Cisco Certified Support Technician (CCST) Networking 100-150 Practice Test 69
Question 680
A change reviewer considers: At the fictional Stonewater Manufacturing during a physical cabling audit, the team observes: A switch's port-security list blocks an unknown device MAC, but the technician removes all VLAN segmentation and calls the result normal switching. During “Inspect the authorized MAC policy and address the device identity or approved port-security limit.”, which precaution MOST specifically prevents a related risk?
- Do not confuse an Ethernet traffic uplink with a local serial console path.
- Do not use a router console port as a general Ethernet access port.
- Do not disable unrelated VLAN boundaries merely to bypass a MAC-filtering denial.
- Do not assume every switch model lacks all routing capability.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Inspect the authorized MAC policy and address the device identity or approved port-security limit.” at the fictional Stonewater Manufacturing. The required protection is “Do not disable unrelated VLAN boundaries merely to bypass a MAC-filtering denial.”; success still requires “The authorized device is admitted and unauthorized MACs remain blocked within the planned VLAN.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A work order specifies a dedicated console cable from a notebook to a switch for initial setup but the tech plugs into the switch's user-data uplink instead. The principal adjacent risk here is controlled by “Do not disable unrelated VLAN boundaries merely to bypass a MAC-filtering denial.”.
B:This caution is appropriate for a separate failure pattern: A wiring plan shows workstation cable runs terminating on patch-panel ports that should connect to a local access switch, but the installer jumps those ports directly into an unrelated WAN router console. The principal adjacent risk here is controlled by “Do not disable unrelated VLAN boundaries merely to bypass a MAC-filtering denial.”.
D:This caution is appropriate for a separate failure pattern: A technician says a Layer 3 switch can only learn MAC addresses and is incapable of routing between configured VLAN interfaces. The principal adjacent risk here is controlled by “Do not disable unrelated VLAN boundaries merely to bypass a MAC-filtering denial.”.
Question 681
A service desk receives this network finding: At the fictional Harborline Clinic after a user reports a recurring problem, the team observes: An outage ticket contains only 'network down' and the team repeatedly asks users which site and device are affected. Which action MOST directly resolves the reported issue?
- Run show ip interface brief and identify interface addresses and up/down status.
- Record affected users, locations, timestamps, error text and reproducible steps in the incident ticket.
- Choose an authorized SSH session or physical console for the switch rather than RDP.
- Resolve the hostname and separately test the HTTPS service's TCP connection.
Explanation
Correct Answer
B:Correct. In the fictional Harborline Clinic case, Troubleshooting requires accurate symptom, scope, device and time information before diagnosis or escalation. The specified corrective action, “Record affected users, locations, timestamps, error text and reproducible steps in the incident ticket.”, directly targets that condition. Evidence of resolution: Another technician can reproduce or scope the problem from the complete ticket without guessing missing facts.
Incorrect Answers
A:That action addresses a different network issue: A router's interfaces are administratively down and a junior engineer uses show ip route as the only way to see whether each interface has an IP or is up. The present fictional Harborline Clinic finding instead needs “Record affected users, locations, timestamps, error text and reproducible steps in the incident ticket.”, verified by “Another technician can reproduce or scope the problem from the complete ticket without guessing missing facts.”.
C:That action addresses a different network issue: A technician uses a Windows remote desktop tool to administer a router CLI and expects a graphical Windows session on the Cisco switch. The present fictional Harborline Clinic finding instead needs “Record affected users, locations, timestamps, error text and reproducible steps in the incident ticket.”, verified by “Another technician can reproduce or scope the problem from the complete ticket without guessing missing facts.”.
D:That action addresses a different network issue: A technician uses nslookup to confirm a name exists and then claims a specific HTTPS port must be listening. The present fictional Harborline Clinic finding instead needs “Record affected users, locations, timestamps, error text and reproducible steps in the incident ticket.”, verified by “Another technician can reproduce or scope the problem from the complete ticket without guessing missing facts.”.
