NEW QUESTION 1

A software developer changed positions within a company and is now a sales engineer. The security team discovered that the former software developer had been modifying code to implement small features requested by customers. Which of the following would be the best thing for the security administrator to implement to prevent this from happening?

• A. A software patching policy
• B. A role-based access control policy
• C. Firewalls on the software development servers
• D. Longer and more complex password requirements

Answer: B

Explanation:
A role-based access control (RBAC) policy is a security measure that assigns permissions and privileges to users based on their roles and responsibilities within an organization. RBAC helps to enforce the principle of least privilege, which states that users should only have the minimum level of access required to perform their tasks. RBAC also helps to prevent unauthorized access, modification, or misuse of sensitive data or resources by limiting the scope and impact of user actions.
A software patching policy, firewalls on the software development servers, and longer and more complex password requirements are all good security practices, but they do not directly address the issue of preventing the former software developer from modifying code. A software patching policy ensures that software is updated regularly to fix bugs and vulnerabilities, but it does not prevent a user from introducing new code changes. Firewalls on the software development servers protect the servers from external attacks, but they do not prevent a user from accessing the servers internally. Longer and more complex password requirements make it harder for attackers to guess or crack passwords, but they do not prevent a user from using their own valid credentials.
References
1: Role-Based Access Control (RBAC) - Definition and Examples 2: Network+ (Plus) Certification | CompTIA IT Certifications
3: [What is the Principle of Least Privilege? - Definition from Techopedia]

NEW QUESTION 2

An engineer needs to restrict the database servers that are in the same subnet from communicating with each other. The database servers will still need to communicate with the application servers in a different subnet. In some cases, the database servers will be clustered, and the servers will need to communicate with other cluster members. Which of the following technologies will be BEST to use to implement this filtering without creating rules?

• A. Private VLANs
• B. Access control lists
• C. Firewalls
• D. Control plane policing

Answer: A

Explanation:
"Use private VLANs: Also known as port isolation, creating a private VLAN is a method of restricting switch ports (now called private ports) so that they can communicate only with a particular uplink. The private VLAN usually has numerous private ports and only one uplink, which is usually connected to a router, or firewall."

NEW QUESTION 3

A user cannot connect to the network, although others in the office are unaffected. The network technician sees that the link lights on the NIC are not on. The technician needs to check which switchport the user is connected to, but the cabling is not labeled. Which of the following is the best way for the technician to find where the computer is connected?

• A. Look up the computer's IP address in the switch ARP table.
• B. Use a cable tester to trace the cable.
• C. Look up the computer's MAC address in the switch CAM table.
• D. Use a tone generator to trace the cable.

Answer: D

Explanation:

A tone generator is a device that emits an audible signal on a wire. A tone probe is a device that detects the signal on the wire. By attaching the tone generator to one end of the cable and using the tone probe to scan the other end, the technician can identify which switchport the cable is connected to. This method does not require any knowledge of the computer’s IP or MAC address, or access to the switch configuration. It is also faster and more reliable than physically tracing the cable or disconnecting the cable and looking for the link light to go out on the switch.
ReferencesHow to find what port im connected to on a switch from my PC?Switch Port Monitoring Guide - ComparitechFinding Out Which Network Switch Port My Computer is Connected

NEW QUESTION 4

A customer wants to log in t o a vendor's server using a web browser on a laptop. Which of the following would require the LEAST configuration to allow encrypted access to the server?

• A. Secure Sockets Layer
• B. Site-to-site VPN
• C. Remote desktop gateway
• D. Client-to-site VPN

Answer: A

Explanation:
SSL is a widely used protocol for establishing secure, encrypted connections between devices over the Internet. It is typically used to secure communication between web browsers and servers, and can be easily enabled on a server by installing an SSL certificate.

NEW QUESTION 5

A user notifies a network administrator about losing access to a remote file server. The network administrator is able to ping the server and verifies the current firewall rules do not block access to the network fileshare. Which of the following tools would help identify which ports are open on the remote file server?

