Cisco Certified Support Technician (CCST) Networking 100-150 Practice Test 80
Question 790
Before changing settings, consider this issue: At the fictional Cedar Valley Academy during basic configuration verification, the team observes: A technician uses nslookup to confirm a name exists and then claims a specific HTTPS port must be listening. What is the MOST specific underlying cause?
- DNS records indicate name-to-address mappings but do not validate an application's TCP listener.
- A packet analyzer must capture on the interface carrying the traffic under investigation.
- A capture started late may omit the TCP SYN, SYN-ACK and ACK establishing the connection.
- show version reports system software, platform and often uptime information rather than learned endpoint MACs.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Cedar Valley Academy: DNS records indicate name-to-address mappings but do not validate an application's TCP listener. The corresponding remedy is “Resolve the hostname and separately test the HTTPS service's TCP connection.”. Confirmation: The investigation reports distinct DNS and transport outcomes for the host.
Incorrect Answers
B:That cause belongs to a different case: A technician captures packets on a laptop's inactive Ethernet adapter and sees nothing while the issue occurs over active Wi-Fi. The observed fictional Cedar Valley Academy condition is specifically explained by “DNS records indicate name-to-address mappings but do not validate an application's TCP listener.”.
C:That cause belongs to a different case: A team needs evidence of a TCP connection setup but starts capturing only after the application session is already established. The observed fictional Cedar Valley Academy condition is specifically explained by “DNS records indicate name-to-address mappings but do not validate an application's TCP listener.”.
D:That cause belongs to a different case: A switch's Cisco IOS release and uptime are requested for a support case but the engineer runs show mac address-table and reports MAC entries as software versions. The observed fictional Cedar Valley Academy condition is specifically explained by “DNS records indicate name-to-address mappings but do not validate an application's TCP listener.”.
Question 791
A reviewer evaluates a proposed repair for: At the fictional Cedar Valley Academy during basic configuration verification, the team observes: A technician uses nslookup to confirm a name exists and then claims a specific HTTPS port must be listening. The approved corrective action is: “Resolve the hostname and separately test the HTTPS service's TCP connection.” Which result BEST demonstrates success?
- The incident timeline correlates the failures with a reproducible condition or narrows the affected interval.
- The table reports the targeted interface's administrative state and line protocol correctly.
- The escalation attachment includes relevant traffic without unauthorized unrelated sensitive data.
- The investigation reports distinct DNS and transport outcomes for the host.
Explanation
Correct Answer
D:Correct. This is the required observable acceptance evidence for “Resolve the hostname and separately test the HTTPS service's TCP connection.” at the fictional Cedar Valley Academy. It demonstrates correction of the original cause: DNS records indicate name-to-address mappings but do not validate an application's TCP listener.
Incorrect Answers
A:That result is evidence for a separate corrective action, “Capture the event times, client location, AP association and nearby interference indicators.”. It does not establish the intended outcome “The investigation reports distinct DNS and transport outcomes for the host.” for the fictional Cedar Valley Academy case.
B:That result is evidence for a separate corrective action, “Run show ip interface brief and identify interface addresses and up/down status.”. It does not establish the intended outcome “The investigation reports distinct DNS and transport outcomes for the host.” for the fictional Cedar Valley Academy case.
C:That result is evidence for a separate corrective action, “Obtain authorization, capture only the minimum necessary scope and protect or redact the resulting file.”. It does not establish the intended outcome “The investigation reports distinct DNS and transport outcomes for the host.” for the fictional Cedar Valley Academy case.
Question 792
The technician plans a correction for: At the fictional Cedar Valley Academy during basic configuration verification, the team observes: A technician uses nslookup to confirm a name exists and then claims a specific HTTPS port must be listening. During “Resolve the hostname and separately test the HTTPS service's TCP connection.”, which precaution MOST specifically prevents a related risk?
- Do not confuse passive device monitoring with unrestricted remote command execution.
