AP Networking CLI Command Output Troubleshooting Practice Test

1. nslookup only
2. net user
3. route delete
4. ipconfig /all

Correct answer: D. ipconfig /all

ipconfig /all reports local interface configuration. It does not by itself test whether the displayed gateway or resolver responds.

1. hostname only
2. net user
3. ipconfig /flushdns
4. route print

Correct answer: D. route print

route print shows route/interface information used to interpret destination paths. DNS cache flushing changes a different dependency.

1. route print only
2. tracert alone
3. nslookup
4. arp -a

Correct answer: D. arp -a

arp -a exposes IP-to-MAC entries. It is not a DNS-name lookup or a complete map of every host.

1. arp -a
2. ipconfig /release only
3. net user
4. nslookup

Correct answer: D. nslookup

nslookup asks a resolver for DNS information. The resulting address still needs a working application path.

1. ping
2. ipconfig /flushdns
3. route add alone
4. hostname

Correct answer: A. ping

Ping tests a specific ICMP exchange. It does not certify all service ports or all destinations.

1. ipconfig /renew alone
2. hostname
3. tracert
4. arp -a only

Correct answer: C. tracert

Tracert uses controlled probe lifetimes to reveal responding hops. Silent hops do not automatically prove forwarding failure.

1. ip address show
2. passwd
3. ss only
4. dig only

Correct answer: A. ip address show

ip address show exposes interface address state. Resolver and socket commands investigate other layers.

1. dig only
2. ip address flush
3. ip route show
4. hostname only

Correct answer: C. ip route show

ip route show identifies destination prefixes and next-hop information. A listed route still depends on usable neighbors and policy.

1. whoami
2. ss -ltn only
3. ip neigh show
4. dig

Correct answer: C. ip neigh show

Neighbor output describes local IP-to-link-layer relationships and state. It does not list every remote Internet host.

1. ip route show only
2. dig only
3. ss -ltn
4. ping -c 1 only

Correct answer: C. ss -ltn

A listening-socket view checks whether a process has a TCP endpoint. It does not alone show firewall permission or application readiness.

1. Only TCP window size
2. IPv4 address acquisition and its dependencies
3. Only a public DNS A record
4. Only server disk space

Correct answer: B. IPv4 address acquisition and its dependencies

An automatic link-local address suggests normal DHCP assignment did not complete. Use further evidence to locate the cause.

1. Every route is healthy
2. The server's HTTPS listener works
3. The user is authorized in the app
4. The queried resolver returned that address for that name

Correct answer: D. The queried resolver returned that address for that name

Resolution is one stage. Verify the returned address is intended, then test transport and application behavior separately.

1. The switch cable path
2. The remote server return route
3. The DHCP server
4. The local host's IP-stack response

Correct answer: D. The local host's IP-stack response

Loopback traffic stays on the host. External link and service dependencies remain untested.

1. The site's HTML title
2. The public certificate chain
3. Local link connection and enabled interface/port state
4. Remote DNS TTL

Correct answer: C. Local link connection and enabled interface/port state

The observation places the first investigation at local physical/link state. Higher-layer tests come after a usable attachment.

1. Only the technician's favorite tool
2. Only a screenshot color
3. Only the browser zoom
4. Time, source device/interface, destination, and command context

Correct answer: D. Time, source device/interface, destination, and command context

Context defines which path and moment the evidence represents. Similar-looking output from another device may answer a different question.

1. Every client can reach that address
2. That source completed an ICMP exchange with that address in the test
3. DNS is always correct
4. All school services work

Correct answer: B. That source completed an ICMP exchange with that address in the test

Tests are source-, destination-, protocol-, and time-specific. Avoid generalizing one reply to the whole network.

1. It can reduce a stated uncertainty
2. It is the longest command available
3. It appears first alphabetically
4. It always repairs the network

Correct answer: A. It can reduce a stated uncertainty

Choose a tool based on the boundary being tested. Collecting unrelated output without a hypothesis does not produce a diagnosis.

1. A fallback next hop for matching off-link traffic without a more specific route
2. The DNS authoritative server
3. The cable's rated speed
4. Every application's password

Correct answer: A. A fallback next hop for matching off-link traffic without a more specific route

The default route specifies forwarding selection. It cannot demonstrate downstream reachability on its own.

