Upgrade to remove ads
Only $2.99/month

Chapter 8 - Network Troubleshooting (Quiz + Exam)

Pearson_IT
Get Quizlet's official Network+ - 1 term, 1 practice question, 1 full practice test
Preview

Terms in this set (40)

to identify future abnormal network behavior

to determine if the network can deliver the required policies


Refer to curriculum topic: 8.1.1
A network baseline is created to provide a comparison point, at the time that the network is performing optimally, to whatever changes are implemented in the infrastructure. A baseline helps to keep track of the performance, to track the traffic patterns, and to monitor network behavior.
What are two reasons to create a network baseline? (Choose two.)


to determine what kind of equipment to implement

to evaluate security vulnerabilities in the network

to identify future abnormal network behavior

to design a network according to a proper model

to determine if the network can deliver the required policies

to select a routing protocol
The helpdesk has enough information to begin finding a resolution.


Refer to curriculum topic: 8.1.2
Descriptions of symptoms should be sufficiently detailed so that the troubleshooter knows exactly what is happening. The client describes the application in use, the error that occurred, and the fact that other resources are still functioning properly. Often people feel that rebooting PCs will fix all issues but in this case the issue points to the application since other tasks are still possible. Rebooting the PC, changing ports on the switch, or changing cables will have no effect and will just delay the resolution to the problem.
A client calls the support desk and says this to a technician: "I have just started my computer and attempted to check e-mail. The error 0x800ccc0d was displayed. However, I was able to connect to network drives and access the Internet." Which statement would describe the status of this issue?


More detail is required before a complete problem description can be completed.

The client needs to reboot the PC and report back to the helpdesk.

The helpdesk has enough information to begin finding a resolution.

The client needs to switch cables before the helpdesk can begin to resolve the issue.
Issue the no transport input telnet ssh command and then issue the transport input ssh command.


Refer to curriculum topic: 8.2.3
The configuration command transport input telnet ssh allows a remote access to be connected via Telnet, which transmits information in plain-text. The correct command transport input ssh allows remote accesses only through SSH, which encrypts the information being transmitted.
Refer to the exhibit.

A network administrator issues the commands in order to configure secure remote access to the router. However, the administrator notices that sessions are still being made over telent and are in plain-text. What action should be taken to encrypt the remote access traffic?


Use the enable secret command to configure encryption.

Add the service password-encryption command to the configuration.

Replace the login command with login local.

Issue the no transport input telnet ssh command and then issue the transport input ssh command.
divide-and-conquer


Refer to curriculum topic: 8.1.3
This is a variation on the divide-and-conquer method. Since a routing protocol change was recently made, the administrator can be fairly certain the issue resides with the network layer. Comparing a working to a non-working situation involves comparing configurations, software versions, and hardware changes. The aim is to identify the changes that led to a non-working environment.
A network engineer is troubleshooting a network that has recently been updated with a new routing protocol, but the network is not working as expected. The engineer is comparing the running configuration from before and after the change was made. Which approach to troubleshooting the problem is the engineer using?


comparing IP settings on network devices

divide-and-conquer

bottom-up

top-down
to probe the server that provides the web service to determine if it is also running an email service


Refer to curriculum topic: 8.2.4
Although the Telnet protocol uses TCP port 23, the command can be used to check if other TCP based applications, such as email (port 25), are running on the destination host. Telnet can do so by probing the TCP ports used by those applications. This is accomplished by adding the TCP port number as an argument in the Telnet command. Because the destination is a website, using a web browser can verify its functionality. To establish a management session (if the Telnet server is enabled on the web site), the telnet www.cisco.com command without the port argument could be used. Finally, the tracert www.cisco.com command should be used to identify the path to the server.
A network administrator issues the telnet www.cisco.com 25 command on the workstation. What is the purpose of this command?


to verify that the website is operational

to establish a management session to the web server

to probe the server that provides the web service to determine if it is also running an email service

to identify the path of network traffic toward the web server
Contact the administrator of the external system.


Refer to curriculum topic: 8.1.2
If a problem is outside the control of the organization, it typically cannot be corrected without help from the owner or administrator of the external system.
After gathering symptoms, if the troubleshooter determines that the problem is located outside the control of the organization, what is the next step?


Question the end users.

Analyze existing symptoms.

