Exam Bundle

Approved supplicants receive authorized access and unknown clients remain in the intended restricted state. Such an observation would verify a separate issue: Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. It would follow the distinct action: Configure policy-based 802.1X with a supported RADIUS backend and defined failure behavior. Here the reported failure is A shared administrator account has full rights from every network and no centralized audit trace. The decisive result for Northpoint Health must instead be: Access logs identify individual authorized operators and restricted users cannot change protected settings.

Packet tests show needed DNS exchanges work and prohibited flows are denied at the intended interface. Such an observation would verify a separate issue: An interface ACL blocks legitimate DNS replies because its direction and permit order were not reviewed. It would follow the distinct action: Place ordered ACL entries on the appropriate ingress or egress path with explicit required traffic permits. Here the reported failure is A shared administrator account has full rights from every network and no centralized audit trace. The decisive result for Northpoint Health must instead be: Access logs identify individual authorized operators and restricted users cannot change protected settings.

Rogue DHCP offers from edge ports are rejected and the legitimate server lease exchange succeeds. Such an observation would verify a separate issue: An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. It would follow the distinct action: Use DHCP snooping with trusted uplinks and untrusted edge ports, validating the trust boundary. Here the reported failure is A shared administrator account has full rights from every network and no centralized audit trace. The decisive result for Northpoint Health must instead be: Access logs identify individual authorized operators and restricted users cannot change protected settings.

Place ordered ACL entries on the appropriate ingress or egress path with explicit required traffic permits. That relates to a different fault: An interface ACL blocks legitimate DNS replies because its direction and permit order were not reviewed. The incident in the scenario is instead: An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. Changing the unrelated setting does not establish the required repair at Riverton Utilities; the relevant confirmation would be: Rogue DHCP offers from edge ports are rejected and the legitimate server lease exchange succeeds.

Use authenticated role-based administration with AAA and appropriate management-plane restrictions. That relates to a different fault: A shared administrator account has full rights from every network and no centralized audit trace. The incident in the scenario is instead: An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. Changing the unrelated setting does not establish the required repair at Riverton Utilities; the relevant confirmation would be: Rogue DHCP offers from edge ports are rejected and the legitimate server lease exchange succeeds.

Integrate ClearPass-derived roles or equivalent supported policy assignment and apply least-privilege segmentation. That relates to a different fault: Different device roles require distinct network access policies but the switch uses one broad VLAN for everyone. The incident in the scenario is instead: An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. Changing the unrelated setting does not establish the required repair at Riverton Utilities; the relevant confirmation would be: Rogue DHCP offers from edge ports are rejected and the legitimate server lease exchange succeeds.

Approved supplicants receive authorized access and unknown clients remain in the intended restricted state. Such an observation would verify a separate issue: Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. It would follow the distinct action: Configure policy-based 802.1X with a supported RADIUS backend and defined failure behavior. Here the reported failure is An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. The decisive result for Riverton Utilities must instead be: Rogue DHCP offers from edge ports are rejected and the legitimate server lease exchange succeeds.

The printer obtains only permitted access while an unknown MAC cannot inherit its rights. Such an observation would verify a separate issue: A network printer cannot run a supplicant and keeps failing strict 802.1X admission. It would follow the distinct action: Use an approved limited MAC-authentication or exception role rather than disabling authentication for the entire closet. Here the reported failure is An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. The decisive result for Riverton Utilities must instead be: Rogue DHCP offers from edge ports are rejected and the legitimate server lease exchange succeeds.

Packet tests show needed DNS exchanges work and prohibited flows are denied at the intended interface. Such an observation would verify a separate issue: An interface ACL blocks legitimate DNS replies because its direction and permit order were not reviewed. It would follow the distinct action: Place ordered ACL entries on the appropriate ingress or egress path with explicit required traffic permits. Here the reported failure is An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. The decisive result for Riverton Utilities must instead be: Rogue DHCP offers from edge ports are rejected and the legitimate server lease exchange succeeds.

Configure policy-based 802.1X with a supported RADIUS backend and defined failure behavior. That relates to a different fault: Managed employee laptops should authenticate to wired access but ports are configured for unrestricted admission. The incident in the scenario is instead: An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. Changing the unrelated setting does not establish the required repair at Harborline Finance; the relevant confirmation would be: Rogue DHCP offers from edge ports are rejected and the legitimate server lease exchange succeeds.

Use authenticated role-based administration with AAA and appropriate management-plane restrictions. That relates to a different fault: A shared administrator account has full rights from every network and no centralized audit trace. The incident in the scenario is instead: An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. Changing the unrelated setting does not establish the required repair at Harborline Finance; the relevant confirmation would be: Rogue DHCP offers from edge ports are rejected and the legitimate server lease exchange succeeds.

Place ordered ACL entries on the appropriate ingress or egress path with explicit required traffic permits. That relates to a different fault: An interface ACL blocks legitimate DNS replies because its direction and permit order were not reviewed. The incident in the scenario is instead: An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. Changing the unrelated setting does not establish the required repair at Harborline Finance; the relevant confirmation would be: Rogue DHCP offers from edge ports are rejected and the legitimate server lease exchange succeeds.

