Cisco Certified Support Technician (CCST) Networking 100-150 Practice Test 75
Question 740
The technician plans a correction for: At the fictional Maplecrest Office before a planned system change, the team observes: A technician shares a full packet capture containing customer passwords and unrelated sessions in a public ticket. During “Obtain authorization, capture only the minimum necessary scope and protect or redact the resulting file.”, which precaution MOST specifically prevents a related risk?
- Do not label a recurring issue random without gathering its occurrence pattern.
- Do not require an IP route for a direct physical console connection.
- Do not publish unrestricted pcap payloads in publicly accessible support systems.
- Do not repair browser history in place of missing IP routing configuration.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Obtain authorization, capture only the minimum necessary scope and protect or redact the resulting file.” at the fictional Maplecrest Office. The required protection is “Do not publish unrestricted pcap payloads in publicly accessible support systems.”; success still requires “The escalation attachment includes relevant traffic without unauthorized unrelated sensitive data.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A user reports recurring Wi-Fi loss after lunch but the engineer records no times or environmental conditions. The principal adjacent risk here is controlled by “Do not publish unrestricted pcap payloads in publicly accessible support systems.”.
B:This caution is appropriate for a separate failure pattern: A switch's management IP is misconfigured and remote SSH fails, but an on-site technician refuses to use its working console port. The principal adjacent risk here is controlled by “Do not publish unrestricted pcap payloads in publicly accessible support systems.”.
D:This caution is appropriate for a separate failure pattern: A Windows client has no IPv4 default gateway and a technician checks only browser cache before escalating a routing outage. The principal adjacent risk here is controlled by “Do not publish unrestricted pcap payloads in publicly accessible support systems.”.
Question 741
A service desk receives this network finding: At the fictional Quarry Municipal IT in a technician onboarding review, the team observes: A Wireshark user wants to investigate a failed DNS lookup but records only Ethernet broadcast frames unrelated to the query. Which action MOST directly resolves the reported issue?
- Run show cdp neighbors where permitted and compare the result with cabling records.
- Filter or inspect DNS traffic from the affected client and correlate transaction IDs and timing.
- Read the source of the ICMP error and inspect route and ARP state on the client.
- Use the console for device CLI access and a proper Ethernet or WAN interface for normal data service.
Explanation
Correct Answer
B:Correct. In the fictional Quarry Municipal IT case, Useful capture evidence should include the client's resolver request and the corresponding response or timeout. The specified corrective action, “Filter or inspect DNS traffic from the affected client and correlate transaction IDs and timing.”, directly targets that condition. Evidence of resolution: The saved capture shows the DNS query and its response status or missing reply.
Incorrect Answers
A:That action addresses a different network issue: A technician must identify which neighboring Cisco device connects to a local switch port but guesses from cable color instead of using available discovery data. The present fictional Quarry Municipal IT finding instead needs “Filter or inspect DNS traffic from the affected client and correlate transaction IDs and timing.”, verified by “The saved capture shows the DNS query and its response status or missing reply.”.
C:That action addresses a different network issue: A technician tests 192.168.10.40 and receives 'Destination host unreachable' from the local PC, but records it as the same as an ordinary remote timeout. The present fictional Quarry Municipal IT finding instead needs “Filter or inspect DNS traffic from the affected client and correlate transaction IDs and timing.”, verified by “The saved capture shows the DNS query and its response status or missing reply.”.
D:That action addresses a different network issue: A field engineer plugs a console rollover cable into a router and expects the operating system to create a normal internet connection over the cable. The present fictional Quarry Municipal IT finding instead needs “Filter or inspect DNS traffic from the affected client and correlate transaction IDs and timing.”, verified by “The saved capture shows the DNS query and its response status or missing reply.”.
Question 742
Before changing settings, consider this issue: At the fictional Quarry Municipal IT in a technician onboarding review, the team observes: A Wireshark user wants to investigate a failed DNS lookup but records only Ethernet broadcast frames unrelated to the query. What is the MOST specific underlying cause?
