Exam Bundle

Only member ports and required router-facing ports receive the multicast traffic during observation. Such an observation would verify a separate issue: A video VLAN floods all switch ports with a multicast stream although only some hosts joined. It would follow the distinct action: Enable and validate IGMP snooping with correct multicast group membership on the receiver VLAN. Here the reported failure is Receivers in another routed subnet cannot join an allowed multicast source despite working unicast routing. The decisive result for Dunhaven University must instead be: A cross-subnet test receiver obtains the intended multicast group while unrelated segments remain unaffected.

Receiver memberships persist across query intervals and multicast delivery remains stable. Such an observation would verify a separate issue: IGMP membership entries disappear on a standalone VLAN because no device sends periodic membership queries. It would follow the distinct action: Provide a suitable IGMP querier or multicast router for the VLAN under the supported design. Here the reported failure is Receivers in another routed subnet cannot join an allowed multicast source despite working unicast routing. The decisive result for Dunhaven University must instead be: A cross-subnet test receiver obtains the intended multicast group while unrelated segments remain unaffected.

A management test permits authorized SSH and rejects unapproved insecure sessions. Such an observation would verify a separate issue: A switch is managed with shared credentials over insecure legacy protocols. It would follow the distinct action: Configure supported SSH-based management and individual authenticated accounts or AAA, disabling insecure access methods. Here the reported failure is Receivers in another routed subnet cannot join an allowed multicast source despite working unicast routing. The decisive result for Dunhaven University must instead be: A cross-subnet test receiver obtains the intended multicast group while unrelated segments remain unaffected.

Use an approved limited MAC-authentication or exception role rather than disabling authentication for the entire closet. That relates to a different fault: A network printer cannot run a supplicant and keeps failing strict 802.1X admission. The incident in the scenario is instead: Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. Changing the unrelated setting does not establish the required repair at Harborline Finance; the relevant confirmation would be: Approved supplicants receive authorized access and unknown clients remain in the intended restricted state.

Use DHCP snooping with trusted uplinks and untrusted edge ports, validating the trust boundary. That relates to a different fault: An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. The incident in the scenario is instead: Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. Changing the unrelated setting does not establish the required repair at Harborline Finance; the relevant confirmation would be: Approved supplicants receive authorized access and unknown clients remain in the intended restricted state.

Use authenticated role-based administration with AAA and appropriate management-plane restrictions. That relates to a different fault: A shared administrator account has full rights from every network and no centralized audit trace. The incident in the scenario is instead: Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. Changing the unrelated setting does not establish the required repair at Harborline Finance; the relevant confirmation would be: Approved supplicants receive authorized access and unknown clients remain in the intended restricted state.

Access logs identify individual authorized operators and restricted users cannot change protected settings. Such an observation would verify a separate issue: A shared administrator account has full rights from every network and no centralized audit trace. It would follow the distinct action: Use authenticated role-based administration with AAA and appropriate management-plane restrictions. Here the reported failure is Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. The decisive result for Harborline Finance must instead be: Approved supplicants receive authorized access and unknown clients remain in the intended restricted state.

A role-by-role test confirms that guests, employees and IoT devices reach only authorized services. Such an observation would verify a separate issue: Different device roles require distinct network access policies but the switch uses one broad VLAN for everyone. It would follow the distinct action: Integrate ClearPass-derived roles or equivalent supported policy assignment and apply least-privilege segmentation. Here the reported failure is Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. The decisive result for Harborline Finance must instead be: Approved supplicants receive authorized access and unknown clients remain in the intended restricted state.

Rogue DHCP offers from edge ports are rejected and the legitimate server lease exchange succeeds. Such an observation would verify a separate issue: An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. It would follow the distinct action: Use DHCP snooping with trusted uplinks and untrusted edge ports, validating the trust boundary. Here the reported failure is Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. The decisive result for Harborline Finance must instead be: Approved supplicants receive authorized access and unknown clients remain in the intended restricted state.

Use an approved limited MAC-authentication or exception role rather than disabling authentication for the entire closet. That relates to a different fault: A network printer cannot run a supplicant and keeps failing strict 802.1X admission. The incident in the scenario is instead: Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. Changing the unrelated setting does not establish the required repair at Riverton Utilities; the relevant confirmation would be: Approved supplicants receive authorized access and unknown clients remain in the intended restricted state.

Use DHCP snooping with trusted uplinks and untrusted edge ports, validating the trust boundary. That relates to a different fault: An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. The incident in the scenario is instead: Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. Changing the unrelated setting does not establish the required repair at Riverton Utilities; the relevant confirmation would be: Approved supplicants receive authorized access and unknown clients remain in the intended restricted state.

Integrate ClearPass-derived roles or equivalent supported policy assignment and apply least-privilege segmentation. That relates to a different fault: Different device roles require distinct network access policies but the switch uses one broad VLAN for everyone. The incident in the scenario is instead: Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. Changing the unrelated setting does not establish the required repair at Riverton Utilities; the relevant confirmation would be: Approved supplicants receive authorized access and unknown clients remain in the intended restricted state.

