration:

Firewall Rules: Set up rules to allow traffic only from internal IP addresses.

Access Control Lists (ACLs): Implement ACLs on routers and switches to restrict access based on IP addresses and other criteria.

Segmentation: Use VLANs and subnetting to segment and isolate the trusted zone from other zones.

Explanation of the Options:

A. Extranet: Suitable for external partners, not for internal-only access.

B. Trusted: The correct answer, as it provides controlled access to internal corporate users.

C. VPN: A method for secure remote access, not a security zone itself.

D. Public: Suitable for public access, not for internal corporate users.

Conclusion:

Implementing a trusted zone is the best solution for controlling access within a corporate network. It ensures that only trusted internal users can access sensitive resources, enhancing network security.

The IPv4 address 192.168.123.232 falls within the Class C range under classful addressing. In classful terms, Class C addresses have a first octet from 192 to 223, which makes any address starting with 192.x.x.x a Class C address. Network+ (N10-009) networking concepts cover IPv4 addressing fundamentals and commonly reference class ranges as foundational knowledge, even though modern networks primarily use CIDR (classless) subnetting rather than strict classful boundaries.

This address is also within a well-known private IPv4 block: 192.168.0.0/16 (RFC1918 private addressing), which is frequently used for internal networks and NIC configurations where addresses are not routable on the public internet.

To eliminate the distractors: Class A uses first octet 1–126, Class B uses 128–191, and Class D (224–239) is reserved for multicast. Since the first octet here is 192, it maps to Class C, making option C correct.

===========

Acold disaster recovery (DR) siteis a backup facility equipped withminimal infrastructure, often lacking active systems or real-time data replication. Itsgreatest advantage is cost-efficiency. Cold sites aremuch cheaperto maintain than warm or hot sites, which require continuous synchronization and operational readiness. They are used when low cost is more important than recovery speed.

The correct answer is A. The TX/RX connection is transposed . In fiber optic networking, communication requires proper alignment of the transmit (TX) and receive (RX) strands between devices. If these are reversed (not crossed correctly), the devices cannot properly send and re ceive signals, resulting in no link light . This is a common issue when working with fiber connections and media converters.

The scenario confirms that cables are tested and functional, and all devices are powered on, which eliminates physical damage or power issues. Fiber cables can still pass basic continuity tests while being incorrectly connected (TX to TX and RX to RX instead of TX to RX), which prevents link establishment.

Option B is incorrect because duplex mismatch (such as half vs. full duplex) typically causes performance issues like collisions and slow throughput, not a complete loss of link light. Option C is ruled out because the cables were tested successfully. Option D refers to errors that occur after a link is established, not a condition preventing link initialization.

According to CompTIA Network+ objectives, proper fiber polarity (TX/RX alignment) is critical for link establishment, making this the most accurate cause.

The most likely cause is that the switch ports were previously configured for a different VLAN than the one the users’ computers are on. If the native VLAN on the port doesn’t match the end device’s VLAN, communication fails.

A. Ports are error-disabled: Would result in no link at all, not common across multiple ports unless a violation occurred.

C. MDIX issue: Auto-MDIX eliminates most crossover problems on modern switches.

D. Ports are trunk ports: While possible, typical user devices should be on access ports, but if the port is incorrectly trunked, it can cause similar issues. However, “incorrect VLAN” is more precise here.

???? Reference:

CompTIA Network+ N10-009 Official Objectives: 2.3 – Given a scenario, configure and verify VLANs.

===========

Band steering allows wireless access points to automatically direct capable devices to the 5GHz band, which typically has higher throughput and less interference than the 2.4GHz band, improving performance. The document confirms:

“Band steering helps balance wireless client loads by steering dual-band capable devices to the 5GHz band, which offers higher speeds and less channel congestion than 2.4GHz.”

The CIA triad (Confidentiality, Integrity, Availability) is a foundational security model used in Network+ (N10-009) to evaluate risk and guide prioritization of mitigations. By categorizing assets and threats based on how they could impact confidentiality (data exposure), integrity (unauthorized alteration), or availability (service disruption), administrators can better understand which attacks from external actors matter most to the business and which controls to apply first. For example, a public-facing portal might prioritize availability protections (DDoS mitigation, redundancy), while sensitive customer records demand strong confidentiality controls (encryption, access control), and financial systems require integrity controls (logging, validation, change control). This model helps translate “threats” into business impact, which is central to deciding what to mitigate.

