CompTIA CompTIA Certifications N10-008 Questions & Answers

• Question 251:

  A technician just validated a theory that resolved a network outage. The technician then verified that all users could access resources. Which of the following is the next step the technician should take in the network troubleshooting methodology?

  A. Verify the services are restored.

  B. Test a new theory.

  C. Write the lessons learned.

  D. Identify where the network outage is occurring.

  Correct Answer: C

  The network troubleshooting methodology is a systematic process of identifying and resolving network problems. It consists of eight steps:

  1.

  Identify the problem.

  2.

  Establish a theory of probable cause.

  3.

  Test the theory to determine the cause.

  4.

  Establish a plan of action to resolve the problem and identify potential effects.

  5.

  Implement the solution or escalate as necessary.

  6.

  Verify full system functionality and, if applicable, implement preventive measures.

  7.

  Document findings, actions, and outcomes.

  8.

  Write the lessons learned. The last step, writing the lessons learned, is important for improving the network troubleshooting skills and knowledge. It involves reviewing the entire troubleshooting process, analyzing the root cause of the problem, evaluating the effectiveness of the solution, and identifying any best practices, tips, or tools that can be used for future reference. Writing the lessons learned can also help to update the network documentation, policies, and procedures, and share the experience and feedback with other network professionals

• Question 252:

  During an incident, an analyst sends reports regularly to the investigation and leadership teams. Which of the following best describes how Pll should be safeguarded during an incident?

  A. Implement data encryption and store the data so only the company has access.

  B. Ensure permissions are limited to the investigation team and encrypt the data.

  C. Implement data encryption and create a standardized procedure for deleting data that is no longer needed.

  D. Ensure the permissions are open only to the company.

  Correct Answer: C

  PII stands for Personally Identifiable Information, which is any data that can be used to identify, contact, or locate a specific individual, such as name, address, phone number, email, social security number, and so on. PII should be safeguarded during an incident to protect the privacy and security of the individuals involved, and to comply with the legal and ethical obligations of the organization. One way to safeguard PII during an incident is to implement data encryption, which is a process of transforming data into an unreadable format that can only be accessed by authorized parties who have the decryption key. Data encryption can prevent unauthorized access, modification, or disclosure of PII by malicious actors or third parties. Another way to safeguard PII during an incident is to create a standardized procedure for deleting data that is no longer needed, such as after the incident is resolved or the investigation is completed. Deleting data that is no longer needed can reduce the risk of data breaches, data leaks, or data theft, and can also save storage space and resources. A standardized procedure for deleting data can ensure that the data is erased securely and completely, and that the deletion process is documented and audited.

• Question 253:

  Users ate moving back into an office that had been vacant for awhile. Ten workstations are hooked up in the office, but one workstation cannot obtain a link with (he switch. A network engineer checks the documentation and cable labeling, and everything is hooked up as expected. The engineer moves the connection lo a different switchport. but a link still cannot be obtained. When the engineer puts a tone generator on (he infrastructure cable, no tone is heard at the far end. Which of the following issues is the engineer MOST likely trying to find?

  A. A bad switchport

  B. A break in the cable

  C. A cable short

  D. Cable interference

  Correct Answer: B

  A break in the cable means that there is no electrical continuity between the two ends of the cable, which prevents the signal from reaching the switch. A tone generator is a device that sends an audible signal through the cable, and if no tone is heard at the far end, it indicates a break in the cable.

• Question 254:

  Which of the following refers to a weakness in a mechanism or technical process?

  A. Vulnerability

  B. Risk

  C. Exploit

  D. Threat

  Correct Answer: A

  The term that refers to a weakness in a mechanism or technical process is vulnerability. A vulnerability is a flaw or gap in a system's security that can be exploited by an attacker to gain unauthorized access, compromise data, or cause damage. A vulnerability can be caused by design errors, configuration errors, software bugs, human errors, or environmental factors. For example, an outdated software version that has known security holes is a vulnerability that can be exploited by malware or hackers.

• Question 255:

  An organization has a security staff shortage and must prioritize efforts in areas where the staff will have the most impact. In particular, the focus is to avoid expending resources on identifying non-relevant events. A security analyst is reviewing web server logs and sees the following:

  

  Which of the following should the analyst recommend?

