N10-009: CompTIA Network+

Implement the solution happens only after a probable cause has been identified, tested if necessary, and a remediation path has been chosen. This step is about making the change, such as replacing a cable, reconfiguring a switch port, or updating a routing table. Checking each OSI layer is primarily a diagnostic technique used before changes are made, not the implementation itself. While implementation may involve touching a specific layer, it is not the stage where you systematically analyze all layers to find the cause.

Create a plan of action comes after you have a likely cause and are deciding how to resolve it. In this phase, you consider the impact of the fix, required resources, rollback options, and communication or escalation needs. The OSI model can inform the plan, but the actual layer-by-layer checking is done earlier when diagnosing the issue. Planning is about remediation strategy, not root-cause investigation.

Verify functionality is the post-fix step where you confirm the issue is resolved and that full system operation has been restored. This can include testing connectivity, application access, and user experience after the solution is applied. Although verification may touch multiple OSI layers, the question asks about checking through each level after the problem has been identified, which points to diagnosis rather than confirmation. On the exam, verification is associated with validating the fix, not determining the probable cause.

A separate DHCP scope with a /32 subnet is not a typical or practical solution for assigning a stable address to a single server. DHCP scopes are normally aligned to real subnets/VLANs. A /32 represents a single host route and does not match how clients communicate on a LAN segment. Reservations within the existing scope are the standard method to give one device a consistent IP via DHCP.

A static IP address within the DHCP IP range is a common mistake because the DHCP server may lease that same address to another client, causing an IP conflict and intermittent connectivity issues. If using static addressing, best practice is to place it outside the DHCP pool and document it carefully. Given the organization uses DHCP, a reservation is safer and more manageable.

SLAAC (Stateless Address Autoconfiguration) is an IPv6 mechanism where hosts self-generate addresses based on router advertisements. While useful for client networks, it is not ideal for a file server that needs a predictable, centrally controlled address. Servers typically use static IPv6 or DHCPv6 reservations/assignments (plus stable DNS), not SLAAC, for consistent access.

VLAN tagging refers to IEEE 802.1Q, which inserts VLAN IDs into Ethernet frames to segment Layer 2 networks. It deals with switching, trunk ports, and broadcast domain separation—not identity, encryption, or certificate formats. X.509 certificates operate at higher layers for authentication and encryption (e.g., TLS), so VLAN tagging is unrelated.

LDAP is a directory protocol used to access and manage directory information, such as users, groups, and sometimes certificate-related objects. Although LDAP directories can store X.509 certificates or publish certificate revocation information, LDAP is not the trust model or certificate framework itself. X.509 is most directly tied to PKI, which handles certificate issuance, validation, and chain of trust. Therefore, LDAP may interact with certificates in some environments, but it is not the technology most commonly associated with X.509.

MFA (multi-factor authentication) is an authentication strategy requiring two or more factor types (something you know/have/are). Certificates can be used as “something you have” (smart card/cert-based auth), but MFA is not inherently tied to X.509. X.509 is a certificate standard; PKI is the infrastructure that uses it.

Enterprise authentication usually refers to WPA2/WPA3-Enterprise using 802.1X with a RADIUS/AAA backend (often integrated with AD/LDAP and EAP methods). While secure and scalable for employees, it’s not the typical solution for temporary access because it requires distributing credentials/certificates and configuring client supplicants, which is cumbersome for guests and short-term users.

An ad hoc network is a device-to-device (peer-to-peer) wireless network without a centralized access point and without centralized authentication controls. It’s generally discouraged in enterprise environments because it bypasses standard security monitoring and policy enforcement. It does not provide a managed, temporary authentication process for accessing an organization’s network resources.

WPA3 is a Wi-Fi security standard that improves encryption and authentication (e.g., SAE for Personal, stronger cryptography for Enterprise). However, WPA3 alone doesn’t create a temporary access workflow like vouchers or web-based login. You could run a guest SSID with WPA3-Personal, but that still relies on sharing a PSK rather than providing controlled, expiring, user-specific access.

A crash cart is a portable set of local-access tools (monitor, keyboard, mouse, cables/serial adapter) used to connect directly to a server or appliance in a data center. It’s useful when the device won’t boot or has no network access, but it requires someone physically on-site. Because the question asks for remote access, a crash cart is not the best answer.

