Sun_CertifyMe_ _v _256q_By-Marvina

Transcription

1 Sun_CertifyMe v _256q_by-marvina Number: Passing Score: 800 Time Limit: 120 min File Version: Exam: Sun Code : Ver : New Questions & Answers modified Questions : 256 By-Marvina

2 Exam A QUESTION 1 You work as the network administrator at Certkiller.com. You are concerned about network security and want to remove network topologies and devices that may pose a risk. What should you do? A. Replace the hub and the bus. B. Replace the bridge. C. Replace the switch. D. Replace the VLAN. Answer: A QUESTION 2 Consider the following exhibit: Using the /dev/bge device (promiscuous mode) Certkiller -SR02 -> Certkiller -SR01 ETHER Type=0800 (IP), size = 98 bytes Certkiller -SR02 -> Certkiller -SR01 IP D= S= LEN=84, ID=48009, TOS=0x0, TTL=255 Certkiller -SR02 -> Certkiller -SR01 ICMP Echo Request (ID: 345 Sequence number: 0) Certkiller -SR01 -> Certkiller -SR02 ETHER Type=0800 (IP), size = 98 bytes Certkiller -SR01 -> Certkiller -SR02 IP D= S= LEN=84, ID=45375, TOS=0x0, TTL=255 Certkiller -SR01 -> Certkiller -SR02 ICMP Echo Reply (ID: 345 Sequence number: 0) Which of the following would result in the output shown in the exhibit? A. Running the snoop icmp command. B. Running the snoop -d hme command. C. Running the snoop -v -d qfe0 broadcast command. D. Running the snoop -d bge0 -V command. E. Running the snoop -d bge0 -o /tmp/ command. Answer: D QUESTION 3 You need to compile a list of MAC addresses for all the systems on the subnet where you are located to submit to the IT manager. The IT manager wants the data the same as the output shown in the exhibit. Which of the following will produce the desired output? (Select TWO options.) A. Running the arp -a command. B. Running the arp -an command. C. Running the kstat -av command.

3 D. Running the netstat -p command. E. Running the netstat -av command. F. Running the ifconfig -hme0 command. Answer: AD QUESTION 4 You are required to configure a link-based IPMP on a Solaris system that has two physical interfaces which reside in the same group. Which of the following statements regarding an operational link-based IPMP configuration that is operational is true? (Select TWO options.) A. A unique test address is a requirement for each interface. B. A unique MAC address is a requirement for each interface. C. Connection to the same switch is a requirement for both interfaces. D. The DEPRECATED flag set is a requirement for all failover addresses. E. Connection to the same IP network is a requirement for both interfaces. F. Running the if_mpadmn -e command to start IPMP is a requirement. Answer: BE QUESTION 5 At present the Certkiller.com network infrastructure is managed and allocated in a very insufficient manner. To address the situation Certkiller.com decided to implement Classless Inter-Domain Routing on their network. You need to propose the appropriate routing protocol. What should you do? A. BGP B. RIPv2 C. RDISC D. RIPv1 E. ipcidr-forwarding Answer: B QUESTION 6 You work as the network administrator for Certkiller.com. You have been to implement DNS zones on the Certkiller.com network. Why is it important to have a primary server for each DNS zone? (Select TWO options.) A. All data regarding top-level zones are maintained on primary servers. B. All zone changes are made on the primary server in that particular zone. C. Apart from the loopback address, primary servers are non-authoritative for any domain. D. The primary servers are responsible for the appropriate responses such as update information and synchronizing secondary servers in the DNS zone. Answer: BD

4 QUESTION 7 You work as the network administrator for Certkiller.com. You need to troubleshoot a DNS server because it has stopped responding to client requests. What should you do? (Choose all that apply.) A. Debug the DNS server using the dig command. B. Debug the DNS server using the ndc command. C. Debug the DNS server using the pkill -HUP inetd command. D. Debug the DNS server using the pkill -INT in.inetd command. E. Debug the DNS server using the pkill -INT in.named command. F. Debug the DNS server using the pkill -USR1 in.named command. G. Debug the DNS server using the svcadm restart system/name-service-cache command. Answer: ABEF QUESTION 8 You work as the network administrator for Certkiller.com. You have been instructed to force all DHCP clients to release their IP addresses that were obtained via the DHCP on the qfe0 interface. The DHCP clients were configured with the RELEASE_ON_SIGTERM=yes parameter. (Select TWO options.) A. Run the ifconfig qfe0 dhcp command with the release parameter. B. Run the dhcpinfo command with the r parameter. C. Run the pkill -9 dhcpagent command. D. Run the ifconfig qfe0 dhcp command with the stop parameter. E. Shut down the DHCP client. Answer: AE QUESTION 9 DRAG DROP The following is the addressing on a Solaris system that is installed on the Certkiller.com network: 1. The hme0 IP Address is /32 2. The hme1 IP Address is /32 3. The Certkiller subnet is /24 4. The Admin subnet is /24 The Admin subnet is the local area network that is used to exclusively to administrate the company servers. You have been instructed to configure a Solaris IP Filter firewall on the newly purchased system to comply with the following requirements: 1. All systems on the Admin subnet must have access to the Certkiller subnet. 2. The system itself must be accessible from all systems on the Admin subnet using ssh. 3. All systems on the Certkiller subnet must NOT have access to any systems on the Admin subnet. The new system will be configured with multiple interfaces and IP Forwarding enabled. The interfaces are as follows: 1. One interface, hme0, connects to the Certkiller subnet. 2. The other interface, hme1, connects to the Admin subnet. Select the rules that should be included in the Solaris IP Filter configuration to comply with the stated requirements by dragging the correct rule from the column on the left to the column on the right.

5 A. B. C. D. Answer:

6 QUESTION 10 Certkiller.com regularly transmits data to a subsidiary company using a Telnet communication. The arrangement between the Certkiller.com and the subsidiary company is a peer-to-peer network. The Certkiller.com IP address is and the subsidiary company IP address is With regard to this scenario, which of the following statements is true? A. The source port number will be included in the IP header of the outbound datagram. B. The destination port number will be included in the IP header of the outbound datagram. C. The destination IP address will be included in the IP header of the outbound datagram. D. The destination IP address will be included in the IP header of the outbound datagram. Answer: C QUESTION 11 You work as the network administrator for Certkiller.com. You have been assigned a trainee technician. Your trainee wants to know what the characteristics of the data payload section of an Ethernet frame is. What will your reply be? (Select TWO options.) A. The Ethernet address of the receiving system is included in the data payload. B. The data payload helps the receiving interface with the detection of the frame. C. The Transport, Internet, and Application layer headers are included in the data payload. D. The maximum size of the data payload is specific to the type of network interface on a system that receives the frame.

7 E. The information used by both the sending and receiving hosts to determine if an error has occurred during frame transmission are included in the data payload. Answer: CD QUESTION 12 You work as the network administrator for Certkiller.com. You have been asked for input regarding the types of networking models Certkiller.com can implement. You want to suggest the use of a layered networking model and have to provide the reasons. What will your reasons be? (Select TWO options.) A. The routing tables in a layered networking model are simplified. B. Network performance is improved when using a layered networking model. C. The layered networking model offers simplified troubleshooting processes. D. Changing one layer does NOT require changes to the other layers. E. There is no need to recompile the networking related code for other systems. Answer: CD QUESTION 13 You work as the network administrator for Certkiller.com. The OSI network model is made up of several layers. You have been assigned a trainee who wants to know which of these layers are present in the TCP/IP network model. What will your reply be? A. The Network, Session and Application OSI layers. B. The Session, Application and Presentation OSI layers. C. The Session, Transport and Application OSI layers. D. The Application, Data Link and Presentation OSI layers. E. The Session, Presentation and Data Link OSI layers. Answer: B QUESTION 14 Which of the following TCP/IP layers are responsible for routing? A. The Internet layer. B. The Transport layer. C. The Data Link layer. D. The Application layer. Answer: A QUESTION 15

8 When a Telnet session is initiated between two systems that are located in different subnets, then the Network Interface layer is responsible for creating a datagram. Which of the following statements is true? A. The time to live (TTL) is included in the datagram header. B. The destination host address is included in the datagram header. C. The address of the local subnet's router is included in the datagram header. D. The UID of the user executing the telnet command is included in the datagram header. Answer: C QUESTION 16 All communications on the Certkiller.com peer-to-peer network makes use of UDP as the connectionless protocol. With which of the following adjacent and corresponding TCP/IP layers does UDP interact? A. The Ethernet and Hardware layers. B. The Hardware, Network, and Internet layers. C. The Transport, Application, and Internet layers. D. The Application, Transport, Internet, and Network layers. Answer: C QUESTION 17 You work as the network administrator for Certkiller.com. You have been assigned a trainee who wants to know which of the following statements regarding TCP and/or UDP is true. What will your reply be? A. TCP is responsible for flow control at the Transport layer. B. UDP is responsible for flow control at the Transport layer. C. The difference between TCP and UDP is that TCP is a Transport layer protocol and UDP is an Internet layer protocol. D. TCP segments are converted to UDP datagrams at the Internet layer. Answer: A QUESTION 18 Computers on a computer network make use of protocols for communicating and exchanging data. These computers are all subject to a data communication protocol that will allow communication with each other. Which of the following statements regarding the data communication protocols are true? (Select THREE options.) A. Data communication protocols include rules for Syntax which governs data format and coding. B. Data communication protocols include rules for Internet which manages data addressing. C. Data communication protocols include rules for Timing which governs speed matching and sequencing. D. Data communication protocols include rules for Application which handles the detail and functions. E. Data communication protocols include rules for Semantics which controls information and error handling. F. Data communication protocols include rules for Transport which manages the connections between cooperating applications

9 Answer: ACE QUESTION 19 Which of the following layers forms part of the TCP/IP network model? (Choose all that apply.) A. The Internet layer B. The Software layer C. The Data Link layer D. The Hardware layer E. The Transport layer F. The Application layer G. The Network Interface layer Answer: AEFG QUESTION 20 Which of the following statements are true? A. Transmission Control Protocol is an example of a Network Interface layer protocol. B. Uniform Demultiplexing Protocol is an example of a Network Interface layer protocol. C. Internet Control Message Protocol is an example of a Network Interface layer protocol. D. EIA/TIA Unshielded Twisted Pair is an example of a Network Interface layer protocol. E. IEEE Wireless Network Standard is an example of a Network Interface layer protocol. Answer: E QUESTION 21 Which type of network topology is represented by the configuration shown in the Exhibit below?

10 A. It is a bus network topology. B. It is a ring network topology. C. It is a star network topology. D. It is a full mesh network. Answer: B QUESTION 22 Recently a new server was connected to the network switch on the Certkiller.com network. You run snoop on the new server and discover that the server communicates with a different network than the one which you want it to communicate with. What should you do to ensure that the new server communicates with servers on the intended network? A. Refresh the ARP cache on the server, the current cache might be stale. B. Shorten the network cable since it could be too long. C. Configure the switch port for the correct VLAN. D. Configure the server with the correct IP address. E. Reconfigure the DHCP server since it might be returning incorrect network settings. Answer: C QUESTION 23 You work as the network administrator for Certkiller.com. You have been instructed to reconfigure a VLAN on the Certkiller.com network. What should you do? A. Reconfigure the hub. B. Reconfigure the bridge C. Reconfigure the GBIC. D. Reconfigure the switch. Answer: D

11 QUESTION 24 Certkiller.com wants to implement a new server network. The proposed network must accommodate a minimum of 50 Sun servers and a minimum of 30 user workstations. You have been asked to make a suggestion as to which network topology should be used. What would you reply? A. A ring topology using intelligent hubs would suit the environment. B. A bus topology segmented into multiple networks would suit the environment. C. A VLAN topology with one VLAN for servers and another for workstations would suit the environment. D. A star topology with one segment for servers and another for workstations would suit the environment. Answer: C QUESTION 25 Certkiller.com is expanding and now incorporates a new building that is approximately 1 km (i.e. 1,100 yards) away. You need to connect the current Certkiller.com office network with the new building's network. Which media type should be used to connect the two networks considering that the connection must be able to handle large file transfers between the two offices' networks? A. You should consider using 10BASE-T. B. You should consider using 100BASE-T. C. You should consider using 1000BASE-LX. D. You should consider using 1000BASE-CX. Answer: C QUESTION 26 Which of the following examples represent Ethernet cable connector types? (Select THREE options.) A. An AUI connector. B. A DB-9 connector. C. A BNC connector. D. A RJ-45 connector. E. A HD-15 connector. F. An IEEE1398 connector. Answer: ACD QUESTION 27 Which of the following statements is true? (Select TWO options.) A. The Type field of an Ethernet frame is used for error detection. B. The Type field of an Ethernet frame identifies the location of the target system on the local link.

