Cisco Certified Support Technician (CCST) Networking 100-150 Practice Test 74
Question 730
Before changing settings, consider this issue: At the fictional Lighthouse Research Annex after a site connectivity report, the team observes: A support worker uses a Wireshark display filter to hide TCP traffic and then claims that the filtered packets were never captured. What is the MOST specific underlying cause?
- Display filters change what is shown after capture; they do not delete already recorded packets.
- Some intermediate devices do not answer traceroute probes even while forwarding permitted application traffic.
- Local console access can provide out-of-band recovery when normal IP management is unavailable.
- show ip interface brief summarizes IPv4 interface addresses and administrative/protocol states.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Lighthouse Research Annex: Display filters change what is shown after capture; they do not delete already recorded packets. The corresponding remedy is “Clear or adjust the display filter and review the captured traffic separately from capture filters.”. Confirmation: TCP packets reappear in the same saved capture when the display filter is removed.
Incorrect Answers
B:That cause belongs to a different case: A traceroute stops showing hops after a firewall, but the browser can still load the destination over HTTPS. The observed fictional Lighthouse Research Annex condition is specifically explained by “Display filters change what is shown after capture; they do not delete already recorded packets.”.
C:That cause belongs to a different case: A switch's management IP is misconfigured and remote SSH fails, but an on-site technician refuses to use its working console port. The observed fictional Lighthouse Research Annex condition is specifically explained by “Display filters change what is shown after capture; they do not delete already recorded packets.”.
D:That cause belongs to a different case: A router's interfaces are administratively down and a junior engineer uses show ip route as the only way to see whether each interface has an IP or is up. The observed fictional Lighthouse Research Annex condition is specifically explained by “Display filters change what is shown after capture; they do not delete already recorded packets.”.
Question 731
A reviewer evaluates a proposed repair for: At the fictional Lighthouse Research Annex after a site connectivity report, the team observes: A support worker uses a Wireshark display filter to hide TCP traffic and then claims that the filtered packets were never captured. The approved corrective action is: “Clear or adjust the display filter and review the captured traffic separately from capture filters.” Which result BEST demonstrates success?
- The management session negotiates SSH and the plaintext Telnet service is not required.
- The receiving team has the necessary evidence and acknowledges ownership in the ticket.
- The technician obtains CLI access without requiring working in-band management IP connectivity.
- TCP packets reappear in the same saved capture when the display filter is removed.
Explanation
Correct Answer
D:Correct. This is the required observable acceptance evidence for “Clear or adjust the display filter and review the captured traffic separately from capture filters.” at the fictional Lighthouse Research Annex. It demonstrates correction of the original cause: Display filters change what is shown after capture; they do not delete already recorded packets.
Incorrect Answers
A:That result is evidence for a separate corrective action, “Use SSH with authenticated device identity and approved credentials for remote CLI access.”. It does not establish the intended outcome “TCP packets reappear in the same saved capture when the display filter is removed.” for the fictional Lighthouse Research Annex case.
B:That result is evidence for a separate corrective action, “Transfer the incident to the responsible carrier or network team with circuit ID, impact and tests.”. It does not establish the intended outcome “TCP packets reappear in the same saved capture when the display filter is removed.” for the fictional Lighthouse Research Annex case.
C:That result is evidence for a separate corrective action, “Attach an approved console adapter and inspect the device's configuration through the terminal emulator.”. It does not establish the intended outcome “TCP packets reappear in the same saved capture when the display filter is removed.” for the fictional Lighthouse Research Annex case.
Question 732
The technician plans a correction for: At the fictional Lighthouse Research Annex after a site connectivity report, the team observes: A support worker uses a Wireshark display filter to hide TCP traffic and then claims that the filtered packets were never captured. During “Clear or adjust the display filter and review the captured traffic separately from capture filters.”, which precaution MOST specifically prevents a related risk?
- Do not assume a hostname uniquely determines which NIC transmits a given flow.
- Do not assume first-in-first-out ordering overrides a documented major-incident priority policy.
- Do not infer absence from a filtered packet list without checking the full capture.
- Do not infer all port link states only from interface configuration stanzas.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Clear or adjust the display filter and review the captured traffic separately from capture filters.” at the fictional Lighthouse Research Annex. The required protection is “Do not infer absence from a filtered packet list without checking the full capture.”; success still requires “TCP packets reappear in the same saved capture when the display filter is removed.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A Linux host shows two IPv4 addresses on different NICs but a troubleshooter reads only its hostname to determine which address a route uses. The principal adjacent risk here is controlled by “Do not infer absence from a filtered packet list without checking the full capture.”.
B:This caution is appropriate for a separate failure pattern: A branch loses connectivity for hundreds of staff while one low-impact printer issue is worked first because it was reported earlier. The principal adjacent risk here is controlled by “Do not infer absence from a filtered packet list without checking the full capture.”.