Question 682
Before changing settings, consider this issue: At the fictional Harborline Clinic after a user reports a recurring problem, the team observes: An outage ticket contains only 'network down' and the team repeatedly asks users which site and device are affected. What is the MOST specific underlying cause?
- Troubleshooting requires accurate symptom, scope, device and time information before diagnosis or escalation.
- The endpoint routing configuration must contain a reachable next hop for most off-subnet destinations.
- TCP retransmissions suggest transport delivery or timing issues rather than proving application authentication outcome.
- Firewalls and security controls can block ICMP echo while other services remain reachable.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Harborline Clinic: Troubleshooting requires accurate symptom, scope, device and time information before diagnosis or escalation. The corresponding remedy is “Record affected users, locations, timestamps, error text and reproducible steps in the incident ticket.”. Confirmation: Another technician can reproduce or scope the problem from the complete ticket without guessing missing facts.
Incorrect Answers
B:That cause belongs to a different case: A Windows client has no IPv4 default gateway and a technician checks only browser cache before escalating a routing outage. The observed fictional Harborline Clinic condition is specifically explained by “Troubleshooting requires accurate symptom, scope, device and time information before diagnosis or escalation.”.
C:That cause belongs to a different case: An analyst sees repeated TCP retransmission annotations and claims they prove an application-level password rejection. The observed fictional Harborline Clinic condition is specifically explained by “Troubleshooting requires accurate symptom, scope, device and time information before diagnosis or escalation.”.
D:That cause belongs to a different case: A Windows operator sees 'Request timed out' from ping and concludes the destination host is powered off, ignoring possible ICMP filtering. The observed fictional Harborline Clinic condition is specifically explained by “Troubleshooting requires accurate symptom, scope, device and time information before diagnosis or escalation.”.
Question 683
A reviewer evaluates a proposed repair for: At the fictional Harborline Clinic after a user reports a recurring problem, the team observes: An outage ticket contains only 'network down' and the team repeatedly asks users which site and device are affected. The approved corrective action is: “Record affected users, locations, timestamps, error text and reproducible steps in the incident ticket.” Which result BEST demonstrates success?
- The hardware ticket records valid serial and stack member details from the appropriate read-only commands.
- The route output identifies the connected, static or learned path for the destination prefix.
- The hostname resolves to the intended address and service connectivity is restored.
- Another technician can reproduce or scope the problem from the complete ticket without guessing missing facts.
Explanation
Correct Answer
D:Correct. This is the required observable acceptance evidence for “Record affected users, locations, timestamps, error text and reproducible steps in the incident ticket.” at the fictional Harborline Clinic. It demonstrates correction of the original cause: Troubleshooting requires accurate symptom, scope, device and time information before diagnosis or escalation.
Incorrect Answers
A:That result is evidence for a separate corrective action, “Use show inventory for product identifiers and show switch where supported for switch-stack membership.”. It does not establish the intended outcome “Another technician can reproduce or scope the problem from the complete ticket without guessing missing facts.” for the fictional Harborline Clinic case.
B:That result is evidence for a separate corrective action, “Use show ip route and inspect the matching network and next-hop details.”. It does not establish the intended outcome “Another technician can reproduce or scope the problem from the complete ticket without guessing missing facts.” for the fictional Harborline Clinic case.
C:That result is evidence for a separate corrective action, “Run nslookup against the configured resolver and correct the authoritative record or cache as appropriate.”. It does not establish the intended outcome “Another technician can reproduce or scope the problem from the complete ticket without guessing missing facts.” for the fictional Harborline Clinic case.
Question 684
The technician plans a correction for: At the fictional Harborline Clinic after a user reports a recurring problem, the team observes: An outage ticket contains only 'network down' and the team repeatedly asks users which site and device are affected. During “Record affected users, locations, timestamps, error text and reproducible steps in the incident ticket.”, which precaution MOST specifically prevents a related risk?
- Do not infer login rejection solely from retransmitted TCP segments.
