Practice Test #2

netstat displays local TCP/UDP sessions, listening ports, and connection states (and sometimes per-interface statistics depending on flags). It can confirm that a client has an established connection to the web server and which local port is used, but it does not reveal the upstream hop-by-hop path or which ISP/WAN link carried the traffic. It’s more useful for host-level socket troubleshooting than WAN path selection.

nslookup queries DNS to resolve a hostname to an IP address (and can show which DNS server answered). This helps verify name resolution issues or identify the destination IP to test, but it cannot determine which internet link is being used. DNS resolution is separate from routing decisions; the same resolved IP could be reached via either WAN link depending on load balancing/policy routing.

ping tests basic IP connectivity and round-trip time to a destination using ICMP Echo. It can indicate packet loss or latency that might correlate with one WAN link being degraded, but it does not show the route taken. In a dual-WAN environment, ping alone can’t reliably tell which link was used unless combined with other information (e.g., source interface selection or router logs).

dig is a DNS query tool used to retrieve DNS records (A/AAAA, CNAME, MX, TXT, SRV, etc.) from a DNS server. It helps troubleshoot name resolution issues, such as incorrect records or propagation problems. However, dig does not scan a host for open TCP/UDP ports and cannot determine whether a fileshare port like TCP 445 is open or filtered.

tracert (Windows traceroute) maps the network path to a destination by sending packets with increasing TTL values, revealing intermediate hops and round-trip times. It is useful for diagnosing routing problems, asymmetric paths, or where latency/packet loss begins. It does not test or enumerate which application ports are open on the destination host, so it won’t confirm SMB port availability.

nslookup is a DNS troubleshooting utility used to query DNS servers for name-to-IP resolution and record verification. It can confirm whether the server name resolves correctly and whether the client is using the right DNS server. But it does not probe TCP/UDP ports on the target host, so it cannot identify which ports are open on the remote file server.

IPS (Intrusion Prevention System) typically operates inline, inspecting packets and making allow/deny decisions before forwarding traffic. Because it sits in the traffic path, it can introduce latency and become a throughput bottleneck if undersized or heavily loaded. IPS is best when the goal is to actively block malicious traffic in real time, not when the requirement is analysis without impacting latency.

A load balancer distributes client requests across multiple servers to improve availability and performance. While it can provide some visibility (health checks, basic logs) and may integrate with WAF features in some products, its primary purpose is not attack analysis. It is also typically inline, so it can affect traffic flow characteristics and is not the best answer for passive attack analysis without latency impact.

A firewall enforces security policy by allowing or blocking traffic based on rules (IP/port/protocol, state, and possibly application inspection in NGFWs). Firewalls are inline devices, so traffic must traverse them, which can add latency and processing overhead. Although firewalls provide useful logs, they are primarily control/enforcement devices rather than passive analysis tools that avoid affecting latency.

Fire suppression systems are important building safety controls, but they are not usually the best answer when the exam asks for environmental factors affecting equipment installation conditions. The question is more focused on the operating environment and facility support requirements for the equipment itself. In this context, humidity and electrical load are more direct environmental considerations.

UPS location is primarily a facility layout and power-design consideration rather than an environmental factor. It affects cable routing, maintenance access, and battery placement, but it does not describe the ambient conditions or utility capacity of the room. The exam typically separates placement decisions from environmental operating requirements.

Floor construction type is a structural consideration related to load-bearing capacity, raised flooring, and cable routing. While it can influence how equipment is installed, it is not generally categorized as an environmental factor in Network+ terminology. Environmental factors are more commonly things like humidity, temperature, and electrical capacity.

Proximity to the nearest MDF is a network design and cabling-distance issue. It affects backbone connectivity, pathway planning, and adherence to cable length limitations, but it does not describe the room’s environmental suitability for equipment. Therefore it is not one of the environmental factors being tested here.

ifconfig is used to view and configure network interface parameters (IP address, netmask, MTU, interface up/down status) on Unix-like systems. It helps verify Layer 1/2/3 configuration issues such as wrong IP, incorrect subnet mask, or disabled interface. It does not capture packets or inspect application-layer traffic, so it cannot show what the application is sending/receiving.

nslookup queries DNS servers to resolve hostnames to IP addresses (and vice versa) and can help diagnose name resolution problems (Layer 7 service, but limited to DNS specifically). While DNS issues can cause application failures, nslookup does not let you inspect general application traffic flows or payloads. It only tests DNS query/response behavior.

traceroute (or tracert) identifies the network path to a destination by probing TTL/hop limits and reporting intermediate routers. It is useful for diagnosing routing issues, asymmetric paths, or where packets are being dropped. However, it does not capture or decode application-layer traffic and cannot show whether the application protocol exchange is succeeding.