  A. Configuring the web server log to filter out 404 errors on image files

  B. Updating firewall rules to block 202.180.155.1

  C. Resyncing the network time server and monitoring logs for future anomalous behavior

  D. Checking with the penetration testing team to see if the team ran any scans on January 14, 2021

  Correct Answer: A

  This answer will help the organization to avoid expending resources on identifying non- relevant events, as the 404 errors on image files are not indicative of any security threat or issue, but rather a misconfiguration or a broken link on the web server. The 404 errors on image files are also very frequent and repetitive, as shown by the web server log, which can clutter the log and make it harder to spot any relevant events. By filtering out these errors, the analyst can focus on more important events and reduce the noise in the log. The other answers are not as good as A, because they either do not address the problem of identifying non-relevant events, or they are based on incorrect assumptions or information. For example:

  B. Updating firewall rules to block 202.180.155.1 is not a good answer, because the IP address 202.180.155.1 is not doing anything malicious or suspicious, but rather requesting image files that do not exist on the web server. Blocking this IP address will not improve the security of the web server, but rather create unnecessary firewall rules and possibly deny legitimate access to the web server. C. Resyncing the network time server and monitoring logs for future anomalous behavior is not a good answer, because there is no evidence that the network time server is out of sync or causing any problems. The web server log shows that the entries are all within a few minutes of each other, which is normal and expected. Resyncing the network time server will not help the analyst to identify non-relevant events, but rather waste time and resources on an unrelated task. D. Checking with the penetration testing team to see if the team ran any scans on January 14, 2021 is not a good answer, because the web server log does not show any signs of a penetration test or a scan. The log shows only 404 errors on image files, which are not typical of a penetration test or a scan, which would usually target different types of files, ports, or vulnerabilities. Checking with the penetration testing team will not help the analyst to identify non-relevant events, but rather distract the analyst from the actual events and possibly create false alarms.

  https://www.professormesser.com/network-plus/n10-008/n10-008-video/general-network- troubleshooting-n10-008/

• Question 256:

  A user reports having intermittent connectivity issues to the company network. The network configuration for the user reveals the following:

  IP address: 192.168.1.10

  Subnet mask: 255.255.255.0 Default gateway: 192.168.1.254

  The network switch shows the following ARP table: Which of the following is the most likely cause of the user's connection issues?

  

  A. A port with incorrect VLAN assigned

  B. A switch with spanning tree conflict

  C. Another PC with manually configured IP

  D. A router with overlapping route tables

  Correct Answer: C

• Question 257:

  A network administrator needs to connect two routers in a point-to-point configuration and conserve IP space. Which of the following subnets should the administrator use?

  A. /24

  B. /26

  C. /28

  D. /30

  Correct Answer: D

  A /30 subnet is the smallest possible subnet that can be used for a point-to-point configuration between two routers. A /30 subnet has only two usable host addresses, one for each router, and a network address and a broadcast address. A /30 subnet conserves IP space by minimizing the number of wasted addresses. A /24, /26, or /28 subnet would have more usable host addresses than needed for a point-to-point configuration and would waste IP space.

• Question 258:

  Which of the following common agreements would a company most likely have an employee sign as a condition of employment?

  A. NDA

  B. ISP

  C. SLA

  D. MOU

  Correct Answer: A

  An NDA, or non-disclosure agreement, is a legal contract that binds an employee to keep certain information confidential and not share it with unauthorized parties. This information may include trade secrets, intellectual property, business strategies, customer data, or other sensitive or proprietary information that gives the company a competitive advantage. An NDA protects the company's interests and prevents the employee from disclosing or using the information for personal gain or malicious purposes1.

• Question 259:

  A network engineer installed a new fiber uplink for an office and wants to make sure that the link meets throughput requirements. Which of the following tools should the engineer use to verify that the new link is sufficient?

  A. tcpdump

  B. ping

  C. iperf

  D. netstat

  Correct Answer: C

  iperf is a tool that can measure the bandwidth and quality of a network link by generating and transferring TCP or UDP data streams. iperf can report the maximum achievable throughput, packet loss, jitter, and other statistics for a given link.

  iperf can be used to test both the uplink and downlink performance of a network link by running it on two endpoints and specifying the direction and duration of the test. iperf can help the engineer verify that the new fiber uplink meets the

  throughput requirements for the office network. tcpdump is a tool that can capture and analyze network traffic by filtering and displaying packets based on various criteria. tcpdump can help the engineer troubleshoot network problems,

  monitor network activity, and inspect packet contents, but it cannot measure the throughput or quality of a network link.

  ping is a tool that can test the reachability and latency of a network host by sending and receiving ICMP echo packets. ping can help the engineer check if the new fiber uplink is connected and responsive, and how long it takes for packets to

  travel between the endpoints, but it cannot measure the throughput or quality of a network link. netstat is a tool that can display information about the network connections, routing tables, interfaces, and protocols on a network host. netstat

  can help the engineer view the status and details of the network connections using the new fiber uplink, but it cannot measure the throughput or quality of a network link.

• Question 260:

  Which of the following disaster recovery metrics describes the average length of time a piece of equipment can be expected to operate normally?

  A. RPO

  B. RTO

  C. MTTR

  D. MTBF

  Correct Answer: D

  MTBF is the disaster recovery metric that describes the average length of time a piece of equipment can be expected to operate normally. MTBF stands for mean time between failures, which is a measure of the reliability and availability of a device or system. MTBF is calculated by dividing the total operating time by the number of failures that occurred during that time. MTBF indicates how often a device or system fails and how long it can run without interruption. A higher MTBF means a lower failure rate and a longer operational life span.