AP Networking DNS, DHCP, and Protocols Practice Test

1. Repairing a cable
2. Selecting every router's next hop
3. Providing Ethernet power
4. Resolving a hostname to records such as an IP address

Correct answer: D. Resolving a hostname to records such as an IP address

DNS answers name queries. A resolved address still needs a usable network path and application service.

1. A routing protocol between ISPs
2. An IPv4 lease and configuration options
3. A web certificate for every site
4. An Ethernet cable

Correct answer: B. An IPv4 lease and configuration options

DHCP can deliver address, mask, gateway, and resolver settings. It does not prove those settings are correct merely because a lease exists.

1. TCP FIN
2. DHCPACK
3. DHCPDISCOVER
4. DNS ANSWER

Correct answer: C. DHCPDISCOVER

The initial DORA sequence begins with Discover, followed by Offer, Request, and Acknowledgment.

1. ARP reply
2. DHCPDISCOVER
3. DHCPOFFER
4. HTTP GET

Correct answer: C. DHCPOFFER

A server offers a proposed lease. The client then requests its chosen offer before an acknowledgment completes normal allocation.

1. DNS NXDOMAIN
2. TCP RST
3. DHCPDISCOVER
4. DHCPACK

Correct answer: D. DHCPACK

An acknowledgment confirms the approved lease configuration. An offer alone does not complete the usual initial exchange.

1. UDP server 67 and client 68
2. TCP 443 and 80
3. TCP 22 and 23
4. UDP 53 and 123

Correct answer: A. UDP server 67 and client 68

DHCPv4 commonly uses server UDP 67 and client UDP 68. DHCPv6 uses a different port pair.

1. 22
2. 3389
3. 53
4. 25

Correct answer: C. 53

Conventional DNS uses port 53, over UDP or TCP depending on the exchange. Encrypted DNS variants use other transports/ports.

1. MX
2. A
3. AAAA
4. PTR

Correct answer: B. A

An A record contains an IPv4 address. AAAA contains an IPv6 address.

1. TXT only
2. AAAA
3. MX
4. A

Correct answer: B. AAAA

AAAA records represent IPv6 addresses. The record type is separate from the transport used for the DNS query.

1. A
2. PTR
3. CNAME
4. SOA serial only

Correct answer: C. CNAME

A CNAME points to a canonical name rather than directly storing an address. Resolution may follow that target.

1. PTR
2. CNAME only
3. MX
4. AAAA only

Correct answer: A. PTR

PTR records are used in reverse-name zones. A missing reverse record does not automatically break forward lookup.

1. route print only
2. Cable toner
3. arp -a only
4. nslookup

Correct answer: D. nslookup

nslookup queries DNS and shows response information. Route and ARP tools investigate different dependencies.

1. How many hosts fit a subnet
2. How long Ethernet cable may be
3. How many routers an IP packet may cross
4. How long a record may be cached

Correct answer: D. How long a record may be cached

DNS TTL is cache lifetime in seconds. IP TTL is a separate packet-lifetime field.

1. Only subnet capacity
2. Only physical link loss
3. Only PoE budget
4. Name resolution

Correct answer: D. Name resolution

IP reachability narrows the name-dependent symptom toward DNS or local name configuration. Test the actual queried name and resolver.

1. A switch VLAN tag
2. A DNS alias
3. A permanent optical channel
4. A time-limited allocation of address configuration

Correct answer: D. A time-limited allocation of address configuration

A lease grants configuration for a duration and is renewed according to protocol rules. It is not necessarily permanent.

1. Converts DNS names to MACs
2. Replaces the default route
3. Encrypts all Ethernet frames
4. Forwards DHCP messages between client networks and a server

Correct answer: D. Forwards DHCP messages between client networks and a server

Relays allow centralized servers to serve clients across routed boundaries where ordinary broadcasts are not forwarded.

1. Providing the fastest gateway
2. Forwarding every Ethernet frame
3. Assigning all client IPs
4. Answering from the zone data it serves

Correct answer: D. Answering from the zone data it serves

Authoritative service concerns owned zone records. Recursive resolvers obtain and cache answers for clients.

1. Supply a switch port's power
2. Replace the website application
3. Change every subnet mask
4. Find an answer on the client's behalf and cache it as appropriate

Correct answer: D. Find an answer on the client's behalf and cache it as appropriate

A recursive resolver performs name-resolution work for the client. The destination service remains a separate dependency.