- Useful capture evidence should include the client's resolver request and the corresponding response or timeout.
- Verification must test the original reported business symptom, not only a convenient proxy measurement.
- Help-desk prioritization should account for business impact, urgency and applicable service policy, not only ticket order.
- Operational troubleshooting must observe approved change controls and rollback provisions.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Quarry Municipal IT: Useful capture evidence should include the client's resolver request and the corresponding response or timeout. The corresponding remedy is “Filter or inspect DNS traffic from the affected client and correlate transaction IDs and timing.”. Confirmation: The saved capture shows the DNS query and its response status or missing reply.
Incorrect Answers
B:That cause belongs to a different case: A technician announces a fix after one successful ping but the user's original payment application still cannot connect. The observed fictional Quarry Municipal IT condition is specifically explained by “Useful capture evidence should include the client's resolver request and the corresponding response or timeout.”.
C:That cause belongs to a different case: A branch loses connectivity for hundreds of staff while one low-impact printer issue is worked first because it was reported earlier. The observed fictional Quarry Municipal IT condition is specifically explained by “Useful capture evidence should include the client's resolver request and the corresponding response or timeout.”.
D:That cause belongs to a different case: An engineer receives a request to make a risky production change during an outage but no approver or rollback plan is recorded. The observed fictional Quarry Municipal IT condition is specifically explained by “Useful capture evidence should include the client's resolver request and the corresponding response or timeout.”.
Question 743
A reviewer evaluates a proposed repair for: At the fictional Quarry Municipal IT in a technician onboarding review, the team observes: A Wireshark user wants to investigate a failed DNS lookup but records only Ethernet broadcast frames unrelated to the query. The approved corrective action is: “Filter or inspect DNS traffic from the affected client and correlate transaction IDs and timing.” Which result BEST demonstrates success?
- Large-payload failure is reproduced or excluded with documented packet sizes and path conditions.
- The table shows the relevant MAC and associated switch interface.
- A supported terminal prompt is available without requiring a Windows desktop on the switch.
- The saved capture shows the DNS query and its response status or missing reply.
Explanation
Correct Answer
D:Correct. This is the required observable acceptance evidence for “Filter or inspect DNS traffic from the affected client and correlate transaction IDs and timing.” at the fictional Quarry Municipal IT. It demonstrates correction of the original cause: Useful capture evidence should include the client's resolver request and the corresponding response or timeout.
Incorrect Answers
A:That result is evidence for a separate corrective action, “Compare appropriately sized controlled probes with the application path and consult MTU or PMTU evidence.”. It does not establish the intended outcome “The saved capture shows the DNS query and its response status or missing reply.” for the fictional Quarry Municipal IT case.
B:That result is evidence for a separate corrective action, “Use show mac address-table and locate the workstation's MAC on the appropriate VLAN.”. It does not establish the intended outcome “The saved capture shows the DNS query and its response status or missing reply.” for the fictional Quarry Municipal IT case.
C:That result is evidence for a separate corrective action, “Choose an authorized SSH session or physical console for the switch rather than RDP.”. It does not establish the intended outcome “The saved capture shows the DNS query and its response status or missing reply.” for the fictional Quarry Municipal IT case.
Question 744
The technician plans a correction for: At the fictional Quarry Municipal IT in a technician onboarding review, the team observes: A Wireshark user wants to investigate a failed DNS lookup but records only Ethernet broadcast frames unrelated to the query. During “Filter or inspect DNS traffic from the affected client and correlate transaction IDs and timing.”, which precaution MOST specifically prevents a related risk?
- Do not remove management authentication just to force a connection test to succeed.
- Do not treat configured port descriptions as proof that its physical data path is healthy.
- Do not treat unrelated ARP broadcasts as complete proof of a DNS failure.
- Do not treat console wiring as a replacement for a LAN or WAN uplink.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Filter or inspect DNS traffic from the affected client and correlate transaction IDs and timing.” at the fictional Quarry Municipal IT. The required protection is “Do not treat unrelated ARP broadcasts as complete proof of a DNS failure.”; success still requires “The saved capture shows the DNS query and its response status or missing reply.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A technician cannot open a secure SSH session and recommends disabling all authentication instead of checking identity and management reachability. The principal adjacent risk here is controlled by “Do not treat unrelated ARP broadcasts as complete proof of a DNS failure.”.
