CompTIA Network+ Practice Test.

Answer: B
Layer 3 (Network) handles logical IP addressing and routing between different networks via routers. Layer 2 handles MAC addressing and switching within a local segment, Layer 4 handles end-to-end segmentation and reliability (TCP/UDP), and Layer 7 handles application-level protocols like HTTP and DNS.

Answer: A
A /25 provides 126 usable host addresses (2^7-2), just enough for 100 hosts with little waste. A /28 only yields 14 usable hosts, a /30 yields 2, and a /22 yields 1022, which is far more address space than needed.

Answer: A
Anycast delivers traffic to the topologically nearest member of a group sharing the same address, commonly used for services like DNS root servers. Unicast is one-to-one, multicast is one-to-many to a defined group, and broadcast (not used in IPv6) sends to all hosts on a segment.

Answer: B
Link-state protocols such as OSPF build a full topology map and use cost metrics (often bandwidth-based) with fast convergence via triggered updates. RIP is a distance-vector protocol limited to hop count and slow convergence; static routing has no dynamic recalculation; ARP resolves IP to MAC addresses and is not a routing protocol.

Answer: B
An AAAA record maps a hostname to a 128-bit IPv6 address. An A record performs this mapping for IPv4, a CNAME record creates an alias to another hostname, and an MX record specifies mail exchange servers for a domain.

Answer: A
Elasticity is the ability to dynamically scale resources up or down based on demand. Multitenancy refers to multiple customers sharing the same underlying infrastructure, fault tolerance describes resilience to component failure, and NFV refers to virtualizing network services such as firewalls and routers on standard hardware.

Answer: A
802.1Q is the IEEE standard that defines VLAN tagging on Ethernet trunk links. 802.1X governs port-based network access control, 802.3af defines Power over Ethernet, and 802.11ac is a wireless LAN standard.

Answer: A
Port mirroring, also called a switched port analyzer (SPAN), duplicates traffic from one or more ports or VLANs to a monitoring port for analysis. Port security restricts which MAC addresses may connect to a port, link aggregation bundles multiple physical links into one logical link, and native VLAN configuration defines untagged traffic handling on a trunk.

Answer: A
MU-MIMO (Multi-User Multiple Input, Multiple Output) allows an access point to communicate with multiple client devices simultaneously using multiple antenna streams, improving aggregate throughput. Channel bonding increases the width of a single channel but doesn't enable concurrent multi-user streams by itself, WPA3 is a security protocol, and BSS isolation prevents client-to-client communication on the same AP.

Answer: D
Cat 6A extends 10GBASE-T support to the full 100-meter horizontal run, whereas Cat 6 typically supports 10 Gbps only up to about 37-55 meters due to alien crosstalk. PoE support is not the differentiator between these categories, Cat 6A is still a copper twisted-pair standard, and both categories work fine for wired workstation connections.

Answer: A
VRRP (Virtual Router Redundancy Protocol) and HSRP (Hot Standby Router Protocol, Cisco proprietary) let two or more routers share a virtual IP so hosts always use the same default gateway, with automatic failover. STP prevents Layer 2 loops among switches, LACP bundles physical links into an aggregated logical link, and DHCP relay forwards DHCP requests across subnets rather than providing gateway redundancy.

Answer: A
T568A and T568B are the two TIA/EIA wiring standards that define the pin-out order of colored wire pairs in RJ45 connectors; mixing them on the two ends of one cable creates a crossover cable. The other options are unrelated standards for wireless/Ethernet framing, network management, or IP addressing.

Answer: D
DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addressing information, including address, mask, gateway, and DNS servers, to clients. NTP synchronizes time, SNMP is used for monitoring and managing network devices, and Syslog centralizes log message collection.

Answer: C
An SNMP trap is an unsolicited message sent from a managed device to the manager as soon as a defined event or threshold occurs, enabling near-real-time alerting. GetRequest and Walk are manager-initiated polling operations, and SetRequest is used by the manager to change a device's configuration value, not to receive alerts.

Answer: A
RPO defines the maximum acceptable amount of data loss measured in time, dictating how frequently backups or replication must occur. RTO defines how quickly a service must be restored after an outage, MTBF measures the average time a system operates before failing, and MTTR measures the average time needed to repair a failed component.

Answer: A
Change management is the formal process of planning, documenting, approving, and reviewing changes to production systems, including rollback plans, to minimize risk. Asset management tracks inventory of hardware/software, incident response addresses active security or operational incidents, and vulnerability scanning identifies weaknesses rather than governing planned changes.

