Cisco Certified Support Technician (CCST) Networking 100-150 Practice Test 81
Question 800
The technician plans a correction for: At the fictional Orchard Health Clinic after a site connectivity report, the team observes: A PC has good local pings but application responses fail for large packets; the technician tests only tiny ICMP payloads and declares MTU healthy. During “Compare appropriately sized controlled probes with the application path and consult MTU or PMTU evidence.”, which precaution MOST specifically prevents a related risk?
- Do not leave configuration changes undocumented after restoring service.
- Do not confuse an interface status summary with the full routing table.
- Do not infer full-size packet delivery from a single minimum-size ping reply.
- Do not treat every managed device as a Windows RDP endpoint.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Compare appropriately sized controlled probes with the application path and consult MTU or PMTU evidence.” at the fictional Orchard Health Clinic. The required protection is “Do not infer full-size packet delivery from a single minimum-size ping reply.”; success still requires “Large-payload failure is reproduced or excluded with documented packet sizes and path conditions.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A site network outage is repaired, but follow-up documentation omits what changed and which devices were touched. The principal adjacent risk here is controlled by “Do not infer full-size packet delivery from a single minimum-size ping reply.”.
B:This caution is appropriate for a separate failure pattern: A router's interfaces are administratively down and a junior engineer uses show ip route as the only way to see whether each interface has an IP or is up. The principal adjacent risk here is controlled by “Do not infer full-size packet delivery from a single minimum-size ping reply.”.
D:This caution is appropriate for a separate failure pattern: A technician uses a Windows remote desktop tool to administer a router CLI and expects a graphical Windows session on the Cisco switch. The principal adjacent risk here is controlled by “Do not infer full-size packet delivery from a single minimum-size ping reply.”.
Question 801
A service desk receives this network finding: At the fictional Harborline Clinic while checking a service ticket, the team observes: An administrator wants encrypted command-line access to a router but a trainee selects Telnet on an untrusted network. Which action MOST directly resolves the reported issue?
- Filter or inspect DNS traffic from the affected client and correlate transaction IDs and timing.
- Use SSH with authenticated device identity and approved credentials for remote CLI access.
- Use show inventory for product identifiers and show switch where supported for switch-stack membership.
- Compare ping to an IP with nslookup of the affected hostname and inspect the configured DNS resolver.
Explanation
Correct Answer
B:Correct. In the fictional Harborline Clinic case, Telnet normally sends its terminal session without SSH's encryption protections. The specified corrective action, “Use SSH with authenticated device identity and approved credentials for remote CLI access.”, directly targets that condition. Evidence of resolution: The management session negotiates SSH and the plaintext Telnet service is not required.
Incorrect Answers
A:That action addresses a different network issue: A Wireshark user wants to investigate a failed DNS lookup but records only Ethernet broadcast frames unrelated to the query. The present fictional Harborline Clinic finding instead needs “Use SSH with authenticated device identity and approved credentials for remote CLI access.”, verified by “The management session negotiates SSH and the plaintext Telnet service is not required.”.
C:That action addresses a different network issue: A support case needs a chassis serial and switch-stack member number, but a trainee reads only interface status and invents both. The present fictional Harborline Clinic finding instead needs “Use SSH with authenticated device identity and approved credentials for remote CLI access.”, verified by “The management session negotiates SSH and the plaintext Telnet service is not required.”.
D:That action addresses a different network issue: A PC pings 8.8.8.8 successfully but cannot resolve a website name and the operator replaces its Ethernet cable. The present fictional Harborline Clinic finding instead needs “Use SSH with authenticated device identity and approved credentials for remote CLI access.”, verified by “The management session negotiates SSH and the plaintext Telnet service is not required.”.
Question 802
Before changing settings, consider this issue: At the fictional Harborline Clinic while checking a service ticket, the team observes: An administrator wants encrypted command-line access to a router but a trainee selects Telnet on an untrusted network. What is the MOST specific underlying cause?
- Telnet normally sends its terminal session without SSH's encryption protections.
- Successful small probes do not prove that a path supports larger packets without fragmentation or PMTU issues.
- Verification must test the original reported business symptom, not only a convenient proxy measurement.
- Escalation should follow ownership boundaries and include observations already collected.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Harborline Clinic: Telnet normally sends its terminal session without SSH's encryption protections. The corresponding remedy is “Use SSH with authenticated device identity and approved credentials for remote CLI access.”. Confirmation: The management session negotiates SSH and the plaintext Telnet service is not required.
Incorrect Answers
B:That cause belongs to a different case: A PC has good local pings but application responses fail for large packets; the technician tests only tiny ICMP payloads and declares MTU healthy. The observed fictional Harborline Clinic condition is specifically explained by “Telnet normally sends its terminal session without SSH's encryption protections.”.
