#1. A router has routes 10.20.0.0/16, 10.20.48.0/20, 10.20.48.128/25, and 10.20.48.192/26. Which route matches destination 10.20.48.200?
#2. An LACP bundle has 1 links at 10 Gb/s each. If one flow hashes to a single member link and requires 18 Gb/s, what is the bottleneck throughput for that flow?
#3. A packet crosses 4 identical router hops. Per hop: propagation=5 ms, transmission=1 ms, queueing=2 ms. Estimate end-to-end delay.
#4. Ignoring losses, estimate TCP throughput with receive window 256 kB and RTT 80 ms.
#5. In a campus network, users intermittently lose connectivity after adding redundant links between access and distribution switches. Which control most directly prevents Layer 2 loops while preserving redundancy?
#6. A router has routes 10.20.0.0/16, 10.20.48.0/20, 10.20.48.128/25, and 10.20.48.192/26. Which route matches destination 10.20.48.200?
#7. An LACP bundle has 2 links at 10 Gb/s each. If one flow hashes to a single member link and requires 28 Gb/s, what is the bottleneck throughput for that flow?
#8. A packet crosses 4 identical router hops. Per hop: propagation=10 ms, transmission=2 ms, queueing=3 ms. Estimate end-to-end delay.
#9. Ignoring losses, estimate TCP throughput with receive window 128 kB and RTT 80 ms.
#10. In a campus network, users intermittently lose connectivity after adding redundant links between access and distribution switches. Which control most directly prevents Layer 2 loops while preserving redundancy?
#11. A router has routes 10.20.0.0/16, 10.20.48.0/20, 10.20.48.128/25, and 10.20.48.192/26. Which route matches destination 10.20.48.200?
#12. An LACP bundle has 1 links at 10 Gb/s each. If one flow hashes to a single member link and requires 18 Gb/s, what is the bottleneck throughput for that flow?
#13. A packet crosses 5 identical router hops. Per hop: propagation=20 ms, transmission=4 ms, queueing=2 ms. Estimate end-to-end delay.
#14. Ignoring losses, estimate TCP throughput with receive window 512 kB and RTT 80 ms.
#15. In a campus network, users intermittently lose connectivity after adding redundant links between access and distribution switches. Which control most directly prevents Layer 2 loops while preserving redundancy?
#16. A router has routes 10.20.0.0/16, 10.20.48.0/20, 10.20.48.128/25, and 10.20.48.192/26. Which route matches destination 10.20.48.200?
#17. An LACP bundle has 1 links at 10 Gb/s each. If one flow hashes to a single member link and requires 15 Gb/s, what is the bottleneck throughput for that flow?
#18. A full mesh has 8 nodes and 28 links. If 2 random links fail (no node isolated), what is the remaining link count?
#19. A single-ring topology with 8 nodes loses one link. What is the immediate graph-theoretic impact (before protection mechanisms)?
#20. A design requires high availability and deterministic east-west latency under multiple link failures. Which topology choice is generally strongest before routing protocol tuning?
#21. In a two-tier Clos fabric, why are equal-cost multipath (ECMP) routes advantageous compared with a single-core star?
#22. A full mesh has 10 nodes and 45 links. If 1 random links fail (no node isolated), what is the remaining link count?
#23. A single-ring topology with 12 nodes loses one link. What is the immediate graph-theoretic impact (before protection mechanisms)?
#24. A design requires high availability and deterministic east-west latency under multiple link failures. Which topology choice is generally strongest before routing protocol tuning?
#25. In a two-tier Clos fabric, why are equal-cost multipath (ECMP) routes advantageous compared with a single-core star?
#26. A full mesh has 10 nodes and 45 links. If 1 random links fail (no node isolated), what is the remaining link count?
#27. A single-ring topology with 12 nodes loses one link. What is the immediate graph-theoretic impact (before protection mechanisms)?
#28. A design requires high availability and deterministic east-west latency under multiple link failures. Which topology choice is generally strongest before routing protocol tuning?
#29. In a two-tier Clos fabric, why are equal-cost multipath (ECMP) routes advantageous compared with a single-core star?