- Do not substitute a software-version summary for the active running configuration.
- Do not confuse a successful DNS reply with a successful TCP 443 connection.
- Do not treat every managed device as a Windows RDP endpoint.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Resolve the hostname and separately test the HTTPS service's TCP connection.” at the fictional Cedar Valley Academy. The required protection is “Do not confuse a successful DNS reply with a successful TCP 443 connection.”; success still requires “The investigation reports distinct DNS and transport outcomes for the host.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A small business uses an NMS to collect interface metrics but a novice expects it to provide encrypted administrative command access to every router without SSH or appropriate control channels. The principal adjacent risk here is controlled by “Do not confuse a successful DNS reply with a successful TCP 443 connection.”.
B:This caution is appropriate for a separate failure pattern: A Cisco router's running configuration is questioned after a change but an operator runs show version and claims it lists the active interface and ACL configuration. The principal adjacent risk here is controlled by “Do not confuse a successful DNS reply with a successful TCP 443 connection.”.
D:This caution is appropriate for a separate failure pattern: A technician uses a Windows remote desktop tool to administer a router CLI and expects a graphical Windows session on the Cisco switch. The principal adjacent risk here is controlled by “Do not confuse a successful DNS reply with a successful TCP 443 connection.”.
Question 793
A service desk receives this network finding: At the fictional Pinefield Logistics while assessing a controlled network fault, the team observes: A Linux host shows two IPv4 addresses on different NICs but a troubleshooter reads only its hostname to determine which address a route uses. Which action MOST directly resolves the reported issue?
- Save the actual capture file and include the screenshot only as an optional pointer to relevant frames.
- Use ip addr and ip route get for the destination to identify the selected interface and source.
- Use show inventory for product identifiers and show switch where supported for switch-stack membership.
- Query the approved NMS and compare its alert scope with device-specific interface evidence.
Explanation
Correct Answer
B:Correct. In the fictional Pinefield Logistics case, Interface addresses and routing decisions must be inspected on the host to determine the egress path. The specified corrective action, “Use ip addr and ip route get for the destination to identify the selected interface and source.”, directly targets that condition. Evidence of resolution: The route lookup reports the actual outgoing interface and source IP for the test.
Incorrect Answers
A:That action addresses a different network issue: A technician saves only a screenshot of five Wireshark rows and calls it a reusable packet capture for protocol analysis. The present fictional Pinefield Logistics finding instead needs “Use ip addr and ip route get for the destination to identify the selected interface and source.”, verified by “The route lookup reports the actual outgoing interface and source IP for the test.”.
C:That action addresses a different network issue: A support case needs a chassis serial and switch-stack member number, but a trainee reads only interface status and invents both. The present fictional Pinefield Logistics finding instead needs “Use ip addr and ip route get for the destination to identify the selected interface and source.”, verified by “The route lookup reports the actual outgoing interface and source IP for the test.”.
D:That action addresses a different network issue: A network manager wants an estate-wide view of link health but the technician logs into each device and manually guesses the fleet status. The present fictional Pinefield Logistics finding instead needs “Use ip addr and ip route get for the destination to identify the selected interface and source.”, verified by “The route lookup reports the actual outgoing interface and source IP for the test.”.
Question 794
Before changing settings, consider this issue: At the fictional Pinefield Logistics while assessing a controlled network fault, the team observes: A Linux host shows two IPv4 addresses on different NICs but a troubleshooter reads only its hostname to determine which address a route uses. What is the MOST specific underlying cause?
- Interface addresses and routing decisions must be inspected on the host to determine the egress path.
- Cisco Discovery Protocol neighbor information can reveal directly connected Cisco devices and local interfaces when enabled.
- Intermittent faults need a timeline and correlated environment observations to support diagnosis.
- Controlled troubleshooting changes one plausible variable at a time to establish cause and effect.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Pinefield Logistics: Interface addresses and routing decisions must be inspected on the host to determine the egress path. The corresponding remedy is “Use ip addr and ip route get for the destination to identify the selected interface and source.”. Confirmation: The route lookup reports the actual outgoing interface and source IP for the test.