Packet tests show needed DNS exchanges work and prohibited flows are denied at the intended interface. Such an observation would verify a separate issue: An interface ACL blocks legitimate DNS replies because its direction and permit order were not reviewed. It would follow the distinct action: Place ordered ACL entries on the appropriate ingress or egress path with explicit required traffic permits. Here the reported failure is An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. The decisive result for Harborline Finance must instead be: Rogue DHCP offers from edge ports are rejected and the legitimate server lease exchange succeeds.

A role-by-role test confirms that guests, employees and IoT devices reach only authorized services. Such an observation would verify a separate issue: Different device roles require distinct network access policies but the switch uses one broad VLAN for everyone. It would follow the distinct action: Integrate ClearPass-derived roles or equivalent supported policy assignment and apply least-privilege segmentation. Here the reported failure is An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. The decisive result for Harborline Finance must instead be: Rogue DHCP offers from edge ports are rejected and the legitimate server lease exchange succeeds.

The printer obtains only permitted access while an unknown MAC cannot inherit its rights. Such an observation would verify a separate issue: A network printer cannot run a supplicant and keeps failing strict 802.1X admission. It would follow the distinct action: Use an approved limited MAC-authentication or exception role rather than disabling authentication for the entire closet. Here the reported failure is An attacker on an access port sends forged DHCP replies claiming to be the default gateway server. The decisive result for Harborline Finance must instead be: Rogue DHCP offers from edge ports are rejected and the legitimate server lease exchange succeeds.

Use a suitable policer or shaper according to the required rate and buffering behavior. That relates to a different fault: A low-value backup service saturates a link and needs a hard rate cap rather than preferential scheduling. The incident in the scenario is instead: Real-time voice is queued with bulk backups because ingress traffic is not classified correctly. Changing the unrelated setting does not establish the required repair at Lakeshore Education; the relevant confirmation would be: Voice test packets receive the correct classification and queue treatment end to end.

Record queue occupancy, drops, DSCP distribution and latency before and after QoS changes. That relates to a different fault: Engineers tune QoS without baseline measurements and cannot tell whether packet loss improved. The incident in the scenario is instead: Real-time voice is queued with bulk backups because ingress traffic is not classified correctly. Changing the unrelated setting does not establish the required repair at Lakeshore Education; the relevant confirmation would be: Voice test packets receive the correct classification and queue treatment end to end.

Apply appropriate scheduler and queue-priority policies to protect delay-sensitive traffic. That relates to a different fault: During WAN congestion, control-plane and voice flows suffer despite adequate physical interface speeds. The incident in the scenario is instead: Real-time voice is queued with bulk backups because ingress traffic is not classified correctly. Changing the unrelated setting does not establish the required repair at Lakeshore Education; the relevant confirmation would be: Voice test packets receive the correct classification and queue treatment end to end.

The backup flow conforms to its configured rate and higher-priority traffic remains within service thresholds. Such an observation would verify a separate issue: A low-value backup service saturates a link and needs a hard rate cap rather than preferential scheduling. It would follow the distinct action: Use a suitable policer or shaper according to the required rate and buffering behavior. Here the reported failure is Real-time voice is queued with bulk backups because ingress traffic is not classified correctly. The decisive result for Lakeshore Education must instead be: Voice test packets receive the correct classification and queue treatment end to end.

Captured packets show approved remarking while trusted voice signaling retains intended priority. Such an observation would verify a separate issue: Untrusted endpoints mark all traffic with a high priority DSCP value to win bandwidth. It would follow the distinct action: Rewrite or ignore untrusted markings and establish QoS trust only at controlled network boundaries. Here the reported failure is Real-time voice is queued with bulk backups because ingress traffic is not classified correctly. The decisive result for Lakeshore Education must instead be: Voice test packets receive the correct classification and queue treatment end to end.

Latency and loss for critical classes stay within target limits during controlled congestion. Such an observation would verify a separate issue: During WAN congestion, control-plane and voice flows suffer despite adequate physical interface speeds. It would follow the distinct action: Apply appropriate scheduler and queue-priority policies to protect delay-sensitive traffic. Here the reported failure is Real-time voice is queued with bulk backups because ingress traffic is not classified correctly. The decisive result for Lakeshore Education must instead be: Voice test packets receive the correct classification and queue treatment end to end.

Rewrite or ignore untrusted markings and establish QoS trust only at controlled network boundaries. That relates to a different fault: Untrusted endpoints mark all traffic with a high priority DSCP value to win bandwidth. The incident in the scenario is instead: Real-time voice is queued with bulk backups because ingress traffic is not classified correctly. Changing the unrelated setting does not establish the required repair at Bluecrest Medical; the relevant confirmation would be: Voice test packets receive the correct classification and queue treatment end to end.

Record queue occupancy, drops, DSCP distribution and latency before and after QoS changes. That relates to a different fault: Engineers tune QoS without baseline measurements and cannot tell whether packet loss improved. The incident in the scenario is instead: Real-time voice is queued with bulk backups because ingress traffic is not classified correctly. Changing the unrelated setting does not establish the required repair at Bluecrest Medical; the relevant confirmation would be: Voice test packets receive the correct classification and queue treatment end to end.