#30. A full mesh has 8 nodes and 28 links. If 2 random links fail (no node isolated), what is the remaining link count?
#31. A single-ring topology with 8 nodes loses one link. What is the immediate graph-theoretic impact (before protection mechanisms)?
#32. A design requires high availability and deterministic east-west latency under multiple link failures. Which topology choice is generally strongest before routing protocol tuning?
#33. In a two-tier Clos fabric, why are equal-cost multipath (ECMP) routes advantageous compared with a single-core star?
#34. A full mesh has 6 nodes and 15 links. If 1 random links fail (no node isolated), what is the remaining link count?
#35. A remote site has 150 users, average demand 2 Mb/s each, and concurrency factor 0.25. Estimate WAN access capacity target.
#36. A company needs private connectivity between many global sites with traffic engineering and QoS classes. Which service model is generally preferred over best-effort internet VPN alone?
#37. Which statement best contrasts intranet vs internet in enterprise architecture?
#38. For latency-sensitive branch voice and cloud SaaS traffic, which hybrid design is most robust?
#39. A remote site has 100 users, average demand 4 Mb/s each, and concurrency factor 0.2. Estimate WAN access capacity target.
#40. A company needs private connectivity between many global sites with traffic engineering and QoS classes. Which service model is generally preferred over best-effort internet VPN alone?
#41. Which statement best contrasts intranet vs internet in enterprise architecture?
#42. For latency-sensitive branch voice and cloud SaaS traffic, which hybrid design is most robust?
#43. A remote site has 100 users, average demand 3 Mb/s each, and concurrency factor 0.25. Estimate WAN access capacity target.
#44. A company needs private connectivity between many global sites with traffic engineering and QoS classes. Which service model is generally preferred over best-effort internet VPN alone?
#45. Which statement best contrasts intranet vs internet in enterprise architecture?
#46. For latency-sensitive branch voice and cloud SaaS traffic, which hybrid design is most robust?
#47. A remote site has 150 users, average demand 3 Mb/s each, and concurrency factor 0.25. Estimate WAN access capacity target.
#48. A company needs private connectivity between many global sites with traffic engineering and QoS classes. Which service model is generally preferred over best-effort internet VPN alone?
#49. Which statement best contrasts intranet vs internet in enterprise architecture?
#50. For latency-sensitive branch voice and cloud SaaS traffic, which hybrid design is most robust?
#51. A remote site has 150 users, average demand 4 Mb/s each, and concurrency factor 0.25. Estimate WAN access capacity target.
#52. A host can ping an IP gateway but cannot open HTTPS sessions due to repeated TCP SYN retransmissions. Which layer is most directly implicated?
#53. A packet capture shows valid Ethernet frames with CRC pass, valid IP headers, but destination port blocked by ACL. At which layer is policy enforcement occurring?
#54. A TCP payload of 1460 bytes is sent over path MTU 1500. Assuming IPv4+TCP headers total 40 bytes and no options, what occurs if payload+headers exceeds MTU?
#55. In troubleshooting, ARP resolves correctly but remote subnet is unreachable. Which model interpretation is strongest?
#56. Which mapping is correct between OSI and TCP/IP stacks?
#57. A host can ping an IP gateway but cannot open HTTPS sessions due to repeated TCP SYN retransmissions. Which layer is most directly implicated?
#58. A packet capture shows valid Ethernet frames with CRC pass, valid IP headers, but destination port blocked by ACL. At which layer is policy enforcement occurring?
#59. A TCP payload of 1400 bytes is sent over path MTU 1492. Assuming IPv4+TCP headers total 40 bytes and no options, what occurs if payload+headers exceeds MTU?
#60. In troubleshooting, ARP resolves correctly but remote subnet is unreachable. Which model interpretation is strongest?
#61. Which mapping is correct between OSI and TCP/IP stacks?
#62. A host can ping an IP gateway but cannot open HTTPS sessions due to repeated TCP SYN retransmissions. Which layer is most directly implicated?
