Microsoft Networking Essentials Exam Research & Evidence-Based Practice 4 — Questions and Answers
Question 1: Which evidence-based metric is most useful for diagnosing whether a network link is causing VoIP call quality degradation?
- Total bandwidth capacity of the link
- Jitter, latency, and packet loss measurements (Correct answer)
- Number of connected devices
- Link-layer frame size settings
Correct answer: Jitter, latency, and packet loss measurements
Jitter, latency, and packet loss directly impact VoIP quality and are the specific metrics defined in ITU-T G.114 for voice quality evaluation.
Question 2: A technician uses 'pathping' in Windows to investigate a slow connection. What evidence does this tool combine compared to ping alone?
- It tests UDP connectivity instead of ICMP
- It combines traceroute hop mapping with per-hop packet loss and latency statistics (Correct answer)
- It measures DNS resolution times at each hop
- It shows physical port speeds at each router
Correct answer: It combines traceroute hop mapping with per-hop packet loss and latency statistics
Pathping sends packets to each hop over a period and calculates statistics, providing evidence of both which hops exist and their specific loss and latency characteristics.
Question 3: When applying evidence-based practice to select a wireless channel, which data should a technician collect first?
- The price of access points supporting each channel
- A Wi-Fi spectrum analysis showing channel utilization by neighboring networks (Correct answer)
- User preferences for channel numbers
- The default channel setting in the router firmware
Correct answer: A Wi-Fi spectrum analysis showing channel utilization by neighboring networks
Spectrum analysis reveals actual channel interference from neighboring networks, providing objective evidence to select the least congested channel.
Question 4: Which Windows event log channel is the primary evidence source when investigating failed network authentication attempts?
- Application log
- Security log (Correct answer)
- System log
- Setup log
Correct answer: Security log
The Security log records authentication events including logon failures (Event ID 4625), making it the primary forensic evidence source for authentication investigation.
Question 5: In an evidence-based network design review, what does 'variance analysis' compare?
- The cost of two competing vendors
- Actual measured network performance against the documented baseline or design targets (Correct answer)
- Number of users on each network segment
- Physical cable distances against theoretical limits
Correct answer: Actual measured network performance against the documented baseline or design targets
Variance analysis compares actual performance measurements against the baseline or design targets to quantify the gap and identify areas needing remediation.
Question 6: Which SNMP version should be referenced when researching secure network monitoring implementation, based on current best-practice standards?
- SNMPv1
- SNMPv2c
- SNMPv3 (Correct answer)
- SNMPv4
Correct answer: SNMPv3
SNMPv3 introduced authentication and encryption, making it the only version recommended by current security best practices for network monitoring.
Question 7: A network administrator uses Microsoft's Message Analyzer to find evidence of a DNS resolution problem. Which packet filter would best isolate the relevant traffic?
- tcp.port == 80
- udp.port == 53 or tcp.port == 53 (Correct answer)
- icmp
- arp
Correct answer: udp.port == 53 or tcp.port == 53
DNS operates on port 53 using both UDP (standard queries) and TCP (zone transfers and large responses), so filtering on port 53 for both protocols isolates DNS traffic.
Microsoft Networking Essentials Exam Research & Evidence-Based Practice 4
Which evidence-based metric is most useful for diagnosing whether a network link is causing VoIP call quality degradation?