Cisco Certified Support Technician (CCST) Networking 100-150 Practice Test 85
Question 840
The technician plans a correction for: At the fictional Westport Transit Depot in a technician onboarding review, the team observes: A small business uses an NMS to collect interface metrics but a novice expects it to provide encrypted administrative command access to every router without SSH or appropriate control channels. During “Record which tasks use the monitoring platform and which require authorized device management access.”, which precaution MOST specifically prevents a related risk?
- Do not change unrelated subnet masks to compensate for a stale DNS record.
- Do not claim a packet capture is delivered when only an unsaved Wireshark window exists.
- Do not confuse passive device monitoring with unrestricted remote command execution.
- Do not infer all port link states only from interface configuration stanzas.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Record which tasks use the monitoring platform and which require authorized device management access.” at the fictional Westport Transit Depot. The required protection is “Do not confuse passive device monitoring with unrestricted remote command execution.”; success still requires “The procedure retrieves status from NMS and uses SSH or console only when a permitted CLI change is necessary.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A workstation's name lookup returns an obsolete IP address and the technician changes its subnet mask instead of checking DNS. The principal adjacent risk here is controlled by “Do not confuse passive device monitoring with unrestricted remote command execution.”.
B:This caution is appropriate for a separate failure pattern: An operator captures a DNS exchange in Wireshark but closes the capture without saving any file for escalation. The principal adjacent risk here is controlled by “Do not confuse passive device monitoring with unrestricted remote command execution.”.
D:This caution is appropriate for a separate failure pattern: A technician needs a quick view of which switch ports are connected or disconnected but the engineer dumps a full device configuration and misses the status overview. The principal adjacent risk here is controlled by “Do not confuse passive device monitoring with unrestricted remote command execution.”.
Question 841
A service desk receives this network finding: At the fictional Cascade Science Lab during a scheduled lab validation, the team observes: A Cisco router's running configuration is questioned after a change but an operator runs show version and claims it lists the active interface and ACL configuration. Which action MOST directly resolves the reported issue?
- Select the active Wi-Fi interface and start a Wireshark capture during the reproducible fault.
- Use show running-config at the proper privilege level and inspect the relevant configuration sections.
- Record the baseline, intervention, validation and follow-up actions in the ticket and change log.
- Attach an approved console adapter and inspect the device's configuration through the terminal emulator.
Explanation
Correct Answer
B:Correct. In the fictional Cascade Science Lab case, The active device configuration is viewed with show running-config rather than only software-version information. The specified corrective action, “Use show running-config at the proper privilege level and inspect the relevant configuration sections.”, directly targets that condition. Evidence of resolution: The retrieved output contains the configured interfaces and access policies under review.
Incorrect Answers
A:That action addresses a different network issue: A technician captures packets on a laptop's inactive Ethernet adapter and sees nothing while the issue occurs over active Wi-Fi. The present fictional Cascade Science Lab finding instead needs “Use show running-config at the proper privilege level and inspect the relevant configuration sections.”, verified by “The retrieved output contains the configured interfaces and access policies under review.”.
C:That action addresses a different network issue: A site network outage is repaired, but follow-up documentation omits what changed and which devices were touched. The present fictional Cascade Science Lab finding instead needs “Use show running-config at the proper privilege level and inspect the relevant configuration sections.”, verified by “The retrieved output contains the configured interfaces and access policies under review.”.
D:That action addresses a different network issue: A switch's management IP is misconfigured and remote SSH fails, but an on-site technician refuses to use its working console port. The present fictional Cascade Science Lab finding instead needs “Use show running-config at the proper privilege level and inspect the relevant configuration sections.”, verified by “The retrieved output contains the configured interfaces and access policies under review.”.
Question 842
Before changing settings, consider this issue: At the fictional Cascade Science Lab during a scheduled lab validation, the team observes: A Cisco router's running configuration is questioned after a change but an operator runs show version and claims it lists the active interface and ACL configuration. What is the MOST specific underlying cause?