• A. dig
• B. nmap
• C. tracert
• D. nslookup

Answer: B

Explanation:
nmap is the tool that would help identify which ports are open on the remote file server. nmap stands for Network Mapper, which is a free and open-source tool that can perform various network scanning and discovery tasks. nmap can help identify which ports are open on a remote device by sending probes or packets to different ports and analyzing the responses. nmap can also provide information about the operating system, services, versions, firewalls, or vulnerabilities of the remote device. nmap can be useful for network administrators, security professionals, or hackers to monitor, audit, or attack network devices. References: [CompTIA Network+ Certification Exam Objectives], Nmap - Free Security Scanner For Network Exploration & Security Audits

NEW QUESTION 6

An engineer is designing a network topology for a company that maintains a large on- premises private cloud. A design requirement mandates internet-facing hosts to be partitioned off from the internal LAN and internal server IP ranges. Which Of the following
defense strategies helps meet this requirement?

• A. Implementing a screened subnet
• B. Deploying a honeypot
• C. Utilizing network access control
• D. Enforcing a Zero Trust model

Answer: A

Explanation:
A screened subnet is a network segment that is isolated from both the internal LAN and the Internet by firewalls. A screened subnet can be used to host internet- facing hosts such as web servers, email servers, or DNS servers. A screened subnet provides an additional layer of security and prevents direct access to the internal network from the Internet.
References: Network+ Study Guide Objective 3.1: Explain the purposes and use cases for advanced networking devices.

NEW QUESTION 7

A store owner would like to have secure wireless access available for both business equipment and patron use. Which of the following features should be configured to allow different wireless access through the same equipment?

• A. MIMO
• B. TKIP
• C. LTE
• D. SSID

Answer: D

Explanation:
SSID stands for Service Set Identifier and is the name of a wireless network. A wireless access point (WAP) can support multiple SSIDs, which allows different wireless access through the same equipment. For example, the store owner can create one SSID for business equipment and another SSID for patron use, and assign different security settings and bandwidth limits for each SSID. MIMO stands for Multiple Input Multiple Output and is a technology that uses multiple antennas to improve wireless performance. TKIP stands for Temporal Key Integrity Protocol and is an encryption method for wireless networks. LTE stands for Long Term Evolution and is a cellular network technology. References: CompTIA Network+ Certification Exam Objectives Version 7.0 (N10-007), Objective 3.1: Given a scenario, install and configure wireless LAN infrastructure and implement the appropriate technologies in support of wireless capable devices.

NEW QUESTION 8

Which of the following OSI model layers would allow a user to access and download files from a remote computer?

• A. Session
• B. Presentation
• C. Network
• D. Application

Answer: D

Explanation:
The application layer of the OSI model (Open Systems Interconnection) is responsible for providing services to applications that allow users to access and download files from a remote computer. These services include file transfer, email, and web access, as well as other related services. In order for a user to access and download files from a remote computer, the application layer must provide the necessary services that allow the user to interact with the remote computer.

NEW QUESTION 9

A network administrator views a network pcap and sees a packet containing the following:

Which of the following are the BEST ways for the administrator to secure this type of traffic? (Select TWO).

• A. Migrate the network to IPv6.
• B. Implement 802.1 X authentication
• C. Set a private community siring
• D. Use SNMPv3.
• E. Incorporate SSL encryption
• F. Utilize IPSec tunneling.

Answer: CD

Explanation:
The packet shown in the image is an SNMP (Simple Network Management Protocol) packet, which is used to monitor and manage network devices. SNMP uses community strings to authenticate requests and responses between SNMP agents and managers. However, community strings are sent in clear text and can be easily intercepted by attackers. Therefore, one way to secure SNMP traffic is to set a private community string that is not the default or well-known value. Another way to secure SNMP traffic is to use SNMPv3, which is the latest version of the protocol that supports encryption and authentication of SNMP messages.
References: CompTIA Network+ Certification Exam Objectives Version 7.0 (N10-007), Objective 2.5: Given a scenario, use remote access methods.

NEW QUESTION 10

Several end users viewing a training video report seeing pixelated images while watching. A network administrator reviews the core switch and is unable to find an immediate cause. Which of the following BEST explains what is occurring?

• A. Jitter
• B. Bandwidth
• C. Latency
• D. Giants

Answer: A

Explanation:
"Jitter is the loss of packets due to an overworked WAP. Jitter shows up as choppy conversations over a video call, strange jumps in the middle of an online game—pretty much anything that feels like the network has missed some data. Latency is when data stops moving for a moment due to a WAP being unable to do the work. This manifests as a Word document that stops loading, for example, or an online file that stops downloading."