1. TCP 443
2. UDP 123
3. TCP 22
4. UDP 67

Correct answer: A. TCP 443

HTTPS commonly uses TCP 443, with HTTP/3 often using QUIC over UDP 443. Port observations need protocol context.

1. TCP 25
2. UDP 68
3. TCP 22
4. UDP 53

Correct answer: C. TCP 22

SSH commonly uses TCP 22 for secure remote access. DNS and DHCP ports serve different purposes.

1. Resolving MAC addresses
2. Testing cable pairs
3. Time synchronization
4. Assigning VLANs

Correct answer: C. Time synchronization

NTP synchronizes clocks, commonly using UDP 123. Accurate time also matters for logs and some security mechanisms.

1. DHCPACK
2. FIN
3. SYN
4. DNS MX

Correct answer: C. SYN

A normal active TCP opening starts with SYN, then SYN-ACK, then ACK. Application data is a later stage.

1. UDP has no TCP-style connection handshake or built-in reliable ordered delivery
2. UDP never uses ports
3. TCP never retransmits
4. UDP always encrypts data

Correct answer: A. UDP has no TCP-style connection handshake or built-in reliable ordered delivery

UDP provides datagrams without TCP's ordered stream machinery. Applications can add their own reliability.

1. The Ethernet link is always down
2. The queried name does not exist according to the response
3. The requested IP is a broadcast
4. Every DNS server is unreachable

Correct answer: B. The queried name does not exist according to the response

NXDOMAIN is an actual negative DNS response, unlike a timeout. Confirm the exact name and answering resolver.

1. Every local frame is blocked
2. IP-based access works while hostname-based access fails
3. The address becomes a MAC
4. The NIC necessarily loses link

Correct answer: B. IP-based access works while hostname-based access fails

Addressing and resolution are separate dependencies. A valid lease can still contain an incorrect resolver option.

1. Whether the client receives and accepts the offer
2. Authoritative DNS zone transfer first
3. Changing all WAN routes
4. Replacing the server certificate

Correct answer: A. Whether the client receives and accepts the offer

The server generated an offer, but the next expected client action is missing. Capture at the client to distinguish delivery from client behavior.

1. Change the client's DNS suffix only
2. Check available lease space, exclusions, and scope sizing
3. Replace every cable
4. Disable all VLANs

Correct answer: B. Check available lease space, exclusions, and scope sizing

The server sees discovery but cannot allocate from the exhausted pool. Correct allocation capacity rather than unrelated dependencies.

1. Only HTTPS certificates
2. Only the DNS A record
3. The DHCP scope's gateway configuration
4. Only switch MAC aging

Correct answer: C. The DHCP scope's gateway configuration

A completed lease exchange can deliver wrong options. Validate the contents, not just the presence of ACK.

1. Renew DHCP repeatedly
2. Test TCP 443 reachability and server/policy state
3. Increase DNS TTL blindly
4. Assume DNS failed

Correct answer: B. Test TCP 443 reachability and server/policy state

Resolution succeeded for that query. Network path, transport, filtering, and service health still need evidence.

1. Only DHCP address count
2. Only Ethernet category
3. Only the website's disk capacity
4. Reachability or service health of the configured resolver

Correct answer: D. Reachability or service health of the configured resolver

The comparison isolates resolver-specific behavior. Verify policy and whether different resolvers are meant to provide different views.

1. DHCP assigns DNS records directly to every browser
2. IP TTL forwarding
3. Positive DNS caching
4. STP convergence alone

Correct answer: C. Positive DNS caching

A resolver or client may reuse an unexpired cached answer. Check the cache layer and returned TTL before declaring the authoritative update failed.

1. DNS search suffix and the exact expanded query
2. The cable's pair order only
3. The WAN bandwidth only
4. The DHCP pool size only

Correct answer: A. DNS search suffix and the exact expanded query

Short-name expansion depends on suffix configuration. Observe which full name is actually queried.

1. The gateway is down
2. The client has no IP
3. Forward DNS must also be broken
4. The reverse PTR data may be missing without invalidating the forward record

Correct answer: D. The reverse PTR data may be missing without invalidating the forward record

Forward and reverse zones are separate data. Diagnose the operation that actually fails.

