CompTIA Network+ Domain 2: Network Implementation

A trunk tags frames with 802.1Q VLAN IDs so one physical link carries many VLANs between switches.

• AAn access port belongs to exactly one VLAN and carries untagged traffic. It can't pass multiple VLANs.
• CA routed port drops switching and acts like a router interface — it doesn't tag/carry multiple VLANs.
• DLink aggregation bundles links for bandwidth/redundancy. It can run over a trunk but isn't what tags VLANs.

WPA3 uses SAE (Simultaneous Authentication of Equals) to resist offline cracking — the current strongest option.

• AWEP's RC4/IV scheme was broken long ago and can be cracked in minutes. Fully obsolete.
• BStrong for years, but vulnerable to offline dictionary attacks on the PSK and the KRACK weakness. Good, not best.
• DNo encryption at all — anyone nearby can read the traffic. The weakest possible choice.

Single-mode's narrow core and laser source carry signals many kilometers — the right choice for long hauls.

• ATwisted-pair copper is limited to about 100 m. It can't span kilometers.
• BMultimode is for shorter runs (hundreds of meters). At 10 km, modal dispersion makes it unsuitable.
• DCoax isn't used for multi-kilometer building-to-building data backbones at these speeds.

VLANs are separate broadcast domains/subnets. Traffic between them must be routed at Layer 3.

• BAdding access ports doesn't bridge two separate subnets — they still can't route to each other.
• CRemoving tagging breaks VLAN separation on the trunk; it doesn't provide routing between VLANs.
• DThat technically lets them talk, but by destroying the VLAN design — not the intended way to route between VLANs.

PoE delivers DC power alongside data on the same Ethernet cable, ideal for APs and cameras.

• BUSB-C isn't the medium for Ethernet networking runs to a ceiling AP.
• C802.1Q is VLAN tagging — it carries no electrical power. Sounds technical but unrelated.
• DCoax isn't how modern APs are powered over their data cable.

Local traffic works without a gateway, but anything off-subnet (including the internet) needs the default gateway to forward it.

• BMAC addresses are burned into the NIC and aren't configured by the user. Not the cause.
• CIf local communication works, the link is up. Speed/duplex wouldn't selectively block off-subnet traffic.
• DA DNS issue breaks name lookups, but you could still reach internet IPs directly. The symptom points to routing, not DNS.

OSPF is a link-state IGP that floods LSAs so every router builds an identical topology database, elects a DR and BDR on multi-access broadcast segments, and derives its cost metric from interface bandwidth, satisfying all of the stated conditions.

• ARIPv2 is a distance-vector protocol whose metric is a simple hop count capped at 15, and it never builds a full topology map or elects a designated router, so it fails the link-state and bandwidth requirements.
• CBGP is an exterior path-vector protocol designed to exchange routes between separate autonomous systems using path attributes, not an interior link-state protocol, so it does not elect designated routers or use bandwidth-based cost inside one AS.
• DStatic routing relies on manually configured next-hop entries that never adapt, build a topology database, or elect designated routers, so it cannot meet the automatic metric and dynamic link-state requirements described here.

Port Address Translation, also called NAT overload, multiplexes many private hosts behind one public IP by assigning each outbound session a unique source port, which is exactly how the firewall keeps the concurrent flows distinct.

• AStatic NAT permanently maps one private address to one dedicated public address, so it cannot let fifty hosts share a single public IP and offers no port multiplexing to keep concurrent sessions separate.
• BDHCP only leases IP addresses and options to clients on the local network; it performs no address translation at the perimeter and plays no role in mapping internal flows to ports on a public address.
• DDNS round robin distributes client requests across multiple server addresses for load sharing; it does not translate internal addresses or track port mappings, so it cannot let hosts share one public IP.

On an 802.1Q trunk the native VLAN carries any frame that arrives without a tag, so defining VLAN 99 as the native VLAN on both ends places the untagged management frames into VLAN 99 as required.