Incorrect Answers
B:That cause belongs to a different case: A technician must identify which neighboring Cisco device connects to a local switch port but guesses from cable color instead of using available discovery data. The observed fictional Pinefield Logistics condition is specifically explained by “Interface addresses and routing decisions must be inspected on the host to determine the egress path.”.
C:That cause belongs to a different case: A user reports recurring Wi-Fi loss after lunch but the engineer records no times or environmental conditions. The observed fictional Pinefield Logistics condition is specifically explained by “Interface addresses and routing decisions must be inspected on the host to determine the egress path.”.
D:That cause belongs to a different case: A technician changes the switch, router and endpoint all at once and cannot tell which modification restored service. The observed fictional Pinefield Logistics condition is specifically explained by “Interface addresses and routing decisions must be inspected on the host to determine the egress path.”.
Question 795
A reviewer evaluates a proposed repair for: At the fictional Pinefield Logistics while assessing a controlled network fault, the team observes: A Linux host shows two IPv4 addresses on different NICs but a troubleshooter reads only its hostname to determine which address a route uses. The approved corrective action is: “Use ip addr and ip route get for the destination to identify the selected interface and source.” Which result BEST demonstrates success?
- A supported terminal prompt is available without requiring a Windows desktop on the switch.
- The hardware ticket records valid serial and stack member details from the appropriate read-only commands.
- Another authorized technician opens the saved file and sees the expected captured DNS packets.
- The route lookup reports the actual outgoing interface and source IP for the test.
Explanation
Correct Answer
D:Correct. This is the required observable acceptance evidence for “Use ip addr and ip route get for the destination to identify the selected interface and source.” at the fictional Pinefield Logistics. It demonstrates correction of the original cause: Interface addresses and routing decisions must be inspected on the host to determine the egress path.
Incorrect Answers
A:That result is evidence for a separate corrective action, “Choose an authorized SSH session or physical console for the switch rather than RDP.”. It does not establish the intended outcome “The route lookup reports the actual outgoing interface and source IP for the test.” for the fictional Pinefield Logistics case.
B:That result is evidence for a separate corrective action, “Use show inventory for product identifiers and show switch where supported for switch-stack membership.”. It does not establish the intended outcome “The route lookup reports the actual outgoing interface and source IP for the test.” for the fictional Pinefield Logistics case.
C:That result is evidence for a separate corrective action, “Save the relevant capture in an approved .pcap or .pcapng file with case identification.”. It does not establish the intended outcome “The route lookup reports the actual outgoing interface and source IP for the test.” for the fictional Pinefield Logistics case.
Question 796
The technician plans a correction for: At the fictional Pinefield Logistics while assessing a controlled network fault, the team observes: A Linux host shows two IPv4 addresses on different NICs but a troubleshooter reads only its hostname to determine which address a route uses. During “Use ip addr and ip route get for the destination to identify the selected interface and source.”, which precaution MOST specifically prevents a related risk?
- Do not label a recurring issue random without gathering its occurrence pattern.
- Do not treat console wiring as a replacement for a LAN or WAN uplink.
- Do not assume a hostname uniquely determines which NIC transmits a given flow.
- Do not infer all port link states only from interface configuration stanzas.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Use ip addr and ip route get for the destination to identify the selected interface and source.” at the fictional Pinefield Logistics. The required protection is “Do not assume a hostname uniquely determines which NIC transmits a given flow.”; success still requires “The route lookup reports the actual outgoing interface and source IP for the test.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A user reports recurring Wi-Fi loss after lunch but the engineer records no times or environmental conditions. The principal adjacent risk here is controlled by “Do not assume a hostname uniquely determines which NIC transmits a given flow.”.