D:This caution is appropriate for a separate failure pattern: A technician needs a quick view of which switch ports are connected or disconnected but the engineer dumps a full device configuration and misses the status overview. The principal adjacent risk here is controlled by “Do not infer absence from a filtered packet list without checking the full capture.”.
Question 733
A service desk receives this network finding: At the fictional Summit Print Shop during its network support shift, the team observes: A team needs evidence of a TCP connection setup but starts capturing only after the application session is already established. Which action MOST directly resolves the reported issue?
- Use ip addr and ip route get for the destination to identify the selected interface and source.
- Restart the test application and begin capture before initiating the TCP session.
- Use show interfaces status on the switch and note the affected port's operational state.
- Check permitted application-port reachability and firewall policy alongside the ping result.
Explanation
Correct Answer
B:Correct. In the fictional Summit Print Shop case, A capture started late may omit the TCP SYN, SYN-ACK and ACK establishing the connection. The specified corrective action, “Restart the test application and begin capture before initiating the TCP session.”, directly targets that condition. Evidence of resolution: The file records the handshake sequence before subsequent application traffic.
Incorrect Answers
A:That action addresses a different network issue: A Linux host shows two IPv4 addresses on different NICs but a troubleshooter reads only its hostname to determine which address a route uses. The present fictional Summit Print Shop finding instead needs “Restart the test application and begin capture before initiating the TCP session.”, verified by “The file records the handshake sequence before subsequent application traffic.”.
C:That action addresses a different network issue: A technician needs a quick view of which switch ports are connected or disconnected but the engineer dumps a full device configuration and misses the status overview. The present fictional Summit Print Shop finding instead needs “Restart the test application and begin capture before initiating the TCP session.”, verified by “The file records the handshake sequence before subsequent application traffic.”.
D:That action addresses a different network issue: A Windows operator sees 'Request timed out' from ping and concludes the destination host is powered off, ignoring possible ICMP filtering. The present fictional Summit Print Shop finding instead needs “Restart the test application and begin capture before initiating the TCP session.”, verified by “The file records the handshake sequence before subsequent application traffic.”.
Question 734
Before changing settings, consider this issue: At the fictional Summit Print Shop during its network support shift, the team observes: A team needs evidence of a TCP connection setup but starts capturing only after the application session is already established. What is the MOST specific underlying cause?
- A capture started late may omit the TCP SYN, SYN-ACK and ACK establishing the connection.
- Firewalls and security controls can block ICMP echo while other services remain reachable.
- Telnet normally sends its terminal session without SSH's encryption protections.
- show version reports system software, platform and often uptime information rather than learned endpoint MACs.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Summit Print Shop: A capture started late may omit the TCP SYN, SYN-ACK and ACK establishing the connection. The corresponding remedy is “Restart the test application and begin capture before initiating the TCP session.”. Confirmation: The file records the handshake sequence before subsequent application traffic.
Incorrect Answers
B:That cause belongs to a different case: A Windows operator sees 'Request timed out' from ping and concludes the destination host is powered off, ignoring possible ICMP filtering. The observed fictional Summit Print Shop condition is specifically explained by “A capture started late may omit the TCP SYN, SYN-ACK and ACK establishing the connection.”.
C:That cause belongs to a different case: An administrator wants encrypted command-line access to a router but a trainee selects Telnet on an untrusted network. The observed fictional Summit Print Shop condition is specifically explained by “A capture started late may omit the TCP SYN, SYN-ACK and ACK establishing the connection.”.
D:That cause belongs to a different case: A switch's Cisco IOS release and uptime are requested for a support case but the engineer runs show mac address-table and reports MAC entries as software versions. The observed fictional Summit Print Shop condition is specifically explained by “A capture started late may omit the TCP SYN, SYN-ACK and ACK establishing the connection.”.
Question 735
A reviewer evaluates a proposed repair for: At the fictional Summit Print Shop during its network support shift, the team observes: A team needs evidence of a TCP connection setup but starts capturing only after the application session is already established. The approved corrective action is: “Restart the test application and begin capture before initiating the TCP session.” Which result BEST demonstrates success?
- The remote session reaches the router through the approved protected path with access logs.
- The operator discovers valid command syntax without modifying device configuration or escalating privileges unnecessarily.
- The receiving team has the necessary evidence and acknowledges ownership in the ticket.
- The file records the handshake sequence before subsequent application traffic.
Explanation
Correct Answer
D:Correct. This is the required observable acceptance evidence for “Restart the test application and begin capture before initiating the TCP session.” at the fictional Summit Print Shop. It demonstrates correction of the original cause: A capture started late may omit the TCP SYN, SYN-ACK and ACK establishing the connection.