12 C. The Type field of an Ethernet frame defines the protocol that processes the encapsulated data. D. The Type field of an Ethernet frame describes the data encapsulated in the payload section of an Ethernet frame. E. The Type field of an Ethernet frame helps the receiving interface to determine the starting bit of an Ethernet frame. Answer: CD QUESTION 28 CSMA/CD is a method specified by the IEEE standard. What is CSMA/CD? A. CSMA/CD is short for Common Serial Multiple Access with Carrier Detection. B. CSMA/CD is short for Collision Sensing Multiple Access with Carrier Detection. C. CSMA/CD is short for Carrier Sensing Multiple Access with Collision Detection. D. CSMA/CD is short for Common Serial Multiple Access with Collision Detection. E. CSMA/CD is short for Carrier Serial Multiplexing Access with Carrier Detection. Answer: C QUESTION 29 Which of the following would represent a reason why a full-duplex Ethernet connection will be the preferred choice over a half-duplex Ethernet connection? A. A full-duplex Ethernet connection has twice the half-duplex throughput capacity. B. A full-duplex Ethernet connection has twice the half-duplex transmission speed. C. A full-duplex Ethernet connection results in more reliable transmissions. D. A system involved in a full-duplex connection experiences fewer interruptions in CPU processes. Answer: A QUESTION 30 Depending on the type of configuration, Gigabit Ethernet is capable of using 9000 byte Ethernet frames and NOT the standard 1500 byte frames. Whys would this be more advantageous? (Select TWO options.) A. Using Jumbo Ethernet frames and not standard frames results in higher network throughput. B. Using Jumbo Ethernet frames and not standard frames reduces VLAN complexity. C. Using Jumbo Ethernet frames and not standard frames lowers host CPU utilization. D. Using Jumbo Ethernet frames and not standard frames results in more reliable data transmission. E. Using Jumbo Ethernet frames and not standard frames lowers the number of packet collisions. Answer: AC QUESTION 31

13 Following is an Ethernet address: 20:0:2e:47:b6:8a showing that Ethernet addresses are 48 bits long, are displayed as 12 hexadecimal digits (usually depicted as 6 groups of two digits) that are separated by colons. What are two functions of the first three octets? (Select TWO options.) A. It identifies the vendor. B. It determines the interface driver. C. It determines if the address is multicast. D. It determines the multicast's group identity. E. It determines the size of the Ethernet frame. Answer: AC QUESTION 32 Why is the preamble so important in the correct functioning of the Ethernet frame? A. The preamble is responsible for the length of the Ethernet frame. B. The preamble is responsible for the provision of error correction data for the frame. C. The preamble describes the data section contents of the frame. D. The preamble is responsible for synchronizing communication between sender and receiver. Answer: D QUESTION 33 Which of the following terms represents the term used to describe the networking technique whereby the data structure is included within another structure to temporarily mask the original data structure? A. Masking B. Tunnelling C. Encryption D. Embedding E. Encapsulation Answer: E QUESTION 34 You received instructions to configure an additional network connection on a Solaris server. You comply and then try to configure the server to forward traffic between the two interfaces. You run the snoopcommand which indicates that traffic do arrive on both interfaces, but is not forwarded between interfaces as required. What should you do? (Select TWO options.) A. Use the routeadm command to verify that the system is configured to forward traffic between those two interfaces. B. Use the netstat -r command to verify that the system is configured to forward traffic between those two interfaces. C. Use the ndd -get /dev/ip \? command to verify that the system is configured to forward traffic between those two interfaces. D. Use the ndd -get /dev/udp ip-forward command to verify that the system is configured to forward traffic between those two interfaces.

14 E. Use the ndd -get /dev/ip ip_forwarding command to verify that the system is configured to forward traffic between those two interfaces. Answer: AE QUESTION 35 Certkiller.com operates as a web-hosting company. Each of the Certkiller.com website that is hosted has been assigned its own IP address. You have been instructed to assign each of these IP addresses to its own virtual interface on the Certkiller.com server. This server must be able to host more websites that the default number of virtual interfaces that run Solaris OS. What should you do? A. Change the maximum number of configurable virtual interfaces using the ndd command. B. Change the maximum number of configurable virtual interfaces using the route command. C. Change the maximum number of configurable virtual interfaces using the netstat command. D. Change the maximum number of configurable virtual interfaces using the ifconfig command. Answer: A QUESTION 36 You work as the network administrator for Certkiller.com. You instructed your trainee to run the following command: # snoop -v Your trainee wants to know why. What would you reply? (Select TWO options.) A. You want an output that you can use to view all broadcast packets. B. You want an output that you can use to view multiple lines of output for each level of encapsulation. C. You want an output that you can use to view packets sent between host and host D. You want an output that you can use to view all packets sent to host and all packets sent to host E. You want an output that you can use to view packets sent to all IP addresses in the range between and Answer: BC QUESTION 37 You work as the network administrator for Certkiller.com. You need to troubleshoot a situation of a newly installed system that is not performing to expectation in terms of network throughput. Your first action would be to check the number of collisions on the network interface since an increasing amount of collisions might indicate a potential issue that needs to be resolved. What should you do? A. Run the netstat -i command. B. Run the netstat -d qfe0 command. C. Run the ndd -get /dev/qfe collisions command.

15 D. Run the snoop -d qfe0 -s collision_count command. Answer: A QUESTION 38 You just joined Certkiller.com as a network administrator and need to query the status of the configured qfe0 interface. You do not know the parameters that are available from the nddcommand. What should you do? A. Run the ndd /dev/qfe \? command to yield the parameters available for the qfe driver. B. Run the ifconfig qfe0 -list command to yield the parameters available for the qfe driver. C. Run the ndd -list /dev/qfe0 command to yield the parameters available for the qfe driver. D. Run the ndd -get /dev/qfe -help command to yield the parameters available for the qfe driver. Answer: A QUESTION 39 What should you do to check the speed and duplex settings of the qfe0 interface? (Select TWO options.) A. Run the netstat -I qfe command. B. Run the netstat qfe link_mode command. C. Run the ndd -get /dev/qfe speed command. D. Run the ndd -get /dev/qfe duplex command. E. Run the ndd -get /dev/qfe link_mode command. F. Run the ndd -get /dev/qfe link_speed command. G. Run the ndd -get /dev/qfe link_status command. Answer: EF QUESTION 40 You have just checked the /var/adm/messages file reports to verify whether the hme3 interface successfully autonegotiated a port connection for the Certkiller.com multi-homed Solaris system. You viewed the following entry: NOTICE: hme3: 100 Mbps full duplex link up However you also ran the ndd -get /dev/hme link_speed command which yielded a value of 0. How would you explain the mismatch in reported values of this output? A. The ndd command is querying the wrong driver. B. The switch is unable to negotiate full-duplex connections. C. The ndd command was run with the default instance value. D. A reboot is required to effect a change in the link_speed value. Answer: C

16 QUESTION 41 The Certkiller.com security policy states that all users must connect to the remote server named Certkiller -SR07 using Secure Shell (SSH). Certkiller -SR07 uses the IP address A Certkiller.com user reports that he is unable to connect to the Certkiller -SR07 and you need to check why the user cannot connect. The user's IP address is What should you do? A. Run the netstat -rn command on the server to check if the connection request gets to the server. B. Run the inetadm -v command on the server to check if the connection request gets to the server. C. Run the snoop and dst ssh command on the server to check if the connection request gets to the server. D. Run the snoop src and port 22 command on the server to check if the connection request gets to the server. Answer: D QUESTION 42 You have been instructed to troubleshoot a network latency issue between an nfs client to an nfs server. You thus run the snoop -d bge0 -o /tmp/outfile command. What should you do next? A. Run the snoop -d bge0 -v grep NFS command to view the time nfs packets were received as captured in /tmp/outfile. B. Run the snoop -i /tmp/outfile -tw -NFS command to view the time nfs packets were received as captured in /tmp/outfile. C. Run the snoop -i /tmp/outfile -time -V command to view the time nfs packets were received as captured in /tmp/outfile. D. Run the snoop -i /tmp/outfile -t a grep NFS command to view the time nfs packets were received as captured in /tmp/outfile. Answer: D QUESTION 43 You need to force the hme1 interface to 100 Mbps half duplex on one of the servers in order to deal with a network switch problem. The following exhibit shows the current bge1 interface configuration: What should you do? (Select TWO options.) A. Run the ndd -get /dev/bge adv_100hdx cap command after the bge instance has been set. B. Run the ndd -set /dev/bge adv_10fdx_cap 0 command after the bge instance has been set. C. Run the ndd -set /dev/bge adv_100fdx_cap 0 command after the bge instance has been set. D. Run the ndd -set /dev/bge adv_100fdx_cap 1 command after the bge instance has been set. E. Run the ndd -set /dev/bge adv_autoneg_cap=1 command after the bge instance has been set. F. Run the ndd -set /dev/bge adv_autoneg_cap 0 command after the bge instance has been set. Answer: CF

17 QUESTION 44 A Certkiller.com security policy states that only predefined MAC addresses are allowed to access the Internet from the internal network. You received instructions to replace a workstation. The user to whom the workstation is assigned requires access to the Internet from the internal network. Since the instructions came at a time when the IT security staff was unable to change any of the settings until the next business day, you need to enable this particular user to continue working. What should you do? A. Run the ifconfig -a ether 20:0:3f:9d:a3:48 command to allow the user access to the Internet from the internal network. B. Run the cat "8:0:20:b9:73:23" >/etc/ethers command to allow the user access to the Internet from the internal network. C. Run the ifconfig qfe0 ether 20:0:3f:9d:a3:48 command to allow the user access to the Internet from the internal network. D. Run the ifconfig qfe0 plumb 20:0:3f:9d:a3:48 command to allow the user access to the Internet from the internal network. Answer: C QUESTION 45 You were just hired as the network administrator at Certkiller.com. You need to troubleshoot a system that does not forward packets. You have been informed that ndd was used to enable IP forwarding on the network interfaces and that the system was just rebooted. What could be the reason why the system does not forward packages? A. The previous administrator neglected to configure the svc.startd daemon. B. During the reboot resulted in the recreation of the /etc/notrouter file. C. One of the /etc/rc2.d start scripts was not fully executed. D. The reboot eliminated the effects of the ndd command. Answer: D QUESTION 46 The identification for a workstation named Certkiller -WS302 is: Which of the following will result in placing a valid entry in the ARP table for Certkiller -WS302 A. Running the arp -a Certkiller -WS302 command. B. Running the arp -s command. C. Running the arp -d Certkiller -WS command. D. Running the arp -s Certkiller -WS302 20:0:3f:9d:a3:48 command. E. Running the arp 20:0:3f:9d:a3: command. Answer: D

18 QUESTION 47 You must allow your workstation to reply to ARP requests for a printer that is located on the same subnet. The printer identification is: What should you do? A. Run the arp -p Certkiller -PR02 20:0:3f:9d:a3:48 command on your workstation. B. Run the arp -s Certkiller -PR02 20:0:3f:9d:a3:48 pub command on your workstation. C. Run the netconfig -p Certkiller -PR02 command on your workstation. D. Run the rarp -s :0:3f:9d:a3:48 command on your workstation. Answer: B QUESTION 48 You need to troubleshoot a system that is failing to boot from a network boot server which displays the following message when you attempt to boot the system: Timeout waiting for ARP/RARP packet What should you do? A. Run the arp -a command to check if the RARP packet arrived at the server and whether the server replied. B. Run the inetadm -d command to check if the RARP packet arrived at the server and whether the server replied. C. Run the rarp -debug command to check if the RARP packet arrived at the server and whether the server replied. D. Run the in.rarpd -da command to check if the RARP packet arrived at the server and whether the server replied. Answer: D QUESTION 49 Where would you find the MAC address to hostname lookup table? A. In the /etc/ethers file. B. In the /etc/inet/ethers file. C. In the /etc/inet/inetd.conf file. D. In the /var/adm/net/config file. Answer: A QUESTION 50 What are the conditions required to successfully answer RARP requests when configuring a system as a network boot server?

