CompTIA Network+ Domain 3: Network Operations

RPO is the maximum acceptable data loss expressed as time, which directly sets your backup frequency.

• ARTO is how long you can be DOWN before recovering — a time-to-restore target, not a data-loss target.
• CMTTR is the average time to fix a failed component — a maintainability metric, not a data-loss window.
• DMTBF predicts how long a component runs before failing — a reliability metric, unrelated to data loss.

SNMP polls devices for health data and sends traps when events occur — the standard for device monitoring.

• BSMTP sends email. The similar name is the trap — it doesn't monitor network devices.
• CFTP transfers files; it has nothing to do with device health monitoring.
• DNTP synchronizes clocks. Useful operationally, but it doesn't monitor or alert on device state.

NTP synchronizes device clocks to a common time source, keeping log timestamps consistent.

• BDNS resolves names to IPs; it has no role in clock synchronization.
• CDHCP assigns IP configuration, not time. It can hand out an NTP server option, but it isn't the sync protocol.
• DSNMP monitors devices but doesn't set their clocks. Plausible-sounding trap.

Syslog severities run 0–7 with 0 (Emergency) the most severe — system is unusable.

• B7 is the LEAST severe (verbose debugging). People assume higher numbers are worse — that's the trap.
• CNotice is a normal-but-significant condition, not the most critical.
• DError conditions are serious but still less severe than Emergency (0), Alert (1), and Critical (2).

One device handles traffic while the standby waits to take over on failure — classic HA failover.

• BRound-robin DNS spreads requests across hosts; it doesn't provide stateful firewall failover.
• CAggregation bundles links for bandwidth/redundancy on one device, not firewall-to-firewall failover.
• DSTP prevents Layer 2 loops; it isn't a device failover mechanism.

Documented, approved, scheduled changes with a rollback plan are exactly what change management defines.

• BIncident response reacts to an unplanned event. This is a planned, pre-approved change.
• CPen testing probes for vulnerabilities; it isn't about controlling configuration changes.
• DCapacity planning forecasts future resource needs, not the approval workflow for a change.

A rollback plan documents the specific steps required to return systems to their previous working configuration if the implemented change causes failures or unexpected outages.

• AA maintenance window defines the approved time frame for performing the work, but it does not describe the steps needed to undo a failed change.
• BA risk assessment evaluates the potential impact and likelihood of problems beforehand, yet it does not provide the concrete procedure used to restore the prior state.
• DThe approval workflow grants authorization to proceed with the change, but authorization alone does not specify how technicians would reverse the change after deployment.

IP address management centralizes the tracking and allocation of address space, integrates with DHCP and DNS, and reports available and used addresses to prevent overlapping assignments.

• BA NetFlow collector accounts for traffic conversations and bandwidth usage between hosts, but it does not manage or track the assignment of IP addresses.
• CAn SNMP manager polls device health and interface statistics for monitoring purposes, yet it offers no centralized inventory or allocation of network address space.
• DA syslog server aggregates event and log messages from network devices for review, but it does not record or coordinate which IP addresses are assigned.

Level 0 Emergency is the highest syslog severity and indicates the system is unusable, exactly matching the most critical condition the administrator wants forwarded.

• ALevel 1 Alert signals that immediate action is needed, making it the second most severe, but it does not represent a fully unusable system.
• CLevel 7 Debug is the least severe level and carries verbose troubleshooting details, which is the opposite of the most critical unusable condition described.
• DLevel 3 Error reports error conditions that disrupt functions, but the device generally remains operational rather than completely unusable as required here.

NetFlow exports flow records summarizing source, destination, ports, and protocols for each conversation, efficiently identifying top talkers without capturing the full packet payloads.

• ASNMP polling returns interface counters and aggregate totals such as bytes in and out, but it does not break traffic down into per-conversation source and destination detail.
• BFull packet capture records entire payloads and consumes large amounts of storage and processing, which is far more than the summarized flow report the manager needs.
• CSyslog collection gathers event and status messages generated by devices, but it does not produce statistics about traffic volume between communicating host pairs.