Incorrect Answers
A:That result is evidence for a separate corrective action, “Connect through the authorized VPN and least-privilege management route before opening SSH.”. It does not establish the intended outcome “The file records the handshake sequence before subsequent application traffic.” for the fictional Summit Print Shop case.
B:That result is evidence for a separate corrective action, “Use ? help and command completion in the appropriate EXEC context before running a read-only show command.”. It does not establish the intended outcome “The file records the handshake sequence before subsequent application traffic.” for the fictional Summit Print Shop case.
C:That result is evidence for a separate corrective action, “Transfer the incident to the responsible carrier or network team with circuit ID, impact and tests.”. It does not establish the intended outcome “The file records the handshake sequence before subsequent application traffic.” for the fictional Summit Print Shop case.
Question 736
The technician plans a correction for: At the fictional Summit Print Shop during its network support shift, the team observes: A team needs evidence of a TCP connection setup but starts capturing only after the application session is already established. During “Restart the test application and begin capture before initiating the TCP session.”, which precaution MOST specifically prevents a related risk?
- Do not infer full-size packet delivery from a single minimum-size ping reply.
- Do not expose a management plane to arbitrary public IP sources simply for convenience.
- Do not report missing SYN packets as evidence of abnormal behavior if recording began after setup.
- Do not grant write privileges to a diagnostic script when read-only permissions suffice.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Restart the test application and begin capture before initiating the TCP session.” at the fictional Summit Print Shop. The required protection is “Do not report missing SYN packets as evidence of abnormal behavior if recording began after setup.”; success still requires “The file records the handshake sequence before subsequent application traffic.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A PC has good local pings but application responses fail for large packets; the technician tests only tiny ICMP payloads and declares MTU healthy. The principal adjacent risk here is controlled by “Do not report missing SYN packets as evidence of abnormal behavior if recording began after setup.”.
B:This caution is appropriate for a separate failure pattern: A worker connects to a branch router's SSH service over public internet without using the corporate remote access policy. The principal adjacent risk here is controlled by “Do not report missing SYN packets as evidence of abnormal behavior if recording began after setup.”.
D:This caution is appropriate for a separate failure pattern: A support engineer launches an ad hoc script that reconfigures every router to collect interface data without confirming whether read-only data is available. The principal adjacent risk here is controlled by “Do not report missing SYN packets as evidence of abnormal behavior if recording began after setup.”.
Question 737
A service desk receives this network finding: At the fictional Maplecrest Office before a planned system change, the team observes: A technician shares a full packet capture containing customer passwords and unrelated sessions in a public ticket. Which action MOST directly resolves the reported issue?
- Transfer the incident to the responsible carrier or network team with circuit ID, impact and tests.
- Obtain authorization, capture only the minimum necessary scope and protect or redact the resulting file.
- Use show mac address-table and locate the workstation's MAC on the appropriate VLAN.
- Run an available supported Linux traceroute-style command toward the target.
Explanation
Correct Answer
B:Correct. In the fictional Maplecrest Office case, Packet capture files can contain sensitive payloads, identifiers and communications not needed for troubleshooting. The specified corrective action, “Obtain authorization, capture only the minimum necessary scope and protect or redact the resulting file.”, directly targets that condition. Evidence of resolution: The escalation attachment includes relevant traffic without unauthorized unrelated sensitive data.
Incorrect Answers
A:That action addresses a different network issue: A help-desk worker cannot resolve a carrier circuit fault but leaves the ticket unassigned because the local desktop was restarted. The present fictional Maplecrest Office finding instead needs “Obtain authorization, capture only the minimum necessary scope and protect or redact the resulting file.”, verified by “The escalation attachment includes relevant traffic without unauthorized unrelated sensitive data.”.
C:That action addresses a different network issue: A switch is missing a workstation's MAC entry and the technician runs show ip route expecting it to show learned Ethernet source locations. The present fictional Maplecrest Office finding instead needs “Obtain authorization, capture only the minimum necessary scope and protect or redact the resulting file.”, verified by “The escalation attachment includes relevant traffic without unauthorized unrelated sensitive data.”.
D:That action addresses a different network issue: A Linux technician tries tracert and reports the command unavailable even though the objective is to find where a path fails. The present fictional Maplecrest Office finding instead needs “Obtain authorization, capture only the minimum necessary scope and protect or redact the resulting file.”, verified by “The escalation attachment includes relevant traffic without unauthorized unrelated sensitive data.”.
Question 738
Before changing settings, consider this issue: At the fictional Maplecrest Office before a planned system change, the team observes: A technician shares a full packet capture containing customer passwords and unrelated sessions in a public ticket. What is the MOST specific underlying cause?
- Packet capture files can contain sensitive payloads, identifiers and communications not needed for troubleshooting.
- Successful numeric IP reachability with failed name lookup points toward DNS rather than necessarily physical disconnection.