B:This caution is appropriate for a separate failure pattern: A Cisco switch port intermittently drops frames but the team only reads the port description in the running configuration. The principal adjacent risk here is controlled by “Do not treat unrelated ARP broadcasts as complete proof of a DNS failure.”.
D:This caution is appropriate for a separate failure pattern: A field engineer plugs a console rollover cable into a router and expects the operating system to create a normal internet connection over the cable. The principal adjacent risk here is controlled by “Do not treat unrelated ARP broadcasts as complete proof of a DNS failure.”.
Question 745
A service desk receives this network finding: At the fictional Kestrel Regional Office while checking a service ticket, the team observes: An analyst sees repeated TCP retransmission annotations and claims they prove an application-level password rejection. Which action MOST directly resolves the reported issue?
- Compare appropriately sized controlled probes with the application path and consult MTU or PMTU evidence.
- Compare TCP sequence, acknowledgment and retransmission evidence separately from application-layer status.
- Transfer the incident to the responsible carrier or network team with circuit ID, impact and tests.
- Use show interfaces status on the switch and note the affected port's operational state.
Explanation
Correct Answer
B:Correct. In the fictional Kestrel Regional Office case, TCP retransmissions suggest transport delivery or timing issues rather than proving application authentication outcome. The specified corrective action, “Compare TCP sequence, acknowledgment and retransmission evidence separately from application-layer status.”, directly targets that condition. Evidence of resolution: The capture review identifies loss/retry behavior without mislabeling it as authentication denial.
Incorrect Answers
A:That action addresses a different network issue: A PC has good local pings but application responses fail for large packets; the technician tests only tiny ICMP payloads and declares MTU healthy. The present fictional Kestrel Regional Office finding instead needs “Compare TCP sequence, acknowledgment and retransmission evidence separately from application-layer status.”, verified by “The capture review identifies loss/retry behavior without mislabeling it as authentication denial.”.
C:That action addresses a different network issue: A help-desk worker cannot resolve a carrier circuit fault but leaves the ticket unassigned because the local desktop was restarted. The present fictional Kestrel Regional Office finding instead needs “Compare TCP sequence, acknowledgment and retransmission evidence separately from application-layer status.”, verified by “The capture review identifies loss/retry behavior without mislabeling it as authentication denial.”.
D:That action addresses a different network issue: A technician needs a quick view of which switch ports are connected or disconnected but the engineer dumps a full device configuration and misses the status overview. The present fictional Kestrel Regional Office finding instead needs “Compare TCP sequence, acknowledgment and retransmission evidence separately from application-layer status.”, verified by “The capture review identifies loss/retry behavior without mislabeling it as authentication denial.”.
Question 746
Before changing settings, consider this issue: At the fictional Kestrel Regional Office while checking a service ticket, the team observes: An analyst sees repeated TCP retransmission annotations and claims they prove an application-level password rejection. What is the MOST specific underlying cause?
- TCP retransmissions suggest transport delivery or timing issues rather than proving application authentication outcome.
- Network management systems aggregate device telemetry and alerts across a managed inventory.
- show mac address-table is used to inspect learned Ethernet MAC addresses and associated VLAN or ports.
- Verification must test the original reported business symptom, not only a convenient proxy measurement.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Kestrel Regional Office: TCP retransmissions suggest transport delivery or timing issues rather than proving application authentication outcome. The corresponding remedy is “Compare TCP sequence, acknowledgment and retransmission evidence separately from application-layer status.”. Confirmation: The capture review identifies loss/retry behavior without mislabeling it as authentication denial.
Incorrect Answers
B:That cause belongs to a different case: A network manager wants an estate-wide view of link health but the technician logs into each device and manually guesses the fleet status. The observed fictional Kestrel Regional Office condition is specifically explained by “TCP retransmissions suggest transport delivery or timing issues rather than proving application authentication outcome.”.