19 (Select THREE options.) A. The /etc/ethers table has to be online or present. B. The /etc/inet/hosts file has to be online or present. C. The /etc/resolv.conf file has to be online or present. D. The svc:/network/rarp has to be online or present. E. The svc:/network/ethers has to be online or present. Answer: ABD QUESTION 51 Where does a server send its ARP reply to when responding to an ARP request? A. The ARP reply is sent to the default router. B. The ARP request is sent to the broadcast address. C. The ARP request is sent to the system which originated the ARP request. D. The ARP request is sent to all the published entries in the local ARP table. Answer: C QUESTION 52 You have been instructed to troubleshoot a new installation of Solaris 10 Operating System that failed. The failure stems from the following message that is continually showing up in the /var/adm/messages file after the new installation: Mar 08 11:04:52 mailman sendmail[898]: [ID mail.alert] unable to qualify my own domain name (mailman) -- using short name What should you do? A. The nscd daemon should be restarted. B. The domainname command should be run. C. A DNS server should be added to the /etc/nsswitch.conf file. D. A fully qualified hostname should be added to the /etc/inet/hosts file. Answer: D QUESTION 53 The following exhibit represents a system's ARP table output: Considering the above which of the following statements are valid? (Select TWO options.) A. The Certkiller _ext will resolve to the IP address

20 B. The IP address' associated MAC address is incorrect. C. ARP requests for the address will be replied to. D. The IP address is not a dynamic address that was added to the system arp table. E. The IP address' associated MAC address should be 00:11:2f:0e:0f:ae. Answer: CD QUESTION 54 You need to modify the address with a broadcast address and a netmask so as to temporarily change the IP address on the bge0 interface of a system. What should you do? A. Use the ifconfig bge netmask broadcast + command. B. Use the ifconfig bge netmask broadcast command. C. Use the ifconfig bge netmask broadcast command. D. Use the ifconfig bge netmask broadcast + command. E. Use the ifconfig bge netmask broadcast + command. Answer: E QUESTION 55 The following exhibit represents the output from the ifconfig command as run on you system's current hme0 interface. However the interface on your system is not fully operational. What is wrong with the current configuration of the hme0 interface? A. The network cable is not connected. B. The current hme0 interface has been configured with an incorrect broadcast address. C. A duplicate IP address is causing a conflict. D. The current hme0 interface is configured, but it has not been enabled. E. The current hme0 interface driver is not configured in the kernel. Answer: D QUESTION 56 You must implement a subnetworking strategy that will accommodate the restructuring of the Certkiller.com organization. Certkiller.com is to be divided into three separate groups which will be organized into three separate subnetworks operating with a single Class C address range. How would you accommodate the implementation of an appropriate subnetworking strategy that will serve the organization?

21 A. Modify the /etc/netgroup file on every host on each of the three subnets. B. Modify the /etc/netmask file on every host on each of the three subnets. C. Modify the /etc/inet/netmasks file on every host on each of the three subnets. D. Modify the /etc/defaultrouter file on every host on each of the three subnets. E. Modify the /etc/inet/hostname.bge0 file on every host on each of the three subnets. Answer: C QUESTION 57 Incorrect modifications have been made to the Certkiller.com server and the server was rebooted causing the changes to take effect. Why is your server using ARP to reach hosts on a different subnetwork than before the modifications? A. The /etc/netgroup file is not properly modified. B. The /etc/inet/hosts file is not properly modified. C. The /etc/inetd.conf file is not properly modified. D. The /etc/inet/netmasks file is not properly modified. E. The /etc/inet/services file is not properly modified. F. The /etc/init.d/inetinit file is not properly modified. Answer: D QUESTION 58 Several tasks require the use of Internet Control and Message Protocol (ICMP) packets. What are these tasks? (Select THREE options.) A. RIPv2 routing updates. B. MAC address updates. C. RDISC router discovery. D. The encapsulation of fragmented TCP packets. E. Executing the ping command between hosts on different networks. F. Executing the ping command between hosts on the same network. Answer: CEF QUESTION 59 The following exhibit represents the error message that you encounter while trying to configure an interface: # ifconfig qf1 Certkiller -SR netmask up ifconfig: SOCIALADDR: qfe1: Cannot assign requested address Which of the following is a possible explanation why this error occurs? A. There is no broadcast address. B. There is no such thing as interface qfe1. C. Other options are given with the Certkiller -SR02 option.

22 D. The IP address is an invalid unicast address. Answer: D QUESTION 60 The current configuration of a Solaris system named Certkiller -SR03 includes an IPv6 IPMP group that has two hme interfaces. The name of this group is cobra. You need to ensure that a third interface named bge0 is added to cobra when the system is rebooted again. What should you do? A. Edit the /etc/ Certkiller -SR03.bge0 file by adding -failover group cobra up. B. Edit the /etc/ Certkiller -SR03.bge0 file by adding -deprecated inet6 group cobra -failover up. C. Edit the /etc/ Certkiller -SR03.bge0 file by adding group cobra addif site-local -deprecated up to the. D. Edit the /etc/ Certkiller -SR03.bge0 file by adding site-local group cobra addif bge0 -failover up. Answer: A QUESTION 61 You have been instructed to ensure that failures are detected more quickly on the IPMP group that contains the IPv6 interface qfe0. How would you go about changing the failure detection time from IPMP? A. You should edit the /etc/default/mpathd file. B. You should edit the /etc/hostname6.qfe0 file. C. You should edit the /etc/default/mpathd6 file. D. You should edit the /kernel/drv/ipmp.conf file. E. You should edit the /kernel/drv/ipmp6.conf file. Answer: A QUESTION 62 Transmission Control Protocol (TCP) functions by exercising flow control on both the sender and receiver side of the transmission. Which of the following statements represents a valid statement regarding the congestion window on the sending side of the TCP protocol algorithm? A. The sender side congestion window advertises the amount of data loss. B. The sender side congestion window adjusts the data transmission rate. C. The sender side congestion window advertises the maximum amount of data allowed to be sent. D. The sender side congestion window advertises the maximum amount of data allowed to be received. Answer: B

23 QUESTION 63 What should you do to investigate the status of a TCP connection state between a web server and a specific client in the shortest time possible? A. Run the dig -a command. B. Run the ping -s command. C. Run the netstat -a command. D. Run the iostat 10 -tcp command. Answer: C QUESTION 64 Which of the following are present in a TCP segment header? (Select TWO options.) A. The MAC address. B. The UDP datagram. C. The sequence numbers. D. The congestion window. E. The window advertisements. Answer: CE QUESTION 65 The Transport layer is responsible for the management of data between communicating hosts. Which methods are used by the Transport layer when checking if data is correctly delivered? A. Flow control; expedited forwarding; and acknowledgement responses. B. Flow control; sequencing; and acknowledgement responses. C. Sequencing; acknowledgement responses; and data fragmentation and reassembly. D. Expedited forwarding; acknowledgement responses; and data fragmentation and reassembly. Answer: B QUESTION 66 Exhibit:

24 You have been instructed to implement probe-based multipathing. What should you do? (Select TWO options.) A. Run the ifconfig qfe1 group engineer-two command. B. Run the eeprom local-mac-address?=true command. C. Run the ifconfig qfe1 group engineer-one command. D. Run the ifconfig qfe1 addif deprecated netmask + broadcast + -failover up command. E. Run the ifconfig qfe0 addif deprecated netmask + broadcast + -failover up command. F. Run the ifconfig qfe1 plumb netmask + broadcast + group engineer-one up command. Answer: CD QUESTION 67 You have been asked to troubleshoot a system that is displaying the following error message in the console window: Mar 21 12:02:03 sys11 in.mpathd[853]: No test address configured on interface qfe2; disabling probe-based failure detection on it What should you do? A. You should run the if_mpadm -t hme command. B. You should run the inetadm enable svc:/network/mpath command. C. You should add a test address to the /etc/default/mpathd file. D. You should run the ifconfig qfe2 addif failover deprecated up command. Answer: D QUESTION 68 You run a section of the ifconfig -acommand on a Solaris system with Probe-Based IPMP configured as follows: The address is marked as deprecated. Exhibit the above which of the following statements are valid? (Select TWO options.) A. The deprecated address is used as a source address for outbound packages when a system has a static router configured. B. The deprecated address is used as a source address for outbound packages when the system functions as a router. C. The deprecated address is used as a source address for outbound packages when a TCP connection is requested. D. The deprecated address is used as a source address for outbound packages when the interface group has are no other addresses available.

25 E. The deprecated address is used as a source address for outbound packages when an application has been explicitly bound to the address. Answer: DE QUESTION 69 Consider the following: route addhost cobra cougar. Which of the following statements are true? (Select TWO options.) A. route add host cobra cougar add a static route to the routing table. B. route add host cobra cougar indicates cougar as an intermediate host on this route. C. route add host cobra cougar forces a routing table update on both the cougar and cobra hosts. D. route add host cobra cougar renders all hosts on the cobra network available. E. route add host cobra cougar renders cobra the only intermediate host on this route. Answer: AB QUESTION 70 How would you go about deleting all gateway entries from a routing table? A. Run the route flush command. B. Run the rmroute all command. C. Run the route delete all command. D. Run the route delete default command. Answer: A QUESTION 71 The following exhibit represents a netstat -rcommand output showing the destination o as an IP address: What should you do to show the destination network as a name in the netstat -routput? A. Assign a name to the network by modifying the /etc/inet/hosts file. B. Assign a name to the network by modifying the /etc/inet/networks file. C. Assign a name to the network by modifying the /etc/networks.conf file. D. Assign a name to the network by modifying the /etc/netmask file. E. Assign a name to the network by modifying the /etc/inet/networks.conf file.

26 F. Assign a name to the network by modifying the /etc/default/networks.conf file. Answer: B QUESTION 72 Consider the case where the default router on a network malfunctions and ceases to broadcast RDISC packets. Which of the following statements regarding a non-router host in the same subnet as the router is true? (Select TWO options.) A. The in.rdisc daemon on the host will terminate. B. The router address listed in /etc/defaultrouter will be used instead. C. The entry for the default router is immediately removed from the host's routing table. D. The entry for the default router will be reestablished when the router restarts broadcasting RDISC packets. E. The entry for the default router is removed from the host's routing table after a timeout of about 30 minutes. Answer: DE QUESTION 73 The following exhibit shows the routing table on your workstation: Though you are able to ping hosts on the same network as your workstation, you found that you cannot communicate with them. You need to find out why this is the case since you made no changes to nor rebooted the workstation? A. A core dump of inetd occurred. B. The /etc/defaultrouter file was deleted. C. There must be a router that stopped broadcasting RDISC packets. D. A switch to which the workstation is connected, failed. Answer: C QUESTION 74 A new Solaris system is configured with a single interface. The network in which this system is connected supports Router Discovery Protocol (RDP). You ran the snoop command on the interface and started the in.routed daemon. Which of the following statements are true given the above situation? (Select TWO options.) A. A router advertisement is captured by the snoop utility. B. A ping to the default router is captured by the snoop utility. C. A gateway timeout parameter is captured by the snoop utility. D. A packet to destination is captured by the snoop utility. Answer: AD

27 QUESTION 75 You need to view a system's routing configuration. Which command will yield information relating to updates to a routing table in real time? A. The route monitor command. B. The in.routed -u root command. C. The routeadm -u table command. D. The routeadm -e update command. Answer: A QUESTION 76 Given a system configured with Solaris 10 OS. Which of the following statements are true? (Select TWO options.) A. The RDISC protocol makes use of multicast. B. The RDISC protocol is independent of the routing protocol. C. The RDISC protocol is responsible for providing routing information between switches. D. in.rdisc daemon will start automatically at system boot when using the RDISC protocol. Answer: AB QUESTION 77 You work as the network administrator at Certkiller.com and have been instructed to configure a static, default route a local router The netmask is You must ensure that the default route installed immediately and at the next reboot. What should you do? (Select TWO options.) A. Use the route add default command. B. Use the routeadm -u -a default command. C. Use the echo > /etc/defaultrouter command. D. Use the echo /25 > /etc/defaultrouter command. E. Use the routeadm add default -netmask command. Answer: AC QUESTION 78 Exhibit: net gateway Certkiller -SR58 metric 1 You added the above line to the /etc/defaultrouter file in order to add a static route to the routing table on your system. However, when you rebooted the system you discover that the in.routed daemon did not start and the svcs -x command did not yield any problems. Why does the netstat -rcommand not show the static route in the routing table?