1. Only the Wi-Fi SSID text
2. Only DNS TXT records
3. VLAN 20 relay configuration and path to the server
4. Only the clients' browser homepages

Correct answer: C. VLAN 20 relay configuration and path to the server

Routed client networks need an appropriate relay/server path and scope. A working different VLAN does not prove VLAN 20 is configured.

1. SOA serial alone
2. MX alone
3. PTR alone
4. AAAA plus the IPv6 path and service

Correct answer: D. AAAA plus the IPv6 path and service

AAAA supplies an IPv6 address, but a correct record still needs working IPv6 connectivity and service.

1. It is identical to a successful A answer
2. It proves the physical cable is broken
3. A response reports resolution failure rather than no reply being observed
4. It proves the queried name does not exist

Correct answer: C. A response reports resolution failure rather than no reply being observed

SERVFAIL means the responding server could not complete the operation. Investigate upstream, validation, or server issues rather than equating it with NXDOMAIN.

1. Clients always merge both offers safely
2. DNS chooses the only legal offer
3. Clients may receive inconsistent configuration depending on the accepted offer
4. The switch blocks every DHCP message automatically

Correct answer: C. Clients may receive inconsistent configuration depending on the accepted offer

Uncoordinated servers can produce inconsistent options. Identify authorized servers and scope design.

1. The subnet mask expands automatically
2. DHCP renews the record
3. All DNS always works over UDP only
4. A retry over TCP may fail even though some UDP DNS queries work

Correct answer: D. A retry over TCP may fail even though some UDP DNS queries work

Conventional DNS supports TCP, including retries after truncation. Policy allowing only UDP 53 can create selective failures.

1. The DNS service and its transport policy are working
2. The tested destination was reachable for ICMP
3. The server IP replied to ICMP
4. An IP exchange happened

Correct answer: A. The DNS service and its transport policy are working

ICMP reachability is not a DNS application test. Check UDP/TCP 53 and service behavior explicitly.

1. Only the provider speed
2. Only the DNS TTL
3. Only the user's password length
4. SSID-to-VLAN mapping and the associated DHCP scope/relay

Correct answer: D. SSID-to-VLAN mapping and the associated DHCP scope/relay

Client broadcast-domain placement determines which scope is appropriate. The mapping change is relevant causal evidence.

1. DHCPv4 ACK only
2. SSH on TCP 22 only
3. HTTP/3 attempts, with possible fallback depending on the client/server
4. All HTTPS necessarily becomes impossible

Correct answer: C. HTTP/3 attempts, with possible fallback depending on the client/server

HTTP/3 uses QUIC over UDP, commonly 443. TCP-based HTTPS may remain available; fallback behavior is implementation dependent.

1. Its VLAN necessarily changed
2. Its MAC necessarily changed
3. Its DNS zone became authoritative
4. Its lease timing may be extended without changing the IP

Correct answer: D. Its lease timing may be extended without changing the IP

Renewal can retain configuration while extending lease validity. It does not require moving the endpoint.

1. The TCP connection setup
2. The TLS trust check necessarily
3. The application login necessarily
4. Every DNS query necessarily

Correct answer: A. The TCP connection setup

The three-way handshake completed, but TLS and application processing are later stages. Diagnose the specific subsequent error.

1. No packets returned
2. The observed endpoint/path returned an explicit rejection/reset
3. DHCP denied a lease
4. DNS necessarily failed

Correct answer: B. The observed endpoint/path returned an explicit rejection/reset

A reset is an active response. Verify who generated it and whether the service is listening or policy rejects the connection.

1. Only DNS TTL
2. The identifier sent by the client and the reservation key
3. Only the server hostname
4. Only optical power

Correct answer: B. The identifier sent by the client and the reservation key

DHCP allocation identity must match the reservation design. MAC randomization or other identifiers can affect matching.

1. The DHCP port numbers
2. The client's cable speed
3. The LAN broadcast address
4. The alias target or the target's required records

Correct answer: D. The alias target or the target's required records

Following the alias still requires valid target resolution. A syntactically valid CNAME does not guarantee a usable address answer.

1. The requested configuration is not valid for the current network
2. A valid DNS answer
3. A successful lease extension
4. A completed TCP handshake

Correct answer: A. The requested configuration is not valid for the current network

A negative acknowledgment rejects the request. The client must obtain appropriate configuration for its current network.