- Do not confuse passive device monitoring with unrestricted remote command execution.
- Do not close or escalate an incident based solely on an unqualified 'network down' label.
- Do not confuse a successful DNS reply with a successful TCP 443 connection.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Record affected users, locations, timestamps, error text and reproducible steps in the incident ticket.” at the fictional Harborline Clinic. The required protection is “Do not close or escalate an incident based solely on an unqualified 'network down' label.”; success still requires “Another technician can reproduce or scope the problem from the complete ticket without guessing missing facts.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: An analyst sees repeated TCP retransmission annotations and claims they prove an application-level password rejection. The principal adjacent risk here is controlled by “Do not close or escalate an incident based solely on an unqualified 'network down' label.”.
B:This caution is appropriate for a separate failure pattern: A small business uses an NMS to collect interface metrics but a novice expects it to provide encrypted administrative command access to every router without SSH or appropriate control channels. The principal adjacent risk here is controlled by “Do not close or escalate an incident based solely on an unqualified 'network down' label.”.
D:This caution is appropriate for a separate failure pattern: A technician uses nslookup to confirm a name exists and then claims a specific HTTPS port must be listening. The principal adjacent risk here is controlled by “Do not close or escalate an incident based solely on an unqualified 'network down' label.”.
Question 685
A service desk receives this network finding: At the fictional Crescent Community Center during a physical cabling audit, the team observes: A branch loses connectivity for hundreds of staff while one low-impact printer issue is worked first because it was reported earlier. Which action MOST directly resolves the reported issue?
- Compare ping to an IP with nslookup of the affected hostname and inspect the configured DNS resolver.
- Triage both incidents against the published severity and impact criteria.
- Use SSH with authenticated device identity and approved credentials for remote CLI access.
- Filter or inspect DNS traffic from the affected client and correlate transaction IDs and timing.
Explanation
Correct Answer
B:Correct. In the fictional Crescent Community Center case, Help-desk prioritization should account for business impact, urgency and applicable service policy, not only ticket order. The specified corrective action, “Triage both incidents against the published severity and impact criteria.”, directly targets that condition. Evidence of resolution: The high-impact site outage receives an appropriate priority and escalation record.
Incorrect Answers
A:That action addresses a different network issue: A PC pings 8.8.8.8 successfully but cannot resolve a website name and the operator replaces its Ethernet cable. The present fictional Crescent Community Center finding instead needs “Triage both incidents against the published severity and impact criteria.”, verified by “The high-impact site outage receives an appropriate priority and escalation record.”.
C:That action addresses a different network issue: An administrator wants encrypted command-line access to a router but a trainee selects Telnet on an untrusted network. The present fictional Crescent Community Center finding instead needs “Triage both incidents against the published severity and impact criteria.”, verified by “The high-impact site outage receives an appropriate priority and escalation record.”.
D:That action addresses a different network issue: A Wireshark user wants to investigate a failed DNS lookup but records only Ethernet broadcast frames unrelated to the query. The present fictional Crescent Community Center finding instead needs “Triage both incidents against the published severity and impact criteria.”, verified by “The high-impact site outage receives an appropriate priority and escalation record.”.
Question 686
Before changing settings, consider this issue: At the fictional Crescent Community Center during a physical cabling audit, the team observes: A branch loses connectivity for hundreds of staff while one low-impact printer issue is worked first because it was reported earlier. What is the MOST specific underlying cause?
- Help-desk prioritization should account for business impact, urgency and applicable service policy, not only ticket order.
- Local console access can provide out-of-band recovery when normal IP management is unavailable.
- A serial console is a local management channel, not a general-purpose routed WAN link.
- show inventory commonly reports hardware PID and serial, while show switch on supported stack-capable Catalyst models reports stack-member roles and identities.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Crescent Community Center: Help-desk prioritization should account for business impact, urgency and applicable service policy, not only ticket order. The corresponding remedy is “Triage both incidents against the published severity and impact criteria.”. Confirmation: The high-impact site outage receives an appropriate priority and escalation record.