Narrow the scope of the problem.

Gather symptoms from suspected devices.

Contact the administrator of the external system.
top-down


Refer to curriculum topic: 8.1.3
The fact that some application layer services provided by a network device are operating successfully but others are not means that the lower OSI or TCP/IP layers are functional with the problem likely to be in the application layer.
A network engineer is troubleshooting a network problem where users cannot access the FTP server at the same IP address where a website can be successfully accessed. Which troubleshooting method would be the best to apply in this case?


comparing IP settings on user workstations

top-down

bottom-up

divide-and-conquer
It defines how hosts and network devices connect to the LAN.


Refer to curriculum topic: 8.1.1
A physical topology defines the way in which computers and other network devices are connected to a network.
Which statement describes the physical topology for a LAN?


It depicts the addressing scheme that is employed in the LAN.

It describes whether the LAN is a broadcast or token-passing network.

It defines how hosts and network devices connect to the LAN.

It shows the order in which hosts access the network.
at the same time each day across a set period of average working days, so that typical traffic patterns can be established


Refer to curriculum topic: 8.1.1
The purpose of establishing a network performance baseline is to provide a reference of normal or average network use to enable data traffic anomalies to be detected and then investigated. Network operations that are not average, or are not normal, cannot be used to establish a network performance baseline.
When is the most appropriate time to measure network operations to establish a network performance baseline?


at random times during a 10 week period, so that abnormal traffic levels can be detected

during quiet vacation periods, so that the level of non-data traffic can be determined

whenever high network use is detected, so that how the network performs under stress can be monitored

at the same time each day across a set period of average working days, so that typical traffic patterns can be established
cable tester


Refer to curriculum topic: 8.2.2
Cable testers that include time-domain reflectometers (TDRs) can be used to find the location of breaks in cables by sending signals along the cable and waiting for them to be reflected back.
Which troubleshooting tool can be used to pinpoint the distance to a break in a network cable?


digital multimeter

network analyzer

network analysis module

cable tester
show tech-support


Refer to curriculum topic: 8.1.1
The show tech-support command is useful for troubleshooting very complex problems, and is often requested by Cisco Technical Assistance Center engineers.
Which command runs several other show commands in order to generate many pages of detailed troubleshooting information?


show ip cache

show protocols

show tech-support

show running-config
arp -d


Refer to curriculum topic: 8.2.4
The problem is caused by the router MAC address change because of a new router being used. To re-establish the correct ARP cache on the PCs, the arp -d command should be issued. The arp -a command will list the current ARP cache entries. The ipconfig /renew command is used to obtain/renew a dynamic IPv4 address from a DHCP server. The ipconfig /flushdns command is used to purge the DNS cache. These two ipconfig commands will not solve the problem because the problem is not related to IPv4 configuration.
Users report that their PCs cannot access the file server that is located in the server farm at the headquarters building. The support desk technician checks the latest network update reports and realizes that the router that was connected to the network segment of those users failed suddenly and has just been replaced. What command should the technician instruct the users to issue on the PCs to solve the problem?


arp -a

arp -d

ipconfig /renew

ipconfig /flushdns
An ACL is blocking incoming connections.


Refer to curriculum topic: 8.2.3
The web server does have a default gateway configured, otherwise it could not access the Internet. If there were a faulty cable, the web server would not connect to any other equipment. Excessive broadcasts in the network would make the network unstable and therefore any communication would be affected.
A network engineer is investigating an access issue to a web server. The web server can access the Internet and the local clients can open the web pages. However, outside clients cannot access the web pages. What is the most likely cause of the problem?


The web server does not have a default gateway configured.

An ACL is blocking incoming connections.

There is a cable fault.

There are excessive broadcasts in the network.
nslookup


Refer to curriculum topic: 8.2.4
An attack has been launched within a company and a host name has been identified as the source. What command can a network technician use to determine the IP address assigned to the host name?


ipconfig /all

net computer

nslookup

tracert
IP SLA


Refer to curriculum topic: 8.2.1
IP SLAs use generated traffic to measure network performance between two locations, two network devices, or through multiple network paths. IP SLAs are useful in providing data related to network performance and in troubleshooting congestion-related issues.
Which feature sends simulated data across the network and measures performance between multiple network locations?