NEW QUESTION 11

Which of the following is the NEXT step to perform network troubleshooting after identifying an issue?

• A. Implement a solution.
• B. Establish a theory.
• C. Escalate the issue.
• D. Document the findings.

Answer: B

Explanation:
1 Identify the Problem.
2 Develop a Theory. 3 Test the Theory.
4 Plan of Action.
5 Implement the Solution.
6 Verify System Functionality.
7 Document the Issue.

NEW QUESTION 12

Which of the following cloud components can filter inbound and outbound traffic between cloud resources?

• A. NAT gateways
• B. Service endpoints
• C. Network security groups
• D. Virtual private cloud

Answer: C

Explanation:
Network security groups are cloud components that can filter inbound and outbound traffic between cloud resources based on rules and priorities. Network security groups can be applied to virtual machines, subnets, or network interfaces to control the network access and security. Network security groups can allow or deny traffic based on the source, destination, port, and protocol of the packets. Network security groups are different from NAT gateways, service endpoints, and virtual private clouds, which are other cloud components that have different functions and purposes.
References
✑ 1: Network Security Groups – N10-008 CompTIA Network+ : 3.2
✑ 2: CompTIA Network+ N10-008 Certification Study Guide, page 329-330
✑ 3: CompTIA Network+ N10-008 Exam Subnetting Quiz, question 17
✑ 4: CompTIA Network+ N10-008 Certification Practice Test, question 10

NEW QUESTION 13

A network administrator is setting up several loT devices on a new VLAN and wants to accomplish the following
* 1. Reduce manual configuration on each system
* 2. Assign a specific IP address to each system
* 3. Allow devices to move to different switchports on the same VLAN
Which of the following should the network administrator do to accomplish these requirements?

• A. Set up a reservation for each device
• B. Configure a static IP on each device
• C. Implement private VLANs for each device
• D. Use DHCP exclusions to address each device

Answer: A

Explanation:
A reservation is a feature of DHCP that assigns a specific IP address to a device based on its MAC address. This way, the device will always receive the same IP address from the DHCP server, regardless of its location or connection time. A network administrator can set up a reservation for each loT device to accomplish the requirements of reducing manual configuration, assigning a specific IP address, and allowing devices to move to different switchports on the same VLAN. References: https://www.comptia.org/blog/what-is-dhcp

NEW QUESTION 14

A network administrator is configuring a new switch and wants to connect two ports to the core switch to ensure redundancy. Which of the following configurations would meet this
requirement?

• A. Full duplex
• B. 802.1Q tagging
• C. Native VLAN
• D. Link aggregation

Answer: D

Explanation:
Link aggregation is a technique that allows multiple physical ports to be combined into a single logical channel, which provides increased bandwidth, load balancing, and redundancy. Link aggregation can be configured using protocols such as Link Aggregation Control Protocol (LACP) or static methods.
References
✑ Link aggregation is one of the common Ethernet switching features covered in Objective 2.3 of the CompTIA Network+ N10-008 certification exam1.
✑ Link aggregation can be used to connect two ports to the core switch to ensure redundancy23.
✑ Link aggregation can be configured using LACP or static methods23.
1: CompTIA Network+ Certification Exam Objectives, page 5 2: Interface Configurations – N10-008 CompTIA Network+ : 2.3 3: CompTIA Network+ N10-008 Cert Guide, Chapter 11, page 323

NEW QUESTION 15

Which of the following would be BEST to use to detect a MAC spoofing attack?

• A. Internet Control Message Protocol
• B. Reverse Address Resolution Protocol
• C. Dynamic Host Configuration Protocol
• D. Internet Message Access Protocol

Answer: B

Explanation:
Reverse Address Resolution Protocol (RARP) is a protocol that allows a device to obtain its MAC address from its IP address. A MAC spoofing attack is an attack where a device pretends to have a different MAC address than its actual one. RARP can be used to detect a MAC spoofing attack by comparing the MAC address obtained from RARP with the MAC address obtained from other sources, such as ARP or DHCP. References: https://partners.comptia.org/docs/default-source/resources/comptia-network-n10-008-exam-objectives-(2-0), https://www.techopedia.com/definition/25597/reverse- address-resolution-protocol-rarp

NEW QUESTION 16
......