A jump box (jump host/bastion host) is a hardened system used as an intermediate point to access internal resources securely. It improves security and auditing, but it still depends on the target appliance being reachable over the network and having working in-band management services. If the appliance failed to start properly, a jump box won’t help you access its console/boot process.

Secure Shell (SSH) is an in-band remote management protocol that requires the device OS/network stack to be running and the SSH service to be available. If the appliance fails during boot, interfaces may not come up and the SSH daemon may never start, making SSH unusable. SSH is excellent for normal remote administration, but not for boot-level recovery access.

MAC flooding (CAM table flooding) sends many frames with spoofed source MAC addresses to overflow a switch’s MAC address table. When the table is full, the switch may flood traffic out all ports, enabling sniffing. This attack is about exhausting switch memory/resources, not about adding multiple VLAN (802.1Q) tags to a single frame.

DNS spoofing (DNS cache poisoning) forges DNS responses so a victim resolves a domain name to an attacker-controlled IP address. It operates at the application layer (DNS over UDP/TCP 53) and involves transaction IDs, caching behavior, and sometimes man-in-the-middle positioning. It does not involve Ethernet frames containing multiple VLAN tags.

ARP poisoning (ARP spoofing) sends forged ARP replies to associate the attacker’s MAC address with a legitimate IP address (e.g., the default gateway), enabling man-in-the-middle or denial-of-service on a LAN. This is a Layer 2/Layer 3 adjacency attack using ARP messages, not an attack based on inserting multiple VLAN tags into a frame.

Full duplex allows simultaneous send/receive on a single Ethernet link, eliminating collisions compared to half duplex. It improves performance and is a common default on modern switched networks. However, it does not provide redundancy because it still relies on one physical port and one cable. If that link fails, connectivity is lost, so it does not meet the requirement for redundant uplinks.

802.1Q tagging is used on trunk links to carry traffic for multiple VLANs over a single physical connection by adding VLAN tags to frames. This is a VLAN segmentation and trunking feature, not a redundancy mechanism. You could use 802.1Q on an aggregated uplink, but tagging alone does not provide failover if one of the physical links goes down.

A native VLAN is the VLAN used for untagged frames on an 802.1Q trunk. It is important for interoperability and to avoid VLAN mismatch issues, and best practice often recommends changing it from VLAN 1 and ensuring it matches on both ends. However, native VLAN configuration does not create redundant physical paths; it only affects how untagged traffic is handled on a trunk.

Port 25 is standard SMTP used primarily for server-to-server email transport (MTA to MTA). While STARTTLS can be enabled on 25, it is commonly used for relaying and may allow opportunistic (not enforced) encryption. Many organizations block outbound 25 from clients to reduce spam. For “secure email submission,” 587 is the better, modern choice.

Port 110 is POP3, used by clients to retrieve email from a mailbox. POP3 on 110 is typically cleartext unless upgraded with STARTTLS (not always enabled). The secure, implicit TLS version is POP3S on port 995. Since 995 is not listed, 110 is not the correct answer for secure email.

Port 143 is IMAP, used for email retrieval and mailbox synchronization. Like POP3, IMAP on 143 is not inherently encrypted, though it can use STARTTLS if configured. The secure, implicit TLS version is IMAPS on port 993. Because 993 is not an option, 143 is not the secure email port here.

Dynamic inventories help track assets and can improve visibility into what devices and services exist in the environment. That information is useful for operations, patching, and incident response, but it does not itself enforce security restrictions or prevent insecure changes. In other words, inventory is supportive rather than a primary hardening control. Compared with least privilege and drift prevention, it is not one of the best direct security improvements.

Central policy management can improve consistency and simplify administration, but it is not itself as direct a security control as restricting access or preventing insecure configuration changes. A centralized console or policy framework is only effective if the underlying policies are strong and properly enforced. In this question, the better post-breach improvements are the controls that directly reduce permissions and stop baseline deviation. Therefore, central policy management is beneficial but not among the best two choices.

Zero-touch provisioning automates deployment of devices and can reduce manual setup effort. However, automation alone does not guarantee stronger security, and it can even spread poor configurations quickly if the templates are weak. It is primarily an operational efficiency feature rather than a direct post-breach hardening measure. For improving overall security, access restriction and configuration integrity are more impactful.