- The active device configuration is viewed with show running-config rather than only software-version information.
- Interface addresses and routing decisions must be inspected on the host to determine the egress path.
- The endpoint routing configuration must contain a reachable next hop for most off-subnet destinations.
- Troubleshooting requires accurate symptom, scope, device and time information before diagnosis or escalation.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Cascade Science Lab: The active device configuration is viewed with show running-config rather than only software-version information. The corresponding remedy is “Use show running-config at the proper privilege level and inspect the relevant configuration sections.”. Confirmation: The retrieved output contains the configured interfaces and access policies under review.
Incorrect Answers
B:That cause belongs to a different case: A Linux host shows two IPv4 addresses on different NICs but a troubleshooter reads only its hostname to determine which address a route uses. The observed fictional Cascade Science Lab condition is specifically explained by “The active device configuration is viewed with show running-config rather than only software-version information.”.
C:That cause belongs to a different case: A Windows client has no IPv4 default gateway and a technician checks only browser cache before escalating a routing outage. The observed fictional Cascade Science Lab condition is specifically explained by “The active device configuration is viewed with show running-config rather than only software-version information.”.
D:That cause belongs to a different case: An outage ticket contains only 'network down' and the team repeatedly asks users which site and device are affected. The observed fictional Cascade Science Lab condition is specifically explained by “The active device configuration is viewed with show running-config rather than only software-version information.”.
Question 843
A reviewer evaluates a proposed repair for: At the fictional Cascade Science Lab during a scheduled lab validation, the team observes: A Cisco router's running configuration is questioned after a change but an operator runs show version and claims it lists the active interface and ACL configuration. The approved corrective action is: “Use show running-config at the proper privilege level and inspect the relevant configuration sections.” Which result BEST demonstrates success?
- The incident timeline correlates the failures with a reproducible condition or narrows the affected interval.
- Test evidence identifies which single intervention changed the observed failure.
- The case includes only traffic needed to reproduce and analyze the laptop issue.
- The retrieved output contains the configured interfaces and access policies under review.
Explanation
Correct Answer
D:Correct. This is the required observable acceptance evidence for “Use show running-config at the proper privilege level and inspect the relevant configuration sections.” at the fictional Cascade Science Lab. It demonstrates correction of the original cause: The active device configuration is viewed with show running-config rather than only software-version information.
Incorrect Answers
A:That result is evidence for a separate corrective action, “Capture the event times, client location, AP association and nearby interference indicators.”. It does not establish the intended outcome “The retrieved output contains the configured interfaces and access policies under review.” for the fictional Cascade Science Lab case.
B:That result is evidence for a separate corrective action, “Write a hypothesis, make one authorized change and retest before making further changes.”. It does not establish the intended outcome “The retrieved output contains the configured interfaces and access policies under review.” for the fictional Cascade Science Lab case.
C:That result is evidence for a separate corrective action, “Obtain the appropriate authorization and capture the smallest relevant interface, duration and traffic scope.”. It does not establish the intended outcome “The retrieved output contains the configured interfaces and access policies under review.” for the fictional Cascade Science Lab case.
Question 844
The technician plans a correction for: At the fictional Cascade Science Lab during a scheduled lab validation, the team observes: A Cisco router's running configuration is questioned after a change but an operator runs show version and claims it lists the active interface and ACL configuration. During “Use show running-config at the proper privilege level and inspect the relevant configuration sections.”, which precaution MOST specifically prevents a related risk?
- Do not collect unrestricted production traffic when a narrow authorized capture is sufficient.
- Do not replace an exchangeable packet capture artifact with a picture of the UI.
- Do not substitute a software-version summary for the active running configuration.