1. No; an unexpired cached answer may be reused
2. No; applications never resolve names
3. Yes; DNS caches cannot exist
4. Yes; every TCP SYN contains DNS

Correct answer: A. No; an unexpired cached answer may be reused

Caching reduces repeated lookups. Absence of a new query does not prove name resolution was skipped or broken.

1. Only the Internet subscription
2. Overlapping static assignments, reservations, and active ownership
3. Only DNS MX records
4. Only the browser cache

Correct answer: B. Overlapping static assignments, reservations, and active ownership

Successful allocation does not prove no other device uses that address. Confirm actual ownership and allocation coordination.

1. A duplicate MAC necessarily
2. An intentional split-DNS design and expected client location
3. An invalid IPv4 mask
4. DNS always has one worldwide answer

Correct answer: B. An intentional split-DNS design and expected client location

Different views can be intentional for internal services. Compare the requested name, resolver, and intended audience.

1. Only PoE budget
2. Only gateway ARP state
3. Cache age and TTL at the client/recursive layers
4. Only the access cable length

Correct answer: C. Cache age and TTL at the client/recursive layers

The discrepancy is between authoritative data and cached answers. Inspect which layer serves the stale answer and its remaining lifetime.

1. The printer's TCP port only
2. DNS search order only
3. HTTP proxy only
4. Relay interface/network selection and matching scope configuration

Correct answer: D. Relay interface/network selection and matching scope configuration

The relay's network information helps the server choose a scope. Wrong identification can deliver configuration for the wrong client network.

1. DNS rejected the ACK
2. The client received a valid lease
3. The server has no addresses
4. The return delivery path or intervening policy needs investigation

Correct answer: D. The return delivery path or intervening policy needs investigation

Server transmission is not proof of client receipt. Trace the relay/VLAN/policy path between observation points.

1. Delete the authoritative DNS zone
2. Accept whichever offer arrives first without review
3. Increase all lease times
4. Identify and contain the unauthorized DHCP source using the approved network policy

Correct answer: D. Identify and contain the unauthorized DHCP source using the approved network policy

The offered options create a concrete redirection risk. Confirm server authorization and use scoped controls rather than disabling the whole network blindly.

1. Family-specific reachability, policy, and service behavior
2. Only whether the A record exists
3. Only Ethernet link LEDs
4. Only DHCPv4 lease length

Correct answer: A. Family-specific reachability, policy, and service behavior

Name resolution can be correct for both families while one path fails. Test each returned address and transport separately.

1. Resolver choice matters
2. The school's DNS answer must be invalid
3. Public DNS may lack internal data
4. The name may exist only in an internal view

Correct answer: B. The school's DNS answer must be invalid

Split DNS can intentionally expose internal records only inside the organization. Verify expected design before overriding resolvers.

1. PoE negotiation
2. IP TTL expiration
3. MAC aging
4. Negative DNS caching

Correct answer: D. Negative DNS caching

Negative responses can be cached according to DNS rules. Creating the record does not instantly erase every previously cached negative response.

1. Only DHCP UDP 68
2. Only HTTPS TCP 443
3. Whether the DNS TCP retry path is allowed
4. Only ICMP broadcast rules

Correct answer: C. Whether the DNS TCP retry path is allowed

The evidence distinguishes ordinary UDP replies from the required TCP fallback. Test both conventional DNS transports.

1. Only the IP subnet count
2. Only switch port speed
3. Only server PoE usage
4. Application resolver behavior versus operating-system resolver behavior

Correct answer: D. Application resolver behavior versus operating-system resolver behavior

Applications can choose a separate resolution path. An OS-level lookup does not prove the browser consulted the same internal resolver.

1. Only DHCP pool exhaustion
2. Only cable continuity
3. Only VLAN names
4. The returned address, intended hostname, and TLS certificate served

Correct answer: D. The returned address, intended hostname, and TLS certificate served

Resolution may return an unintended destination, or the server may serve the wrong certificate. The TLS mismatch alone does not locate the fault in DNS.

1. The server cannot be exhausted if one host works
2. Every existing client has become static
3. DNS reserves infinite IPs
4. Existing valid allocations can continue while no new lease is available

Correct answer: D. Existing valid allocations can continue while no new lease is available

Pool exhaustion affects new allocation differently from already valid leases. Check renewals, abandoned leases, exclusions, and capacity.