A role-by-role test confirms that guests, employees and IoT devices reach only authorized services. Such an observation would verify a separate issue: Different device roles require distinct network access policies but the switch uses one broad VLAN for everyone. It would follow the distinct action: Integrate ClearPass-derived roles or equivalent supported policy assignment and apply least-privilege segmentation. Here the reported failure is Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. The decisive result for Riverton Utilities must instead be: Approved supplicants receive authorized access and unknown clients remain in the intended restricted state.

Access logs identify individual authorized operators and restricted users cannot change protected settings. Such an observation would verify a separate issue: A shared administrator account has full rights from every network and no centralized audit trace. It would follow the distinct action: Use authenticated role-based administration with AAA and appropriate management-plane restrictions. Here the reported failure is Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. The decisive result for Riverton Utilities must instead be: Approved supplicants receive authorized access and unknown clients remain in the intended restricted state.

Packet tests show needed DNS exchanges work and prohibited flows are denied at the intended interface. Such an observation would verify a separate issue: An interface ACL blocks legitimate DNS replies because its direction and permit order were not reviewed. It would follow the distinct action: Place ordered ACL entries on the appropriate ingress or egress path with explicit required traffic permits. Here the reported failure is Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. The decisive result for Riverton Utilities must instead be: Approved supplicants receive authorized access and unknown clients remain in the intended restricted state.

Use authenticated role-based administration with AAA and appropriate management-plane restrictions. That relates to a different fault: A shared administrator account has full rights from every network and no centralized audit trace. The incident in the scenario is instead: A network printer cannot run a supplicant and keeps failing strict 802.1X admission. Changing the unrelated setting does not establish the required repair at Bluecrest Medical; the relevant confirmation would be: The printer obtains only permitted access while an unknown MAC cannot inherit its rights.

Integrate ClearPass-derived roles or equivalent supported policy assignment and apply least-privilege segmentation. That relates to a different fault: Different device roles require distinct network access policies but the switch uses one broad VLAN for everyone. The incident in the scenario is instead: A network printer cannot run a supplicant and keeps failing strict 802.1X admission. Changing the unrelated setting does not establish the required repair at Bluecrest Medical; the relevant confirmation would be: The printer obtains only permitted access while an unknown MAC cannot inherit its rights.

Use DHCP snooping with trusted uplinks and untrusted edge ports, validating the trust boundary. That relates to a different fault: An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. The incident in the scenario is instead: A network printer cannot run a supplicant and keeps failing strict 802.1X admission. Changing the unrelated setting does not establish the required repair at Bluecrest Medical; the relevant confirmation would be: The printer obtains only permitted access while an unknown MAC cannot inherit its rights.

Rogue DHCP offers from edge ports are rejected and the legitimate server lease exchange succeeds. Such an observation would verify a separate issue: An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. It would follow the distinct action: Use DHCP snooping with trusted uplinks and untrusted edge ports, validating the trust boundary. Here the reported failure is A network printer cannot run a supplicant and keeps failing strict 802.1X admission. The decisive result for Bluecrest Medical must instead be: The printer obtains only permitted access while an unknown MAC cannot inherit its rights.

A role-by-role test confirms that guests, employees and IoT devices reach only authorized services. Such an observation would verify a separate issue: Different device roles require distinct network access policies but the switch uses one broad VLAN for everyone. It would follow the distinct action: Integrate ClearPass-derived roles or equivalent supported policy assignment and apply least-privilege segmentation. Here the reported failure is A network printer cannot run a supplicant and keeps failing strict 802.1X admission. The decisive result for Bluecrest Medical must instead be: The printer obtains only permitted access while an unknown MAC cannot inherit its rights.

Approved supplicants receive authorized access and unknown clients remain in the intended restricted state. Such an observation would verify a separate issue: Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. It would follow the distinct action: Configure policy-based 802.1X with a supported RADIUS backend and defined failure behavior. Here the reported failure is A network printer cannot run a supplicant and keeps failing strict 802.1X admission. The decisive result for Bluecrest Medical must instead be: The printer obtains only permitted access while an unknown MAC cannot inherit its rights.

Configure policy-based 802.1X with a supported RADIUS backend and defined failure behavior. That relates to a different fault: Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. The incident in the scenario is instead: A network printer cannot run a supplicant and keeps failing strict 802.1X admission. Changing the unrelated setting does not establish the required repair at Lakeshore Education; the relevant confirmation would be: The printer obtains only permitted access while an unknown MAC cannot inherit its rights.