1. The remote server listener
2. The Ethernet cable
3. The installed default route
4. Locally cached name-resolution data

Correct answer: D. Locally cached name-resolution data

A cache operation is relevant to cached-name issues. It does not repair unrelated link, routing, or application failures.

1. Lease configuration through DHCP
2. All public DNS records
3. The browser TLS trust store
4. Every switch's VLAN table

Correct answer: A. Lease configuration through DHCP

Renewal asks for address configuration. It is not a universal repair and should be tied to an allocation problem.

1. That the intended gateway and service path work
2. That the interface has some address state
3. That output was produced
4. That the address is configured

Correct answer: A. That the intended gateway and service path work

Configured values are not successful network exchanges. Test relevant reachability and correct membership.

1. No usable reply was observed within that test window
2. The name definitely does not exist
3. The gateway is definitely wrong
4. The resolver definitely has no power

Correct answer: A. No usable reply was observed within that test window

A timeout differs from a negative response. Further tests distinguish path, filtering, server, and observation issues.

1. Claiming every service on that host works
2. Comparing another required port
3. Checking application response next
4. Recording the tested port

Correct answer: A. Claiming every service on that host works

A successful transport test is port-specific. Other listeners and policies can differ.

1. To find mismatches rather than assuming configured values are correct
2. To eliminate all packet captures
3. To make every command authoritative
4. To avoid testing the real symptom

Correct answer: A. To find mismatches rather than assuming configured values are correct

A plausible-looking address or resolver can still be wrong for the intended VLAN or workload.

1. Only if the hostname is short
2. No; the inference still must fit its scope
3. Yes; every output proves the whole network
4. Yes; all commands show every layer

Correct answer: B. No; the inference still must fit its scope

Tool safety and evidence quality are separate issues. Read-only output can still be overinterpreted.

1. Gateway lies outside the ordinary local /25
2. The mask is /24
3. The host is broadcast
4. The address is public multicast

Correct answer: A. Gateway lies outside the ordinary local /25

The host belongs to .128–.255, excluding .1. Verify the intended host/gateway subnet design.

1. A random larger subnet
2. All switch power supplies
3. The exact name and configured resolver path
4. The entire Ethernet cable plant

Correct answer: C. The exact name and configured resolver path

The tested numeric paths worked. The remaining observed failure is name-dependent, so resolver evidence is more targeted.

1. Name existence only
2. DHCP address count only
3. MAC vendor registration
4. Transport/service reachability and policy

Correct answer: D. Transport/service reachability and policy

Resolution succeeded for that query. Test the port path and service rather than assuming another lookup will fix it.

1. The larger metric automatically chooses LAN across prefixes
2. DNS overrides the route
3. The more specific host route can select the old VPN
4. The default always wins

Correct answer: C. The more specific host route can select the old VPN

A host route matches exactly one address and is more specific than default. Check whether it is installed and usable.

1. No; it concerns a local neighbor mapping
2. Only if the MAC is uppercase
3. Yes; ARP contains DNS records
4. Yes; all downstream routers are in the cache

Correct answer: A. No; it concerns a local neighbor mapping

ARP state supports local-link delivery knowledge. It cannot certify downstream routes, policies, or remote services.

1. Only DNS TTL
2. Only the client's DHCP scope
3. Only the WAN subscription
4. The service is bound only to loopback rather than the intended reachable interface

Correct answer: D. The service is bound only to loopback rather than the intended reachable interface

Loopback binding limits where the listener accepts connections. Adjust the intended service binding and policy under the application design.

1. A larger prefix
2. A TCP password
3. Successful neighbor address resolution
4. A DNS MX answer

Correct answer: C. Successful neighbor address resolution

The local neighbor's link-layer information has not been resolved. Check attachment, addressing, gateway presence, and relevant exchange.

1. DNS must be broken
2. All silent routers are down
3. The trace failed end to end
4. Some intermediate probe responses are absent while the tested destination remains reachable

Correct answer: D. Some intermediate probe responses are absent while the tested destination remains reachable

The final response disproves a universal forwarding failure at the first silent hop. Probe response behavior varies.