Answer: A
A physical network diagram shows the actual hardware, cabling, and connections between devices, often layered with logical information like IP addressing, to aid design and troubleshooting. An SLA defines expected service performance between provider and customer, an SOP documents step-by-step procedures for routine tasks, and an NDA is a legal confidentiality agreement, none of which depict network topology.

Answer: A
Installing a redundant power supply removes a single point of failure so the device continues operating if one component fails, a core high-availability design principle. Load balancing distributes traffic across multiple servers or links rather than protecting a single device, traffic shaping controls bandwidth usage patterns, and QoS tagging prioritizes certain traffic types, neither of which is about component redundancy.

Answer: A
Establishing a performance baseline and continuously logging metrics over time allows administrators to visualize trends like gradually rising CPU usage and detect anomalies before they cause outages. A single ping test or one-time port scan gives only a snapshot rather than a trend, and static ARP entries have nothing to do with performance monitoring.

Answer: A
An ACL applied to the management interface can permit SSH only from the trusted IT subnet and implicitly deny all other sources, directly enforcing least-privilege management access. Enabling CDP actually broadcasts device information and reduces security, disabling STP creates loop risk without any access-control benefit, and DHCP lease time is unrelated to restricting administrative access.

Answer: C
An evil twin attack involves a rogue access point mimicking a legitimate SSID to trick clients into connecting so the attacker can intercept traffic or harvest credentials. ARP poisoning corrupts a device's ARP cache to redirect Layer 2 traffic, VLAN hopping exploits trunking misconfiguration to access other VLANs, and DNS amplification is a DDoS technique leveraging open DNS resolvers.

Answer: A
Segmenting devices by risk profile (IoT, guest, corporate) into separate VLANs with firewall-enforced boundaries limits lateral movement and contains breaches, a core defense-in-depth practice. Single sign-on addresses authentication convenience, VPN tunneling modes concern remote access routing, and port forwarding exposes an internal service externally, none of which describe internal network segmentation.

Answer: A
An IPS sits inline with traffic flow and can automatically block or drop packets matching malicious signatures in real time. An IDS only monitors and alerts without taking blocking action, a syslog server merely aggregates log messages, and a proxy cache server accelerates and filters web requests but is not designed for real-time attack signature blocking.

Answer: A
A split-tunnel VPN routes only traffic destined for corporate resources through the encrypted tunnel while other internet traffic uses the local connection directly, reducing bandwidth load on the VPN concentrator. A full-tunnel VPN forces all traffic, including general internet browsing, through the tunnel; a site-to-site VPN connects two networks rather than a single remote user; and a clientless portal describes browser-based access rather than tunnel scope.

Answer: A
Following the standard troubleshooting methodology of testing connectivity layer by layer, the next logical step is pinging the gateway and then an external address to narrow down whether the failure is local, at the gateway, or further upstream (e.g., DNS or an external route). Reformatting or replacing hardware without further diagnosis skips isolating the actual fault, and disabling the port would remove the user's access entirely without diagnosing anything.

Answer: A
Jitter is the variation in packet delay over time, which can degrade real-time applications like VoIP even without packet loss. Latency refers to the absolute delay of a single packet's round trip, not its variability; attenuation is the weakening of a signal over distance in a cable; and crosstalk is interference between adjacent wire pairs, neither related to timing variability between pings.

Answer: A
Given signal strength dropped specifically after a firmware update and correlates with distance from the AP, a change to transmit power, antenna settings, or channel width introduced by the update is the most likely cause of reduced coverage. DNS misconfiguration would cause name resolution failures rather than distance-dependent signal drop, DHCP exhaustion would prevent address assignment entirely rather than degrade with distance, and a duplicate IP would cause address conflicts, not a signal strength/distance correlation.

Answer: A
Because the wire map is confirmed correct (no opens, shorts, or transposed pairs) yet performance issues correlate with nearby electrical equipment operation, EMI coupling into the cable is the most likely cause of degraded signal quality and retransmissions. An open circuit or transposed pair would show up on the wire map test which passed, and a duplex mismatch is a switch/NIC configuration issue unrelated to environmental electrical noise.

