Network Operations CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   While analyzing a packet capture from a SPAN session, a network engineer notices that TCP packets from a client to a server have the SYN flag set but the server never responds with SYN-ACK. The capture also shows that the packets are arriving at the server's interface. What is the most likely cause?

   • AThe server's TCP stack is not responding because the SYN packets are being dropped by the server's firewall before reaching the application.
   • BThe server's firewall is dropping the incoming SYN packets.
   • CThe server's application is not listening on the destination port.
   • DThe server's TCP stack is not sending SYN-ACK due to a misconfigured access control list on the server.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A network engineer is analyzing a packet capture and sees that a client is sending TCP SYN packets to a server, but the server is responding with a RST, ACK. The client is using the correct IP address and port. What is the most likely cause?

   • AThe client's IP address is blocked by the server's firewall.
   • BThe server's application is not listening on the destination port.
   • CThe client is sending SYNs too quickly, causing the server to reset.
   • DThe server is experiencing a SYN flood and is resetting connections.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A network administrator is troubleshooting a connectivity issue from a workstation to a remote server. The administrator can ping the default gateway but cannot ping the remote server. The administrator runs traceroute and sees that the path stops at the third hop. What should the administrator do next?

   • AUse telnet to the remote server's port 80 to test TCP connectivity.
   • BRun a packet capture on the workstation to see if the ICMP packets are being sent.
   • CCheck the firewall rules on the remote server to see if ICMP is blocked.
   • DCheck the routing table on the third-hop router to see if it has a route to the destination.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A network engineer runs 'show ip route' on a router and sees that a route to 10.10.10.0/24 is learned via OSPF with an administrative distance of 110. However, the router is forwarding traffic to 10.10.10.1 via a different next hop than the OSPF route. What is the most likely explanation?

   • AThere is a static route with a lower administrative distance that overrides the OSPF route.
   • BThe OSPF route is in the routing table but the router is using a more specific route that matches the destination.
   • CThe OSPF route is not in the routing table because the interface is down.
   • DThe router is using a load-balancing mechanism that sends traffic across multiple paths.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A network engineer needs to capture traffic between two sites that are connected over a WAN link. The engineer wants to analyze the traffic on a centralized analyzer located at the main site. The capture must include all traffic between the two sites, not just a single VLAN. What method should the engineer use?

   • AConfigure RSPAN on the main site's switch to capture traffic from the remote site.
   • BConfigure an ERSPAN session on the remote site's router and send the encapsulated traffic to the analyzer at the main site.
   • CUse tcpdump on the remote site's router to capture traffic and then transfer the capture file to the analyzer.
   • DConfigure a SPAN session on the main site's switch and send the traffic to the analyzer.
   Reveal Solution Discussion Select an answer first