C:That cause belongs to a different case: A technician announces a fix after one successful ping but the user's original payment application still cannot connect. The observed fictional Harborline Clinic condition is specifically explained by “Telnet normally sends its terminal session without SSH's encryption protections.”.
D:That cause belongs to a different case: A help-desk worker cannot resolve a carrier circuit fault but leaves the ticket unassigned because the local desktop was restarted. The observed fictional Harborline Clinic condition is specifically explained by “Telnet normally sends its terminal session without SSH's encryption protections.”.
Question 803
A reviewer evaluates a proposed repair for: At the fictional Harborline Clinic while checking a service ticket, the team observes: An administrator wants encrypted command-line access to a router but a trainee selects Telnet on an untrusted network. The approved corrective action is: “Use SSH with authenticated device identity and approved credentials for remote CLI access.” Which result BEST demonstrates success?
- The Windows configuration shows a valid on-subnet gateway and the client reaches a remote network.
- Another analyst can reopen and filter the original packet data.
- The route lookup reports the actual outgoing interface and source IP for the test.
- The management session negotiates SSH and the plaintext Telnet service is not required.
Explanation
Correct Answer
D:Correct. This is the required observable acceptance evidence for “Use SSH with authenticated device identity and approved credentials for remote CLI access.” at the fictional Harborline Clinic. It demonstrates correction of the original cause: Telnet normally sends its terminal session without SSH's encryption protections.
Incorrect Answers
A:That result is evidence for a separate corrective action, “Use ipconfig /all and route inspection to identify and correct the missing gateway.”. It does not establish the intended outcome “The management session negotiates SSH and the plaintext Telnet service is not required.” for the fictional Harborline Clinic case.
B:That result is evidence for a separate corrective action, “Save the actual capture file and include the screenshot only as an optional pointer to relevant frames.”. It does not establish the intended outcome “The management session negotiates SSH and the plaintext Telnet service is not required.” for the fictional Harborline Clinic case.
C:That result is evidence for a separate corrective action, “Use ip addr and ip route get for the destination to identify the selected interface and source.”. It does not establish the intended outcome “The management session negotiates SSH and the plaintext Telnet service is not required.” for the fictional Harborline Clinic case.
Question 804
The technician plans a correction for: At the fictional Harborline Clinic while checking a service ticket, the team observes: An administrator wants encrypted command-line access to a router but a trainee selects Telnet on an untrusted network. During “Use SSH with authenticated device identity and approved credentials for remote CLI access.”, which precaution MOST specifically prevents a related risk?
- Do not close the incident solely because an unrelated host responds to ICMP echo.
- Do not infer absence from a filtered packet list without checking the full capture.
- Do not transmit privileged management passwords over plain Telnet on untrusted links.
- Do not assume all operating systems expose the same diagnostic command names.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Use SSH with authenticated device identity and approved credentials for remote CLI access.” at the fictional Harborline Clinic. The required protection is “Do not transmit privileged management passwords over plain Telnet on untrusted links.”; success still requires “The management session negotiates SSH and the plaintext Telnet service is not required.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A technician announces a fix after one successful ping but the user's original payment application still cannot connect. The principal adjacent risk here is controlled by “Do not transmit privileged management passwords over plain Telnet on untrusted links.”.
B:This caution is appropriate for a separate failure pattern: A support worker uses a Wireshark display filter to hide TCP traffic and then claims that the filtered packets were never captured. The principal adjacent risk here is controlled by “Do not transmit privileged management passwords over plain Telnet on untrusted links.”.
D:This caution is appropriate for a separate failure pattern: A Linux technician tries tracert and reports the command unavailable even though the objective is to find where a path fails. The principal adjacent risk here is controlled by “Do not transmit privileged management passwords over plain Telnet on untrusted links.”.
Question 805
A service desk receives this network finding: At the fictional Crescent Community Center after a user reports a recurring problem, the team observes: A technician uses a Windows remote desktop tool to administer a router CLI and expects a graphical Windows session on the Cisco switch. Which action MOST directly resolves the reported issue?
- Save the relevant capture in an approved .pcap or .pcapng file with case identification.
- Choose an authorized SSH session or physical console for the switch rather than RDP.
- Capture the event times, client location, AP association and nearby interference indicators.
- Inspect TLS handshake metadata and transport behavior rather than promising automatic plaintext disclosure.
Explanation
Correct Answer
B:Correct. In the fictional Crescent Community Center case, RDP targets compatible desktop hosts; Cisco network-device CLI access usually uses SSH or console. The specified corrective action, “Choose an authorized SSH session or physical console for the switch rather than RDP.”, directly targets that condition. Evidence of resolution: A supported terminal prompt is available without requiring a Windows desktop on the switch.