Use authenticated role-based administration with AAA and appropriate management-plane restrictions. That relates to a different fault: A shared administrator account has full rights from every network and no centralized audit trace. The incident in the scenario is instead: A network printer cannot run a supplicant and keeps failing strict 802.1X admission. Changing the unrelated setting does not establish the required repair at Lakeshore Education; the relevant confirmation would be: The printer obtains only permitted access while an unknown MAC cannot inherit its rights.

Use DHCP snooping with trusted uplinks and untrusted edge ports, validating the trust boundary. That relates to a different fault: An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. The incident in the scenario is instead: A network printer cannot run a supplicant and keeps failing strict 802.1X admission. Changing the unrelated setting does not establish the required repair at Lakeshore Education; the relevant confirmation would be: The printer obtains only permitted access while an unknown MAC cannot inherit its rights.

Packet tests show needed DNS exchanges work and prohibited flows are denied at the intended interface. Such an observation would verify a separate issue: An interface ACL blocks legitimate DNS replies because its direction and permit order were not reviewed. It would follow the distinct action: Place ordered ACL entries on the appropriate ingress or egress path with explicit required traffic permits. Here the reported failure is A network printer cannot run a supplicant and keeps failing strict 802.1X admission. The decisive result for Lakeshore Education must instead be: The printer obtains only permitted access while an unknown MAC cannot inherit its rights.

Rogue DHCP offers from edge ports are rejected and the legitimate server lease exchange succeeds. Such an observation would verify a separate issue: An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. It would follow the distinct action: Use DHCP snooping with trusted uplinks and untrusted edge ports, validating the trust boundary. Here the reported failure is A network printer cannot run a supplicant and keeps failing strict 802.1X admission. The decisive result for Lakeshore Education must instead be: The printer obtains only permitted access while an unknown MAC cannot inherit its rights.

Access logs identify individual authorized operators and restricted users cannot change protected settings. Such an observation would verify a separate issue: A shared administrator account has full rights from every network and no centralized audit trace. It would follow the distinct action: Use authenticated role-based administration with AAA and appropriate management-plane restrictions. Here the reported failure is A network printer cannot run a supplicant and keeps failing strict 802.1X admission. The decisive result for Lakeshore Education must instead be: The printer obtains only permitted access while an unknown MAC cannot inherit its rights.

Use authenticated role-based administration with AAA and appropriate management-plane restrictions. That relates to a different fault: A shared administrator account has full rights from every network and no centralized audit trace. The incident in the scenario is instead: Different device roles require distinct network access policies but the switch uses one broad VLAN for everyone. Changing the unrelated setting does not establish the required repair at Pine Valley Telecom; the relevant confirmation would be: A role-by-role test confirms that guests, employees and IoT devices reach only authorized services.

Place ordered ACL entries on the appropriate ingress or egress path with explicit required traffic permits. That relates to a different fault: An interface ACL blocks legitimate DNS replies because its direction and permit order were not reviewed. The incident in the scenario is instead: Different device roles require distinct network access policies but the switch uses one broad VLAN for everyone. Changing the unrelated setting does not establish the required repair at Pine Valley Telecom; the relevant confirmation would be: A role-by-role test confirms that guests, employees and IoT devices reach only authorized services.

Configure policy-based 802.1X with a supported RADIUS backend and defined failure behavior. That relates to a different fault: Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. The incident in the scenario is instead: Different device roles require distinct network access policies but the switch uses one broad VLAN for everyone. Changing the unrelated setting does not establish the required repair at Pine Valley Telecom; the relevant confirmation would be: A role-by-role test confirms that guests, employees and IoT devices reach only authorized services.

Approved supplicants receive authorized access and unknown clients remain in the intended restricted state. Such an observation would verify a separate issue: Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. It would follow the distinct action: Configure policy-based 802.1X with a supported RADIUS backend and defined failure behavior. Here the reported failure is Different device roles require distinct network access policies but the switch uses one broad VLAN for everyone. The decisive result for Pine Valley Telecom must instead be: A role-by-role test confirms that guests, employees and IoT devices reach only authorized services.

Access logs identify individual authorized operators and restricted users cannot change protected settings. Such an observation would verify a separate issue: A shared administrator account has full rights from every network and no centralized audit trace. It would follow the distinct action: Use authenticated role-based administration with AAA and appropriate management-plane restrictions. Here the reported failure is Different device roles require distinct network access policies but the switch uses one broad VLAN for everyone. The decisive result for Pine Valley Telecom must instead be: A role-by-role test confirms that guests, employees and IoT devices reach only authorized services.

Rogue DHCP offers from edge ports are rejected and the legitimate server lease exchange succeeds. Such an observation would verify a separate issue: An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. It would follow the distinct action: Use DHCP snooping with trusted uplinks and untrusted edge ports, validating the trust boundary. Here the reported failure is Different device roles require distinct network access policies but the switch uses one broad VLAN for everyone. The decisive result for Pine Valley Telecom must instead be: A role-by-role test confirms that guests, employees and IoT devices reach only authorized services.