B:This caution is appropriate for a separate failure pattern: A field engineer plugs a console rollover cable into a router and expects the operating system to create a normal internet connection over the cable. The principal adjacent risk here is controlled by “Do not assume a hostname uniquely determines which NIC transmits a given flow.”.
D:This caution is appropriate for a separate failure pattern: A technician needs a quick view of which switch ports are connected or disconnected but the engineer dumps a full device configuration and misses the status overview. The principal adjacent risk here is controlled by “Do not assume a hostname uniquely determines which NIC transmits a given flow.”.
Question 797
A service desk receives this network finding: At the fictional Orchard Health Clinic after a site connectivity report, the team observes: A PC has good local pings but application responses fail for large packets; the technician tests only tiny ICMP payloads and declares MTU healthy. Which action MOST directly resolves the reported issue?
- Use ? help and command completion in the appropriate EXEC context before running a read-only show command.
- Compare appropriately sized controlled probes with the application path and consult MTU or PMTU evidence.
- Filter or inspect DNS traffic from the affected client and correlate transaction IDs and timing.
- Use a controlled read-only script or supported NMS query to collect required device data.
Explanation
Correct Answer
B:Correct. In the fictional Orchard Health Clinic case, Successful small probes do not prove that a path supports larger packets without fragmentation or PMTU issues. The specified corrective action, “Compare appropriately sized controlled probes with the application path and consult MTU or PMTU evidence.”, directly targets that condition. Evidence of resolution: Large-payload failure is reproduced or excluded with documented packet sizes and path conditions.
Incorrect Answers
A:That action addresses a different network issue: An entry-level operator receives an unfamiliar IOS show command syntax and repeatedly enters random privileged configuration commands to discover the correct keyword. The present fictional Orchard Health Clinic finding instead needs “Compare appropriately sized controlled probes with the application path and consult MTU or PMTU evidence.”, verified by “Large-payload failure is reproduced or excluded with documented packet sizes and path conditions.”.
C:That action addresses a different network issue: A Wireshark user wants to investigate a failed DNS lookup but records only Ethernet broadcast frames unrelated to the query. The present fictional Orchard Health Clinic finding instead needs “Compare appropriately sized controlled probes with the application path and consult MTU or PMTU evidence.”, verified by “Large-payload failure is reproduced or excluded with documented packet sizes and path conditions.”.
D:That action addresses a different network issue: A support engineer launches an ad hoc script that reconfigures every router to collect interface data without confirming whether read-only data is available. The present fictional Orchard Health Clinic finding instead needs “Compare appropriately sized controlled probes with the application path and consult MTU or PMTU evidence.”, verified by “Large-payload failure is reproduced or excluded with documented packet sizes and path conditions.”.
Question 798
Before changing settings, consider this issue: At the fictional Orchard Health Clinic after a site connectivity report, the team observes: A PC has good local pings but application responses fail for large packets; the technician tests only tiny ICMP payloads and declares MTU healthy. What is the MOST specific underlying cause?
- Successful small probes do not prove that a path supports larger packets without fragmentation or PMTU issues.
- Root-cause conclusions require supporting observations and elimination of plausible alternatives.
- show mac address-table is used to inspect learned Ethernet MAC addresses and associated VLAN or ports.
- TCP retransmissions suggest transport delivery or timing issues rather than proving application authentication outcome.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Orchard Health Clinic: Successful small probes do not prove that a path supports larger packets without fragmentation or PMTU issues. The corresponding remedy is “Compare appropriately sized controlled probes with the application path and consult MTU or PMTU evidence.”. Confirmation: Large-payload failure is reproduced or excluded with documented packet sizes and path conditions.
Incorrect Answers
B:That cause belongs to a different case: A help desk attributes a recurring outage to 'user error' without collecting interface counters, logs or endpoint details. The observed fictional Orchard Health Clinic condition is specifically explained by “Successful small probes do not prove that a path supports larger packets without fragmentation or PMTU issues.”.