- Do not declare a third-party circuit issue resolved merely after restarting an unrelated endpoint.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Use show running-config at the proper privilege level and inspect the relevant configuration sections.” at the fictional Cascade Science Lab. The required protection is “Do not substitute a software-version summary for the active running configuration.”; success still requires “The retrieved output contains the configured interfaces and access policies under review.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: An engineer captures on a production uplink for hours without approval and collects traffic from unrelated departments to debug one laptop. The principal adjacent risk here is controlled by “Do not substitute a software-version summary for the active running configuration.”.
B:This caution is appropriate for a separate failure pattern: A technician saves only a screenshot of five Wireshark rows and calls it a reusable packet capture for protocol analysis. The principal adjacent risk here is controlled by “Do not substitute a software-version summary for the active running configuration.”.
D:This caution is appropriate for a separate failure pattern: A help-desk worker cannot resolve a carrier circuit fault but leaves the ticket unassigned because the local desktop was restarted. The principal adjacent risk here is controlled by “Do not substitute a software-version summary for the active running configuration.”.
Question 845
A service desk receives this network finding: At the fictional Seabrook Bakery during basic configuration verification, the team observes: A technician must identify which neighboring Cisco device connects to a local switch port but guesses from cable color instead of using available discovery data. Which action MOST directly resolves the reported issue?
- Use ipconfig /all and route inspection to identify and correct the missing gateway.
- Run show cdp neighbors where permitted and compare the result with cabling records.
- Use a controlled read-only script or supported NMS query to collect required device data.
- Restart the test application and begin capture before initiating the TCP session.
Explanation
Correct Answer
B:Correct. In the fictional Seabrook Bakery case, Cisco Discovery Protocol neighbor information can reveal directly connected Cisco devices and local interfaces when enabled. The specified corrective action, “Run show cdp neighbors where permitted and compare the result with cabling records.”, directly targets that condition. Evidence of resolution: The local port maps to the expected neighbor device and remote port in the discovery output.
Incorrect Answers
A:That action addresses a different network issue: A Windows client has no IPv4 default gateway and a technician checks only browser cache before escalating a routing outage. The present fictional Seabrook Bakery finding instead needs “Run show cdp neighbors where permitted and compare the result with cabling records.”, verified by “The local port maps to the expected neighbor device and remote port in the discovery output.”.
C:That action addresses a different network issue: A support engineer launches an ad hoc script that reconfigures every router to collect interface data without confirming whether read-only data is available. The present fictional Seabrook Bakery finding instead needs “Run show cdp neighbors where permitted and compare the result with cabling records.”, verified by “The local port maps to the expected neighbor device and remote port in the discovery output.”.
D:That action addresses a different network issue: A team needs evidence of a TCP connection setup but starts capturing only after the application session is already established. The present fictional Seabrook Bakery finding instead needs “Run show cdp neighbors where permitted and compare the result with cabling records.”, verified by “The local port maps to the expected neighbor device and remote port in the discovery output.”.
Question 846
Before changing settings, consider this issue: At the fictional Seabrook Bakery during basic configuration verification, the team observes: A technician must identify which neighboring Cisco device connects to a local switch port but guesses from cable color instead of using available discovery data. What is the MOST specific underlying cause?
- Cisco Discovery Protocol neighbor information can reveal directly connected Cisco devices and local interfaces when enabled.
- Troubleshooting requires accurate symptom, scope, device and time information before diagnosis or escalation.
- Useful capture evidence should include the client's resolver request and the corresponding response or timeout.
- Management scripts should use appropriate authorized access and minimize changes when gathering diagnostics.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Seabrook Bakery: Cisco Discovery Protocol neighbor information can reveal directly connected Cisco devices and local interfaces when enabled. The corresponding remedy is “Run show cdp neighbors where permitted and compare the result with cabling records.”. Confirmation: The local port maps to the expected neighbor device and remote port in the discovery output.
Incorrect Answers
B:That cause belongs to a different case: An outage ticket contains only 'network down' and the team repeatedly asks users which site and device are affected. The observed fictional Seabrook Bakery condition is specifically explained by “Cisco Discovery Protocol neighbor information can reveal directly connected Cisco devices and local interfaces when enabled.”.