28 A. You neglected to place the entry in the /etc/gateways file. B. You neglected to put a static keyword in the entry. C. You neglected to place the netmask specification in the entry. D. You used the gateway name and not the gateway IP address in the entry. Answer: A QUESTION 79 Which IP address range is represented by a CIDR address of /21? A only B to C to D to Answer: D QUESTION 80 Certkiller.com requires a new IP subnet on their network. In your solution you must ensure that the new subnet will be able to accommodate 1,500 IP addresses. What should you do? A. Use the /23 CIDR notation. B. Use the /22 CIDR notation. C. Use the /21 CIDR notation. D. Use the /32 CIDR notation. Answer: C QUESTION 81 The in.routed daemon failed to start when a Solaris system was rebooted. You investigate the issue and verified that execution of svcs -1 svc:/network/initial reports are enabled an online. What could then be the reason why the in.routed daemon failed to start? (Select TWO options.) A. The IPv4-routing is NOT enabled. B. There is no /etc/gateways file. C. The svc:/network/interfaces are NOT enabled. D. The /etc/defaultrouter file contains an IP address. Answer: AD QUESTION 82

29 You need to modify the default configuration of the in.routed daemon of a Solaris system. At present this system is used as a router. The modification must be done to the time interval in which Router Discovery Advertisements are transmitted. What should you do? A. Modify the /etc/system in.routed configuration file. B. Modify the /etc/gateways in.routed configuration file. C. Modify the /etc/defaultrouter in.routed configuration file. D. Modify the /etc/inet/routing.conf in.routed configuration file. Answer: B QUESTION 83 You need to reuse an old Solaris 10 OS router as a normal system. You thus disable the second Ethernet interface. You also want in.routed disabled immediately and prevent it from starting on the reboot. What should you do? A. Use the routeadm -e ipv4-routing command to prevent in.routed from starting on the reboot. B. Use the routeadm -d ipv4-routing command to prevent in.routed from starting on the reboot. C. Use the routeadm -u -d ipv4-routing command to prevent in.routed from starting on the reboot. D. Use the routeadm -u -e ipv4-routing command to prevent in.routed from starting on the reboot. Answer: C QUESTION 84 Exhibit: You need to enable Certkiller -WS301 to reach Certkiller -WS302 by adding a static route. What should you do? A. Run the route add int-sr01 command. B. Run the routeadm add int-sr01 command. C. Run the route change ext-sr01 command. D. Run the route add host int-sr01 command. E. Run the routeadm add host ext-sr01 command.

30 Answer: D QUESTION 85 The Certkiller.com network consists of three IP subnets named Network1, Network2, and Network3. The default route for all clients on the Network2 subnet is set to while the default route for all clients on the Network3 subnet is set to The relevant potion of the Certkiller.com network is shown in the exhibit: Certkiller.com users on the Network2 subnet report that they are unable to communicate with any of the clients on the Network3 subnet. You run the netstat -rncommand from Certkiller -SR01 and receive the following output: Which entry is incorrect? A UG 1 0 B UG 1 0 C UH 1 3 lo0 D U qfe0 E U 1 0 hme0 F U hme0 Answer: A QUESTION 86 On the Certkiller.com network there is a host with two interfaces. The exhibit below

31 shows the routing table of this host. What do the UG flags in the second line indicate? A. The second line UG flags show that IP address is a gateway. B. The second line UG flags show that gateway is up. C. The second line UG flags show that gateway has been updated. D. The second line UG flags show that it is an indirect route, and the gateway system is Answer: D QUESTION 87 At present a host's IPv6 link-local unicast address is based on the host's Ethernet address. You must enable a 48-bit Ethernet address to lengthen to a 64-bit Ethernet address. You thus insert a 16-bit code in the existing 64-bit Interface ID portion of the IPv6 address. Which of the following statements are true? A. The FE80 value represents the added 16-bit code. B. The FEC0 value represents the added 16-bit code. C. The FFFE value represents the added 16-bit code. D. The FFEE value represents the added 16-bit code. E. The FFFF value represents the added 16-bit code. Answer: C QUESTION 88 Most systems on the Certkiller.com network currently have IPv4 addresses configured. Consider the configuration of the qfe0 interface on one of these systems shown in the exhibit: You need to test an IPv6 implementation on this particular system. What should you do? (Select TWO options.) A. Use the routeadm -e -i qfe0 inet6 command to add an IPv6 address to the qfe0 Actualtests.com - The Power of Knowing interface. B. Use the ifconfig qfe0 ipv6 plumb up command to add an IPv6 address to the qfe0 interface C. Use the ifconfig qfe0 inet6 plumb up command to add an IPv6 address to the qfe0 interface D. Use the touch /etc/ Certkiller -SR06.qfe0; init 6 command to add an IPv6 address to the qfe0 interface

32 E. Use the ifconfig -d qfe0 addif inet6 -auto command to add an IPv6 address to the qfe0 interface Answer: CD QUESTION 89 Consider the interface shown in the exhibit: Which of the following statements are true? (Select TWO options.) A. The interface forms part of a multipath group. B. The interface is a link-local unicast address. C. The interface contains an embedded IPv4 address. D. The interface was autoconfigured using the host's MAC address. E. This interface will allow communication with systems on different subnets. Answer: BD QUESTION 90 You have been instructed to troubleshoot an IPv6 router that has difficulty routing to a default router that is connected to the Internet. To comply you need to check the routing table and check whether the default route is established. In addition you need to check the neighbor cache to check if the default router MAC address was learnt. What should you do? (Select TWO options.) A. Run the arp -n command. B. Run the netstat -r command. C. Run the netstat -m command. D. Run the netstat -p command. E. Run the ifconfig -a command. Answer: BD QUESTION 91 You need to establish communication between Certkiller -WS301 and Certkiller -WS302. The exhibit shows the interfaces of these two systems. Exhibit:

33 You also configure a router that will enable communication between systems with IPv4 and IPv6. However when you execute the following command: Certkiller -WS301# ping -s fd90::203:baff:fe02:7aa5 ityields an error message: ICMPv6 Address Unreachable from gateway 2002:5919:a8d::1 foricmp6 from 2002:5919:a8d::1 to fd90::203:baff:fe02:7aa5 What could be the problem? A. You neglected to add a default route for the IPv6 traffic. B. You neglected to add a route to gateway 2002:5919:a8d::1. C. You are unable to reach the system on the local link address. D. There is no IPv6 configured on the system you are trying to ping. Answer: C QUESTION 92 Consider the following scenario: You received instructions to set up a tunnel. You complied and now need to test the functionality of the tunnel. Thus you ping the host at the remote end of the tunnel but found that you can ping the remote end with and without a tunnel. Taking the above into account what would then be the rationale behind creating tunnels. (Select TWO options.) A. You can guarantee privacy of data through encryption using tunneling. B. Ethernet packets can be encapsulated in IPv6 packets when using tunneling. C. IPv6 datagrams can be routed within IPv4 datagrams when using tunneling. D. Because routers will have fewer headers to inspect, using tunneling will result in faster routing. E. IPv6 networks can be routed over IPv4 network infrastructures when using tunneling. Answer: CE QUESTION 93 You need to troubleshoot an IPv6 issue. Consequently you run the snoopcommand and received the following output: # snoop Using device /dev/qfe (promiscuous mode) ba20::c00:2d0d:cb9d:7ad8->ba20::c00:30ff:feff:7322 TELNET C port=33369 ba20::c00:30ff:feff:7322->ba20::c00:2d0d:cb9d:7ad8telnet R port=33369 ba20::c00:2d0d:cb9d:7ad8 -> ba20::c00:30ff:feff:7322 TELNET C port=33369 ba20::c00:2d0d:cb9d:7ad8 -> ba20::c00:30ff:feff:7322 TELNET C port=33369 ba20::c00:30ff:feff:7322->ba20::c00:2d0d:cb9d:7ad8telnet R port=33369 Which of the following statements are valid?

34 A. The output shows that both hosts are on the same local network. B. The output shows that both hosts are connected to each other via the Internet. C. The output shows that the telnet session is passing from the IPv4 to the IPv6 tunnel. D. The output shows that the telnet session is using a source port of 7ad8 (hex) and a destination port of 7322 (hex). Answer: A QUESTION 94 Certkiller -WS302 is directly connected to three local IPv6 networks. At present Certkiller -WS302 is able to communicate with other hosts on each of these IPv6 networks. These three IPv6 networks have Certkiller -WS302 configured as their default IPv6 router. However, the computers on these networks are unable to communicate with each other. Consequently you run the route admcommand on Certkiller -WS302. The exhibit shows the output you received: You need to ensure that Certkiller -WS302 can forward packets between the three directly connected networks immediately. What should you do? A. Run the /usr/lib/inet/in.ripngd command. B. Run the routeadm -e ipv6-routing command. C. Run the routeadm -e ipv6-forwarding command. D. Run the routeadm -u -e ipv6-forwarding command. E. Run the ndd -set /dev/ip ipv6_send_redirects 1 command. Answer: D QUESTION 95 Certkiller.com is expanding and opens a new branch office. Internet connection for this branch office will be via the head office. You need to set up a DNS server in the new branch office. What should you do? A. Configure the DNS server as a root server. B. Configure the DNS server as a replica server. C. Configure the DNS server as an authoritative server. D. Configure the DNS server as a forwarding server. E. Configure the DNS server as a Top-Level Domain server.