C:That cause belongs to a different case: A switch is missing a workstation's MAC entry and the technician runs show ip route expecting it to show learned Ethernet source locations. The observed fictional Orchard Health Clinic condition is specifically explained by “Successful small probes do not prove that a path supports larger packets without fragmentation or PMTU issues.”.
D:That cause belongs to a different case: An analyst sees repeated TCP retransmission annotations and claims they prove an application-level password rejection. The observed fictional Orchard Health Clinic condition is specifically explained by “Successful small probes do not prove that a path supports larger packets without fragmentation or PMTU issues.”.
Question 799
A reviewer evaluates a proposed repair for: At the fictional Orchard Health Clinic after a site connectivity report, the team observes: A PC has good local pings but application responses fail for large packets; the technician tests only tiny ICMP payloads and declares MTU healthy. The approved corrective action is: “Compare appropriately sized controlled probes with the application path and consult MTU or PMTU evidence.” Which result BEST demonstrates success?
- The original transaction succeeds and the user confirms service restoration.
- The overview shows the intended connected or notconnect status for the selected access port.
- The management session negotiates SSH and the plaintext Telnet service is not required.
- Large-payload failure is reproduced or excluded with documented packet sizes and path conditions.
Explanation
Correct Answer
D:Correct. This is the required observable acceptance evidence for “Compare appropriately sized controlled probes with the application path and consult MTU or PMTU evidence.” at the fictional Orchard Health Clinic. It demonstrates correction of the original cause: Successful small probes do not prove that a path supports larger packets without fragmentation or PMTU issues.
Incorrect Answers
A:That result is evidence for a separate corrective action, “Recreate the user's failing application transaction after the network adjustment.”. It does not establish the intended outcome “Large-payload failure is reproduced or excluded with documented packet sizes and path conditions.” for the fictional Orchard Health Clinic case.
B:That result is evidence for a separate corrective action, “Use show interfaces status on the switch and note the affected port's operational state.”. It does not establish the intended outcome “Large-payload failure is reproduced or excluded with documented packet sizes and path conditions.” for the fictional Orchard Health Clinic case.
C:That result is evidence for a separate corrective action, “Use SSH with authenticated device identity and approved credentials for remote CLI access.”. It does not establish the intended outcome “Large-payload failure is reproduced or excluded with documented packet sizes and path conditions.” for the fictional Orchard Health Clinic case.
Question 800
The technician plans a correction for: At the fictional Orchard Health Clinic after a site connectivity report, the team observes: A PC has good local pings but application responses fail for large packets; the technician tests only tiny ICMP payloads and declares MTU healthy. During “Compare appropriately sized controlled probes with the application path and consult MTU or PMTU evidence.”, which precaution MOST specifically prevents a related risk?
- Do not leave configuration changes undocumented after restoring service.
- Do not confuse an interface status summary with the full routing table.
- Do not infer full-size packet delivery from a single minimum-size ping reply.
- Do not treat every managed device as a Windows RDP endpoint.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Compare appropriately sized controlled probes with the application path and consult MTU or PMTU evidence.” at the fictional Orchard Health Clinic. The required protection is “Do not infer full-size packet delivery from a single minimum-size ping reply.”; success still requires “Large-payload failure is reproduced or excluded with documented packet sizes and path conditions.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A site network outage is repaired, but follow-up documentation omits what changed and which devices were touched. The principal adjacent risk here is controlled by “Do not infer full-size packet delivery from a single minimum-size ping reply.”.
B:This caution is appropriate for a separate failure pattern: A router's interfaces are administratively down and a junior engineer uses show ip route as the only way to see whether each interface has an IP or is up. The principal adjacent risk here is controlled by “Do not infer full-size packet delivery from a single minimum-size ping reply.”.
D:This caution is appropriate for a separate failure pattern: A technician uses a Windows remote desktop tool to administer a router CLI and expects a graphical Windows session on the Cisco switch. The principal adjacent risk here is controlled by “Do not infer full-size packet delivery from a single minimum-size ping reply.”.