The recovery point objective expresses the maximum acceptable amount of data loss measured in time, so a 15-minute tolerance directly sets the required backup or replication interval.

• BThe recovery time objective defines how quickly service must be restored after an outage, addressing downtime duration rather than the amount of data that can be lost.
• CMean time to repair measures the average time taken to fix a failed component, which describes repair efficiency, not the acceptable quantity of lost data.
• DMean time between failures estimates how long a system operates before failing, indicating reliability rather than how much recent data loss is tolerable.

Network Time Protocol synchronizes device clocks to a common time source, and misconfiguration causes the skew that breaks Kerberos and produces inconsistent log timestamps.

• ADNS resolves hostnames to IP addresses and is unrelated to clock synchronization, so verifying it would not correct the multi-minute timestamp differences between servers.
• BDHCP leases IP configuration to clients but does not synchronize system clocks, so it cannot be responsible for the inconsistent timestamps observed across the servers.
• DSNMP monitors device status and gathers metrics, but it does not set or synchronize system time, so it would not cause or fix the clock discrepancies.

A service-level agreement specifies the measurable performance levels such as uptime percentages and the remedies or credits owed when the provider fails to meet the agreed targets.

• AAn MOU records a non-binding statement of mutual intent to cooperate between parties and does not establish enforceable uptime metrics or financial penalties for missed targets.
• CAn acceptable use policy dictates how users may use organizational systems and networks responsibly, but it does not define vendor performance guarantees or service availability commitments.
• DA non-disclosure agreement protects confidential information shared between parties from being revealed, and it has nothing to do with measured service availability or uptime penalties.

SNMPv3 at the authPriv security level authenticates the sender and encrypts the message payload, protecting both the credentials and the monitoring data from sniffing on the wire.

• ASNMPv1 still transmits its community string in clear text regardless of length and provides no authentication or encryption, leaving the management traffic fully exposed to interception.
• BMoving to a non-standard port only adds obscurity; SNMPv2c continues to send the community string unencrypted, so an attacker capturing packets can still read the credential.
• CSwitching from polling to traps only changes which device initiates the message and does not add authentication or encryption, so the underlying credential exposure remains unresolved.

A hot site is a fully equipped, continuously updated duplicate facility holding live replicated data, allowing operations to fail over and resume within minutes of a disaster declaration.

• BA warm site has hardware and connectivity in place but lacks continuously replicated data, so staff must restore recent backups first, requiring hours rather than minutes to resume.
• CA cold site provides only space, power, and cooling with no installed equipment or data, so bringing operations online takes days while hardware is procured and configured.
• DCloud cold storage archives data inexpensively for long-term retention with deliberately slow retrieval times, so it cannot deliver the immediate operational failover the firm requires.

A DHCP relay agent configured with an IP helper address converts the client broadcast requests into unicast and forwards them to the DHCP server on the remote subnet.

• AA DHCP reservation maps a specific MAC address to a fixed IP within a scope, but it does nothing to carry broadcast requests across a router to a remote server.
• BAn exclusion range merely removes selected addresses from a pool so they are never handed out, and it cannot relay DISCOVER broadcasts between two separate subnets.
• DDHCP snooping is a switch security feature that filters untrusted DHCP responses on access ports, but it does not forward client requests across routed subnet boundaries.

Mean time to repair measures the average time required to diagnose and restore a failed component back to service, so reducing it directly shortens the outage duration described.

• AMean time between failures measures the average operational interval between successive failures, describing how reliable a device is rather than how quickly a failed unit is restored.
• CThe recovery time objective is a target maximum downtime set by the business during planning, not a measured average of the actual repair times observed after failures occur.
• DThe recovery point objective defines the maximum tolerable data loss measured in time, which concerns backup frequency and not the duration of repair work on hardware.