35 Answer: D QUESTION 96 The exhibit below shows the DNS zone file: The primary server configuration for this domain is removed without modifying the secondary server configuration. Which of the following statements are true? A. The secondary server will immediately cease to return authoritative replies for the Certkiller.com domain. B. Within 1 hour the secondary server will cease to return authoritative replies for the Certkiller.com domain. C. Within 10 days the secondary server will cease to return authoritative replies for the Certkiller.com domain. D. Within 15 minutes the secondary server will cease to return authoritative replies for the Certkiller.com domain. E. Within 30 minutes the secondary server will cease to return authoritative replies for the Certkiller.com domain. Answer: C QUESTION 97 Exhibit: # cat /etc/resolv.conf domainname Certkiller.com nameserver nameserver You are required to set up a new Solaris server named Certkiller -SR21. However you do not know the appropriate mail relay server to use for this subnet. What should you do? A. Use the cat /etc/nsswitch.conf command. B. Use the dig -relay command. C. Use the dig Certkiller.com mx command. D. Use the dig mailrelay Certkiller -SR21. Certkiller.com command. E. Use the nslookup type=a Certkiller -SR21. Certkiller.com command Answer: C

36 QUESTION 98 You work as the network administrator at Certkiller.com and ran the dig host. Certkiller.comcommand which yielded a record that is indicative of a non-authoritative response. What does this mean? A. A non-authoritative response indicates that the default DNS server in /etc/resolv.conf is unavailable. B. A non-authoritative response indicates an expired TTL for the host. Certkiller.com DNS entry. C. A non-authoritative response indicates that the default DNS server does not own the Certkiller.com zone. D. A non-authoritative response indicates that the Certkiller.com SOA record serial number requires updating. Answer: C QUESTION 99 Following exhibit represents the contents of a zone file: Which of the following statements are true? (Select TWO options.) A. This is the contents of a reverse zone file. B. The exhibit indicates that the hosts www and buy are the same system. C. A remote DNS server caching a record for mail. Certkiller.com is set to flush the entry every 10 days. D. The command Certkiller.com relay.store.com returns an A record entry of Answer: BD QUESTION 100 Certkiller.com is merging with TestLabs, Inc. At present Certkiller.com owns, and is authoritative for the Certkiller.com domain. In lieu of the expected merger the Certkiller.com and TestLabs, Inc. domains, the Certkiller.com DNS server zone files were configured to include and become authoritative of the TestLabs, Inc. domain named testlab.com. What should you do to ensure that the network merger is successful? (Select TWO options.) A. You should reduce the TTL value for the Certkiller.com domain prior to turning off the testlab.com DNS servers. B. You should initiate zone transfer to A.root-servers.net prior to turning off the testlab.com DNS servers. C. You should update the Certkiller.com Top-Level name server entries for testlab.com prior to turning off the

37 testlab.com DNS servers. D. You should create a Certkiller.com to testlab.com reverse zone configuration file prior to turning off the testlab.com DNS servers. E. You should require testlab.com hosts to update the IP address used for DNS resolution prior to turning off the testlab.com DNS servers. Answer: CE QUESTION 101 Where does an authoritative DNS server get its answers from? A. The local cache. B. A root server. C. A disk-based file. D. The loopback device. Answer: C QUESTION 102 Name resolution allowed on a Solaris system includes name-to-address or address-to-name in many ways with different orders. Which file specifies the name resolution order when using the Solaris operating system? A. The /etc/domainame file. B. The /etc/inet/hosts file. C. The /etc/named.conf file. D. The /etc/resolv.conf file. E. The /etc/nsswitch.conf file. Answer: E QUESTION 103 DRAG DROP The statements in the /etc/named.conf file provide the configuration information for BIND8 and BIND9. The /etc/named.conf file allows for certain tasks to be accomplished. What are these tasks? Select the tasksby dragging the correct task from the column on the left to the column on the right.

38 A. B. C. D. Answer:

39 QUESTION 104 DNS clients can either receive an authoritative or a non-authoritative response from a DNS server. Which of the following statements regarding non-authoritative responses are true? (Select TWO options.) A. A non-authoritative response is always correct. B. A non-authoritative response is sourced from a disk-based file. C. A non-authoritative response is sourced from the DNS server cache. D. A non-authoritative response can be incorrect if the DNS server cache contains stale data that should be purged. E. A non-authoritative response is if validated from a minimum of two other sources; are changed to an authoritative response. Answer: CD QUESTION 105 After changes had been made to the primary DNS server's zone file as well as a reboot, the secondary DNS server failed to synchronize. What caused this problem? A. A failure to update the NS record of the updated zone file. B. A failure to update the time record of the updated zone file. C. A failure to update the serial number of the updated zone file. D. A failure to update the SOA ttl number of the updated zone file. Answer: C QUESTION 106 A DNS server is unable to resolve addresses in zones for which it is non-authoritative. Even though it can successfully provide information related to zones for which it is authoritative. What caused this problem? A. The DNS server does NOT have a /etc/resolv.conf file. B. The DNS server only has a single Ethernet interface. C. The DNS server has no knowledge of the root-level servers. D. The DNS server is NOT configured to support the.com domain. Answer: C QUESTION 107 You received the following error message when you ran the ping www. Certkiller.com command on asystem on the Certkiller.com network: ping: unknown host www. Certkiller.com You verified that the Certkiller.com DNS server is correctly configured to resolve queries. What could have caused this problem? (Select TWO options.)

40 A. The system does NOT run the nscd daemon. B. The DNS server is NOT a secondary server for Certkiller.com. C. Ping requests to the www. Certkiller.com host are not replied. D. The /etc/nsswitch.conf file does NOT reference DNS. E. The /etc/dns.conf file has NOT been configured on the system. F. The /etc/resolv.conf file has NOT been configured on the system. Answer: DF QUESTION 108 The following exhibit shows a SOA record that rendered a Certkiller.com DNS server unable to resolve hosts: Referring to the SOA record what is causing the error? A. The {} bracket pair should be used instead of the () bracket pair. B. A serial number of 1002 is too small. C. The final ")" must be on its own line. D. The wrong order is used for the soa and in fields. Answer: D QUESTION 109 The Certkiller.com primary DNS server is unable to delegate authority and responsibility for the Certkiller.com subdomain named research. Certkiller.com. You need to solve the problem. You investigate and find that the delegation is not operational. Following are some of the lines from the Certkiller.com zone file: research. in ns cobra. Certkiller.com. cobra. Certkiller.com in a What are the errors contained in those lines? (Select TWO options.) A. The ns should be in the upper case and not the lower case as it is currently. B. The two lines should have a blank line in-between them. C. The name field research is terminated with a dot (.). D. The name field of the second line should be terminated with a dot (.). E. The zone file does NOT have a PTR record for the name server cobra. Certkiller.com. Answer: CD

41 QUESTION 110 The exhibit shows a BIND configuration: With regard to the above exhibit, which of the following statements is true? A. In the Certkiller.com domain the user Andy is allowed to modify the domain. B. The zone configuration for the Certkiller.com domain is invalid because is no serial number. C. In the Certkiller.com domain any host in /24 can operate as a secondary server. D. In the Certkiller.com domain another DNS server in /24 is allowed to forward requests to this server. Answer: D QUESTION 111 The exhibit below shows some of the lines contained in your system's DNS configuration file: search research. Certkiller.com development. Certkiller.com production. Certkiller.com nameserver nameserver nameserver With regard to the above exhibit, which of the following statements is true? A. Only three DNS domains may be queried by your system. B. Your system operates as a secondary server to three primary servers. C. Your system has three network interfaces and operates as a DNS server for three domains. D. Your system is busy searching the three domains specified to find a match for a given host name. Answer: D QUESTION 112 You received instructions to configure an existing DNS server to operate as a secondary server for the Certkiller.com domain. While busy you encounter the following error message: Mar 25 08:12:52 cobra named[1531]: transfer of Certkiller.com/IN' from #53: failed while receiving responses: REFUSED What should you do? A. You should modify the SOA record on the secondary server. B. You should modify the allow-query entry on the secondary server.

42 C. You should modify the allow-query entry on the master server. D. You should modify the allow-transfer entry on the master server. E. You should modify the allow-update entry on the secondary server. Answer: D QUESTION 113 The exhibit shows the existing /etc/named.conf configuration file of a Certkiller.com DNS server: How does the allow-update option change the behavior of the primary DNS server? A. All forward DNS servers are dynamically updated by the DNS server. B. All reverse DNS servers are dynamically updated by the DNS server. C. All secondary DNS servers are dynamically updated by the DNS server. D. Root DNS servers are dynamically updated by the DNS server. E. The host information from a DHCP server is dynamically updated by the DNS server. Answer: E QUESTION 114 The exhibit shows a subsection of the /etc/named.conf file as it currently exists on a primary DNS server. Which of the following statements are valid? (Select TWO options.) A. The primary DNS server is unable to perform dynamic updates. B. The secondary DNS server /32 is able to receive zone transfers. C. Only systems with IP addresses /26 receives responses from the name server. D. Only the system with IP addresses /32 can dynamically update the zone Certkiller.com. E. The system "research" with IP address /32 receives responses from the name server.

43 Answer: BE QUESTION 115 You received instruction to install a new server in the Certkiller.com network. You complied with this request. Then you received reports from users stating they are unable to log into the new server. You must address the problem and thus check the log files and encountered the following error message: Mar 28 11:36:33 compserv in.telnetd[1430]: [ID daemon.warning] refused connect from (name/address mismatch) What could be the problem? A. This message indicates that the server has been hacked. B. This message indicates that another system on the network is using the server's IP address. C. This message indicates that the Telnet service has NOT been enabled due to security problems. D. This message indicates that the forward and reverse DNS mappings used different IP addresses. Answer: D QUESTION 116 You need to troubleshoot a DNS server that has failed when it attempted to resolve Certkiller.south.com to an IP address. You need to make sure that the nslookup command references the DNS server However you do not want to change the /etc/resolv.conf file. What should you do? A. Use the nslookup command. B. Use the nslookup command. C. Use the nslookup / command. D. Use the force command. E. Use the smreg replace -m -s dns command. Answer: B QUESTION 117 A DHCP sever with an IP address of can support clients in two separate Class C networks. Certkiller -WS202 is a DHCP client on one of these networks and has an IP address of Certkiller -WS302 is a DHCP client on the other network and has an IP address of What are the conditions whereby the DHCP can support Certkiller -WS202 and Certkiller -WS302? (Select TWO options.) A. The /etc/inet/dhcpsvc.conf file must exist on the DHCP server. B. The /var/dhcp/sunwfiles1_dhcptab file must exist on the DHCP server. C. The /var/dhcp/sunwfiles1_192_168_0_0 file must exist on the DHCP server. D. The /var/dhcp/sunwfiles1_192_168_5_0 file must exist on the DHCP server. E. The /var/dhcp/sunwfiles1_192_168_10_0 file must exist on the DHCP server. Answer: DE

44 QUESTION 118 What are the advantages of using DHCP? (Select TWO options.) A. You can set up BOOTP and RARP relays using DHCP. B. You can replace JumpStart using DHCP. C. There is less administrative effort required when using DHCP to automatically assign available IP addresses to clients. D. You do not need the RARP and bootparams file when using DHCP for clients that boot over a network. Answer: CD QUESTION 119 You received instructions to configure a new DHCP server. What should you do? (Select TWO options.) A. Use the dhcpsvc command. B. Use the dhcpmgr command. C. Use the dhcpagent command. D. Use the dhcpsetup command. E. Use the dhcpconfig command. Answer: BE QUESTION 120 You received instructions to change a DHCP server's configuration and now need to test the changes on a DHCP client that runs Solaris OS. You do not want to reboot the client or wait for the DHCP lease to expire. What should you do test the configuration changes made to the DHCP server? A. Run the dhcpagent -f command to force the workstation to re-query the DHCP server. B. Run the svcadm restart dhcpagent command to force the workstation to re-query the DHCP server. C. Run the ifconfig qfe0 down; ifconfig qfe0 up command to force the workstation to re-query the DHCP server. D. Run the ifconfig qfe0 dhcp release; ifconfig qfe0 dhcp start command to force the workstation to re-query the DHCP server. Answer: D QUESTION 121 A workstation on the Certkiller.com network currently makes use of a static IP address. You need to change the configuration of this workstation so that it will make use of the DHCP server to receive an IP address next time it boots on its qfe0 interface. What should you do?