1. Only the PC hostname
2. The effective route lookup and selected interface
3. Only the DNS suffix
4. Only one interface's link LED

Correct answer: B. The effective route lookup and selected interface

Multiple interfaces complicate source/path selection. Read actual routing state instead of assuming the cable in use supplies every path.

1. Server's disk capacity only
2. PoE allocation
3. Switch port duplex only
4. Search suffix and actual expanded query

Correct answer: D. Search suffix and actual expanded query

Short-name resolution can depend on suffix expansion. Verify the queried name before diagnosing a missing full-name record.

1. Only AP channel utilization
2. Only address-pool exhaustion
3. Only DNS spelling despite an explicit IP
4. The responding endpoint/policy and listener state

Correct answer: D. The responding endpoint/policy and listener state

An explicit refusal differs from silence. Confirm the source of the response and whether the intended service listens there.

1. The service response is impossible
2. ICMP may be restricted while the required service works
3. The gateway must be wrong
4. All IP forwarding is down

Correct answer: B. ICMP may be restricted while the required service works

Protocol-specific observations can differ. Use the actual workload to assess application availability.

1. Only the longest DNS name
2. Only screenshot resolution
3. Only device manufacturer
4. The active interface and effective path for the test

Correct answer: D. The active interface and effective path for the test

Evidence from an inactive adapter may not explain the observed connection. Map configuration to the actual path.

1. A TCP connection reached that state
2. The user completed the desired application task
3. Endpoints participated in setup
4. Some transport exchange succeeded

Correct answer: B. The user completed the desired application task

Transport state is not application success. Login, permissions, data transfer, and service logic are later dependencies.

1. Repeat under comparable load and inspect where end-to-end delay appears
2. Assume the local cable is broken
3. Rename the resolver
4. Change all IPs immediately

Correct answer: A. Repeat under comparable load and inspect where end-to-end delay appears

A low local delay and high remote delay identify different tested scopes. Load and path evidence help narrow the additional delay.

1. Newly installed prefixes, metrics, and policy routing where applicable
2. Only the local MAC vendor
3. Only DNS answer order
4. Only fiber wavelength

Correct answer: A. Newly installed prefixes, metrics, and policy routing where applicable

The state change and selected path support a routing lead. Confirm specific installed routes before editing random interfaces.

1. Only TLS certificate age
2. Assume every change proves malicious spoofing
3. Authorized ownership, redundancy behavior, and possible conflict
4. Only DNS A record expiry

Correct answer: C. Authorized ownership, redundancy behavior, and possible conflict

Changes can reflect conflict, attacks, or legitimate failover. Correlate actual identities and topology before assigning cause.

1. Assume all remote clients are authorized
2. Delete the default route
3. The actual client-to-service path and effective policy
4. Change every DNS server

Correct answer: C. The actual client-to-service path and effective policy

Wildcard listening is endpoint evidence, not proof that filtering or application authorization allows every remote source.

1. Which resolver/name path the application actually uses
2. Only route prefix count
3. Only DHCP lease length
4. Only the Ethernet category

Correct answer: A. Which resolver/name path the application actually uses

Applications may use caches or different resolver mechanisms. A command-line success does not prove identical application behavior.

1. The small sample may not characterize the full pattern
2. No larger measurement can help
3. Four packets prove a permanent exact loss rate
4. Every loss proves cable damage

Correct answer: A. The small sample may not characterize the full pattern

Sampling and timing matter. Use a suitable longer controlled test and compare it with the user's symptom.

1. Only the DHCP server's pool size
2. Only the subnet broadcast
3. Only the AP power budget
4. Both operating-system and application resolution paths

Correct answer: D. Both operating-system and application resolution paths

The app may bypass the displayed resolver. Check actual behavior before treating the lease option as proof of browser resolution.

1. Which device generated the message and its reason/context
2. Every unreachable proves the server is off
3. The cable definitely lacks power
4. The name definitely does not exist

Correct answer: A. Which device generated the message and its reason/context

The reporting source helps locate the failed decision, but the exact reason and path still matter.