A performance baseline captures normal operating metrics over a representative period so administrators can later compare current readings and detect deviations that indicate degradation or anomalies.

• BAn SLA threshold is a contractually agreed minimum service level negotiated with a provider, not an internally measured snapshot of typical performance used for later comparison.
• CA NetFlow record summarizes individual traffic conversations by source, destination, port, and protocol, but it is not a reference snapshot of overall normal device performance over time.
• DSyslog collects event and status messages generated by devices, and there is no syslog baseline construct used to gauge CPU, utilization, and latency norms for comparison.

Asset tags assign a unique identifier to each device and link it to an inventory record capturing location, purchase date, and warranty, supporting lifecycle tracking and audits.

• BIPAM tracks how IP addresses and subnets are allocated across the network, but it does not record physical hardware ownership, purchase dates, or warranty status for auditing.
• CPort labeling identifies which cable terminates where on a patch panel, helping with cabling, but it does not capture a device's lifecycle, warranty, or acquisition details.
• DA logical diagram depicts how traffic and addressing flow between segments, yet it conveys no physical inventory data such as serial numbers, warranty expiry, or purchase records.

Environmental sensors directly measure physical conditions such as temperature and humidity and can trigger alerts when readings exceed configured thresholds, warning staff before heat damages equipment.

• APolling CPU utilization reports how hard the processor is working, which can rise during heat stress, but it does not directly measure the closet's ambient temperature or humidity.
• CA syslog collector aggregates event and status messages generated by network devices, but it has no capability to sense or report the room's ambient temperature or humidity.
• DA NetFlow exporter summarizes traffic conversations by source, destination, and protocol, which is unrelated to physical environmental conditions like the temperature inside a network closet.

NIC teaming bonds two or more adapters on one server into a single logical interface, providing fault tolerance if one fails and aggregating their bandwidth together.

• AClustering provides application failover across multiple separate servers, so if a node fails another takes over, but it does not bond adapters on a single host for redundancy.
• BA load balancer distributes incoming client requests across several backend servers to spread workload, but it does not provide adapter-level fault tolerance for one server's own connections.
• DRound-robin DNS rotates responses among multiple address records to spread client load across hosts, offering no adapter redundancy or bandwidth aggregation for an individual server.

A PTR record maps an IP address back to a hostname, providing the reverse DNS entry that recipient mail servers query to validate the sender's address.

• AAn A record maps a hostname to an IPv4 address in the forward direction, which is the opposite of the reverse IP-to-name mapping that the verification check requires.
• BAn MX record designates which mail servers accept inbound mail for a domain and their priority, but it does not map a sending IP address back to a hostname.
• CA CNAME record creates an alias pointing one hostname to another canonical hostname, so it cannot satisfy a reverse lookup that resolves an IP address to a name.

A snapshot records the virtual machine's point-in-time state inside the hypervisor, allowing the engineer to revert it within seconds if the patch causes problems.

• BA full backup copies all data to separate media for long-term recovery, and restoring it takes far longer than reverting a snapshot, making it unsuitable for instant rollback.
• CA differential backup captures only data changed since the last full backup and is used to rebuild data during restoration, not to instantly revert a single VM's state.
• DCold site replication moves data to an alternate facility for disaster recovery purposes, which addresses site-wide outages rather than a quick local rollback of one virtual machine.

A stratum 1 server is directly synchronized to a stratum 0 reference clock, making it the most authoritative usable tier for an internal server to consume.

• AA stratum 0 device is the reference clock itself, such as a GPS receiver or atomic clock, rather than a network server that synchronizes to one over NTP.
• BStratum 16 indicates a clock that is unsynchronized and therefore considered invalid by NTP, representing the least authoritative state rather than a trusted upstream source.
• DA stratum 2 server synchronizes to a stratum 1 server, placing it one additional hop from the reference clock and thus making it less authoritative than stratum 1.