Incorrect Answers
A:That action addresses a different network issue: An operator captures a DNS exchange in Wireshark but closes the capture without saving any file for escalation. The present fictional Crescent Community Center finding instead needs “Choose an authorized SSH session or physical console for the switch rather than RDP.”, verified by “A supported terminal prompt is available without requiring a Windows desktop on the switch.”.
C:That action addresses a different network issue: A user reports recurring Wi-Fi loss after lunch but the engineer records no times or environmental conditions. The present fictional Crescent Community Center finding instead needs “Choose an authorized SSH session or physical console for the switch rather than RDP.”, verified by “A supported terminal prompt is available without requiring a Windows desktop on the switch.”.
D:That action addresses a different network issue: A user says a packet analyzer can reconstruct any encrypted HTTPS password from normal packet capture without keys. The present fictional Crescent Community Center finding instead needs “Choose an authorized SSH session or physical console for the switch rather than RDP.”, verified by “A supported terminal prompt is available without requiring a Windows desktop on the switch.”.
Question 806
Before changing settings, consider this issue: At the fictional Crescent Community Center after a user reports a recurring problem, the team observes: A technician uses a Windows remote desktop tool to administer a router CLI and expects a graphical Windows session on the Cisco switch. What is the MOST specific underlying cause?
- RDP targets compatible desktop hosts; Cisco network-device CLI access usually uses SSH or console.
- Escalation should follow ownership boundaries and include observations already collected.
- Intermittent faults need a timeline and correlated environment observations to support diagnosis.
- Complete operational records support repeatability, auditing and preventing recurrence.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Crescent Community Center: RDP targets compatible desktop hosts; Cisco network-device CLI access usually uses SSH or console. The corresponding remedy is “Choose an authorized SSH session or physical console for the switch rather than RDP.”. Confirmation: A supported terminal prompt is available without requiring a Windows desktop on the switch.
Incorrect Answers
B:That cause belongs to a different case: A help-desk worker cannot resolve a carrier circuit fault but leaves the ticket unassigned because the local desktop was restarted. The observed fictional Crescent Community Center condition is specifically explained by “RDP targets compatible desktop hosts; Cisco network-device CLI access usually uses SSH or console.”.
C:That cause belongs to a different case: A user reports recurring Wi-Fi loss after lunch but the engineer records no times or environmental conditions. The observed fictional Crescent Community Center condition is specifically explained by “RDP targets compatible desktop hosts; Cisco network-device CLI access usually uses SSH or console.”.
D:That cause belongs to a different case: A site network outage is repaired, but follow-up documentation omits what changed and which devices were touched. The observed fictional Crescent Community Center condition is specifically explained by “RDP targets compatible desktop hosts; Cisco network-device CLI access usually uses SSH or console.”.
Question 807
A reviewer evaluates a proposed repair for: At the fictional Crescent Community Center after a user reports a recurring problem, the team observes: A technician uses a Windows remote desktop tool to administer a router CLI and expects a graphical Windows session on the Cisco switch. The approved corrective action is: “Choose an authorized SSH session or physical console for the switch rather than RDP.” Which result BEST demonstrates success?
- The incident record links approval, executed actions, results and a tested recovery path.
- Numeric reachability remains good while the corrected resolver returns the expected DNS answer.
- The report distinguishes visible connection metadata from encrypted application payload.
- A supported terminal prompt is available without requiring a Windows desktop on the switch.
Explanation
Correct Answer
D:Correct. This is the required observable acceptance evidence for “Choose an authorized SSH session or physical console for the switch rather than RDP.” at the fictional Crescent Community Center. It demonstrates correction of the original cause: RDP targets compatible desktop hosts; Cisco network-device CLI access usually uses SSH or console.
Incorrect Answers
A:That result is evidence for a separate corrective action, “Seek the required authorization, document the planned change and prepare a reversible rollback.”. It does not establish the intended outcome “A supported terminal prompt is available without requiring a Windows desktop on the switch.” for the fictional Crescent Community Center case.
B:That result is evidence for a separate corrective action, “Compare ping to an IP with nslookup of the affected hostname and inspect the configured DNS resolver.”. It does not establish the intended outcome “A supported terminal prompt is available without requiring a Windows desktop on the switch.” for the fictional Crescent Community Center case.
C:That result is evidence for a separate corrective action, “Inspect TLS handshake metadata and transport behavior rather than promising automatic plaintext disclosure.”. It does not establish the intended outcome “A supported terminal prompt is available without requiring a Windows desktop on the switch.” for the fictional Crescent Community Center case.
Question 808
The technician plans a correction for: At the fictional Crescent Community Center after a user reports a recurring problem, the team observes: A technician uses a Windows remote desktop tool to administer a router CLI and expects a graphical Windows session on the Cisco switch. During “Choose an authorized SSH session or physical console for the switch rather than RDP.”, which precaution MOST specifically prevents a related risk?
- Do not assume the IPv4 routing table contains learned per-port Ethernet MAC entries.