1. Only DHCP reservations for staff
2. Only a longer hostname
3. A test from the affected client/source context
4. Only more router screenshots

Correct answer: C. A test from the affected client/source context

Source-specific routes and policy can differ. The router's own trace does not reproduce the guest flow.

1. Every server password
2. Every public DNS zone
3. The original required service and intended access restrictions
4. Only the new IP's appearance

Correct answer: C. The original required service and intended access restrictions

Configuration correction needs outcome verification. Confirm both required functionality and the intended network boundary.

1. Returned address and intended service identity
2. Only the link LED
3. Only IPv4 address length
4. Only TCP retry count

Correct answer: A. Returned address and intended service identity

The comparison changes the actual destination. Check the resolver view/record before interpreting it as identical path behavior.

1. Radio association failure
2. DHCP absence
3. The service-specific policy decision
4. DNS name absence

Correct answer: C. The service-specific policy decision

Addressing, gateway exchange, and name resolution have supporting evidence. The denial is a specific observation for the failing connection.

1. DNS decides the next hop
2. The installed /16 is the more specific match
3. The lower /8 metric always wins
4. The routes prove the server returns traffic

Correct answer: B. The installed /16 is the more specific match

Prefix matching precedes comparing paths for the same prefix context. Selection still does not prove end-to-end delivery.

1. Only the resolver's TTL
2. Only unrelated ARP entries
3. Only the client's hostname
4. Server listener state and whether/where its response leaves

Correct answer: D. Server listener state and whether/where its response leaves

Request arrival establishes one direction to that point. Examine endpoint response and the return path to locate the next missing stage.

1. Listener binding excludes the intended remote interface
2. DHCP must be exhausted
3. DNS is universally down
4. The allow rule proves remote service health

Correct answer: A. Listener binding excludes the intended remote interface

The local loopback success and binding explain why remote reachability is unproven. Correct the approved bind and verify the real path.

1. Only the hostname command
2. Only the Ethernet LED
3. Only ipconfig's DNS list
4. The effective route lookup for that destination

Correct answer: D. The effective route lookup for that destination

Interface configuration does not show every override. A matching specific route can redirect the destination.

1. The ping provides new evidence
2. The stale label alone proved the gateway was down
3. State can refresh during use
4. Neighbor cache states need context

Correct answer: B. The stale label alone proved the gateway was down

STALE is a cache-state condition, not a definitive outage. Observe actual resolution/reachability behavior.

1. Destination/service while comparing the selected source/interface path
2. Change interface, server, credentials, and time together
3. Only the device name
4. Only screenshot color

Correct answer: A. Destination/service while comparing the selected source/interface path

Holding the target fixed helps isolate path/configuration differences. Multiple uncontrolled changes weaken attribution.

1. Replace all patch cables without further evidence
2. Delete DNS records
3. Assume every network dependency is proven healthy
4. Application behavior and packet flow after setup, including possible size/path issues

Correct answer: D. Application behavior and packet flow after setup, including possible size/path issues

Handshake success establishes initial transport exchange, not reliable delivery of every later payload or successful application processing.

1. More measurements can refine the path
2. Probe processing may differ
3. The destination result matters
4. That it adds the same delay to all transit traffic

Correct answer: D. That it adds the same delay to all transit traffic

Intermediate control-plane response time is not necessarily transit-forwarding delay. Use continuing end-to-end evidence.

1. Only gateway metric
2. Only DHCP pool size
3. Certificate chain, server identity, and client clock/trust state
4. Only ARP cache deletion

Correct answer: C. Certificate chain, server identity, and client clock/trust state

The failure occurs after resolution and transport setup. Inspect the security negotiation rather than restarting unrelated address services.

1. The client is broadcast
2. A /25 includes all .2 addresses
3. The gateway is outside the ordinary local subnet and configuration must be checked
4. Every ARP retry proves DNS is down

Correct answer: C. The gateway is outside the ordinary local subnet and configuration must be checked

The /25 containing .200 starts at .128. Compare intended configuration and any special routing design rather than treating the values as an ordinary valid gateway pair.