C:That cause belongs to a different case: A switch is missing a workstation's MAC entry and the technician runs show ip route expecting it to show learned Ethernet source locations. The observed fictional Kestrel Regional Office condition is specifically explained by “TCP retransmissions suggest transport delivery or timing issues rather than proving application authentication outcome.”.
D:That cause belongs to a different case: A technician announces a fix after one successful ping but the user's original payment application still cannot connect. The observed fictional Kestrel Regional Office condition is specifically explained by “TCP retransmissions suggest transport delivery or timing issues rather than proving application authentication outcome.”.
Question 747
A reviewer evaluates a proposed repair for: At the fictional Kestrel Regional Office while checking a service ticket, the team observes: An analyst sees repeated TCP retransmission annotations and claims they prove an application-level password rejection. The approved corrective action is: “Compare TCP sequence, acknowledgment and retransmission evidence separately from application-layer status.” Which result BEST demonstrates success?
- The technician obtains CLI access without requiring working in-band management IP connectivity.
- Another technician can reproduce or scope the problem from the complete ticket without guessing missing facts.
- The remote session reaches the router through the approved protected path with access logs.
- The capture review identifies loss/retry behavior without mislabeling it as authentication denial.
Explanation
Correct Answer
D:Correct. This is the required observable acceptance evidence for “Compare TCP sequence, acknowledgment and retransmission evidence separately from application-layer status.” at the fictional Kestrel Regional Office. It demonstrates correction of the original cause: TCP retransmissions suggest transport delivery or timing issues rather than proving application authentication outcome.
Incorrect Answers
A:That result is evidence for a separate corrective action, “Attach an approved console adapter and inspect the device's configuration through the terminal emulator.”. It does not establish the intended outcome “The capture review identifies loss/retry behavior without mislabeling it as authentication denial.” for the fictional Kestrel Regional Office case.
B:That result is evidence for a separate corrective action, “Record affected users, locations, timestamps, error text and reproducible steps in the incident ticket.”. It does not establish the intended outcome “The capture review identifies loss/retry behavior without mislabeling it as authentication denial.” for the fictional Kestrel Regional Office case.
C:That result is evidence for a separate corrective action, “Connect through the authorized VPN and least-privilege management route before opening SSH.”. It does not establish the intended outcome “The capture review identifies loss/retry behavior without mislabeling it as authentication denial.” for the fictional Kestrel Regional Office case.
Question 748
The technician plans a correction for: At the fictional Kestrel Regional Office while checking a service ticket, the team observes: An analyst sees repeated TCP retransmission annotations and claims they prove an application-level password rejection. During “Compare TCP sequence, acknowledgment and retransmission evidence separately from application-layer status.”, which precaution MOST specifically prevents a related risk?
- Do not treat a screenshot from one router as complete estate-wide monitoring evidence.
- Do not bypass organizational change-management policy solely because a network failure is urgent.
- Do not infer login rejection solely from retransmitted TCP segments.
- Do not assume first-in-first-out ordering overrides a documented major-incident priority policy.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Compare TCP sequence, acknowledgment and retransmission evidence separately from application-layer status.” at the fictional Kestrel Regional Office. The required protection is “Do not infer login rejection solely from retransmitted TCP segments.”; success still requires “The capture review identifies loss/retry behavior without mislabeling it as authentication denial.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A network manager wants an estate-wide view of link health but the technician logs into each device and manually guesses the fleet status. The principal adjacent risk here is controlled by “Do not infer login rejection solely from retransmitted TCP segments.”.
B:This caution is appropriate for a separate failure pattern: An engineer receives a request to make a risky production change during an outage but no approver or rollback plan is recorded. The principal adjacent risk here is controlled by “Do not infer login rejection solely from retransmitted TCP segments.”.
D:This caution is appropriate for a separate failure pattern: A branch loses connectivity for hundreds of staff while one low-impact printer issue is worked first because it was reported earlier. The principal adjacent risk here is controlled by “Do not infer login rejection solely from retransmitted TCP segments.”.