Compliance benchmarks support meeting regulatory/industry requirements, but they don’t inherently provide a conceptual lens for analyzing external attacker impact across all systems. SAML is a federation/authentication standard, not a risk model. A honeypot can provide insight into attacker behavior, but it doesn’t broadly structure risk prioritization the way CIA does. Therefore, CIA triad is the best answer.

===========

A Security Information and Event Management (SIEM) system collects, correlates, and analyzes logs from multiple sources in real-time, providing enhanced visibility across multivendor environments.

Breakdown of Options:

A. SNMP – SNMP is used for network device monitoring, but it lacks real-time correlation across multiple vendors.

B. SIEM – Correct answer. SIEM aggregates, analyzes, and correlates logs from multiple sources, providing real-time visibility.

C. Nmap – Nmap is a network scanning tool used for mapping hosts and detecting open ports but does not provide log correlation.

D. Syslog – Syslog collects logs but does not correlate or analyze them in real-time.

GSM (Global System for Mobile communications) is the international standard that uses SIM cards to authenticate and connect phones to the cellular network. GSM allows users to place and receive calls while traveling globally, provided they have a SIM card. CDMA, on the other hand, does not use SIM cards in the same way and is primarily used in the United States. (Reference: CompTIA Network+ Study Guide, Chapter on Network Fundamentals)

The correct choice is B. Captive portal . This is the common setup used in places like libraries, hotels, airports, and cafés. A user first joins the wireless network, opens a browser, and is redirected to a web page where they must log in, accept terms, or enter provided credentials. Since the question specifically mentions authentication through HTTPS , that matches the behavior of a captive portal very closely.

The other options do not line up with the scenario. WPA3 is a wireless encryption and authentication standard, but it is not the same as a browser-based login page after connection. Single sign-on and SAML are identity and federation technologies used to simplify authentication across applications or services, not to provide the typical guest Wi-Fi web login experience.

The important clue is the sequence described in the question: first connect to Wi-Fi, then authenticate through a web page. That is exactly how a captive portal works. In many public-access wireless environments, the portal sits between the client and normal internet access until the user successfully authenticates or accepts the usage policy. For Network+ exam purposes, browser-based guest wireless authentication is most directly associated with a captive portal .

The correct answer is 25, which is the default port used by SMTP (Simple Mail Transfer Protocol) for communication between mail servers. According to CompTIA Network+ (N10-009) objectives under common port numbers and protocols, SMTP operates over TCP port 25 for server-to-server email transmission.

When an email is sent from one domain to another, the sending mail server queries DNS for the recipient domain’s MX (Mail Exchange) record and then establishes an SMTP session over TCP port 25 to deliver the message. This port is specifically designated for mail relay between mail transfer agents (MTAs).

Port 21 is used for FTP (File Transfer Protocol), 53 is used for DNS (Domain Name System), and 69 is used for TFTP (Trivial File Transfer Protocol). None of these are responsible for transferring email between mail servers.

While SMTP can also use ports 587 (submission) and 465 (SMTPS) for client-to-server communication, port 25 remains the standard for mail server-to-mail server communication.

Therefore, TCP port 25 is the correct answer.

ESP (Encapsulating Security Payload) is an IPsec protocol that provides encryption, integrity, and authentication for data inside a VPN tunnel. It ensures that all tunneled traffic is encrypted.

B. SSH secures remote terminal sessions, not site-to-site VPN tunnels.

C. GRE (Generic Routing Encapsulation) provides encapsulation but does not encrypt data.

D. IKE (Internet Key Exchange) negotiates keys and establishes the IPsec tunnel but does not encrypt the payload itself.

References (CompTIA Network+ N10-009):

Domain: Network Security — VPN protocols, IPsec (AH vs. ESP), encryption in transit.

Infrastructure as a Service (IaaS) provides scalable compute power, storage, and networking resources on demand. It is the best choice for a company that needs to customize its cloud solution based on size, compute capacity, and storage needs.

IaaS Benefits:

Provides virtual machines, storage, and networking resources.

Scalable based on company needs.

Reduces the need for physical infrastructure.

Incorrect Options:

A. SaaS (Software as a Service): Delivers software applications (e.g., Google Docs, Microsoft 365) but does not provide compute/storage infrastructure.

B. PaaS (Platform as a Service): Provides a development environment for application deployment but not full infrastructure control.

D. IaC (Infrastructure as Code): A methodology for automating infrastructure, not a cloud deployment model.