CompTIA Network+ Practice Test (N10-009)

The primary purpose of key management in network security is to handle cryptographic keys in a secure manner. This involves the generation, distribution, storage, and destruction of keys, ensuring they remain protected throughout their lifecycle. This helps prevent unauthorized access and maintains the integrity of encrypted data. The wrong answers mention auditing, which is more related to reviewing and verifying compliance with security policies; authenticating entities, which involves verifying identities rather than managing keys; and defining security rules, which focuses on establishing guidelines and policies for network security rather than directly managing keys.

An asset inventory explicitly lists all the hardware within an organization, including details about warranty support, which is crucial for understanding which devices are currently under warranty before planning hardware updates. Hence, it facilitates informed decisions about upgrades or replacements if warranty support is nearing an end. Physical and logical diagrams, though useful for understanding network connectivity and layout, do not typically include warranty information. IPAM tools are primarily used for managing IP addresses and do not include hardware warranty details.

WPA3 provides enhanced security features compared to WPA2, including improved protections against brute-force attacks and better data encryption. WPA2, while still secure, is older and potentially vulnerable to security exploits that have been addressed in WPA3. WEP is outdated and highly insecure, with many vulnerabilities that can be exploited easily. WPA-PSK offers a decent security level but lacks the advanced features and strength of WPA3, making it less ideal for environments requiring robust security measures.

Setting the MTU to match the smallest allowed data packet size in the network minimizes fragmentation. In settings with a combination of higher and lower capacity links, selecting the MTU of the smaller links as the standard avoids fragmentation that could occur if packets allowed by larger capacity links are too big to be handled by the smaller links without breaking them up.

The correct technique to implement in this scenario is Port Address Translation (PAT).

Port Address Translation allows multiple devices on a local network to share a single public IP address when accessing the internet. PAT works by assigning a unique port number to each outgoing connection, so the edge router can track and manage traffic between internal private IP addresses and external public IP communications. This makes it especially useful for small businesses with limited public IPs.

The other options are not suitable for this specific use case:

• VLAN tagging is used for segmenting network traffic within a LAN, not for internet access sharing.
• Dynamic routing helps routers share routing information but does not manage IP address translation.
• Dynamic Host Configuration Protocol (DHCP) assigns IP addresses to devices within a network, but it does not handle public IP sharing.

Therefore, Port Address Translation (PAT) is the correct choice.

Routers at the network layer generally use IP addresses to make decisions about packet forwarding, routing them to the next hop based on the routing table. MAC addresses are used in Layer 2 for device identification on the same network segment and not for routing decisions, making them incorrect for this context. Port numbers and service numbers are associated with TCP/UDP in the transport layer and layer 4 services respectively, which are not used for routing decisions at the network layer.

Choosing a directional antenna for a point-to-point setup is ideal because it focuses the signal between two specific points, which enhances the signal strength and reduces interference compared to an omnidirectional antenna which spreads the signal in all directions. Omnidirectional antennas, despite their usability in different scenarios, are not optimal for long, specific links as they do not focus the signal. High-gain antennas without specifying directional or omnidirectional criteria might seem suitable, but the key is the directionality which maximizes the strength and focus of the signal. Finally, an autonomous access point is a solution for network management and flexibility but does not inherently address the directional strength needed in a point-to-point connection.

Packet loss in a network typically results in intermittent or incomplete data transmission, leading to delays or failures in data reception, which can severely affect network performance. Increased latency is often a result of slowed data transmission or retransmission attempts, not directly caused by packet loss itself. Increased bandwidth can actually reduce the likelihood of packet loss, and encryption protocols pertain to data security, not the integrity of data transmission.

802.1X provides an authentication framework that allows network devices, such as switches and wireless access points, to become part of an authentication process before allowing further access to the network. This protocol works by encapsulating and transporting the authentication data between the client and the authentication server, typically using the Extensible Authentication Protocol (EAP). Port-based Network Access Control is a feature of 802.1X that denies all access to the network via the port to which the client is connected until the client's identity is verified and authorized. This involves blocking all traffic, except authentication messages, until the client is authenticated, serving to prevent unauthorized access. The other options, while related to network security, do not directly describe the function of 802.1X as thoroughly or accurately.

A stateful firewall is optimal for enhancing network security as it not only filters traffic based on state, port, and protocol, but also keeps track of active connections. By monitoring the state of network connections, it can make more informed decisions about which packets to allow or deny, dynamically adjusting to the flow of traffic based on the context of the traffic and sessions. Other options, such as static packet filtering, do not offer the dynamic tracking of connection states, making them less effective in scenarios where comprehensive security and control over both ingress and egress traffic are needed.

The correct answer is True. Extended Service Set Identifier (ESSID) is used to create a larger wireless network where multiple access points (APs) are present. This allows devices to connect to the internet seamlessly as they move within the range of different APs configured under the same ESSID, without having to manually select or switch between different network names. The incorrect response might stem from confusion with SSID, which is generally unique to each access point.

The correct answer is 'Frame', as Layer 2 of the OSI model, also known as the Data Link Layer, processes data in units called frames. A frame encapsulates packets with a header and a trailer to facilitate node-to-node communication across the physical layer. Ethernet frames are the most common type of Layer 2 frames, which include headers containing MAC addresses. The other answers, while related to networking, represent data units or terminologies used at different OSI model layers or different contexts, none of which pertain to the primary function of Layer 2.

The correct answer is 'To prevent switching loops in a broadcast domain'. Spanning Tree Protocol (STP) is essential in a layered network to prevent loops, which can create broadcast storms and destabilize network communications. While improving performance and expanding network coverage are beneficial outcomes of many network protocols, they are not the primary functions of the spanning tree protocol. As for managing collision domains, that is primarily addressed by switching devices and protocols at a different layer.

BGP (Border Gateway Protocol) is the standard protocol used to exchange routing information between different autonomous systems on the internet, making it the appropriate choice for a router that needs to communicate across different ASs. OSPF and EIGRP are typically used for routing within a single AS (intra-domain routing), hence they would not be suitable for this scenario where inter-domain routing is required. RIPv2, although capable of dynamic routing, is generally considered outdated and insufficient for the scale and complexity of multinational corporation networks.

The three-way handshake is essential for establishing a reliable connection between a client and server. This process involves sending a SYN packet, receiving a SYN-ACK in response, and then sending an ACK. If any part of this handshake fails, the connection will not be established reliably, which could lead to the intermittent connection issues observed. The other options do not directly affect the fundamental establishment of connections. Window scaling impacts the flow control but not the initial connection establishment. Keepalive messages are used to maintain a connection but not in establishing one. Checksums ensure data integrity rather than connection reliability.