CompTIA Network+ Free Sample Questions

A distributed firewall, often integrated directly into the hypervisor, is the most effective technology for enforcing granular east-west microsegmentation policies in a virtualized environment. This approach allows security policies to be applied at the virtual NIC (vNIC) of each virtual machine. It can inspect and filter traffic between VMs on the same host without the traffic ever leaving the hypervisor, providing highly granular control that is central to a Zero Trust model. Traditional VLANs with ACLs are less scalable and do not provide visibility into intra-host traffic. A perimeter firewall is ineffective for east-west traffic, and port security only operates at Layer 2, lacking the application-layer awareness needed to enforce policies based on ports like 8443 and 3306.

BGP (Border Gateway Protocol) is the standard and most suitable routing protocol for large-scale SD-WAN overlays. It is an open standard (ensuring multi-vendor compatibility) and is designed for scalability and complex policy implementation, which are key requirements for managing traffic across many branch offices and data centers. BGP's path attributes allow for granular, policy-based routing decisions, making it ideal for the intelligent path selection capabilities of SD-WAN. While OSPF is an open standard, it is an IGP not designed for the policy-rich, large-scale nature of WAN overlays. EIGRP is historically Cisco-proprietary and less suited for multi-vendor policy enforcement. RIP is outdated and lacks the required scalability and features.

In a VxLAN environment, the VxLAN Network Identifier (VNI) is used to segment traffic in the overlay network, similar to how a VLAN ID works in a traditional network. For two VMs to communicate within the same logical Layer 2 segment, their traffic must be mapped to the same VNI by their respective VxLAN Tunnel Endpoints (VTEPs). A misconfigured VNI on one VTEP would cause it to encapsulate or decapsulate traffic into the wrong logical segment, preventing communication even if the underlying VLANs and IP settings are correct. Since VxLAN operates over a Layer 3 underlay, STP on the physical switches is not directly involved in the overlay forwarding path. A mismatched VLAN ID was ruled out in the scenario.

The Main Distribution Frame (MDF) is the central point of a structured cabling system where external connections (like the ISP) terminate and connect to the internal network's core equipment. In this scenario, the main telecommunications room on the second floor serves this function.

Intermediate Distribution Frames (IDFs) are secondary wiring closets that connect to the MDF and distribute network access to end-users in a specific area, such as a single floor. The wiring closets on each floor fit this description perfectly.

Idempotence is a core principle of declarative IaC tools like Terraform and Ansible. It means that an operation can be applied multiple times without changing the result beyond the initial application. In this scenario, the IaC tool ensures that running the configuration script repeatedly will only configure the firewall rules once to match the desired state. Subsequent runs will detect that the state is already correct and will make no further changes. This makes automation safe and predictable. Immutability refers to creating new resources instead of changing existing ones. Orchestration is the broader coordination of automated tasks. Abstraction hides underlying complexity.

The statement is false. A core principle of SASE is the convergence of networking and security into a single, cloud-delivered service model. In a SASE architecture, traffic is directed to a cloud-based point of presence (PoP) where security inspections (like SWG, CASB, FWaaS, ZTNA) and optimized routing decisions are made. This is the opposite of the traditional model of deploying and managing separate on-premises appliances at each branch office.