1. TCP has no sequencing
2. Timestamp order across captures may not represent true event order
3. Packet addresses become unreliable automatically
4. DNS timestamps repair clocks

Correct answer: B. Timestamp order across captures may not represent true event order

Clock differences can distort cross-device timing. Correlate transaction/sequence identifiers and synchronize observation context.

1. Resolver context matters
2. The public query received a negative answer
3. The approved internal resolver cannot resolve the name
4. The exact query should be recorded

Correct answer: C. The approved internal resolver cannot resolve the name

Internal namespace views can differ. Test the resolver intended for that client before declaring universal name absence.

1. Source-specific firewall and return-route state for that subnet
2. Only the cable label
3. Only the client's monitor resolution
4. Only the server hostname

Correct answer: A. Source-specific firewall and return-route state for that subnet

The comparative failure is source-dependent. Listener existence plus ICMP success still leaves traffic policy and reply path differences.

1. Time-aligned configuration and test evidence
2. Only another DNS alias
3. Only a larger screenshot
4. Only a new hostname

Correct answer: A. Time-aligned configuration and test evidence

Current state cannot explain historical forwarding without the state at that time. Align evidence to the failure event.

1. The switch had no VLANs
2. An empty cache proves no devices exist
3. The cache was rebuilt through normal neighbor resolution
4. DNS created all MACs

Correct answer: C. The cache was rebuilt through normal neighbor resolution

Caches need not be prepopulated. Observe the resolution exchange rather than interpreting emptiness as a complete topology inventory.

1. The private configuration is necessarily false
2. DNS changed the client's NIC
3. NAT/proxy path and the observation point
4. TCP converted IPv4 to IPv6

Correct answer: C. NAT/proxy path and the observation point

Different points can legitimately see translated or proxied flows. Map the path before comparing addresses as if they were observed at the same stage.

1. Only the client's Ethernet rate
2. Which cache/resolver answered and its remaining validity/context
3. Only server CPU count
4. Only IP TTL

Correct answer: B. Which cache/resolver answered and its remaining validity/context

The difference is name-state evidence. Identify the answering layer instead of attributing it to a generic cable fault.

1. Increase every DNS TTL
2. Disable all IPv6 without evidence
3. Replace the gateway first
4. Test each intended address and its listener/path separately

Correct answer: D. Test each intended address and its listener/path separately

The destination choice varies across attempts. Family- or host-specific comparison can isolate the failing member.

1. That service can work without a default if a usable matching route exists
2. A private host cannot route
3. DNS creates a default invisibly
4. Every remote destination requires /0

Correct answer: A. That service can work without a default if a usable matching route exists

Default is a fallback, not a requirement when a usable more specific route matches. Other destinations may still fail.

1. Every MAC change is malicious
2. Whether the change fits the configured redundancy mechanism rather than an address conflict
3. DNS must have failed
4. The subnet mask must change

Correct answer: B. Whether the change fits the configured redundancy mechanism rather than an address conflict

Gateway redundancy can change neighbor observations legitimately. Correlate with design, ownership, timing, and traffic symptoms.

1. Observe the interface actually carrying the tested flow
2. Flush every DNS cache
3. Replace the switch immediately
4. Change all server policies

Correct answer: A. Observe the interface actually carrying the tested flow

A misplaced observation point cannot establish packet absence on the real path. Confirm interface and routing selection first.

1. Only link speed
2. Only Wi-Fi channel number
3. Only route count
4. Actual resolver paths, caches, and queried names in both applications

Correct answer: D. Actual resolver paths, caches, and queried names in both applications

Both outputs can be real yet describe different resolution contexts. Diagnose the browser's path explicitly.

1. The revised setup supports that ICMP exchange, without isolating which change fixed it
2. The cable alone was faulty
3. The gateway alone was faulty
4. DNS was definitely the cause

Correct answer: A. The revised setup supports that ICMP exchange, without isolating which change fixed it

The result verifies a bounded outcome after a combined change. Attribution needs controlled comparisons.

1. Only another loopback ping
2. Only the gateway MAC vendor
3. Only the interface address text
4. The original source-to-server SSH path and relevant authorization

Correct answer: D. The original source-to-server SSH path and relevant authorization

Repair verification must reproduce the user's task. A local ICMP result does not establish remote TCP 22 or application identity.