- show ip interface brief summarizes IPv4 interface addresses and administrative/protocol states.
- show inventory commonly reports hardware PID and serial, while show switch on supported stack-capable Catalyst models reports stack-member roles and identities.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Maplecrest Office: Packet capture files can contain sensitive payloads, identifiers and communications not needed for troubleshooting. The corresponding remedy is “Obtain authorization, capture only the minimum necessary scope and protect or redact the resulting file.”. Confirmation: The escalation attachment includes relevant traffic without unauthorized unrelated sensitive data.
Incorrect Answers
B:That cause belongs to a different case: A PC pings 8.8.8.8 successfully but cannot resolve a website name and the operator replaces its Ethernet cable. The observed fictional Maplecrest Office condition is specifically explained by “Packet capture files can contain sensitive payloads, identifiers and communications not needed for troubleshooting.”.
C:That cause belongs to a different case: A router's interfaces are administratively down and a junior engineer uses show ip route as the only way to see whether each interface has an IP or is up. The observed fictional Maplecrest Office condition is specifically explained by “Packet capture files can contain sensitive payloads, identifiers and communications not needed for troubleshooting.”.
D:That cause belongs to a different case: A support case needs a chassis serial and switch-stack member number, but a trainee reads only interface status and invents both. The observed fictional Maplecrest Office condition is specifically explained by “Packet capture files can contain sensitive payloads, identifiers and communications not needed for troubleshooting.”.
Question 739
A reviewer evaluates a proposed repair for: At the fictional Maplecrest Office before a planned system change, the team observes: A technician shares a full packet capture containing customer passwords and unrelated sessions in a public ticket. The approved corrective action is: “Obtain authorization, capture only the minimum necessary scope and protect or redact the resulting file.” Which result BEST demonstrates success?
- The incident records a valid IOS version or system image identifier from command output.
- The investigation reports distinct DNS and transport outcomes for the host.
- The local port maps to the expected neighbor device and remote port in the discovery output.
- The escalation attachment includes relevant traffic without unauthorized unrelated sensitive data.
Explanation
Correct Answer
D:Correct. This is the required observable acceptance evidence for “Obtain authorization, capture only the minimum necessary scope and protect or redact the resulting file.” at the fictional Maplecrest Office. It demonstrates correction of the original cause: Packet capture files can contain sensitive payloads, identifiers and communications not needed for troubleshooting.
Incorrect Answers
A:That result is evidence for a separate corrective action, “Run show version and document the platform and software version for the case.”. It does not establish the intended outcome “The escalation attachment includes relevant traffic without unauthorized unrelated sensitive data.” for the fictional Maplecrest Office case.
B:That result is evidence for a separate corrective action, “Resolve the hostname and separately test the HTTPS service's TCP connection.”. It does not establish the intended outcome “The escalation attachment includes relevant traffic without unauthorized unrelated sensitive data.” for the fictional Maplecrest Office case.
C:That result is evidence for a separate corrective action, “Run show cdp neighbors where permitted and compare the result with cabling records.”. It does not establish the intended outcome “The escalation attachment includes relevant traffic without unauthorized unrelated sensitive data.” for the fictional Maplecrest Office case.
Question 740
The technician plans a correction for: At the fictional Maplecrest Office before a planned system change, the team observes: A technician shares a full packet capture containing customer passwords and unrelated sessions in a public ticket. During “Obtain authorization, capture only the minimum necessary scope and protect or redact the resulting file.”, which precaution MOST specifically prevents a related risk?
- Do not label a recurring issue random without gathering its occurrence pattern.
- Do not require an IP route for a direct physical console connection.
- Do not publish unrestricted pcap payloads in publicly accessible support systems.
- Do not repair browser history in place of missing IP routing configuration.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Obtain authorization, capture only the minimum necessary scope and protect or redact the resulting file.” at the fictional Maplecrest Office. The required protection is “Do not publish unrestricted pcap payloads in publicly accessible support systems.”; success still requires “The escalation attachment includes relevant traffic without unauthorized unrelated sensitive data.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A user reports recurring Wi-Fi loss after lunch but the engineer records no times or environmental conditions. The principal adjacent risk here is controlled by “Do not publish unrestricted pcap payloads in publicly accessible support systems.”.
B:This caution is appropriate for a separate failure pattern: A switch's management IP is misconfigured and remote SSH fails, but an on-site technician refuses to use its working console port. The principal adjacent risk here is controlled by “Do not publish unrestricted pcap payloads in publicly accessible support systems.”.
D:This caution is appropriate for a separate failure pattern: A Windows client has no IPv4 default gateway and a technician checks only browser cache before escalating a routing outage. The principal adjacent risk here is controlled by “Do not publish unrestricted pcap payloads in publicly accessible support systems.”.