• BAn access port belongs to only one VLAN and strips tags, so it could not also carry tagged traffic for VLANs 10, 20, and 30 across the same inter-switch link as the scenario demands.
• CPort security limits which MAC addresses may use a port; it neither tags frames nor assigns untagged traffic to a VLAN, so it does nothing to direct the untagged management frames to VLAN 99.
• DA voice VLAN tags IP-phone traffic on access ports facing endpoints; it is not the mechanism that classifies untagged frames crossing an 802.1Q trunk, so it cannot place them into VLAN 99.

802.3at, known as PoE+, sources up to 30 watts and delivers about 25.5 watts to the powered device, which exactly meets the cameras' stated requirement of 25.5 watts at the endpoint.

• AThe original 802.3af PoE standard supplies only about 15.4 watts at the source and roughly 12.95 watts at the device, which falls short of the 25.5 watts these PTZ cameras require.
• B802.1X is a port-based network access control standard for authenticating devices before granting connectivity; it has nothing to do with delivering electrical power over Ethernet, so it cannot run the cameras.
• C802.1Q defines VLAN frame tagging on trunks to segment traffic; it is unrelated to supplying power over the cable, so enabling it would not meet the camera wattage requirement at all.

In the North American 2.4 GHz plan only channels 1, 6, and 11 are spaced far enough apart that their 20 MHz widths do not overlap, making them the standard non-overlapping set for adjacent access points.

• BAdjacent 2.4 GHz channels are only 5 MHz apart while each channel is about 20 MHz wide, so channels 1, 2, and 3 overlap heavily and would cause exactly the interference the installer is trying to avoid.
• CChannels 36, 40, and 44 exist in the 5 GHz band, not 2.4 GHz, so selecting them does not answer a question scoped to the 2.4 GHz deployment described in the scenario.
• DAlthough 1, 5, and 9 are spread out, the four-channel spacing still leaves their 20 MHz widths partially overlapping, so they are not the accepted non-overlapping trio for the 2.4 GHz band.

Single-mode fiber paired with a long-range 1310 nm LR transceiver is engineered for kilometer-scale runs and easily carries 10 Gbps across the 8-kilometer link using the long-wavelength laser specified.

• ACat6a supports 10 Gbps only to about 100 meters, so over an 8-kilometer span the signal would attenuate far beyond usability, making copper completely unsuitable for this building-to-building run.
• BMultimode OM3 with a short-range 850 nm SR optic typically reaches only around 300 meters at 10 Gbps, so it cannot span the 8-kilometer distance even though it is a fiber solution.
• DCoaxial cable with F-type connectors is used for older broadband and CATV signaling, not multi-kilometer 10 Gbps Ethernet, so it lacks both the bandwidth and the distance capability required here.

VRRP is an open-standard first-hop redundancy protocol that lets multiple routers share one virtual gateway IP, electing a master to forward traffic and a backup that automatically takes over if the master fails.

• BHSRP also provides gateway redundancy with a virtual IP, but it is a Cisco-proprietary protocol, so it violates the explicit requirement for an open, vendor-neutral standard stated in the scenario.
• CSpanning Tree Protocol prevents Layer 2 switching loops by blocking redundant links; it does not present a shared virtual gateway address or perform router failover, so it cannot deliver default-gateway redundancy here.
• DOSPF is an interior routing protocol that exchanges routes between routers, but it does not present a single virtual gateway IP to end hosts, so by itself it cannot give clients automatic first-hop failover.

BGP is the exterior path-vector protocol that exchanges routes between autonomous systems and uses attributes such as AS-path and local preference to choose one provider's path over another, matching every requirement.

