Common Network Protocols GNFA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A network analyst is troubleshooting intermittent connectivity between two hosts on the same /24 IPv4 subnet. A packet capture on the source host shows ARP requests being sent repeatedly, but no ARP replies are captured. The source host's ARP cache shows the destination IP as incomplete. Which two-layer issue is most directly indicated by this evidence?

   • AThe destination host is not responding to the ARP request because its network interface is down or the cable is unplugged.
   • BThe source host has a static ARP entry pointing to the wrong MAC address for the destination IP.
   • CThe destination host's IP address is misconfigured with a different subnet mask.
   • DA firewall on the source host is blocking the ARP reply packets from reaching the TCP/IP stack.
   Reveal Solution Discussion Select an answer first
2. 17application · easy

   A network analyst is troubleshooting a connectivity issue between two hosts on different subnets. The analyst runs a ping from Host A to Host B and receives 'Destination Host Unreachable' from the router. Which ICMP message type is being used to report this error?

   • AICMP Type 8 (Echo Request)
   • BICMP Type 3 (Destination Unreachable)
   • CICMP Type 5 (Redirect)
   • DICMP Type 11 (Time Exceeded)
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A user reports that they can send email but cannot receive email on their desktop client. The client is configured to use SMTP for outgoing mail and IMAP for incoming mail. A packet capture shows successful TCP connections to port 25 and port 143. Which protocol is failing if the user cannot receive email?

   • ASMTP, because port 25 is used for sending email and the capture shows a connection, but the server may be rejecting the message.
   • BHTTP, because webmail uses port 80 and the capture does not show a connection to it.
   • CPOP3, because port 110 is the standard port for receiving email, and the capture does not show a connection to it.
   • DIMAP, because port 143 is used for receiving email and the capture shows a connection, but the client may be failing authentication or the server may not be responding correctly.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security analyst is investigating a potential data exfiltration. The analyst sees a DNS query for 'exfil.example.com' from an internal host. The response contains an A record with an IP address, but the analyst also notices that the DNS query was sent to an external DNS server instead of the internal corporate DNS server. What is the most significant concern?

   • AThe host may be using DNS tunneling to exfiltrate data, as the query is sent to an external DNS server and the domain is suspicious.
   • BThe external DNS server is faster than the internal one, so the host is using it for performance reasons.
   • CThe host is using an external DNS server because the internal DNS server is down, which is a normal failover behavior.
   • DThe host is trying to resolve a legitimate domain but the internal DNS server is misconfigured, so it is using an external server.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of ICMPv6?

   • ATo translate IPv6 addresses to MAC addresses
   • BTo encrypt IPv6 packets
   • CTo assign IPv6 addresses to hosts automatically
   • DTo provide error reporting and diagnostic functions for IPv6, including Neighbor Discovery
   Reveal Solution Discussion Select an answer first