Network Troubleshooting — CompTIA Network+ practice questions

A laptop reports an address of 169.254.18.7 with a 255.255.0.0 mask and cannot reach anything beyond its own segment. What does this MOST likely indicate?

1. The laptop received a lease from a rogue DHCP server on the segment
2. The laptop could not obtain a DHCP lease and self-assigned an address
3. The laptop's gateway is unreachable but its lease is otherwise valid
4. The laptop has a duplicate address conflict with a statically assigned host

Answer: B — The laptop could not obtain a DHCP lease and self-assigned an address

B) Correct — the 169.254.0.0/16 range is automatic private addressing, assigned by the host only after DHCP requests go unanswered. A) A rogue server would hand out a wrong but routable address, not a link-local one. C) A valid lease would show the organization's addressing, not the automatic private range. D) A conflict typically produces a warning and address release, not this specific range.

A user reports they can ping a server by IP address but not by hostname. The MOST likely cause is:

1. A routing problem is blocking traffic toward the server's subnet
2. DNS resolution is failing while the underlying network path works
3. A firewall is dropping ICMP echo requests bound for that server
4. An incorrect subnet mask is placing the host on the wrong local network

Answer: B — DNS resolution is failing while the underlying network path works

B is right: a successful ping by IP proves routing and reachability, so the failure by name isolates the fault to name resolution. A and D would break the ping by IP as well. C would block both forms of ping, not just the named one. Check the configured DNS server, reachability on UDP 53, dig or nslookup output, and any hosts file override.

Users on VLAN 30 receive an IP but cannot reach VLAN 20. ICMP from the L3 switch's VLAN 30 SVI to a VLAN 20 host succeeds. Which is the BEST next step?

1. Reload the Layer 3 switch outside of business hours
2. Replace the cabling serving the VLAN 30 access ports
3. Check VLAN 20 host gateways and the ACL between SVIs
4. Disable spanning tree across the VLAN 30 access ports

Answer: C — Check VLAN 20 host gateways and the ACL between SVIs

L3 reachability from the SVI proves routing; the issue is endpoint/ACL/firewall. Reload/cabling/STP are misaligned with the evidence.

A technician has interviewed the affected users, asked what changed recently and reproduced the failure on a second workstation. According to the seven-step methodology, what should the technician do NEXT?

1. Implement the solution that resolved a similar case last month
2. Establish a theory of probable cause
3. Verify full system functionality with the affected users
4. Document the findings, actions and lessons learned

Answer: B — Establish a theory of probable cause

B) Correct — gathering information and duplicating the problem completes step one, so forming a theory of probable cause follows. A) Implementing a fix skips theory, testing and planning, and the earlier case may not apply. C) Verification is step six and requires a solution to have been applied first. D) Documentation is the final step and there is nothing yet to document.

A workstation on a horizontal copper run experiences intermittent errors and occasional link loss. A certification tester reports the run measures 130 metres end to end. What is the MOST likely cause?

1. The run exceeds the 100 metre limit, so attenuation is corrupting signalling
2. Crosstalk from pairs untwisted too far back at the termination point
3. A speed and duplex mismatch negotiated between the NIC and switch port
4. A failing small form-factor transceiver in the switch's uplink module

Answer: A — The run exceeds the 100 metre limit, so attenuation is corrupting signalling

A) Correct — the measured length is the decisive evidence; balanced twisted pair Ethernet is specified to 100 metres and beyond that signal degradation causes exactly these symptoms. B) Excess untwist does cause errors but the tester's length reading is the far stronger indicator here. C) A duplex mismatch produces errors but would not vary with an over-length run and is not indicated. D) The transceiver serves the uplink, which would affect many users rather than one workstation.

A dense open-plan office with modern dual-band clients suffers congestion on 2.4 GHz while the 5 GHz radios sit lightly loaded. Which action MOST directly improves the situation?