LLDP

IP SLA

syslog

SPAN
during normal work hours of an organization


The purpose of a network performance baseline is to record the characteristics of a network during normal operations. This can be used as a standard to determine when a network is performing abnormally. Measurements that are performed during particular circumstances (such as main network device restart or after working hours) will result in an inaccurate set of characteristics for the purpose of a baseline. A DoS attack might cause abnormal network performance, but once it is blocked, network performance should return to normal, so there is no immediate need to measure performance in order to establish a baseline.
When should a network performance baseline be measured?


immediately after the main network devices restarted

during normal work hours of an organization

when a denial of service attack to the network is detected and blocked

after normal work hours to reduce possible interruptions
It creates a point of reference for future network evaluations.


A baseline is used to establish normal network or system performance. It can be used to compare with future network or system performances in order to detect abnormal situations.
What is a purpose of establishing a network baseline?


It manages the performance of network devices.

It provides a statistical average for network performance.

It checks the security configuration of network devices.

It creates a point of reference for future network evaluations.
routing protocols

static routes

IP address and prefix lengths


There are two types of network topology diagrams: physical topology diagrams and logical topology diagrams. Logical topology diagrams show how devices are logically connected and how data moves through the network. Logical topology diagrams include information such as IP addresses, routing protocols, and static routes.
Which three pieces of information are typically recorded in a logical topology diagram? (Choose three.)


routing protocols

device models and manufacturers

cable specifications

device locations

static routes

IP address and prefix lengths
Narrow the scope.


In the "narrow the scope" step of gathering symptoms, a network engineer will determine if the network problem is at the core, distribution, or access layer of the network. Once this step is complete and the layer is identified, the network engineer can determine which pieces of equipment are the most likely cause.
In which step of gathering symptoms does the network engineer determine if the problem is at the core, distribution, or access layer of the network?


Determine the symptoms.

Narrow the scope.

Document the symptoms.

Determine ownership.

Gather information.
change-control procedures


Change-control procedures should be established and applied for each stage to ensure a consistent approach to implementing the solutions, and to enable changes to be rolled back if they cause other unforeseen problems.
A team of engineers has identified a solution to a significant network problem. The proposed solution is likely to affect critical network infrastructure components. What should the team follow while implementing the solution to avoid interfering with other processes and infrastructure?


syslog messages and reports

knowledge base guidelines

change-control procedures

one of the layered troubleshooting approaches
Correct the problem.


There are three stages in the general troubleshooting process:

Gather symptoms
Isolate the problem
Correct the problem

If the problem is not corrected, the administrator documents the attempted solution, removes any changes made, and returns to gathering symptoms.
Refer to the exhibit.

What action occurs at stage 3 of the general troubleshooting process?


Document symptoms.

Narrow the scope.

Correct the problem.

Question end users.
gathering symptoms from suspect devices


A layered troubleshooting approach (top-down, bottom-up, or divide-and-conquer) is used to gather hardware and software symptoms from the suspect devices.
After which step in the network troubleshooting process would one of the layered troubleshooting methods be used?


documenting symptoms

determining ownership

narrowing the scope

gathering symptoms from suspect devices
When did you first notice your email problem?


To efficiently establish exactly when the user first experienced email problems, an open-ended question should be asked so that the user can state the day and time that the problem was first noticed. Closed questions only require a yes or no answer which will require further questions to determine the actual time of the problem.
A network technician is troubleshooting an email connection problem. Which question to the end-user will provide clear information to better define the problem?


What kind of equipment are you using to send emails?

When did you first notice your email problem?

Is your email working now?

How big are the emails you tried to send?
from the network layer to the application layer


A successful ping indicates that everything is working on the physical, data link, and network layer. All of the other layers should be investigated.
A network engineer is troubleshooting a network problem and can successfully ping between two devices. However, Telnet between the same two devices does not work. Which OSI layers should the administrator investigate next?


all of the layers

only the network layer

from the network layer to the application layer

from the network layer to the physical layer
network


Routing is a Layer 3 process. The network layer is another name for Layer 3. The top-down method of troubleshooting typically starts at the application layer, but when a problem is definitely a routing problem, there is no need for troubleshooting to be performed at the higher levels. The problem can only be a Layer 1, 2, or 3 problem.
A network administrator is having issues with a newly installed network not appearing in other routers. At which layer of the OSI model is the network administrator going to start the troubleshooting process when using a top-down approach?


internet

network

application

session

transport
bottom-up


In troubleshooting with the bottom-up method, a technician would start with the physical components of the network and move up through the layers of the OSI model until the cause of the problem is identified.
Which troubleshooting method begins by examining cable connections and wiring issues?


top-down

divide-and-conquer

bottom-up

substitution
IP SLA 99 is sending echo requests every 10 seconds.