Answer: A
A new switch introducing a redundant Layer 2 path without STP properly blocking it creates a loop, causing broadcast and unknown-unicast frames to circulate endlessly, spiking CPU and saturating bandwidth network-wide. A DNS outage would cause name resolution failures rather than network-wide flooding, an expired certificate only affects encrypted sessions to one service, and DHCP exhaustion prevents new address assignment but does not cause flooding or high switch CPU from looping frames.

Answer: A
Since the tunnel establishes and some subnets work while others don't, the most likely cause is that the VPN's defined traffic selectors (interesting traffic/proxy IDs) omit the missing subnets, so packets to those networks are never routed into the tunnel. A fully down ISP link or failed power supply would prevent the tunnel from establishing at all, and a DHCP outage affects address assignment locally, not selective reachability of specific remote subnets through an already-established tunnel.

Answer: A
Because DNS resolution is confirmed correct and only connections to specific server addresses fail with unanswered SYN packets, a firewall or ACL silently dropping (rather than rejecting) that traffic is the most likely cause, which produces exactly this retransmission pattern with no response. Incorrect DNS records would misdirect the client to a wrong address rather than causing name-correct connections to specific servers to hang, a half-duplex NIC would typically produce collisions and errors rather than clean unanswered SYNs, and a corrupted gateway ARP cache would affect all destinations, not selectively certain servers.

Answer: A
When latency jumps sharply at one hop and remains elevated for all subsequent hops, it indicates a slow, congested, or otherwise degraded link at that point in the path, since every later hop inherits the added delay. A client-side subnet mask or DHCP lease issue would affect local connectivity broadly rather than produce a hop-specific mid-path latency jump, and a duplicate MAC address typically causes intermittent connectivity or ARP conflicts rather than a consistent added-latency traceroute signature.

Answer: B
The current CompTIA Network+ exam (N10-009) is organized into five official content domains covering networking concepts, network implementation, network operations, network security, and network troubleshooting. The other counts do not match the exam's official published structure.

Answer: B
Network Troubleshooting is the largest domain at 24% of the exam, reflecting the emphasis on applying diagnostic methodology to real-world network problems. Networking Concepts is 23%, Network Implementation is 20%, and Network Security is only 14%, all smaller than Troubleshooting's share.

Answer: A
Usable hosts equal two raised to the number of host bits, minus the network and broadcast addresses, so a /23 with nine host bits gives 512 minus 2, or 510. A /24 provides only 254 usable and falls short, while a /22 works but wastes over 500 addresses, which matters when the space is being subnetted efficiently.

Answer: C
MAC addressing belongs to the data link layer, IP addressing to the network layer, and port numbers to the transport layer, which is why a device's forwarding basis identifies its layer. The mapping matters diagnostically, since determining which layer a fault occupies narrows the investigation immediately.

Answer: A
Trunking carries multiple VLANs on one physical link by tagging frames, which is what connects switches without requiring a separate cable per VLAN. Link aggregation is the separate feature combining ports for bandwidth, and Power over Ethernet is the unrelated capability delivering power to devices.

Answer: A
Without a baseline, a reported figure such as sixty percent utilization is uninterpretable, since it may be routine or unprecedented for that link. The baseline also supports capacity planning by showing the trend, and it must be refreshed after significant changes or it describes a network that no longer exists.

Answer: A
A /26 leaves six host bits, giving blocks of 64 addresses, so the boundaries fall at .0, .64, .128 and .192. The host at .100 sits in the second block, making the network address .64, the broadcast .127 and the usable range .65 through .126.

Answer: B
TCP's three-way handshake, sequencing and acknowledgment provide reliability at the cost of latency and overhead, which is why real-time voice and video prefer UDP where a late packet is worthless anyway. DNS queries also use UDP for speed, falling back to TCP for large responses and zone transfers.

Answer: A
Name resolution and address resolution are separate steps, and frames on a local segment are addressed by MAC regardless of the IP layer above. For an off-subnet destination the ARP resolution targets the default gateway's MAC rather than the destination's, which is a distinction that explains many connectivity symptoms.

Answer: A
Fibre carries light rather than electrical signals, so interference cannot induce noise on it, and it also exceeds copper's 100-metre Ethernet limit by a wide margin. Shielded twisted pair is the copper alternative in noisy environments, but it requires correct grounding to work and can perform worse than unshielded cable if that grounding is wrong.

Answer: D
The 2.4 GHz band's channels overlap, and only 1, 6 and 11 are sufficiently separated to avoid interfering, so adjacent channel numbers actively degrade each other. The 5 GHz band offers many more non-overlapping channels, which is the more fundamental remedy for a dense deployment.