• AOSPF is an interior gateway protocol that shares link-state information inside a single autonomous system; it is not designed to exchange routes between separate autonomous systems or to manipulate inter-domain path attributes.
• BEIGRP is a Cisco interior gateway protocol using composite metrics within one autonomous system; it does not peer between independent provider autonomous systems or carry the path attributes the scenario requires for route preference.
• DA static default route can point to one provider but cannot dynamically exchange reachability between autonomous systems or weigh path attributes, so it cannot intelligently prefer one provider's routes over the other's.

Rapid Spanning Tree, defined in 802.1w, preserves a loop-free topology while introducing alternate and backup port roles and a proposal-agreement handshake that restores forwarding in about a second, meeting the fast-convergence requirement.

• AClassic 802.1D Spanning Tree is exactly what the team is replacing; its timer-based listening and learning states cause the 30-to-50-second convergence delay the scenario explicitly wants to eliminate, so it is wrong.
• C802.1Q is the VLAN tagging standard for trunk links; it segments traffic into virtual LANs but provides no loop prevention or convergence behavior, so it does not address the slow failover problem described.
• D802.3ad defines link aggregation that bundles parallel links into one logical channel; it is unrelated to recalculating a loop-free spanning topology after a failure, so it does not solve the convergence delay.

LACP, part of IEEE 802.3ad, is the open-standard protocol that dynamically negotiates multiple physical links into a single logical aggregated channel, increasing bandwidth and providing redundancy if one member link fails.

• ASpanning Tree would treat the second parallel cable as a loop and block it, leaving only one active link, which defeats the goal of combining both cables to double bandwidth, so it is incorrect.
• BPAgP does negotiate an aggregated link, but it is a Cisco-proprietary protocol, so it fails the explicit requirement for an open, vendor-neutral standard to bundle the two cables between the switches.
• CAn 802.1Q trunk carries multiple VLANs over a single link but does not aggregate two physical cables into one logical higher-bandwidth channel, so it cannot deliver the combined throughput and resilience requested.

WPA3-Personal replaces the WPA2 four-way handshake with Simultaneous Authentication of Equals, a dragonfly key exchange that resists offline dictionary attacks and provides forward secrecy, exactly matching the protection the owner is asking for.

• BWPA2-Enterprise improves authentication by using 802.1X and a RADIUS server instead of a shared key, but it still relies on the WPA2 handshake and does not implement SAE, so it misses the requirement.
• CWEP is a deprecated standard whose RC4 cipher and weak initialization vectors are trivially cracked; it is far less secure than WPA2 and offers nothing like SAE, so choosing it would worsen security.
• DWPA2-Personal is the very standard the consultant flagged as vulnerable, since its pre-shared key handshake can be captured and brute-forced offline, so keeping it would not introduce the SAE exchange the owner wants.

A QSFP+ transceiver provides a 40 Gigabit Ethernet interface, typically by combining four 10 Gbps lanes, which is exactly the form factor needed to establish the 40 Gbps uplink between the core switches.

• AAn SFP transceiver is rated for 1 Gigabit Ethernet interfaces, so it cannot carry a 40 Gbps link and falls far short of the throughput the data center uplink between the core switches requires.
• BAn SFP+ transceiver supports up to 10 Gigabit Ethernet, which is four times too slow for the 40 Gbps uplink described, so it cannot satisfy the bandwidth requirement between the two core switches.
• DA GBIC is a legacy gigabit interface converter limited to 1 Gigabit Ethernet in a larger form factor; it is obsolete for high-speed uplinks and cannot deliver the 40 Gbps the scenario requires.

A router prefers the route with the lowest administrative distance when the same prefix is learned from multiple sources, and a static route's administrative distance of 1 beats OSPF's 110, so the static route is installed.

• ARouters do not compare metrics across different protocols when both offer the same prefix; they first compare administrative distance, and OSPF's distance of 110 is higher than a static route's, so the OSPF path is not preferred.
• CEqual-cost load balancing happens only among multiple paths from the same protocol with identical metrics; routes from different sources carry different administrative distances, so the router cannot balance an OSPF route against a static route.
• DRoute selection is not based on which entry arrived most recently; the router evaluates administrative distance first and metric second, so the timing of when a route was learned plays no role here.