Apply appropriate scheduler and queue-priority policies to protect delay-sensitive traffic. That relates to a different fault: During WAN congestion, control-plane and voice flows suffer despite adequate physical interface speeds. The incident in the scenario is instead: Real-time voice is queued with bulk backups because ingress traffic is not classified correctly. Changing the unrelated setting does not establish the required repair at Bluecrest Medical; the relevant confirmation would be: Voice test packets receive the correct classification and queue treatment end to end.

Captured packets show approved remarking while trusted voice signaling retains intended priority. Such an observation would verify a separate issue: Untrusted endpoints mark all traffic with a high priority DSCP value to win bandwidth. It would follow the distinct action: Rewrite or ignore untrusted markings and establish QoS trust only at controlled network boundaries. Here the reported failure is Real-time voice is queued with bulk backups because ingress traffic is not classified correctly. The decisive result for Bluecrest Medical must instead be: Voice test packets receive the correct classification and queue treatment end to end.

Latency and loss for critical classes stay within target limits during controlled congestion. Such an observation would verify a separate issue: During WAN congestion, control-plane and voice flows suffer despite adequate physical interface speeds. It would follow the distinct action: Apply appropriate scheduler and queue-priority policies to protect delay-sensitive traffic. Here the reported failure is Real-time voice is queued with bulk backups because ingress traffic is not classified correctly. The decisive result for Bluecrest Medical must instead be: Voice test packets receive the correct classification and queue treatment end to end.

Comparable load tests show measured quality gains without unacceptable starvation of other classes. Such an observation would verify a separate issue: Engineers tune QoS without baseline measurements and cannot tell whether packet loss improved. It would follow the distinct action: Record queue occupancy, drops, DSCP distribution and latency before and after QoS changes. Here the reported failure is Real-time voice is queued with bulk backups because ingress traffic is not classified correctly. The decisive result for Bluecrest Medical must instead be: Voice test packets receive the correct classification and queue treatment end to end.

Apply appropriate scheduler and queue-priority policies to protect delay-sensitive traffic. That relates to a different fault: During WAN congestion, control-plane and voice flows suffer despite adequate physical interface speeds. The incident in the scenario is instead: Untrusted endpoints mark all traffic with a high priority DSCP value to win bandwidth. Changing the unrelated setting does not establish the required repair at Fairmont Logistics; the relevant confirmation would be: Captured packets show approved remarking while trusted voice signaling retains intended priority.

Record queue occupancy, drops, DSCP distribution and latency before and after QoS changes. That relates to a different fault: Engineers tune QoS without baseline measurements and cannot tell whether packet loss improved. The incident in the scenario is instead: Untrusted endpoints mark all traffic with a high priority DSCP value to win bandwidth. Changing the unrelated setting does not establish the required repair at Fairmont Logistics; the relevant confirmation would be: Captured packets show approved remarking while trusted voice signaling retains intended priority.

Use a suitable policer or shaper according to the required rate and buffering behavior. That relates to a different fault: A low-value backup service saturates a link and needs a hard rate cap rather than preferential scheduling. The incident in the scenario is instead: Untrusted endpoints mark all traffic with a high priority DSCP value to win bandwidth. Changing the unrelated setting does not establish the required repair at Fairmont Logistics; the relevant confirmation would be: Captured packets show approved remarking while trusted voice signaling retains intended priority.

The backup flow conforms to its configured rate and higher-priority traffic remains within service thresholds. Such an observation would verify a separate issue: A low-value backup service saturates a link and needs a hard rate cap rather than preferential scheduling. It would follow the distinct action: Use a suitable policer or shaper according to the required rate and buffering behavior. Here the reported failure is Untrusted endpoints mark all traffic with a high priority DSCP value to win bandwidth. The decisive result for Fairmont Logistics must instead be: Captured packets show approved remarking while trusted voice signaling retains intended priority.

Latency and loss for critical classes stay within target limits during controlled congestion. Such an observation would verify a separate issue: During WAN congestion, control-plane and voice flows suffer despite adequate physical interface speeds. It would follow the distinct action: Apply appropriate scheduler and queue-priority policies to protect delay-sensitive traffic. Here the reported failure is Untrusted endpoints mark all traffic with a high priority DSCP value to win bandwidth. The decisive result for Fairmont Logistics must instead be: Captured packets show approved remarking while trusted voice signaling retains intended priority.

Voice test packets receive the correct classification and queue treatment end to end. Such an observation would verify a separate issue: Real-time voice is queued with bulk backups because ingress traffic is not classified correctly. It would follow the distinct action: Classify traffic by approved application or DSCP rules at the defined trust boundary before queue assignment. Here the reported failure is Untrusted endpoints mark all traffic with a high priority DSCP value to win bandwidth. The decisive result for Fairmont Logistics must instead be: Captured packets show approved remarking while trusted voice signaling retains intended priority.