IP SLA 99 will run forever unless explicitly disabled.


From the output, the IP SLA is configured to perform icmp-echo, the target device is 192.168.2.1, and the icmp-echo requests are sent every 10 seconds. "Start Time already passed" indicates that the operation has started. The "Life" parameter indicates that the setting is "Forever".
Refer to the exhibit.

On the basis of the information presented, which two IP SLA related statements are true? (Choose two.)



IP SLA 99 is sending echo requests every 10 seconds.

IP SLA 99 is measuring jitter.

IP SLA 99 is sending echo requests from IP address 192.168.2.1.

IP SLA 99 will run forever unless explicitly disabled.

IP SLA 99 is configured with the type dns target-addr 192.168.2.1 command.

IP SLA 99 is scheduled to begin in 2 hours.
protocol analyzer


To verify that the authentication is indeed encrypted, the authentication process needs to be captured and investigated, which can be accomplished through a protocol analyzer, such as Wireshark. A baselining tool is used for automating the network documentation and baselining process. A fault-management tool is used to manage the fault tolerance of network devices . A cable analyzer is used to test and certify copper and fiber cables for different services and standards.
A company is setting up a web site with SSL technology to protect the authentication credentials required to access the web site. A network engineer needs to verify that the setup is correct and that the authentication is indeed encrypted. Which tool should be used?


fault-management tool

cable analyzer

protocol analyzer

baselining tool
network management system tools


Network management system (NMS) tools include device-level monitoring, configuration, and fault-management tools. Knowledge bases are online repositories of experience-based information. Baselining tools perform tasks of network baselining documentation, network diagram drawings, and network performance statistics establishment. Host-based protocol analyzers capture and decode the various protocol layers in a recorded frame and present the information in a relatively easy to use format.
Which category of software troubleshooting tools provides device-level monitoring, configuration, and fault-management?


knowledge bases

baselining tools

network management system tools

host-based protocol analyzers1
NAM

portable network analyzer


Network analysis modules and portable network analyzers such as the Fluke OptiView can monitor network traffic to investigate the amount of data going through switch ports. TDRs, DMMs, and DTX cable analyzers are used to investigate physical media errors and lengths.
Which two specialized troubleshooting tools can monitor the amount of traffic that passes through a switch? (Choose two.)


digital multimeter

TDR

NAM

portable network analyzer

DTX cable analyzer
0


Syslog levels are numbered 0 through 7, with 0 being the most severe and 7 being the least severe.
Which number represents the most severe level of syslog logging?


0

1

6

7
the status of the departmental workgroup switch in the wiring closet
A user in a large office calls technical support to complain that a PC has suddenly lost connectivity to the network. The technician asks the caller to talk to nearby users to see if other machines are affected. The caller reports that several immediate neighbors in the same department have a similar problem and that they cannot ping each other. Those who are seated in other departments have connectivity. What should the technician check as the first step in troubleshooting the issue?


the trunks between switches in the wiring closet

the power outlet to the PC that is used by the caller

the status of the departmental workgroup switch in the wiring closet

the cable that connects the PC of the caller to the network jack

the cable connection between a PC and a network outlet that is used by a neighbor
corrupted NIC driver


The symptom of excessive runt packets and jabber is typically a Layer 1 issue, such as caused by a corrupted NIC driver, which could be the result of a software error during the NIC driver upgrade process. Cable faults would cause intermittent connections, but in this case, the network is not touched and the cable analyzer has detected frame problems, not signal problems. Ethernet signal attenuation is caused by an extended or long cable, but in this case, the cable has not been changed. A NIC driver is part of the operating system, it is not an application.
A user reports that after an OS patch of the networking subsystem has been applied to a workstation, it performs very slowly when connecting to network resources. A network technician tests the link with a cable analyzer and notices that the workstation sends an excessive number of frames smaller than 64 bytes and also other meaningless frames. What is the possible cause of the problem?