Port Address Translation, also called NAT overload, maps many private addresses to one public address by assigning each outbound session a unique source port, letting all forty workstations share the single public IPv4 address.

• AStatic NAT maps one private address to one dedicated public address permanently, so with only a single public IP available it could translate just one internal host at a time and cannot serve all forty workstations concurrently.
• BDNS round robin distributes client requests across several server addresses for crude load sharing; it performs no address translation at the firewall and therefore cannot let many internal hosts share one outbound public IPv4 address.
• CDesignating a DMZ host forwards unsolicited inbound traffic to a single internal device; it does not translate outbound sessions for dozens of hosts behind one public address, so it fails the multi-user sharing requirement.

The native VLAN defines which VLAN untagged frames belong to on an 802.1Q trunk, and it must match on both ends; setting it to VLAN 99 makes untagged management traffic associate with that VLAN as required.

• BA voice VLAN is an access-port feature that tags IP-phone traffic separately from a connected PC; it does not determine how untagged frames are handled on a trunk link, so it cannot satisfy this requirement.
• CThe default VLAN is simply VLAN 1, the factory assignment for all ports; although it is the default native VLAN, the administrator specifically wants untagged traffic mapped to VLAN 99, which requires changing the native VLAN setting.
• DA private VLAN isolates ports within the same subnet into community or isolated groups; it controls host-to-host segmentation, not which VLAN carries untagged frames on a trunk, so it does not address this configuration.

The 802.3at standard, known as PoE+, delivers up to 30 watts at the switch port, comfortably exceeding the camera's 25-watt draw, so upgrading the port to PoE+ supplies enough power over the single cable.

• AThe 802.3af standard supplies a maximum of 15.4 watts at the switch port, which is the very limitation the scenario states is insufficient, so it cannot power a camera that draws roughly 25 watts.
• BPassive PoE injects a fixed voltage without the negotiation defined by IEEE standards and is meant for low-power proprietary gear; relying on it for a 25-watt camera risks damage and is not the standards-based answer required.
• DUSB Power Delivery negotiates power over USB-C cabling for devices such as laptops; it is unrelated to delivering power over twisted-pair Ethernet to a network camera, so it cannot meet this PoE requirement.

On the 2.4 GHz band, channels 1, 6, and 11 are spaced far enough apart that their 20 MHz-wide signals do not overlap, making them the standard non-overlapping set used to avoid adjacent-channel interference in North America.

• AChannels spaced five apart still overlap on the 2.4 GHz band because each 20 MHz channel is wider than the spacing between center frequencies, so 1, 5, and 9 interfere and do not form the non-overlapping set.
• CAlthough spaced by five, channel 12 is restricted or unavailable for normal use in North America, and this grouping is not the conventional plan, so it does not reliably avoid interference the way 1, 6, and 11 do.
• DChannel 14 is prohibited for Wi-Fi in North America and is only permitted in some other regions, so including it makes this set invalid even though 1, 6, and 11 alone would be correct.

Plenum-rated cable carries a CMP jacket of fire-resistant, low-smoke material made for air-handling spaces; because the ceiling void circulates return air, fire code requires this rating, making CMP the correct specification here.

• BRiser-rated CMR cable is built for vertical runs between floors and resists fire spreading upward, but its jacket produces more smoke than plenum cable, so it does not satisfy code for an air-handling plenum space.
• CGeneral-purpose CM cable with a PVC jacket is intended for ordinary in-wall runs; it emits dense toxic smoke when burned and is prohibited in plenum spaces, so it fails the fire-code requirement described.
• DDirect-burial cable has a rugged moisture-resistant jacket for underground outdoor runs; it addresses water and physical damage, not the smoke and flame characteristics that fire code demands inside an air-return plenum.