45 A. You should create /etc/dhcp.qfe0 B. Run the ndd -set /dev/qfe dhcp bind command. C. You should modify the /etc/hostname.qfe0 to include the dhcp-client tag D. Run the svcadm restart svc:/network/dhcp-server:default command. Answer: A QUESTION 122 The exhibit below shows a portion of an in.dhcpd output that was run in debug mode: 3cdbc114: There is no dhcp-network table. 3cdbc114: Datagram received on network device: qfe0. You were instructed to configure the DHCP server to assign IP addresses to the DHCP clients. What should you do? (Select TWO options.) A. Run the init 6 command on the DHCP server. B. Run the touch /etc/dhcp.qfe0 command on the DHCP server. C. Run the pntadm -C command on the DHCP server. D. Run the ifconfig qfe0 dhcp start command on the DHCP server. E. Run the svcadm restart svc:/network/dhcp-server command on the DHCP server. F. Run the pntadm -p /var/dhcp -A command on the DHCP server. Answer: CF QUESTION 123 The exhibit below shows a DHCP debug output: Referring to the above exhibit; what does this output mean? (Select TWO options.) A. The original client request was a DHCPREQUEST. B. The original client request was a DHCPDISCOVER. C. The DHCP server successfully assigned an IP address to a client. D. The DHCP server permanently reserved an IP address for another DHCP client. E. The DHCP acknowledged receipt of a request, but could not respond. Answer: BC

46 QUESTION 124 The Certkiller.com DHCP server is configured to provide IP addressing services to both JumpStart and non-jumpstart clients. A request for an IP address came from one DHCP client, however the request does not ask for a subnet mask, router, and encapsulated vendor options. You need to configure the DHCP client's dhcpagent to request all the additional networking information from the DHCP server. You must thus modify the /etc/default/dhcpagent file on the DHCP client. What should you do? A. You should modify the PARAM_REQUEST variable. B. You should modify the PARAM_REQUEST_LIST variable. C. You should modify the PARAM_REQUEST_ROWS variable. D. You should modify the PARAM_REQUEST_ADDRESS variable. E. You should modify the PARAM_REQUEST_NETWORKING variable. Answer: B QUESTION 125 You are instructed to configure the Certkiller.com DHCP server to allow the installation of SUN systems that will use JumpStart with DHCP boot. What should you do? (Select TWO options.) A. Run the setup_install_server command. B. Create the required options using dhtadm. C. Create the required macros using dhtadm. D. Restart the DHCP daemonusing dhtadm -R. E. Run the dhcp command using the admin options Answer: BC QUESTION 126 Which of the following will yield an address in your DHCP server being marked as being un-useable? A. A DHCP server failure. B. An invalid IP address. C. A non-responding address assigned to the client. D. An address response to a ping from the DHCP server. Answer: D QUESTION 127 The exhibit shows a snoop trace that reveals that the system clocks on the client and the server did not synchronize after several queries. Certkiller -SR04 -> Certkiller -SR10 NTP client [st=0] ( :13: ) Certkiller -SR10 -> Certkiller -SR04 NTP server [st=4] ( :15: ) Certkiller -SR04 -> Certkiller -SR10 NTP client [st=0] ( :13: )

47 Certkiller -SR10 -> Certkiller -SR04 NTP server [st=4] ( :15: ) Certkiller -SR04 -> Certkiller -SR10 NTP client [st=0] ( :13: ) Certkiller -SR10 -> Certkiller -SR04 NTP server [st=4] ( :15: ) Certkiller -SR04 -> Certkiller -SR10 NTP client [st=0] ( :13: ) Certkiller -SR10 -> Certkiller -SR04 NTP server [st=4] ( :15: ) Why is this so? A. The NTP server daemon is NOT enabled. B. The NTP client is configured as a broadcast client. C. The /etc/init/ntp.client file is NOT properly configured to synchronize the client and server. D. The NTP client needs more updates from the NTP server to synchronize. Answer: D QUESTION 128 As a result of an NTP client refusing to synchronize with the NTP server, the two systems' clocks drifted too far apart to allow the xntpd daemon to align them and the NTP protocol to synchronize them. You need to synchronize the server and the client. What should you do? (Select TWO options.) A. Make use of zdate to synchronize the two systems. B. Make use of rdate to synchronize the two systems. C. Make use of ntpdate to synchronize the two systems. D. Make use of syncdate to synchronize the two systems. E. Make use of ntptrace to synchronize the two systems. Answer: BC QUESTION is the IP address of an NTP Stratum 4 server. Select the entry that is indicative of undisciplined clock usage by the server. A. server in the NTP configuration file. B. server local in the NTP configuration file. C. server prefer in the NTP configuration file. D. server local in the NTP configuration file. Answer: C QUESTION 130 What is the default Stratum level that an NTP server will report itself as when it is configured to synchronize from three other NTP servers? The three NTP servers are all Stratum 2 servers. A. Stratum 1

48 B. Stratum 2 C. Stratum 3 D. Stratum 4 E. Stratum 6 Answer: C QUESTION 131 You received instructions to configure an NTP server. Your configuration must ensure that the server will make use of its local undisciplined clock and an external server address namely You are also instructed to create the following fudge line. fudge stratum 4 Why did you have to add this fudge line? A. You need to ensure that only servers below stratum 4 are queried. B. You need to ensure that the server's local clock is seen as a stratum 4 server. C. You need to ensure that the synchronization is checked at 4:00 A.M. each day. D. You need to make the xntpd daemon check the clients' clock every 4 minutes. Answer: B QUESTION 132 A Solaris OS workstation was configured and enabled an NTP client to use the default multicast address for communicating with an available local NTP server by another administrator. You need to determine whether the clock is synchronized with a public reference NTP server or an alternate undisciplined clock. What should you do? A. Use the ntptrace command on the client. B. Use the ntpq localhost command on the client. C. Use the cat /etc/inet/ntp.conf command on the client. D. Use the svcadm enable svc:/network/ntp command on the client. Answer: A QUESTION 133 You were instructed to configure a Solaris 10 OS host to operate as an NTP server. What should you do? (Select TWO options.) A. You should edit the /etc/inet/ntp.server file on the host. B. You should populate a /etc/inet/ntp.conf file on the host. C. You should run the snoop -d qfe0 grep NTP command on the host. D. You should run the /usr/sbin/ntp.server start command on the host. E. You should run the svcadm enable svc:/network/ntp command on the host. Answer: BE

49 QUESTION 134 The purpose of the Solaris IP Filter firewall is to provide a set of user level utility and kernel modules. Which of the following represents kernel modules? (Select TWO options.) A. ipf B. pfil C. ipfs D. ipnat E. ipmon F. ippool Answer: AB QUESTION 135 You are configuring Solaris 10 OS has packet filtering on all network interfaces. The current entries in the /etc/ipf/pfil.ap file is shown in the exhibit: # IP Filter pfil autopush setup # # See autopush(1m) manpage for more information. # # Format of the entries in this file is: # #major minor lastminor modules #le -1 0 pfil #qe -1 0 pfil hme-1 0 pfil #qfe -1 0 pfil #eri -1 0 pfil #ce -1 0 pfil #bge -1 0 pfil #be -1 0 pfil #vge -1 0 pfil #ge -1 0 pfil #nf -1 0 pfil #fa -1 0 pfil #ci -1 0 pfil #el -1 0 pfil #ipdptp -1 0 pfil #lane -1 0 pfil #dmfe -1 0 pfil You need to enable the Solaris IP Filter firewall for the hme0 interface without rebooting the system. What should you do? A. Run the ifconfig hme0 pfil; ifconfig hme0 modlist UNIX command. B. Run the autopush -f /etc/ipf/pfil.ap; ifconfig hme0 modlist UNIX command. C. Run the ifconfig hme0 modlist; autopush -f /etc/ipf/pfil.ap UNIX command. D. Run the ifconfig hme0 down; ifconfig hme0 unplumb; ifconfig hme0 plumb; autopush -f /etc/ipf/pfil.ap UNIX command. E. Run the autopush -f /etc/ipf/pfil.ap; ifconfig hme0 down unplumb; ifconfig hme0 plumb UNIX command. Answer: E

50 QUESTION 136 The exhibit shows the content of the /etc/ipf/ipf.conf file of a server that is configured to run Solaris 10 OS and has packets filtering enabled. pass in proto tcp from any to any port = 23 pass in proto tcp from any to any port = 21 block in all Referring to the exhibit, which of the following statements are valid? A. The server will block all incoming packets from any client that wants to establish a tcp connection. B. The server will only permit ftp connections. C. The server will only permit telnet connections. D. The server will permit only telnet and ftp connections. Answer: A QUESTION 137 The exhibit shows a portion of the Certkiller.com network: Certkiller -WS202 has the IP address /32 and Certkiller -WS302 has the IP address /32. The Solaris 10 OS server named Certkiller -SR02 has the IP address /32. Packet filtering is enabled on Certkiller -SR02 and the /etc/ipf/ipf.conf files of Certkiller -SR02 contains the following rules: pass in quick from /32 to any pass in proto tcp from /32 to any port = 23 block in all Which of the following statements regarding the above Solaris IP filter configuration on Certkiller -SR02 is true? A. Certkiller -SR02 drops all packets coming from either Certkiller -WS202 or Certkiller -WS302. B. Certkiller -SR02 accepts any packets from Certkiller -WS202 and none from Certkiller -WS302. C. Certkiller -SR02 accepts only telnet packets from Certkiller -WS302 and none from Certkiller -WS202. D. Certkiller -SR02 accepts any packets from Certkiller -WS202 and only telnet packets from Certkiller -WS302.

51 Answer: B QUESTION 138 The exhibit shows the rules currently contained on a Solaris 10 OS server that has packet filtering enabled: pass in all pass in quick from any to any port = 22 pass in quick from any to any port = 80 pass in from any to any port = 23 pass in from any to any port = 25 block in all With regard to the above exhibit, which of the following statements is true? A. FTP-, SMTP- and Telnet connections from all hosts are blocked by the ipfilter software. B. FTP-, SSH- and SMTP connections from all hosts are blocked by the ipfilter software. C. FTP-, Telnet- and HTTP connections from all hosts are blocked by the ipfilter software. D. Telnet-, SSH- and SMTP connections from all hosts are blocked by the ipfilter software. Answer: A QUESTION 139 The rules governing an existing firewall are contained in the /etc/ipf/ipf.conf file. You were instructed to modify the existing Solaris IP Filter rules to enable inbound HTTP traffic to reach a newly implemented web server. You activate the new rule but it does not behave as expected. All outbound response traffic is being blocked and when you run the ipfstat -0command, you get the following output: block out all What has the administrator forgotten? A. The administrator neglected to restart of the ipfilter service. B. The administrator neglected to add the rule allowing outbound auth fragments. C. The administrator neglected to add a keep state keyword on the inbound rule. D. The administrator neglected to enable the default web server group for HTTP traffic. Answer: C QUESTION 140 There is a host running Solaris IP Filter. You have been instructed to audit this post. You thus verify the contents of the /etc/ipf/ipf.conf file and now you need to make sure that the rules listed in this configuration file have been applied to the currently running Solaris IP Filter service. What should you do? A. Run the ipstate -a command to list the rules currently applied by the filter. B. Run the ipfstat -io command to list the rules currently applied by the filter. C. Run the autopush -l ipf command to list the rules currently applied by the filter. D. Run the cat /etc/ipf/ipf.conf command to list the rules currently applied by the filter.