Ethernet signal attenuation

corrupted NIC driver

cabling faults

corrupted application installation
Layer 2


Framing errors are symptoms of problems at the data link layer, Layer 2, of the OSI model.
An administrator is troubleshooting an Internet connectivity problem on a router. The output of the show interfaces gigabitethernet 0/0 command reveals higher than normal framing errors on the interface that connects to the Internet. At what layer of the OSI model is the problem likely occurring?


Layer 1

Layer 2

Layer 3

Layer 4

Layer 7
ping

ipconfig

nslookup


The ipconfig and nslookup commands will provide initial IP address and DNS configuration information to the technicians and determine if DHCP is assigning correct information to the PCs. The ping utility would be used to verify, or not, connectivity to the default gateway (router) using the configured default gateway address, or using the known correct default gateway address if these are found to be different. The arp -a or netsh interface ipv6 show neighbor commands could be used if the problem is then suspected to be an IP address to MAC address mapping issue. The telnet and tracert utilities could be used to determine where the problem was located in the network if the default gateway configuration was found to be correct.
A group of Windows PCs in a new subnet has been added to an Ethernet network. When testing the connectivity, a technician finds that these PCs can access local network resources but not the Internet resources. To troubleshoot the problem, the technician wants to initially confirm the IP address and DNS configurations on the PCs, and also verify connectivity to the local router. Which three Windows CLI commands and utilities will provide the necessary information? (Choose three.)


arp -a

ping

ipconfig

tracert

telnet

nslookup

netsh interface ipv6 show neighbor
transport


The issue is that the new web site is configured with TCP port 90 for HTTP, which is different from the normal TCP port 80. Therefore, this is a transport layer issue.
Users report that the new web site http://www.company1.biz cannot be accessed. The helpdesk technician checks and verifies that the web site can be accessed with http://www.company1.biz:90. Which layer in the TCP/IP model is involved in troubleshooting this issue?


transport

internet

application

network access
The PC has a missing or incorrect default gateway.


Since other computers on the same network work properly, the default gateway router has a default route and the link between the workgroup switch and the router works. An incorrectly configured switch port VLAN would not cause these symptoms.
A networked PC is having trouble accessing the Internet, but can print to a local printer and ping other computers in the area. Other computers on the same network are not having any issues. What is the problem?


The PC has a missing or incorrect default gateway.

The switch port to which the PC connects has an incorrect VLAN configured.

The default gateway router does not have a default route.

The link between the switch to which the PC connects and the default gateway router is down.
The ASBR does not have an OSPF neighbor.


Because no other routers have a default route, the most likely problem is the link between the ASBR and other OSPF routers, or the advertisement of that link between the ASBR and the other OSPF routers. Cisco routers configured with OSPF automatically accept the common LSAs such as 1, 2, 3, 4, 5, and 7. The ASBR has OSPF configured or the default-information originate command would not have been able to have been entered.
The newly configured ASBR that connects a company to the Internet has a default route configured and has the default-information originate command entered. Devices connected through this router can access the Internet. The problem is that no other OSPF routers have a default route in the routing table and no other users throughout the organization can access the Internet. What could be the problem?


The ASBR does not have OSPF configured.

The other routers are not configured to accept LSA type 4s.

The ASBR does not have an OSPF neighbor.

The ASBR should use the exit_interface argument instead of next-hop on the default route.
Static NAT has not been configured properly or at all.


NAT/PAT allows a private IP address to be translated into a public address so that external users can access internal devices. Static NAT assigns one public address to a private address and is used with internal servers.
An internal corporate server can be accessed by internal PCs, but not by external Internet users that should have access. What could be the issue?


The default gateway router for the server does not have a default route.

Static NAT has not been configured properly or at all.

The switch port to which the server connects has an incorrect VLAN configured.

The server does not have a private IP address assigned.
ARP


The ARP cache is used to store IPv4 addresses and the Ethernet physical addresses or MAC addresses to which the IPv4 addresses are mapped. Incorrect mappings of IP addresses to MAC addresses can result in loss of end-to-end connectivity.
Fill in the blank.

Use the ________________ cache to verify IPv4 address to Layer 2 Ethernet address mappings on a host computer.
THIS SET IS OFTEN IN FOLDERS WITH...