Answer: A
Network address translation conserves public addresses and incidentally obscures internal topology, though it is an addressing mechanism rather than a security control. Inbound connections require explicit port forwarding precisely because the translation table is built from outbound flows, which is why NAT is often mistaken for a firewall.

Answer: B
Layer 2 frames have no time-to-live field, so a loop circulates broadcasts indefinitely and saturates the segment within seconds. Spanning tree builds a loop-free logical topology and reactivates blocked links when the active path fails, which is what makes physical redundancy safe at layer 2.

Answer: A
Aggregation presents multiple physical links as one logical link, providing both additional capacity and resilience without spanning tree blocking the redundant members. Individual flows are typically pinned to one member by a hashing algorithm, so a single conversation does not exceed the speed of one link despite the combined total.

Answer: A
Link-state protocols flood link information so every router holds the same topology database and runs a shortest-path calculation locally, which is why convergence is fast and loops are less likely. Distance-vector protocols pass their own tables to neighbours, converge more slowly and rely on mechanisms such as split horizon and hold-down timers to control loops.

Answer: A
Telnet's clear-text transmission means anyone able to observe the traffic obtains administrative credentials, and an internal network is not a safe assumption given insider access and lateral movement after a compromise. The same reasoning replaces SNMPv1 and v2c with SNMPv3 and HTTP management interfaces with HTTPS.

Answer: D
Port security operates on MAC addresses at layer 2, limiting how many devices may appear on a port and optionally pinning specific addresses, with violation actions such as shutting the port down. The naming causes frequent confusion, since it has nothing to do with transport-layer port numbers, which access control lists handle.

Answer: A
Enterprise mode delegates authentication to a RADIUS server, so credentials can be revoked individually without rekeying every device, which a shared passphrase cannot achieve. MAC filtering and SSID hiding are trivially bypassed since both MAC addresses and hidden SSIDs are observable in normal traffic.

Answer: A
Successful connection by IP proves the path, the routing and the destination service are all functioning, which isolates the fault to DNS. The next steps are checking the client's configured resolvers, the record's existence and correctness at the authoritative server, and whether a stale cached entry is being returned.

Answer: A
Traceroute maps the path and per-hop latency by sending packets with increasing time-to-live values, which shows where delay begins to accumulate. High latency at one intermediate hop that does not propagate to subsequent hops usually means that router deprioritized the probe response rather than indicating a genuine problem, which is a common misreading.

Answer: D
The scope of a fault points at the shared component whose reach matches it, so a whole floor failing while others work implicates that floor's switch or uplink. Checking individual cables and drivers would eventually find nothing while consuming the time the shared-component check resolves in minutes.

Answer: A
Output drops accompanying high utilization mean the transmit queue overflowed, which is congestion rather than error. Input errors and cyclic redundancy check failures indicate physical problems instead, and late collisions specifically suggest a duplex mismatch, so the counter type distinguishes the fault class.

Answer: A
Quality of service allocates scarce capacity rather than creating more, which is why it improves voice quality while file transfers slow accordingly. Marking must be applied consistently end to end, since a class honoured on one device and ignored on the next produces unpredictable behaviour that is harder to diagnose than no prioritization at all.

Answer: A
The two views answer different questions, one about how traffic moves and one about which cable runs where, and troubleshooting frequently requires both. A rack elevation and a cable run list complement the physical diagram, while an IP address management record complements the logical one.

Answer: A
On a network with high device turnover, long leases hold addresses for devices that left hours earlier, so shortening the lease recovers them. Lengthening leases suits stable environments where the same devices persist, which makes lease duration a decision about turnover rather than a universally correct value.

Answer: A
Reconstructing an incident from logs is impossible when timestamps across devices disagree by minutes, and certificate validity checks and time-based one-time passwords fail outright with sufficient drift. This makes NTP an operational dependency whose failure surfaces as a set of apparently unrelated problems.

Answer: D
Centralizing the control plane enables consistent policy and programmatic change across many devices, replacing per-device configuration. The controller becomes a critical dependency and a high-value target, which is the trade-off accepted in exchange for that consistency and automation.

Answer: A
The economics favour internet-based tunnels while the performance characteristics remain best-effort, which matters for latency-sensitive applications such as voice. Software-defined WAN approaches address this by using multiple links and steering traffic per application based on measured path quality.