52 Answer: B QUESTION 141 The exhibit shows the Solaris IP Filter rule that is currently configured and enabled on a host on the Certkiller.com network: pass out quick all block in all pass in from /36 to any block out on qfe0 Which of the following statements describes the effects that this rule will have? (Select TWO options.) A. This rule will permit all outbound packets. B. This rule will block all outbound packets leaving qfe0. C. A total of two rules are applied to the outbound packets of this host. D. This rule will permit all inbound packets from host Answer: AD QUESTION 142 DRAG DROP You run the ipfstat -in command on Certkiller -WS302 which has Solaris IP Filter firewall enabled. What is the order of the rules matched for an inbound telnet connection from a system ? To answer select the correct rules from the column on the left and place it in the correct order in the column on the right. A. B. C. D. Answer:

53 QUESTION 143 Which of the following statements are valid? (Select TWO options.) A. The default setting on the Solaris IP Filter is to block all packets. B. It is possible to configure the Solaris IP Filter as a routing firewall. C. It is possible to configure the Solaris IP Filter as a host-based firewall. D. It is possible to configure the Solaris IP Filter as an application-level firewall. E. The SunScreen application should be configured before running the Solaris IP Filter. Answer: BC QUESTION 144 Certkiller.com had a Solaris system named Certkiller -SR01. You configure Certkiller -SR01 as a host-based firewall by configuring Solaris IP Filter on it. You then attempt to telnet to Certkiller -SR01 from a client names Certkiller -WS302. You receive the following error: $ telnet Certkiller -SR01 Trying telnet: Unable to connect to remote host: Connection timed out You then run the netstat -acommand on Certkiller -SR01 and find the following entry: Which of the following is the probable cause of this problem? A. The ipf kernel module has not been loaded on Certkiller -SR01. B. There is not route defined on Certkiller -WS302 that points to Certkiller -SR01. C. Certkiller -SR01 has a block out rule for traffic to Certkiller -WS302. D. Because Telnet is an insecure protocol, it is always blocked by Solaris IP Filter. Answer: C

54 QUESTION 145 You enable Solaris IP Filter on the bge0 network interface of your Solaris system and configure it to block all incoming traffic. You however discover that you can still telnet to the Certkiller.com server. You want to verify that the e Solaris IP Filter kernel modules are loaded and bound to the qfe0 network interface on your system. What should you do? (Select TWO options.) A. Run the ipf -kernel command. B. Run the ipmon -f bge0 command. C. Run the modinfo grep ipf command. D. Run the ifconfig bge0 pfil command. E. Run the ifconfig bge0 modlist command. Answer: CE QUESTION 146 You work as the Solaris IP Filter administrator at Certkiller.com. The Certkiller.com network contains a Solaris system named Certkiller -SR21 that is used for beta testing. You need to create rules granting access to Certkiller -SR21. You need to grant access to a select group of users that are located on a large number of IP subnets. Which of the following can you use create the required rules? A. The Solaris IP Filter group feature. B. The Solaris IP Filter quick feature. C. The Solaris IP Filter keep flag feature. D. The Solaris IP Filter address pool feature. Answer: D QUESTION 147 The Certkiller.com network contains numerous servers that are running many services. One of the servers is named Certkiller -SR07. Certkiller -SR07 runs Solaris 10 OS and functions as an ssh server. Certkiller -SR07 also has the packet filter enabled and configured. The rule set on the server is: pass in quick proto tcp from any to any port = 22 keep state block in all The rule set is added as an inactive rule set to the ipf kernel module of Solaris 10 OS. The Certkiller.com administrator is performing maintenance on the ssh software on Certkiller -SR07. Therefore a telnet connection to Certkiller -SR07 must be used. To allow telnet connections you change the rule set to: pass in quick proto tcp from any to any port = 23 keep state block in all You need to list the inactive rule set and make it active. What should you do? A. Run the ipmon -i; ipf -I command. B. Run the ipmon -i; ipf -s command. C. Run the ipfstat -i; ipf -I command. D. Run the ipfstat -ii; ipf -s command. E. Run the ipmon -l; ipfstat -io command. Answer: D

55 QUESTION 148 You work as the firewall administrator at Certkiller.com. The network interface of your firewall that connects to the internet has the IP address You work at a workstation named Certkiller -WS302 that is configured with the static IP address of You want to log all outbound connections from Certkiller -WS302. What should you do? A. Add the rule pass out log quick from to any flags keep state to your firewall's Solaris IP Filter configuration file. B. Add the rule pass in log quick from to any flags keep state to your firewall's Solaris IP Filter configuration file. C. Add the rule pass in quick from to any flags keep state log to your firewall's Solaris IP Filter configuration file. D. Add the rule pass out quick from to any flags keep state log to your firewall's Solaris IP Filter configuration file. Answer: B QUESTION 149 The Solaris IP Filter is enabled on a Solaris system router that is configured with two network interfaces on different subnets. The router has the IP address of You apply the following ipf.confconfiguration to the router: pass in quick from any to any port = 80 keep state pass in on hme0 from any to /32 port = 22 block in all block out all Which of the following statements describes the effects that this rule will have? (Select TWO options.) A. This rule will block all outbound HTTP traffic. B. This rule will block all inbound SSH traffic on the hme0 interface. C. This rule will block port 80 traffic to host D. This rule will permit all inbound traffic from host Answer: AB QUESTION 150 The Solaris IP Filter is enabled on a Solaris system that has the IP address of The Solaris IP Filter is configured to block all outbound traffic. You need to ping hosts on an IP subnet from the Solaris system. The subnet on which the hosts are located uses a Class B network address. What should you do? A. Add the rule pass out quick proto icmp from /32 to /16 to your firewall's Solaris IP Filter configuration file. B. Add the rule pass out quick proto tcp/udp from /32 to any to your firewall's Solaris IP Filter configuration file. C. Add the rule block out quick proto icmp from /32 icmp-type 9 to your firewall's Solaris IP Filter configuration file.

56 D. Add the rule pass out proto ping from /32 to /24 keep state to your firewall's Solaris IP Filter configuration file. Answer: A QUESTION 151 You work as the firewall administrator at Certkiller.com. You create a /tmp/ckrules file that contains additional Solaris IP Filter rules. Which of the following statements describes the effects that running the ipf -f /tmp/ckrulescommand will have? (Select TWO options.) A. The ipf -f /tmp/ckrules command will update the inactive rule set. B. The ipf -f /tmp/ckrules command will update the /etc/ipf/ipf.conf file. C. The ipf -f /tmp/ckrules command will ensure that packets are filtered based on the additional rules. D. The ipf -f /tmp/ckrules command will flush the active rule set and replace it with rules in /tmp/ckrules. E. The ipf -f /tmp/ckrules command will append the additional rules contained in /tmp/ckrules to the running rule set. Answer: CE QUESTION 152 You work as the system administrator at Certkiller.com. You are implementing the first Solaris IP Filter for the Certkiller.com network. You apply an initial set of filtering rules in the /etc/ipf/ipf.conf file. However, the filtering rules are preventing users from connecting to the server. You want to restore user access as soon as possible while troubleshooting rules that have been applied. What should you do? A. Run the halt; ipf -f command. B. Run the ipf -D; ipf -Fa command. C. Run the ipf -f /etc/ipf/ipf.conf command. D. Run the autopush -f /etc/ipf/pfil.ap command. Answer: B QUESTION 153 Your Solaris system contains two Solaris zones named Zone 1 and Zone 2. Zone 1 uses the IP address on the interface hme0:1 while Zone 2 uses the IP address on the interface hme0:2. You create and activate Solaris IP Filter rules that filter all UDP traffic between two zones. The Solaris IP Filter rules are shown below: block in quick proto udp from to block in quick proto udp from to You later discover that UDP traffic is still allowed between the two zones. What is the cause of this problem? A. You need to apply at least one pass in rule. B. You need to remove the quick option in both rules. C. Solaris IP Filter is NOT able to filter traffic on HME interfaces. D. Solaris IP Filter is NOT able to filter UDP traffic. E. Solaris IP Filter is NOT able to filter traffic between zones on the same system. Answer: E

57 QUESTION 154 A Solaris 10 OS system has two network interfaces named hme0 and bge1. You want to configure the Solaris system to function as a firewall between the two interfaces. You enable and configure Solaris IP Filter on the system. What must you do next? A. You must enable IPv4 routing. B. You must enable IPv4 forwarding. C. You must run the ipf -D command. D. You must apply the latest Solaris 10 OS kernel patch E. You must disable directed broadcasts on the hme0 and bge1 interfaces. Answer: B QUESTION 155 You are configuring Solaris IP Filter on a Solaris 10 OS system. The following entry is in /usr/include/netinet/ip_icmp.h: #define ICMP_REDIRECT 5 /* shorter route, codes:/ You want to block all ICMP Redirect packets. What should you do? A. Add the rule block in quick proto 5 from any to 0/32 to the Solaris IP Filter configuration file. B. Add the rule block in quick proto ip 5 from any to 0/32 to the Solaris IP Filter configuration file. C. Add the rule block in quick proto icmp-type 5 from any to 0/32 to the Solaris IP Filter configuration file. D. Add the rule block in quick proto ip icmp-type 5 from any to 0/32 to the Solaris IP Filter configuration file. E. Add the rule block in quick proto icmp from any to 0/32 icmp-type 5 to the Solaris IP Filter configuration file. Answer: E QUESTION 156 You have applied a Solaris IP Filter rule with the quickoption to immediately act upon a packet that matches the rule and bypass the normal rule checking sequence. Which of the following statements regarding this rule is true? A. The Solaris IP Filter continues to process a packet that matches a rule with the keyword quick when the packet is originally redirected by the NAT layer. B. The Solaris IP Filter continues to process a packet that matches a rule with the keyword quick when the quick keyword matching is disabled with the ipf command. C. The Solaris IP Filter continues to process a packet that matches a rule with the keyword quick when an earlier rule is also applied to the packet, negating the quick option. D. The Solaris IP Filter continues to process a packet that matches a rule with the keyword quick when the rule passes the packet to a numbered group where it matches a later rule. Answer: D

58 QUESTION 157 The Certkiller.com network contains a Solaris 10 OS system named Certkiller -SR01. Certkiller -SR01 has two network interfaces named ce0 and ce1. Packet filtering is enabled and configured on Certkiller -SR01 and the Solaris IP Filter configuration is stored in the /etc/ipf/ipf.conf file. The Solaris IP Filter rule is: pass in quick proto tcp from any to any port = 22 keep state block in all This rule allows ssh connections to Certkiller -SR01 from the ce0 and ce1 interfaces. You change the Solaris IP Filter to allow ssh connections to Certkiller -SR01 only from the ce0 interface. The new Solaris IP Filter rule is: pass in quick on hme0 proto tcp from any to /32 port = 22 keep state block in all You need to load the new packet filtering rule /etc/ipf/ipf.conf. What should you do? A. Run the ipf -f /etc/ipf/ipf.conf command on Certkiller -SR01. B. Run the ipmon -f /etc/ipf/ipf.conf command on Certkiller -SR01. C. Run the ipf -Fa -f /etc/ipf/ipf.conf command on Certkiller -SR01. D. Run the ipf -Fo -f /etc/ipf/ipf.conf command on Certkiller -SR01. E. Run the ipmon -Fa -f /etc/ipf/ipf.conf command on Certkiller -SR01. Answer: C QUESTION 158 The Certkiller.com network consists of three IP subnets, of which one uses the address space /24. This subnet contains a Solaris 10 OS server named Certkiller -SR02 that uses the IP address /32. Currently all Solaris 10 OS servers on the network have Solaris IP Filter firewall enabled with a default policy rule that blocks all incoming connections. You need to change the Solaris IP Filter firewall configuration on Certkiller -SR02 to allow connections to its X:0 to X:9 terminal ports from the /24 subnet. What rule must you add to the /etc/ipf/ipf.conf firewall configuration file? A. pass in quick proto tcp from /32 to any port 5999 <> 6010 B. pass in quick proto tcp from /24 to any port 5999 >< 6010 C. pass in quick proto tcp from /24 to any port 5999 <> 6010 D. pass in quick proto tcp from /32 to any port 5999 >< 6010 Answer: B QUESTION 159 The Certkiller.com network contains a Solaris 10 OS server named Certkiller -SR01. You enable the packet filter on Certkiller -SR01. The following rule of Solaris IP Filter firewall is stored in the /etc/ipf/ipf.conf file on Certkiller -SR01 and blocks all Internet Control Message Protocol (ICMP) traffic: block in proto icmp all You want to change this rule so that it only prevents ping traffic. What should you do? A. Change the rule to block in proto icmp from any to any. B. Change the rule to block in proto icmp all icmp-type echo. C. Change the rule to block in proto icmp all icmp-type dest-unreach. D. Change the rule to block in proto icmp from any to any icmp-type dest-unreach. Answer: B QUESTION 160