Subnet range limits mainly affect network sizing and broadcast domain design rather than directly improving security. Smaller subnets can sometimes support segmentation strategies, but simply limiting subnet ranges does not enforce access control or maintain secure configurations. Without ACLs, firewalls, or VLAN-based policy enforcement, this option provides little direct protection. It is therefore not one of the best answers for increasing overall security after a breach.

Web traffic filtered through a web filter is more aligned with a full-tunnel VPN design, where all remote-user internet traffic is forced through the corporate network and inspected by corporate web proxies/secure web gateways. That can improve policy enforcement and visibility, but it is typically not the cost-saving advantage of split tunneling. Split tunneling often bypasses centralized web filtering for non-corporate destinations.

This is the opposite of what split tunneling provides. Full-tunnel VPNs require more bandwidth on the company’s internet connection because all remote-user traffic (including streaming, updates, and SaaS) hairpins through corporate egress. Split tunneling reduces required bandwidth and VPN gateway load by keeping non-corporate traffic off the tunnel and off the corporate internet circuit.

Detecting insecure machines via monitoring is not a defining advantage of split tunneling. In fact, split tunneling can reduce centralized visibility because some traffic does not traverse corporate security monitoring points (firewalls, IDS/IPS, proxies). Endpoint posture checks (NAC-like posture, EDR, MDM compliance) can exist with either split or full tunneling, but they are not a cost-focused advantage specific to split tunneling.

netstat displays local TCP/UDP sessions, listening ports, and connection states (and sometimes per-interface statistics depending on flags). It can confirm that a client has an established connection to the web server and which local port is used, but it does not reveal the upstream hop-by-hop path or which ISP/WAN link carried the traffic. It’s more useful for host-level socket troubleshooting than WAN path selection.

nslookup queries DNS to resolve a hostname to an IP address (and can show which DNS server answered). This helps verify name resolution issues or identify the destination IP to test, but it cannot determine which internet link is being used. DNS resolution is separate from routing decisions; the same resolved IP could be reached via either WAN link depending on load balancing/policy routing.

ping tests basic IP connectivity and round-trip time to a destination using ICMP Echo. It can indicate packet loss or latency that might correlate with one WAN link being degraded, but it does not show the route taken. In a dual-WAN environment, ping alone can’t reliably tell which link was used unless combined with other information (e.g., source interface selection or router logs).

A denial-of-service attack targets availability by overwhelming a service, host, or network link so legitimate users cannot access the website. While a DoS might cause timeouts or errors (e.g., 503, connection failures), it does not inherently redirect users to an entirely different website; it primarily prevents access.

Social engineering manipulates users into taking actions such as clicking a malicious link, trusting a fake email, or entering credentials on a phishing page. It can lead users to a different website, but it relies on user deception rather than a network-level mechanism that redirects users when they attempt to access the real company site.

ARP spoofing (ARP poisoning) forges ARP replies on a local network to associate the attacker’s MAC address with another IP (often the default gateway), enabling man-in-the-middle or traffic interception. It can influence where traffic flows on a LAN, but it is not the primary mechanism for domain-based redirection across users like DNS poisoning is.

ARP spoofing (ARP poisoning) is when an attacker sends forged ARP replies to trick hosts into associating the attacker’s MAC address with a legitimate IP (often the default gateway). This enables man-in-the-middle or traffic redirection. It targets ARP caches and IP-to-MAC resolution, not the switch’s CAM table capacity. Mitigations include Dynamic ARP Inspection (DAI) and DHCP snooping.

An evil twin is a wireless attack where an attacker sets up a rogue access point that mimics a legitimate SSID (often with stronger signal) to lure users into connecting. The goal is credential theft or traffic interception. It is specific to Wi-Fi/802.11 environments and does not involve overflowing a switch’s CAM/MAC address table.

DNS poisoning (DNS cache poisoning) corrupts DNS resolution so a domain name resolves to an attacker-controlled IP address. This redirects users to malicious sites or enables interception. It operates at the application/name-resolution layer and is unrelated to Layer 2 switching tables like the CAM table. Mitigations include DNSSEC, secure resolvers, and cache-hardening.

URL filters restrict which web domains/categories users can access (often via proxy or next-gen firewall). They do not prevent a device from connecting to the LAN, getting an IP address, or reaching non-web services (SMB, RDP, DNS, etc.). In this scenario, visitors gained network access at Layer 2/3 by plugging into a port; URL filtering would only limit some HTTP/HTTPS traffic after the fact.