Answer: A
Health checks make the distribution adaptive rather than blind, which is what converts load balancing into a fault-tolerance mechanism. Session persistence is the companion consideration, since applications holding state locally break when successive requests from one client reach different servers.

Answer: A
Certification measures parameters such as attenuation, crosstalk and length against the category standard, which a continuity tester cannot assess. Each of the other tools solves a different problem, and using a continuity check to accept a permanent link passes cables that will fail under load at full speed.

Answer: A
Packet captures routinely contain sensitive content and are subject to authorization and handling requirements. The capture point matters equally, since a switch forwards only relevant traffic to a given port, so a port mirror or tap is needed to see traffic between two other hosts.

Answer: A
Clients are configured with a single default gateway address, so redundancy requires that address to move between routers rather than clients being reconfigured. First-hop redundancy protocols provide exactly that through a shared virtual address, with one router active and another standing by to assume it.

Answer: C
Dual-stack avoids a flag-day cutover by letting both protocols coexist, at the cost of maintaining and securing two address plans and two sets of firewall rules simultaneously. Tunnelling encapsulates one protocol in the other and translation converts between them, each addressing a different migration constraint.

Answer: A
Segmentation constrains the blast radius of an intrusion, which is the difference between a compromised workstation and a compromised organization. It also reduces broadcast domain size and can bring a smaller set of systems into a compliance scope, but containment of lateral movement is the primary security rationale.

Answer: C
Link-local IPv6 addresses always fall within the fe80::/10 range and are generated automatically by every IPv6-capable interface for communication within the local link, independent of any external configuration. The fc00::/7 range is reserved for unique local addresses, which serve a different purpose and are not generated automatically the same way.

Answer: B
802.11a was defined to operate only in the 5 GHz band, unlike its contemporaries which used 2.4 GHz. Both 802.11b and 802.11g operate solely in the 2.4 GHz band, making them the opposite of what is being asked for.

Answer: A
Platform as a Service abstracts away the operating system and runtime so customers only need to focus on their application code and data. Infrastructure as a Service, by contrast, still requires the customer to manage the operating system and runtime themselves, which does not match the scenario described.

Answer: B
The transport layer breaks data into segments and uses source and destination port numbers to multiplex traffic from multiple applications over a single IP connection. The network layer only handles logical addressing and routing between networks, and does not track individual application sessions, which is why it is a poor fit despite being adjacent in the stack.

Answer: D
HTTPS is conventionally assigned to TCP port 443 and plain HTTP to TCP port 80, so a rule permitting 443 while blocking 80 achieves the stated goal. Port 22 is used for SSH and port 21 for FTP control, an unrelated pair of services that would not affect web traffic at all.

Answer: A
Four contiguous /24 networks together contain 1,024 addresses, which is exactly the size of a /22 block, so summarizing them into a single /22 route covers all four ranges precisely. A /23 only covers two /24 networks and a /21 covers eight, so neither matches the four-network requirement.

Answer: D
UDP is connectionless and does not retransmit lost data, which keeps latency low and is well suited to real-time voice where a late packet is less useful than a timely one. TCP guarantees delivery through retransmission and acknowledgments, but that reliability mechanism introduces delay that degrades real-time voice quality.

Answer: C
Assigning a switch virtual interface to each VLAN on a Layer 3 switch allows the switch itself to route between VLANs, a design known as inter-VLAN routing. Port mirroring only copies traffic to a monitoring port for analysis and has nothing to do with forwarding traffic between VLANs.

Answer: A
Single-mode fiber uses a narrow core and a laser light source, allowing it to carry signals for many kilometers without significant attenuation, making it suitable for long inter-building runs. Copper standards such as Category 6a are limited to a 100-meter maximum segment length, far short of the two-kilometer requirement.

Answer: D
PortFast is designed for edge ports connected to end hosts and lets the port bypass the normal STP listening and learning states, reaching forwarding almost immediately. BPDU guard is a complementary feature that disables a port if it receives BPDUs, but on its own it does not change how quickly the port begins forwarding.

Answer: A
In a controller-based architecture, lightweight access points depend on a central wireless controller for their configuration, channel planning, and policy enforcement, simplifying management at scale. Autonomous access points are configured and managed individually, which does not match a design driven from one central appliance.

Answer: C
When both ends of a cable are wired to the same standard, T568B on both ends in this case, the pin-outs match at each end and the result is a straight-through cable used to connect dissimilar devices such as a PC to a switch. A crossover cable instead requires one end wired to T568A and the other to T568B so that transmit and receive pairs are swapped.