Incorrect Answers
B:That cause belongs to a different case: A switch's management IP is misconfigured and remote SSH fails, but an on-site technician refuses to use its working console port. The observed fictional Crescent Community Center condition is specifically explained by “Help-desk prioritization should account for business impact, urgency and applicable service policy, not only ticket order.”.
C:That cause belongs to a different case: A field engineer plugs a console rollover cable into a router and expects the operating system to create a normal internet connection over the cable. The observed fictional Crescent Community Center condition is specifically explained by “Help-desk prioritization should account for business impact, urgency and applicable service policy, not only ticket order.”.
D:That cause belongs to a different case: A support case needs a chassis serial and switch-stack member number, but a trainee reads only interface status and invents both. The observed fictional Crescent Community Center condition is specifically explained by “Help-desk prioritization should account for business impact, urgency and applicable service policy, not only ticket order.”.
Question 687
A reviewer evaluates a proposed repair for: At the fictional Crescent Community Center during a physical cabling audit, the team observes: A branch loses connectivity for hundreds of staff while one low-impact printer issue is worked first because it was reported earlier. The approved corrective action is: “Triage both incidents against the published severity and impact criteria.” Which result BEST demonstrates success?
- The investigation reports distinct DNS and transport outcomes for the host.
- The interface counters reveal or exclude CRC, error and other physical symptoms correlated with the outage.
- The remote session reaches the router through the approved protected path with access logs.
- The high-impact site outage receives an appropriate priority and escalation record.
Explanation
Correct Answer
D:Correct. This is the required observable acceptance evidence for “Triage both incidents against the published severity and impact criteria.” at the fictional Crescent Community Center. It demonstrates correction of the original cause: Help-desk prioritization should account for business impact, urgency and applicable service policy, not only ticket order.
Incorrect Answers
A:That result is evidence for a separate corrective action, “Resolve the hostname and separately test the HTTPS service's TCP connection.”. It does not establish the intended outcome “The high-impact site outage receives an appropriate priority and escalation record.” for the fictional Crescent Community Center case.
B:That result is evidence for a separate corrective action, “Run show interfaces for the affected port and examine error, speed, duplex and line status evidence.”. It does not establish the intended outcome “The high-impact site outage receives an appropriate priority and escalation record.” for the fictional Crescent Community Center case.
C:That result is evidence for a separate corrective action, “Connect through the authorized VPN and least-privilege management route before opening SSH.”. It does not establish the intended outcome “The high-impact site outage receives an appropriate priority and escalation record.” for the fictional Crescent Community Center case.
Question 688
The technician plans a correction for: At the fictional Crescent Community Center during a physical cabling audit, the team observes: A branch loses connectivity for hundreds of staff while one low-impact printer issue is worked first because it was reported earlier. During “Triage both incidents against the published severity and impact criteria.”, which precaution MOST specifically prevents a related risk?
- Do not assume every cloud-managed AP is managed from a local unrelated switch web UI.
- Do not treat a screenshot from one router as complete estate-wide monitoring evidence.
- Do not assume first-in-first-out ordering overrides a documented major-incident priority policy.
- Do not conclude there is no network traffic from a capture on the wrong adapter.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Triage both incidents against the published severity and impact criteria.” at the fictional Crescent Community Center. The required protection is “Do not assume first-in-first-out ordering overrides a documented major-incident priority policy.”; success still requires “The high-impact site outage receives an appropriate priority and escalation record.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A managed Meraki access point shows a cloud-dashboard alert but the trainee tries to repair it through an unrelated legacy local switch GUI. The principal adjacent risk here is controlled by “Do not assume first-in-first-out ordering overrides a documented major-incident priority policy.”.
B:This caution is appropriate for a separate failure pattern: A network manager wants an estate-wide view of link health but the technician logs into each device and manually guesses the fleet status. The principal adjacent risk here is controlled by “Do not assume first-in-first-out ordering overrides a documented major-incident priority policy.”.