C:That cause belongs to a different case: A Wireshark user wants to investigate a failed DNS lookup but records only Ethernet broadcast frames unrelated to the query. The observed fictional Seabrook Bakery condition is specifically explained by “Cisco Discovery Protocol neighbor information can reveal directly connected Cisco devices and local interfaces when enabled.”.
D:That cause belongs to a different case: A support engineer launches an ad hoc script that reconfigures every router to collect interface data without confirming whether read-only data is available. The observed fictional Seabrook Bakery condition is specifically explained by “Cisco Discovery Protocol neighbor information can reveal directly connected Cisco devices and local interfaces when enabled.”.
Question 847
A reviewer evaluates a proposed repair for: At the fictional Seabrook Bakery during basic configuration verification, the team observes: A technician must identify which neighboring Cisco device connects to a local switch port but guesses from cable color instead of using available discovery data. The approved corrective action is: “Run show cdp neighbors where permitted and compare the result with cabling records.” Which result BEST demonstrates success?
- The high-impact site outage receives an appropriate priority and escalation record.
- The case includes only traffic needed to reproduce and analyze the laptop issue.
- The evidence narrows the break to a particular link or administrative domain.
- The local port maps to the expected neighbor device and remote port in the discovery output.
Explanation
Correct Answer
D:Correct. This is the required observable acceptance evidence for “Run show cdp neighbors where permitted and compare the result with cabling records.” at the fictional Seabrook Bakery. It demonstrates correction of the original cause: Cisco Discovery Protocol neighbor information can reveal directly connected Cisco devices and local interfaces when enabled.
Incorrect Answers
A:That result is evidence for a separate corrective action, “Triage both incidents against the published severity and impact criteria.”. It does not establish the intended outcome “The local port maps to the expected neighbor device and remote port in the discovery output.” for the fictional Seabrook Bakery case.
B:That result is evidence for a separate corrective action, “Obtain the appropriate authorization and capture the smallest relevant interface, duration and traffic scope.”. It does not establish the intended outcome “The local port maps to the expected neighbor device and remote port in the discovery output.” for the fictional Seabrook Bakery case.
C:That result is evidence for a separate corrective action, “Compare tests at the impacted branch, its gateway, the provider handoff and the central service.”. It does not establish the intended outcome “The local port maps to the expected neighbor device and remote port in the discovery output.” for the fictional Seabrook Bakery case.
Question 848
The technician plans a correction for: At the fictional Seabrook Bakery during basic configuration verification, the team observes: A technician must identify which neighboring Cisco device connects to a local switch port but guesses from cable color instead of using available discovery data. During “Run show cdp neighbors where permitted and compare the result with cabling records.”, which precaution MOST specifically prevents a related risk?
- Do not infer absence from a filtered packet list without checking the full capture.
- Do not claim an ordinary pcap alone reveals all HTTPS credentials or protected content.
- Do not assume CDP proves every possible non-Cisco or disabled-CDP neighbor is absent physically.
- Do not treat unrelated ARP broadcasts as complete proof of a DNS failure.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Run show cdp neighbors where permitted and compare the result with cabling records.” at the fictional Seabrook Bakery. The required protection is “Do not assume CDP proves every possible non-Cisco or disabled-CDP neighbor is absent physically.”; success still requires “The local port maps to the expected neighbor device and remote port in the discovery output.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A support worker uses a Wireshark display filter to hide TCP traffic and then claims that the filtered packets were never captured. The principal adjacent risk here is controlled by “Do not assume CDP proves every possible non-Cisco or disabled-CDP neighbor is absent physically.”.
B:This caution is appropriate for a separate failure pattern: A user says a packet analyzer can reconstruct any encrypted HTTPS password from normal packet capture without keys. The principal adjacent risk here is controlled by “Do not assume CDP proves every possible non-Cisco or disabled-CDP neighbor is absent physically.”.