VLANs on the perimeter are used for segmentation (e.g., separating DMZ, guest, and internal networks) and controlling broadcast domains and policy boundaries. VLANs can exist at the edge, but they do not provide address translation. PAT is about translating IP addresses and ports, not creating logical Layer 2 segments, so VLANs are not what an organization uses PAT for.

A non-routable (private/RFC1918) address on the perimeter router’s Internet-facing interface would not work for direct Internet connectivity because upstream providers will not route private addresses. PAT is used to translate internal private addresses to a routable public address. While the router may have private IPs on its inside interface, PAT’s key requirement is a public IP on the outside.

Servers on the perimeter refers to a DMZ/perimeter network design where public-facing services (web, mail, DNS) are placed in a screened subnet. PAT can be used alongside a DMZ, but the presence of servers on the perimeter is not what PAT is for. Publishing servers typically uses static NAT or port forwarding rather than generic outbound PAT.

VPN (Virtual Private Network) creates an encrypted tunnel over an untrusted network (like the internet) to provide secure remote access or site-to-site connectivity. It protects confidentiality and integrity of traffic and can extend a private network to remote users. However, it does not cache or replicate website content at edge locations, so it is not used to stage copies of a website closer to users.

SAN (Storage Area Network) is a high-speed network that provides block-level storage to servers, commonly used in data centers for shared storage, virtualization clusters, and high availability. SAN technologies include Fibre Channel and iSCSI. While a SAN can store website files centrally for servers, it does not distribute copies globally to be closer to end users, so it doesn’t meet the question’s goal.

SDN (Software-Defined Networking) separates the control plane from the data plane and uses centralized controllers to program and automate network behavior. SDN improves agility, policy enforcement, and network management, especially in large or virtualized environments. However, SDN does not inherently provide edge caching or global replication of website content, so it is not the correct choice for staging website copies near users.

Coaxial cable is largely legacy for Ethernet (10BASE2/10BASE5) and is not the standard medium for modern inter-closet uplinks. While coax can carry signals over decent distances, it does not align with typical enterprise backbone design for Ethernet switching today, and it lacks the flexibility and performance/scalability expected compared to fiber.

DAC (Direct Attach Copper) is a short-range twinax cable used with SFP/SFP+ ports, commonly for switch-to-switch or server-to-switch connections within the same rack or nearby racks. Typical DAC lengths are around 1–7m (sometimes up to ~10–15m depending on type). It is not suitable for a 150m run between network closets.

STP (Shielded Twisted Pair) helps reduce electromagnetic interference and crosstalk, but it does not extend the Ethernet maximum channel distance beyond 100m for structured cabling. At 150m, the link would exceed standards and risk errors/instability. For closet-to-closet runs beyond 100m, fiber is the correct medium.

Incorrect. Restoring default settings on devices addresses configuration issues (VLANs, speed/duplex negotiation edge cases, port security, etc.), not physical-layer crosstalk. Crosstalk is induced coupling between wire pairs and is primarily determined by cable construction, termination quality, and installation practices, not by switch/router configuration.

Incorrect as a first step. Re-terminating may ultimately be required, but best troubleshooting practice is to inspect and verify what is wrong before redoing work. Without inspection, the electrician might repeat the same termination mistake (excess untwist, wrong pair order, poor crimp). Inspect first, then re-terminate if defects are found or if testing confirms failure.

Incorrect as a first step. Radio frequency interference/EMI can contribute to noise, but the scenario points to a new Cat 8 run with passthrough plugs, making termination-induced NEXT/alien crosstalk far more likely. RFI investigation is more appropriate after confirming terminations are correct and if issues correlate with environmental factors (motors, fluorescent ballasts, RF transmitters).