1. No server ever sees Discover
2. DNS automatically supplies the lease
3. The client gains a valid gateway from ICMP
4. Discover reaches the server while client allocation never completes

Correct answer: D. Discover reaches the server while client allocation never completes

DHCP requires both message directions. A one-way forwarding observation does not prove the full DORA exchange can finish.

1. Physical cable continuity
2. DHCP allocation
3. Application authorization or access policy
4. Name-resolution absence

Correct answer: C. Application authorization or access policy

The earlier stages succeeded in the observed exchange. HTTP 403 is an application response that directs attention to authorization/policy.

1. Only switch MAC aging
2. Resolver view, queried name, and intended split-DNS records
3. Only UPS runtime
4. Only cable category

Correct answer: B. Resolver view, queried name, and intended split-DNS records

The answer may be wrong for the client's context. Fix the resolution/design mismatch rather than routing blindly to an unintended endpoint.

1. Approved server identities and coordinated scope/failover state
2. Different server IPs always prove failure
3. Two Offers always prove an attack
4. DNS record count alone

Correct answer: A. Approved server identities and coordinated scope/failover state

Multiple servers can be intentional, but authorization and allocation coordination must be confirmed. Do not infer safety from their mere presence.

1. Cached answers, encrypted DNS, or another capture path
2. DHCP resolved the hostname in every case
3. DNS cannot have been involved
4. The browser bypassed all IP networking

Correct answer: A. Cached answers, encrypted DNS, or another capture path

Observation placement and caching matter. Name resolution may occur without visible conventional port-53 traffic at that point.

1. Only the DNS MX record
2. Only the user's login
3. Only the WAN modem brand
4. Accepted lease options, manual overrides, and which interface is active

Correct answer: D. Accepted lease options, manual overrides, and which interface is active

An offer is not proof of effective client settings. The client may use overrides, a different lease, or another interface.

1. No A data for that query is not necessarily a nonexistent name
2. NOERROR always means an A address was returned
3. The gateway must be wrong
4. The server is unreachable

Correct answer: A. No A data for that query is not necessarily a nonexistent name

A name can exist without the requested record type. Distinguish no-data responses from NXDOMAIN and test the intended family.

1. That the response reached the requesting client
2. That an answer may have been generated
3. That the query was processed there
4. That the server observed some request

Correct answer: A. That the response reached the requesting client

Processing at the server and delivery to the client are distinct observations. Inspect the return path, policy, and capture points.

1. Leased clients normally renew according to timers; they do not repeat initial broadcast acquisition every minute
2. DNS forces minute-by-minute DORA
3. Lease duration is IP TTL
4. DHCP only works once forever

Correct answer: A. Leased clients normally renew according to timers; they do not repeat initial broadcast acquisition every minute

Renewal behavior differs from initial acquisition and often begins with unicast renewal to the server. Timer values and fallback behavior matter.

1. Authoritative answers, delegation, and cache state at both resolvers
2. Only the site's marketing title
3. Only each resolver's Ethernet connector
4. Only client screen size

Correct answer: A. Authoritative answers, delegation, and cache state at both resolvers

Different cache ages or resolution/delegation problems can produce divergent results. Compare the exact query and authoritative data before asserting universal propagation.

1. All DNS is broken
2. DHCP must be disabled
3. The failure of direct external queries may reflect intended policy
4. Every client needs a public IP

Correct answer: C. The failure of direct external queries may reflect intended policy

Policy can intentionally constrain resolver use. Evaluate behavior against the authorized design rather than treating every denied query as an outage.

1. The prefix necessarily grows
2. DNS answers automatically expire
3. The gateway's MAC becomes public
4. A client may receive an address conflicting with the router interface

Correct answer: D. A client may receive an address conflicting with the router interface

Infrastructure addresses must be coordinated with allocation. A conflict can disrupt the gateway path for many clients.

1. Flush DNS until TCP works
2. Investigate destination transport/path policy using the observed address
3. Change every DNS record
4. Increase DNS TTL

Correct answer: B. Investigate destination transport/path policy using the observed address

The lookup succeeded for the tested name. TCP evidence directs investigation toward service reachability and filtering rather than unsupported DNS changes.

1. The gateway was certainly innocent
2. Resolver failure is proven
3. The combined repair worked; separate causal attribution remains unresolved
4. The scope could not have mattered

Correct answer: C. The combined repair worked; separate causal attribution remains unresolved

Multiple changed dependencies prevent a clean isolation claim. Record the final settings and verify correct name, path, and lease behavior independently.