D:This caution is appropriate for a separate failure pattern: A technician captures packets on a laptop's inactive Ethernet adapter and sees nothing while the issue occurs over active Wi-Fi. The principal adjacent risk here is controlled by “Do not assume first-in-first-out ordering overrides a documented major-incident priority policy.”.
Question 689
A service desk receives this network finding: At the fictional Willowbrook Campus during a scheduled lab validation, the team observes: A technician changes the switch, router and endpoint all at once and cannot tell which modification restored service. Which action MOST directly resolves the reported issue?
- Compare ping to an IP with nslookup of the affected hostname and inspect the configured DNS resolver.
- Write a hypothesis, make one authorized change and retest before making further changes.
- Select the active Wi-Fi interface and start a Wireshark capture during the reproducible fault.
- Run nslookup against the configured resolver and correct the authoritative record or cache as appropriate.
Explanation
Correct Answer
B:Correct. In the fictional Willowbrook Campus case, Controlled troubleshooting changes one plausible variable at a time to establish cause and effect. The specified corrective action, “Write a hypothesis, make one authorized change and retest before making further changes.”, directly targets that condition. Evidence of resolution: Test evidence identifies which single intervention changed the observed failure.
Incorrect Answers
A:That action addresses a different network issue: A PC pings 8.8.8.8 successfully but cannot resolve a website name and the operator replaces its Ethernet cable. The present fictional Willowbrook Campus finding instead needs “Write a hypothesis, make one authorized change and retest before making further changes.”, verified by “Test evidence identifies which single intervention changed the observed failure.”.
C:That action addresses a different network issue: A technician captures packets on a laptop's inactive Ethernet adapter and sees nothing while the issue occurs over active Wi-Fi. The present fictional Willowbrook Campus finding instead needs “Write a hypothesis, make one authorized change and retest before making further changes.”, verified by “Test evidence identifies which single intervention changed the observed failure.”.
D:That action addresses a different network issue: A workstation's name lookup returns an obsolete IP address and the technician changes its subnet mask instead of checking DNS. The present fictional Willowbrook Campus finding instead needs “Write a hypothesis, make one authorized change and retest before making further changes.”, verified by “Test evidence identifies which single intervention changed the observed failure.”.
Question 690
Before changing settings, consider this issue: At the fictional Willowbrook Campus during a scheduled lab validation, the team observes: A technician changes the switch, router and endpoint all at once and cannot tell which modification restored service. What is the MOST specific underlying cause?
- Controlled troubleshooting changes one plausible variable at a time to establish cause and effect.
- Telnet normally sends its terminal session without SSH's encryption protections.
- A capture started late may omit the TCP SYN, SYN-ACK and ACK establishing the connection.
- Successful small probes do not prove that a path supports larger packets without fragmentation or PMTU issues.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Willowbrook Campus: Controlled troubleshooting changes one plausible variable at a time to establish cause and effect. The corresponding remedy is “Write a hypothesis, make one authorized change and retest before making further changes.”. Confirmation: Test evidence identifies which single intervention changed the observed failure.
Incorrect Answers
B:That cause belongs to a different case: An administrator wants encrypted command-line access to a router but a trainee selects Telnet on an untrusted network. The observed fictional Willowbrook Campus condition is specifically explained by “Controlled troubleshooting changes one plausible variable at a time to establish cause and effect.”.
C:That cause belongs to a different case: A team needs evidence of a TCP connection setup but starts capturing only after the application session is already established. The observed fictional Willowbrook Campus condition is specifically explained by “Controlled troubleshooting changes one plausible variable at a time to establish cause and effect.”.
D:That cause belongs to a different case: A PC has good local pings but application responses fail for large packets; the technician tests only tiny ICMP payloads and declares MTU healthy. The observed fictional Willowbrook Campus condition is specifically explained by “Controlled troubleshooting changes one plausible variable at a time to establish cause and effect.”.