- Do not claim a packet capture is delivered when only an unsaved Wireshark window exists.
- Do not treat every managed device as a Windows RDP endpoint.
- Do not apply multiple untracked network changes that remove the ability to isolate root cause.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Choose an authorized SSH session or physical console for the switch rather than RDP.” at the fictional Crescent Community Center. The required protection is “Do not treat every managed device as a Windows RDP endpoint.”; success still requires “A supported terminal prompt is available without requiring a Windows desktop on the switch.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A switch is missing a workstation's MAC entry and the technician runs show ip route expecting it to show learned Ethernet source locations. The principal adjacent risk here is controlled by “Do not treat every managed device as a Windows RDP endpoint.”.
B:This caution is appropriate for a separate failure pattern: An operator captures a DNS exchange in Wireshark but closes the capture without saving any file for escalation. The principal adjacent risk here is controlled by “Do not treat every managed device as a Windows RDP endpoint.”.
D:This caution is appropriate for a separate failure pattern: A technician changes the switch, router and endpoint all at once and cannot tell which modification restored service. The principal adjacent risk here is controlled by “Do not treat every managed device as a Windows RDP endpoint.”.
Question 809
A service desk receives this network finding: At the fictional Willowbrook Campus during a physical cabling audit, the team observes: A switch's management IP is misconfigured and remote SSH fails, but an on-site technician refuses to use its working console port. Which action MOST directly resolves the reported issue?
- Seek the required authorization, document the planned change and prepare a reversible rollback.
- Attach an approved console adapter and inspect the device's configuration through the terminal emulator.
- Check permitted application-port reachability and firewall policy alongside the ping result.
- Use ? help and command completion in the appropriate EXEC context before running a read-only show command.
Explanation
Correct Answer
B:Correct. In the fictional Willowbrook Campus case, Local console access can provide out-of-band recovery when normal IP management is unavailable. The specified corrective action, “Attach an approved console adapter and inspect the device's configuration through the terminal emulator.”, directly targets that condition. Evidence of resolution: The technician obtains CLI access without requiring working in-band management IP connectivity.
Incorrect Answers
A:That action addresses a different network issue: An engineer receives a request to make a risky production change during an outage but no approver or rollback plan is recorded. The present fictional Willowbrook Campus finding instead needs “Attach an approved console adapter and inspect the device's configuration through the terminal emulator.”, verified by “The technician obtains CLI access without requiring working in-band management IP connectivity.”.
C:That action addresses a different network issue: A Windows operator sees 'Request timed out' from ping and concludes the destination host is powered off, ignoring possible ICMP filtering. The present fictional Willowbrook Campus finding instead needs “Attach an approved console adapter and inspect the device's configuration through the terminal emulator.”, verified by “The technician obtains CLI access without requiring working in-band management IP connectivity.”.
D:That action addresses a different network issue: An entry-level operator receives an unfamiliar IOS show command syntax and repeatedly enters random privileged configuration commands to discover the correct keyword. The present fictional Willowbrook Campus finding instead needs “Attach an approved console adapter and inspect the device's configuration through the terminal emulator.”, verified by “The technician obtains CLI access without requiring working in-band management IP connectivity.”.
Question 810
Before changing settings, consider this issue: At the fictional Willowbrook Campus during a physical cabling audit, the team observes: A switch's management IP is misconfigured and remote SSH fails, but an on-site technician refuses to use its working console port. What is the MOST specific underlying cause?
- Local console access can provide out-of-band recovery when normal IP management is unavailable.
- Linux commonly uses traceroute or tracepath rather than Windows tracert for hop-by-hop tests.
- TCP retransmissions suggest transport delivery or timing issues rather than proving application authentication outcome.
- Verification must test the original reported business symptom, not only a convenient proxy measurement.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Willowbrook Campus: Local console access can provide out-of-band recovery when normal IP management is unavailable. The corresponding remedy is “Attach an approved console adapter and inspect the device's configuration through the terminal emulator.”. Confirmation: The technician obtains CLI access without requiring working in-band management IP connectivity.
Incorrect Answers
B:That cause belongs to a different case: A Linux technician tries tracert and reports the command unavailable even though the objective is to find where a path fails. The observed fictional Willowbrook Campus condition is specifically explained by “Local console access can provide out-of-band recovery when normal IP management is unavailable.”.
C:That cause belongs to a different case: An analyst sees repeated TCP retransmission annotations and claims they prove an application-level password rejection. The observed fictional Willowbrook Campus condition is specifically explained by “Local console access can provide out-of-band recovery when normal IP management is unavailable.”.
D:That cause belongs to a different case: A technician announces a fix after one successful ping but the user's original payment application still cannot connect. The observed fictional Willowbrook Campus condition is specifically explained by “Local console access can provide out-of-band recovery when normal IP management is unavailable.”.