A VPN provides an encrypted tunnel for remote users over untrusted networks (e.g., the internet) into the corporate network. It does not stop someone who is physically connected to an internal switch port from accessing the LAN. While you could require VPN for certain resources, the visitor would still have local network connectivity unless admission control (like NAC/802.1X) is enforced.

ACLs (Access Control Lists) filter traffic based on IP, protocol, and ports at routers, firewalls, or Layer 3 switches. They are useful for segmentation and limiting what a connected host can reach, but they don’t authenticate the endpoint or prevent link-level access. A visitor could still connect, obtain DHCP, and potentially access allowed services; ACLs are not the best control for open wall jacks.

dig is a DNS query tool used to retrieve DNS records (A/AAAA, CNAME, MX, TXT, SRV, etc.) from a DNS server. It helps troubleshoot name resolution issues, such as incorrect records or propagation problems. However, dig does not scan a host for open TCP/UDP ports and cannot determine whether a fileshare port like TCP 445 is open or filtered.

tracert (Windows traceroute) maps the network path to a destination by sending packets with increasing TTL values, revealing intermediate hops and round-trip times. It is useful for diagnosing routing problems, asymmetric paths, or where latency/packet loss begins. It does not test or enumerate which application ports are open on the destination host, so it won’t confirm SMB port availability.

nslookup is a DNS troubleshooting utility used to query DNS servers for name-to-IP resolution and record verification. It can confirm whether the server name resolves correctly and whether the client is using the right DNS server. But it does not probe TCP/UDP ports on the target host, so it cannot identify which ports are open on the remote file server.

A router primarily connects different networks and forwards packets based on IP routing tables (Layer 3). While routers can use features like policy-based routing or ECMP to choose paths, they are not typically used to distribute client web requests across multiple backend servers with health checks and server pools. In exam context, “distribute user traffic across web servers” points beyond routing to application delivery/load balancing.

A switch primarily operates at Layer 2 (and sometimes Layer 3 for multilayer switches) to forward frames within a LAN using MAC address tables. Switches can provide redundancy (STP), segmentation (VLANs), and high throughput, but they do not natively provide server-pool load distribution, application-aware routing, or health checks for web servers. They move traffic, but they don’t balance web requests across servers.

A firewall enforces security policies by filtering and inspecting traffic (stateful inspection, application control, NAT, etc.). Although some next-generation firewalls can include features resembling load balancing, that is not their primary purpose. For Network+ exam questions, a firewall is chosen when the goal is to block/allow traffic, segment networks, or protect resources—not to distribute user requests across multiple web servers.

A self-signed certificate affects TLS trust, not DNS resolution. The user would typically still reach the correct IP/website but receive a certificate warning or be blocked by policy (HSTS/enterprise inspection). It does not cause the URL to resolve to an incorrect IP address; it occurs after name resolution and TCP/TLS negotiation begin.

A nameserver (NS) record controls DNS delegation for a domain. If NS records were wrong or missing, many or all users would fail to resolve the domain (depending on caching and resolver paths), not just a single user. Since other users can reach the site without issue, domain-level NS delegation is unlikely to be the root cause.

IP helper (often referring to DHCP relay on routers/switches) forwards broadcast DHCP requests to a DHCP server across subnets. It is used for IP address assignment, not for resolving URLs to IP addresses. A misconfigured IP helper might prevent a host from getting an IP, but it would not specifically cause one URL to resolve incorrectly.

Port 22 is SSH, which provides encrypted remote administration (secure alternative to Telnet/23). For hardening, you typically keep SSH if you need remote management, but restrict it: limit source IPs, use key-based authentication, disable root login, and enforce strong ciphers. Disabling 22 could hinder secure administration and is not required by the “encrypted connections” requirement.

Port 443 is HTTPS (HTTP over TLS). This is the standard encrypted web service port and is exactly what you would use to meet the requirement that all connections are encrypted. Disabling 443 would prevent secure web access and contradict the goal of hosting a secure web server.

Port 587 is SMTP submission, typically used by clients/applications to submit outbound email to a mail server. It commonly supports STARTTLS to encrypt the session. While it may be unnecessary on a pure web server (and could be disabled if not needed), it is not the primary port that violates the “all connections encrypted” requirement in the way HTTP/80 does.