1. Disable the 5 GHz radios so all clients use one consistent band
2. Increase transmit power on the 2.4 GHz radios to strengthen the signal
3. Enable band steering so capable clients are moved onto 5 GHz
4. Shorten the DHCP lease time so idle clients release their addresses

Answer: C — Enable band steering so capable clients are moved onto 5 GHz

C) Correct — band steering pushes dual-band clients to the band with far more non-overlapping channels, relieving the congested one. A) Disabling 5 GHz forces every client into the crowded band, the opposite of what is needed. B) More power on 2.4 GHz enlarges cells and increases contention and co-channel interference. D) Lease duration affects addressing, not radio airtime contention.

A router holds a static route for 10.0.0.0/8 pointing to the internet edge and a learned route for 10.10.0.0/16 pointing across the WAN. Which path will a packet destined for 10.10.5.20 take?

1. Across the WAN, because the more specific prefix is preferred
2. To the internet edge, because static routes outrank learned routes
3. Traffic is load shared between the two next hops in equal proportion
4. The packet is dropped because two routes match the same destination

Answer: A — Across the WAN, because the more specific prefix is preferred

A) Correct — forwarding selects the longest matching prefix first, so the /16 wins for this destination regardless of how each route was learned. B) Administrative distance only breaks ties between routes to the same prefix; it never overrides prefix length. C) Load sharing requires equal-length, equal-cost paths, which these are not. D) Overlapping routes are normal and are resolved by longest match, not by dropping traffic.

Users on the third floor report they cannot reach any internal server, while users on other floors are unaffected and third-floor users can still print to a local printer. During problem identification, this scoping is MOST useful because it

1. proves the fault is a physical cable break in a single wall jack
2. eliminates DNS as a possible contributor to the reported symptoms
3. narrows probable cause to infrastructure shared by that floor alone
4. confirms the theory that the core routing table has been corrupted

Answer: C — narrows probable cause to infrastructure shared by that floor alone

C) Correct — symptoms bounded by one floor while intra-floor traffic works point at that floor's shared uplink or distribution path, which is a large reduction in search space. A) One jack cannot affect a whole floor, and nothing has been physically tested. B) DNS has not been ruled out; scoping does not by itself eliminate a name resolution factor. D) A corrupted core routing table would affect more than a single floor, and no theory has been tested yet.

A technician needs to see the layer 3 path a packet takes to a remote host and the delay contributed at each intermediate router. Which utility is the MOST appropriate?

1. ping
2. netstat
3. nslookup
4. traceroute

Answer: D — traceroute

D) Correct — traceroute elicits a response from each hop along the path and reports per-hop round-trip times. A) Ping measures end-to-end reachability and delay with no visibility into intermediate hops. B) Netstat reports local connections and listening sockets, not remote paths. C) Nslookup queries name resolution only.

A user can ping the local gateway but cannot reach the Internet. Which is the BEST next step?

1. Replace the access switch that the user is plugged into
2. Traceroute to a public IP and to a hostname to isolate
3. Reformat and reimage the user's workstation from scratch
4. Reseat the power cable on the default gateway router

Answer: B — Traceroute to a public IP and to a hostname to isolate

Pinging the gateway proves L1-L3 locally. Traceroute to public IP vs public hostname isolates WAN reachability vs DNS. Heavier actions skip diagnosis.

What command shows the routing table on Linux/macOS?

ip route (Linux), netstat -rn or route -n (macOS/legacy). Shows next-hop, interface, metric.

How do you troubleshoot 'cannot reach internal server'?

Verify connectivity (ping, port test), check DNS resolution, look at routing/firewall ACLs, verify server up, check duplex/speed, examine client and server logs.

How do you troubleshoot Wi-Fi performance issues?

Check signal/SNR, channel congestion (Wi-Fi analyzer), client capabilities (Wi-Fi 5 vs 6), AP density, switch to 5/6 GHz, update firmware/drivers.

What is the difference between attenuation, EMI, crosstalk, and latency in cable troubleshooting?

Attenuation: signal loss over distance. EMI: external interference. Crosstalk: signal between adjacent pairs. Latency: delay. Tested via cable certifier.