CompTIA Network+ (N10-009) Practice Tests

Explanation

The primary security benefit of a dual-firewall DMZ architecture is the use of two separate firewall devices, ideally from different vendors. If both firewalls are from different manufacturers, a vulnerability or zero-day exploit affecting one vendor's product will not automatically compromise the second firewall. An attacker who successfully breaches the outer firewall still faces a completely different security barrier between the DMZ and the internal network. This defense-in-depth approach is significantly more secure than a single three-interface firewall where a single vulnerability could expose the internal network directly. A dual-firewall DMZ does not allow unfiltered communication between the internal network and DMZ; traffic between all zones is inspected by the inner firewall. It requires more hardware, not less, which is the trade-off for enhanced security. IDS/IPS sensors in the DMZ are still recommended regardless of firewall architecture.

Explanation

A stub area blocks Type 4 (ASBR Summary) and Type 5 (External AS) LSAs from entering the area, reducing routing table size and LSA flooding overhead. Routers in stub areas receive a default route from the ABR to reach external destinations. Importantly, inter-area routes (Type 3 LSAs) are still permitted, so routes from Area 0 can reach Area 2 via summary LSAs. A normal area allows all LSA types including external Type 4 and 5, which does not meet the requirement. A totally stubby area (Cisco-proprietary extension) blocks Type 3, 4, and 5 LSAs, replacing all inter-area and external routes with a single default route — this would also prevent specific inter-area routes from Area 0 from reaching Area 2. An NSSA allows an ASBR within the stub area to redistribute external routes using Type 7 LSAs, which is for areas that need to redistribute external routes, not for blocking them.

Explanation

Double tagging VLAN hopping exploits the fact that the native VLAN is untagged on trunk links. When an attacker sends a frame with two 802.1Q tags where the outer tag matches the native VLAN, the first switch strips the outer tag (native VLAN processing) and forwards the frame with the inner tag intact, effectively delivering it to a different VLAN. Two mitigations address this: First, changing the native VLAN to an unused VLAN ID that no user devices are assigned to ensures that even if a double-tagged frame is sent using the old native VLAN, it will not reach any legitimate user VLAN. Second, configuring all user-facing ports explicitly as access ports with nonegotiate prevents any DTP negotiation that could allow an attacker's device to form a trunk link (switch spoofing attack). Enabling DTP would make the vulnerability worse by facilitating trunk formation. Port security on trunk links would not prevent double-tagging attacks. BPDU Guard on trunk ports is inappropriate and would err-disable legitimate trunk connections.

Explanation

802.1X port-based network access control requires a supplicant on the client device to authenticate through an authenticator (the switch) to an authentication server (RADIUS). For devices such as printers and IP phones that cannot run a supplicant, MAC Authentication Bypass (MAB) allows the switch to use the device's MAC address as the authentication credential, sending it to the RADIUS server for validation. Together, these two technologies satisfy the requirement for all device types. TACACS+ is used for device administration authentication, not for controlling client network access on switch ports. Port Security limits the number of MAC addresses but does not perform authentication. RADIUS accounting logs session information but does not itself enforce access control decisions.

Explanation

The total power demand calculation is straightforward: 4 cameras x 25 watts = 100 watts required, but the switch has only a 65-watt PoE power budget. When the switch's power budget is exceeded, it will power ports in priority order (typically lowest port number first) and deny power to remaining ports that would exceed the budget. The first two cameras (50W) would receive power, but the third camera would require 75W total, and the fourth would require 100W total, both exceeding the budget. This matches the symptom of exactly two cameras failing to power on. The cable concern is irrelevant because 802.3at (PoE+) supports up to 30W on Cat 5e and Cat 3 minimum, so Cat 5e handles 25W easily. 802.3bt Type 4 delivers up to 100W but 25W falls within standard PoE+ (802.3at) which supports up to 25.5W at the powered device. Camera IP configuration is unrelated to PoE activation, which is a physical layer function independent of Layer 3 addressing.