Question 749
A service desk receives this network finding: At the fictional Ridgecrest Service Desk after a user reports a recurring problem, the team observes: A user says a packet analyzer can reconstruct any encrypted HTTPS password from normal packet capture without keys. Which action MOST directly resolves the reported issue?
- Use the authorized Meraki management dashboard to inspect the device and reported connectivity state.
- Inspect TLS handshake metadata and transport behavior rather than promising automatic plaintext disclosure.
- Use ? help and command completion in the appropriate EXEC context before running a read-only show command.
- Seek the required authorization, document the planned change and prepare a reversible rollback.
Explanation
Correct Answer
B:Correct. In the fictional Ridgecrest Service Desk case, TLS normally protects application contents against passive plaintext inspection without appropriate secrets. The specified corrective action, “Inspect TLS handshake metadata and transport behavior rather than promising automatic plaintext disclosure.”, directly targets that condition. Evidence of resolution: The report distinguishes visible connection metadata from encrypted application payload.
Incorrect Answers
A:That action addresses a different network issue: A managed Meraki access point shows a cloud-dashboard alert but the trainee tries to repair it through an unrelated legacy local switch GUI. The present fictional Ridgecrest Service Desk finding instead needs “Inspect TLS handshake metadata and transport behavior rather than promising automatic plaintext disclosure.”, verified by “The report distinguishes visible connection metadata from encrypted application payload.”.
C:That action addresses a different network issue: An entry-level operator receives an unfamiliar IOS show command syntax and repeatedly enters random privileged configuration commands to discover the correct keyword. The present fictional Ridgecrest Service Desk finding instead needs “Inspect TLS handshake metadata and transport behavior rather than promising automatic plaintext disclosure.”, verified by “The report distinguishes visible connection metadata from encrypted application payload.”.
D:That action addresses a different network issue: An engineer receives a request to make a risky production change during an outage but no approver or rollback plan is recorded. The present fictional Ridgecrest Service Desk finding instead needs “Inspect TLS handshake metadata and transport behavior rather than promising automatic plaintext disclosure.”, verified by “The report distinguishes visible connection metadata from encrypted application payload.”.
Question 750
Before changing settings, consider this issue: At the fictional Ridgecrest Service Desk after a user reports a recurring problem, the team observes: A user says a packet analyzer can reconstruct any encrypted HTTPS password from normal packet capture without keys. What is the MOST specific underlying cause?
- TLS normally protects application contents against passive plaintext inspection without appropriate secrets.
- Intermittent faults need a timeline and correlated environment observations to support diagnosis.
- Incorrect or stale DNS answers can direct an application to a wrong destination independently of local subnetting.
- show inventory commonly reports hardware PID and serial, while show switch on supported stack-capable Catalyst models reports stack-member roles and identities.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Ridgecrest Service Desk: TLS normally protects application contents against passive plaintext inspection without appropriate secrets. The corresponding remedy is “Inspect TLS handshake metadata and transport behavior rather than promising automatic plaintext disclosure.”. Confirmation: The report distinguishes visible connection metadata from encrypted application payload.
Incorrect Answers
B:That cause belongs to a different case: A user reports recurring Wi-Fi loss after lunch but the engineer records no times or environmental conditions. The observed fictional Ridgecrest Service Desk condition is specifically explained by “TLS normally protects application contents against passive plaintext inspection without appropriate secrets.”.
C:That cause belongs to a different case: A workstation's name lookup returns an obsolete IP address and the technician changes its subnet mask instead of checking DNS. The observed fictional Ridgecrest Service Desk condition is specifically explained by “TLS normally protects application contents against passive plaintext inspection without appropriate secrets.”.
D:That cause belongs to a different case: A support case needs a chassis serial and switch-stack member number, but a trainee reads only interface status and invents both. The observed fictional Ridgecrest Service Desk condition is specifically explained by “TLS normally protects application contents against passive plaintext inspection without appropriate secrets.”.