CompTIA Network+ Network+ Troubleshooting Tools and Methods 2 — Questions and Answers
Question 1: A technician uses Wireshark and notices a host is sending ARP requests for every IP on the subnet in rapid succession. What does this most likely indicate?
- Normal DHCP renewal
- ARP poisoning or network scanning activity (Correct answer)
- A misconfigured default gateway
- DNS cache corruption
Correct answer: ARP poisoning or network scanning activity
Rapid ARP requests across an entire subnet are a hallmark of ARP scanning or ARP poisoning attacks.
Question 2: Which command-line tool displays the route a packet takes to reach a destination and reports latency at each hop on a Windows system?
- pathping (Correct answer)
- netstat
- nslookup
- arp
Correct answer: pathping
Pathping combines tracert and ping to show per-hop latency and packet loss statistics.
Question 3: A network cable tester shows a 'crossed pair' fault on pairs 2 and 3. What is the most likely cause?
- Cable is too long
- A wiring error swapped the transmit and receive pairs (Correct answer)
- The cable lacks shielding
- The connector is Cat5 instead of Cat6
Correct answer: A wiring error swapped the transmit and receive pairs
A crossed pair fault means the Tx and Rx wire pairs were transposed during termination.
Question 4: You run 'netstat -an' and see multiple connections in the TIME_WAIT state to port 80. What does this indicate?
- Port 80 is blocked by a firewall
- Recently closed HTTP connections awaiting full TCP teardown (Correct answer)
- A DDoS attack is in progress
- The web server is unreachable
Correct answer: Recently closed HTTP connections awaiting full TCP teardown
TIME_WAIT is a normal TCP state where a connection waits to ensure the remote end received the final ACK before fully closing.
Question 5: A technician suspects duplex mismatch between a switch port and a NIC. Which tool would BEST confirm this without physical access to the switch?
- Tone generator
- Cable certifier
- Protocol analyzer capturing Ethernet errors (Correct answer)
- Optical power meter
Correct answer: Protocol analyzer capturing Ethernet errors
A protocol analyzer can reveal excessive late collisions and FCS errors that are characteristic of a duplex mismatch.
Question 6: What does the '-t' flag do when appended to the Windows 'ping' command?
- Sets the TTL value
- Sends pings continuously until stopped with Ctrl+C (Correct answer)
- Enables TCP mode instead of ICMP
- Timestamps each reply
Correct answer: Sends pings continuously until stopped with Ctrl+C
The -t flag makes ping send ICMP echo requests indefinitely, useful for monitoring link stability over time.
Question 7: A fiber link shows high light loss measured by an OTDR. The OTDR trace shows a sharp spike at 150 meters. What does this spike most likely represent?
- Normal connector loss
- A fiber break or severe bend (Correct answer)
- The far-end reflection
- Chromatic dispersion
Correct answer: A fiber break or severe bend
A sharp reflective event at a specific distance on an OTDR trace indicates a physical break, splice fault, or severe bend in the fiber.
CompTIA Network+ Network+ Troubleshooting Tools and Methods 2
A technician uses Wireshark and notices a host is sending ARP requests for every IP on the subnet in rapid succession.
What does this most likely indicate?