#63. A packet capture shows valid Ethernet frames with CRC pass, valid IP headers, but destination port blocked by ACL. At which layer is policy enforcement occurring?
#64. A TCP payload of 1400 bytes is sent over path MTU 1500. Assuming IPv4+TCP headers total 40 bytes and no options, what occurs if payload+headers exceeds MTU?
#65. In troubleshooting, ARP resolves correctly but remote subnet is unreachable. Which model interpretation is strongest?
#66. Which mapping is correct between OSI and TCP/IP stacks?
#67. A host can ping an IP gateway but cannot open HTTPS sessions due to repeated TCP SYN retransmissions. Which layer is most directly implicated?
#68. A packet capture shows valid Ethernet frames with CRC pass, valid IP headers, but destination port blocked by ACL. At which layer is policy enforcement occurring?
#69. An IDS test produced TP=90 and FN=30. What is detection rate (recall)?
#70. A network detector reports FP=15, TN=95. What is false-positive rate?
#71. A SOC wants to reduce attacker dwell time after endpoint compromise. Which strategy is strongest?
#72. During attack triage, IDS flags lateral SMB scanning between VLANs. Which additional control most directly complements IDS detection?
#73. An IDS test produced TP=70 and FN=10. What is detection rate (recall)?
#74. A network detector reports FP=5, TN=95. What is false-positive rate?
#75. A SOC wants to reduce attacker dwell time after endpoint compromise. Which strategy is strongest?
#76. During attack triage, IDS flags lateral SMB scanning between VLANs. Which additional control most directly complements IDS detection?
#77. An IDS test produced TP=80 and FN=20. What is detection rate (recall)?
#78. A network detector reports FP=10, TN=90. What is false-positive rate?
#79. A SOC wants to reduce attacker dwell time after endpoint compromise. Which strategy is strongest?
#80. During attack triage, IDS flags lateral SMB scanning between VLANs. Which additional control most directly complements IDS detection?
#81. An IDS test produced TP=90 and FN=10. What is detection rate (recall)?
#82. A network detector reports FP=15, TN=95. What is false-positive rate?
#83. A SOC wants to reduce attacker dwell time after endpoint compromise. Which strategy is strongest?
#84. During attack triage, IDS flags lateral SMB scanning between VLANs. Which additional control most directly complements IDS detection?
#85. An external scan shows TCP/22 open, but ACL policy requires SSH only from jump hosts. Which action is best first response?
#86. A vulnerability has CVSS 9.8 on internet-facing system, exploit code is active, and compensating controls are weak. What priority is most appropriate?
#87. During a penetration test, testers gain access through reused credentials then move laterally via flat network segments. Which control set best addresses root causes?
#88. A web app passes authentication but is vulnerable to IDOR (insecure direct object reference). Which security principle is most directly violated?
#89. Which sequence best reflects a risk-based security program for network assets?
#90. An external scan shows TCP/22 open, but ACL policy requires SSH only from jump hosts. Which action is best first response?
#91. A vulnerability has CVSS 9.8 on internet-facing system, exploit code is active, and compensating controls are weak. What priority is most appropriate?
#92. During a penetration test, testers gain access through reused credentials then move laterally via flat network segments. Which control set best addresses root causes?
#93. A web app passes authentication but is vulnerable to IDOR (insecure direct object reference). Which security principle is most directly violated?
#94. Which sequence best reflects a risk-based security program for network assets?
#95. An external scan shows TCP/22 open, but ACL policy requires SSH only from jump hosts. Which action is best first response?
#96. A vulnerability has CVSS 9.8 on internet-facing system, exploit code is active, and compensating controls are weak. What priority is most appropriate?
#97. During a penetration test, testers gain access through reused credentials then move laterally via flat network segments. Which control set best addresses root causes?
#98. A web app passes authentication but is vulnerable to IDOR (insecure direct object reference). Which security principle is most directly violated?
#99. Which sequence best reflects a risk-based security program for network assets?
#100. An external scan shows TCP/22 open, but ACL policy requires SSH only from jump hosts. Which action is best first response?