Answer: D
Power over Ethernet delivers both data and electrical power over standard twisted-pair cabling, eliminating the need for a separate electrical run to devices like access points and cameras. QoS instead manages traffic prioritization and has no role in delivering electrical power to a device.

Answer: A
Syslog is the standard protocol devices use to send time-stamped log messages to a centralized collector, supporting long-term retention and cross-device correlation. NetFlow instead reports flow-level traffic statistics such as source, destination, and byte counts, not discrete event or error messages.

Answer: C
NetFlow exports detailed records for each traffic flow, including source and destination addresses, ports, and byte counts, giving administrators fine-grained insight into bandwidth consumption by application and host. SNMP polling typically reports interface-level counters like total utilization, but it does not break traffic down into individual flows.

Answer: B
Recovery Time Objective defines the maximum tolerable length of time a system can be down after a disruption before the outage causes unacceptable harm to the business. Recovery Point Objective instead measures how much data loss, in time, is acceptable, which addresses a different concern than how long the system can stay offline.

Answer: D
Testing a change in a staging environment that closely resembles production lets a team catch configuration or compatibility problems before they can affect live traffic, which is a core change-management practice for reducing risk. Rolling an untested update out to every production device at once removes this safety net and increases the chance of a widespread outage.

Answer: C
A change management log tracks the who, what, when, and why of every configuration change, which is exactly the information needed to support audits and roll back a problematic change. A wiring diagram instead documents physical cable runs and port connections, not the history of configuration changes over time.

Answer: A
Network Access Control evaluates a connecting device's identity and posture, such as patch level and antivirus status, before deciding whether to grant it network access, matching the described requirement. A VPN concentrator instead terminates remote-access tunnels and does not perform posture assessment for devices already on the local network.

Answer: B
MAC flooding deliberately exhausts a switch's MAC address table with bogus entries so that the switch can no longer make forwarding decisions and falls back to broadcasting frames out every port, which an attacker can then capture. ARP poisoning instead works by sending forged ARP replies to redirect traffic between two hosts, a different mechanism that does not involve exhausting the MAC address table.

Answer: C
A demilitarized zone is a network segment specifically designed to host public-facing services while isolating them from the internal network, exactly as described. A split-tunnel VPN instead describes how a remote client's traffic is routed between an internal tunnel and the open internet, which is unrelated to hosting a public server segment.

Answer: D
802.1X enforces authentication at the port level, requiring a supplicant to present credentials validated by a RADIUS server before the switch opens the port for normal traffic. MAC address filtering only checks a hardware address against an allow list, which can be spoofed and does not involve verifying credentials against a central authentication server.

Answer: A
An operating system's duplicate address warning is a direct signal that two devices are competing for the same IP address, which causes exactly the kind of simultaneous, intermittent connectivity loss described. A misconfigured VLAN would more likely cause complete and consistent isolation from certain resources rather than an intermittent conflict affecting two specific hosts together.

Answer: B
Asymmetric routing occurs when outbound and inbound traffic between two hosts travel over different paths, which can cause stateful devices such as firewalls along one path to drop return traffic they never saw the matching outbound request for, producing exactly this kind of intermittent application failure despite successful ping. DNS misconfiguration would typically prevent the hostname from resolving at all rather than allowing pings to succeed while only the application intermittently times out.

Answer: D
When one side of a link is forced to full duplex while the other is left on auto-negotiation, the auto-negotiating side typically falls back to half duplex, and the resulting mismatch produces late collisions and degraded throughput, matching the symptoms exactly. An incorrect subnet mask would instead cause hosts to be unable to reach certain addresses at all, not generate collision counters on a switch interface.

Answer: C
An unauthorized DHCP server handing out a bogus default gateway would cause exactly this pattern, internal traffic that does not need to leave the subnet keeps working while any traffic that must be routed off-subnet, such as internet access, fails because the assigned gateway is not a real router. A failed DNS server would instead prevent hostname resolution across the board rather than selectively breaking only traffic that needs to leave the local subnet.

Answer: B
Excessive attenuation, often from bends, dirty connectors, or a run exceeding its rated distance, weakens the optical signal below what the receiver needs for a stable link, producing exactly the intermittent drops and low power readings described. A VLAN mismatch would instead cause traffic to be dropped or misdirected at Layer 2 without affecting the physical optical power levels measured at the interface.