D:This caution is appropriate for a separate failure pattern: A Wireshark user wants to investigate a failed DNS lookup but records only Ethernet broadcast frames unrelated to the query. The principal adjacent risk here is controlled by “Do not assume CDP proves every possible non-Cisco or disabled-CDP neighbor is absent physically.”.
Question 849
A service desk receives this network finding: At the fictional Lighthouse Research Annex while assessing a controlled network fault, the team observes: A router's interfaces are administratively down and a junior engineer uses show ip route as the only way to see whether each interface has an IP or is up. Which action MOST directly resolves the reported issue?
- Use SSH with authenticated device identity and approved credentials for remote CLI access.
- Run show ip interface brief and identify interface addresses and up/down status.
- Attach an approved console adapter and inspect the device's configuration through the terminal emulator.
- Query the approved NMS and compare its alert scope with device-specific interface evidence.
Explanation
Correct Answer
B:Correct. In the fictional Lighthouse Research Annex case, show ip interface brief summarizes IPv4 interface addresses and administrative/protocol states. The specified corrective action, “Run show ip interface brief and identify interface addresses and up/down status.”, directly targets that condition. Evidence of resolution: The table reports the targeted interface's administrative state and line protocol correctly.
Incorrect Answers
A:That action addresses a different network issue: An administrator wants encrypted command-line access to a router but a trainee selects Telnet on an untrusted network. The present fictional Lighthouse Research Annex finding instead needs “Run show ip interface brief and identify interface addresses and up/down status.”, verified by “The table reports the targeted interface's administrative state and line protocol correctly.”.
C:That action addresses a different network issue: A switch's management IP is misconfigured and remote SSH fails, but an on-site technician refuses to use its working console port. The present fictional Lighthouse Research Annex finding instead needs “Run show ip interface brief and identify interface addresses and up/down status.”, verified by “The table reports the targeted interface's administrative state and line protocol correctly.”.
D:That action addresses a different network issue: A network manager wants an estate-wide view of link health but the technician logs into each device and manually guesses the fleet status. The present fictional Lighthouse Research Annex finding instead needs “Run show ip interface brief and identify interface addresses and up/down status.”, verified by “The table reports the targeted interface's administrative state and line protocol correctly.”.
Question 850
Before changing settings, consider this issue: At the fictional Lighthouse Research Annex while assessing a controlled network fault, the team observes: A router's interfaces are administratively down and a junior engineer uses show ip route as the only way to see whether each interface has an IP or is up. What is the MOST specific underlying cause?
- show ip interface brief summarizes IPv4 interface addresses and administrative/protocol states.
- Firewalls and security controls can block ICMP echo while other services remain reachable.
- TCP retransmissions suggest transport delivery or timing issues rather than proving application authentication outcome.
- Display filters change what is shown after capture; they do not delete already recorded packets.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Lighthouse Research Annex: show ip interface brief summarizes IPv4 interface addresses and administrative/protocol states. The corresponding remedy is “Run show ip interface brief and identify interface addresses and up/down status.”. Confirmation: The table reports the targeted interface's administrative state and line protocol correctly.
Incorrect Answers
B:That cause belongs to a different case: A Windows operator sees 'Request timed out' from ping and concludes the destination host is powered off, ignoring possible ICMP filtering. The observed fictional Lighthouse Research Annex condition is specifically explained by “show ip interface brief summarizes IPv4 interface addresses and administrative/protocol states.”.
C:That cause belongs to a different case: An analyst sees repeated TCP retransmission annotations and claims they prove an application-level password rejection. The observed fictional Lighthouse Research Annex condition is specifically explained by “show ip interface brief summarizes IPv4 interface addresses and administrative/protocol states.”.
D:That cause belongs to a different case: A support worker uses a Wireshark display filter to hide TCP traffic and then claims that the filtered packets were never captured. The observed fictional Lighthouse Research Annex condition is specifically explained by “show ip interface brief summarizes IPv4 interface addresses and administrative/protocol states.”.