Microsoft Networking Essentials Exam Research & Evidence-Based Practice 3 — Questions and Answers
Question 1: Which Windows command-line tool generates a report of wireless network details that can serve as evidence for Wi-Fi troubleshooting?
- ipconfig /all
- netsh wlan show wlanreport (Correct answer)
- ping -t
- tracert /d
Correct answer: netsh wlan show wlanreport
The 'netsh wlan show wlanreport' command generates an HTML report with detailed Wi-Fi connection history and diagnostic data.
Question 2: In network research, what does a 'baseline' measurement represent?
- The minimum acceptable speed from the ISP
- Normal operating performance metrics collected during steady-state operation (Correct answer)
- The maximum theoretical throughput of a link
- A vendor-provided benchmark from product specifications
Correct answer: Normal operating performance metrics collected during steady-state operation
A baseline captures normal operating metrics during steady-state, providing a reference point to identify deviations that indicate problems or changes.
Question 3: Which protocol's RFC defines the current standard for IPv6 addressing that a network engineer should reference when planning a migration?
- RFC 791
- RFC 8200 (Correct answer)
- RFC 1918
- RFC 2328
Correct answer: RFC 8200
RFC 8200 is the current Internet Standard that defines IPv6, superseding RFC 2460 and serving as the authoritative specification for IPv6 implementation.
Question 4: When analyzing network logs to investigate a breach, which principle guides the evidence-based review process?
- Review only the most recent 24 hours of logs
- Establish a timeline correlating events across multiple log sources (Correct answer)
- Focus exclusively on firewall logs
- Delete logs older than 30 days before reviewing
Correct answer: Establish a timeline correlating events across multiple log sources
Correlating events across multiple log sources builds a complete evidence-based timeline that reveals the attack chain from initial access to impact.
Question 5: A network team uses Microsoft Network Monitor to capture traffic. What type of evidence does this produce for post-incident analysis?
- Verbal testimony from users
- Packet-level forensic evidence of communications (Correct answer)
- CPU utilization graphs only
- SNMP trap alert counts
Correct answer: Packet-level forensic evidence of communications
Network Monitor captures packet-level data providing granular forensic evidence of exactly what communication occurred, including payloads and timing.
Question 6: Which Microsoft documentation resource provides evidence-based guidance on best practices for Windows Server networking configurations?
- Wikipedia articles on networking
- Microsoft Learn and official TechNet documentation (Correct answer)
- Third-party forum posts
- Hardware vendor datasheets only
Correct answer: Microsoft Learn and official TechNet documentation
Microsoft Learn and TechNet documentation are maintained by Microsoft engineers and represent authoritative, evidence-based guidance for Windows Server configurations.
Question 7: What does the 'ping -l' parameter allow a technician to do when gathering evidence about MTU-related issues?
- Specify the number of echo requests to send
- Set the size of the data payload in the ping packet (Correct answer)
- Enable continuous pinging until stopped
- Resolve hostnames to IP addresses
Correct answer: Set the size of the data payload in the ping packet
The '-l' parameter sets the buffer (payload) size, allowing technicians to test different packet sizes to identify MTU mismatches causing fragmentation issues.
Microsoft Networking Essentials Exam Research & Evidence-Based Practice 3
Which Windows command-line tool generates a report of wireless network details that can serve as evidence for Wi-Fi troubleshooting?