59 You are the system administrator of a firewall running Solaris IP Filter. You write an updated set of rules in /root/ckrules. You want to test the new rules for syntax errors before implementing them. What should you do? A. Run the ipf -n -f /root/ckrules command. B. Run the ipf -Fa -f /root/ckrules command. C. Run the svcadm restart svc:/network/ipfilter:/root/ckrules command. D. Run the inetadm restart svc:/network/ipfilter:/root/ckrules command. Answer: A QUESTION 161 You have enabled packet filtering on a Solaris 10 OS server. You want to review information on stdout regarding packets that match rules. What should you do? A. Run the ipmon command. B. Run the ipf -l block command. C. Run the netstat -a block command. D. Run the syslogd -d sysout command. Answer: A QUESTION 162 To which of the following syslog facilities will Solaris IP Filter send logging information to by default? A. kern B. auth C. local0 D. daemon Answer: C QUESTION 163 Which of the following /etc/syslog.conf file lines will log blocked packets to the /var/adm/ipflog file considering that the Solaris IP Filter is configured to log blocked packets to the syslog using the default syslog facilities and levels? A. kern.error /var/adm/ipflog B. auth.error /var/adm/ipflog C. daemon.warning /var/adm/ipflog D. local0.warning /var/adm/ipflog E. local0.error /var/adm/ipflog Answer: D

60 QUESTION 164 The Solaris IP Filter firewall allows for its actions to be logged by its logging device: /dev/ipl. Using a log keyword will ensure that packets are available to the logging device. You need to use a log keyword to configure a rule match to be logged. Which of the following is logged by the Solaris IP Filter firewall? A. The log block in all rule match. B. The block in all log rule match. C. The block in quick on eri0 from any to any log rule match. D. The block in log quick on eri0 from any to any rule match. E. The block in quick on hme0 proto tcp log from any to any rule match. Answer: D QUESTION 165 Exhibit: The Certkiller.com network contains a firewall system named Certkiller -SR02 that is running the Solaris IP Filter firewall. Certkiller -SR02 has a rule set to log and NAT the Certkiller -SR10 system with the IP address /32 as Certkiller -SR12 with the IP address /32. You want to print only NAT log records on Certkiller -SR02. What must you do? A. Run the ipf -l N Solaris IP Filter user-level utility. B. Run the ipnat -l N Solaris IP Filter user-level utility. C. Run the ipfstat -n Solaris IP Filter user-level utility. D. Run the ipmon -o N Solaris IP Filter user-level utility. Answer: D QUESTION 166 The log records of the Solaris IP filter firewall hold the packets filtering information. The exhibit shows the output of the ipmon -o I command when using state: 15:34: b ,443 -> ,4923 PR tcp len A How would you interpret the third A. field indicates that there are two ppp interfaces. B. field indicates that the packet sizes being logged is two kilobytes. C. field indicates that there are two packets logged on the hme0 interface.

61 D. field indicates that the event logged in this case was caused by rule 2 in group 0. Answer: D QUESTION 167 Certkiller -WS302 is a Solaris 10 OS system that has been configured with Solaris IP Filter firewall. The appropriate rules have been added to the Solaris IP Filter configuration file to log packets since packet filtering has been enabled. Given the following command: ipmon -D /var/tmp/filterlog.txt Which of the following statements are true? (Select TWO options.) A. The command instructs ipmon to run as a daemon. B. The command will ensure that the contents of the /var/tmp/filterlog.txt file are purged. C. The command will result in the logging information being captured to the /var/tmp/filterlog.txt file. D. The Solaris IP Filter firewall rule-set will be downloaded into the /var/tmp/filterlog.txt file using this command. E. The command will result in downloading only the logging rule-set into the /var/tmp/filterlog.txt file. Answer: AC QUESTION 168 Certkiller -SR310 is a web server. Which of the following rules should be added to the Solaris IP Filter configuration file if you want to log all attempts to connect to the Certkiller -SR302 SMTP port? A. You should add the block in from any to port = 25 log Solaris IP Filter rule. B. You should add the block in log quick from any to port = 25 Solaris IP Filter rule. C. You should add the log block in quick from any to any port = 25 Solaris IP Filter rule. D. You should add the block in log quick from any to any port = 25 Solaris IP Filter rule. Answer: D QUESTION 169 The exhibit shows the filtering rules that have been configured on Certkiller -WS302: pass in quick from any to any port = 22 pass in quick from any to any port = 80 pass out all keep state block in any You need to verify that the Solaris IP Filter is correctly blocking packets. What should you do? A. Use the ipmon command. B. Use the ipfstat command. C. Use the netstat -f ipf command. D. Use the tail -f /var/adm/messages command. Answer: B

62 QUESTION 170 Certkiller -SR310 is the company web server. You received instruction to log the TCP packets that are being received by Certkiller -SR310 while taking care not to block any traffic. What should you do? A. Use the pass in proto tcp from any to 0/32 port = 80 Solaris IP Filter rule. B. Use the ignore in log tcp from any to 0/32 port = 80 Solaris IP Filter rule. C. Use the pass in log proto tcp from any to 0/32 port = 80 Solaris IP Filter rule. D. Use the pass in log-only proto tcp from any to 0/32 port = 80 Solaris IP Filter rule. Answer: C QUESTION 171 Solaris IP Filter logs messages of events using the /dev/ipl device. You need to collect these logged events. What should you do? A. Make use of ipmon B. Make use of ipf -l C. Make use of ipfstat D. Make use of syslogd Answer: A QUESTION 172 When reviewing the log on a Solaris system, you discover the message shown in the exhibit: Jun 17 18:26:35 ennovy ipmon[757]: 18:26: b , > ,139 PR tcp len S IN Which configuration line led to this message being logged? A. block in log on qfe1 all head 100 B. block in log on qfe2 all head 200 C. block in log on qfe1 from to any D. block in log on qfe1 proto tcp all flags S/SA group 100 E. pass in quick proto icmp from any to /32 group 100 Answer: D QUESTION 173 Certkiller -WS310 is a Solaris 10 OS system that has Solaris IP Filter software installed and enabled for the IPv4 addresses on the hme0 interface. The hme0 IP address is You then started the Solaris IP Filter software without rebooting Certkiller -WS310. At present the hme0 interface is unplumbed. You

63 then create a rule set in the /etc/ipf/ipf.conf file and need to complete the process. What should you do? (Each correct answer presents part of the solution. Select THREE options.) A. You should run the edit /etc/ipf/pfil.ap command. B. You should run the autopush -f /etc/iu.ap command. C. You should run the autopush -f /etc/ipf/pfil.ap command. D. You should run the ipf -f /etc/ipf/ipf.conf start command. E. You should run the svcadm enable svc:/network/ipfilter:default command. F. You should run the inetadm enable svc:/network/ipfilter:default command. Answer: ACE QUESTION 174 Certkiller -WS302 is a Solaris 10 OS system that is running Syslog and IP Filter. You need to configure Solaris IP Filter on Certkiller -WS302 to log all blocked packages to the /var/adm/ipf.blocked file. What should you do? (Select THREE options.) A. Enable logging by running the ipmon -D -s command. B. Enable logging by running the edit /etc/syslog.conf command. C. Enable logging by running the ipf -f /var/adm/ipf.blocked command. D. Enable logging by running the inetadm -e svc:/system/system-log:default command. E. Enable logging by running the svcadm restart svc:/system/system-log:default command. Answer: ABE QUESTION 175 DRAG DROP The Solaris IP Filter firewall is enabled on an HTTP server named Certkiller -SR12. Certkiller -SR12 has a hme0 interface with the You are creating a rule that will allow any incoming Internet connections on the hme0 interface for the HTTP service. Place the appropriate options in the correct position to complete the Solaris IP Filter firewall rule.

64 A. B. C. D. Answer: QUESTION 176 A server named Certkiller -SR22 that usually boots from the network continually displays the following error message: Timeout waiting for ARP/RARP packet. You need to address the problem and thus run the snoopcommand on Certkiller -SR22. The snoopcommand revealed that RARP packet did arrive, but Certkiller -SR22 remains unresponsive. You need to determine why Certkiller -SR22 is not responding. What should you do? A. Run the ndd -set /dev/arp debug 1 command. B. Run the svcadm restart svc:/network/rarp:debug command. C. Run the inetadm restart svc:/network/rarp:debug command. D. Run the pkill in.rarpd ; /usr/sbin/in.rarpd -da command. E. Run the svcadm disable -t /network/rarp; /usr/sbin/in.rarpd -da command. Answer: E

65 QUESTION 177 DRAG DROP Match the network cabling with its associated Ethernet media. A. B. C. D. Answer: QUESTION 178 DRAG DROP Place the Ethernet-II frame components in the correct order that they would appear in the frame.

66 A. B. C. D. Answer: QUESTION 179 DRAG DROP Match each frame error to the appropriate description.

67 A. B. C. D. Answer: QUESTION 180 Which of the following statements regarding network cables are true? (Select FOUR options.) A. Optical Fiber cabling is resistant to RFI. B. Optical Fiber cabling is resistant to EMI. C. Optical Fiber cabling requires shorter cables than other cabling media. D. Optical Fiber cabling is less resistant to physical stress. E. Optical Fiber cabling is the most reasonably priced network cables. F. It is more difficult to intercept data that is transmitted over optical fiber cabling. Answer: ABDF QUESTION 181

68 DRAG DROP You are configuring a Sun UltraSPARC machine for network access. Match the correct "local-mac-address?" OBP variable value on the appropriate definition. (Not all definitions are to be used.) A. B. C. D. Answer: QUESTION 182 DRAG DROP Match the appropriate command or file to the action on that it produces on the ce0 interface.

69 A. B. C. D. Answer: QUESTION 183 Certkiller -SR21 is the Solaris 10 OS system that runs HTTP services. Certkiller -SR21 has two Ethernet interfaces named bge0 and bge1. At present link-based IPMP is configured on bge0 and bge1. You need to accommodate the envisaged future recabling of the network and consequently test the IPMP configuration. You take bge0 offline and fail network access over bge1. Now you need to force the failover. What should you do? A. Use the ipconfig bge0 failover command. B. Use the ifconfig -f bge0 command. C. Use the if_mpadm -d bge0 command. D. Use the if_mpadm -f bge0 command. E. Use the if_mpadm -r bge0 command. Answer: C QUESTION 184 Certkiller -SR22 is a Solaris 10 OS multi-homed host that has three properly configured interfaces. Presently routing and forwarding is disabled on Certkiller -SR22. You need to turn on IP forwarding permanently without Certkiller -SR22 requiring a reboot. What should you do? A. Use the ifconfig Certkiller -sr22 routing command to enable IP forwarding. B. Use the routeadm -e forwarding command to enable IP forwarding. C. Use the routeadm -u -e routing command to enable IP forwarding. D. Use the routeadm -u -e ipv4-forwarding command to enable IP forwarding. E. Use the routeadm -u -f ipv4-forwarding command to enable IP forwarding. Answer: D

70 QUESTION 185 DRAG DROP When you use the snoop utility to examine IPv6 encapsulation, you discover the ICMPv6, ETHER, IPv4 and IPv4 protocols. Place these protocols in the correct order of encapsulation in which they would be displayed in the snoop utility output, from the outermost to the innermost protocol in terms of encapsulation. A. B. C. D. Answer: Explanation: As IPv4 and ICMPv6 are mentioned, the encapsulation is an IPv6 over IPv4 tunnel and as such snoop will show Ether followed by the tunnel (IPv4) and then the IPv6 header, type. QUESTION 186 The name server zone file contains Resource records are entries in the general format of: [name] [ttl] class type data Which of the following is a valid resource record for a Solaris system named SR02? A IN SOA SR02. Certkiller.com B IN NS SR02. Certkiller.com

71 C IN A SR02. Certkiller.com D IN PTR SR02. Certkiller.com E IN CNAME SR02. Certkiller.com Answer: D QUESTION 187 DRAG DROP Match the DNS record type to its description. A. B. C. D. Answer:

72 Explanation: Reference: QUESTION 188 DRAG DROP Place each DHCP packet in the correct position as it would occur during DHCP client-server interaction. A. B. C. D. Answer:

73 QUESTION 189 DRAG DROP Match the file name or identifier to its associated action. A. B. C. D. Answer:

74 QUESTION 190 You are creating filtering rule sets for a Solaris 10 OS IP Filter firewall. You want to create a rule that blocks outgoing ICMP echo replies on the hme0 interface. Which of the following rules meets your requirements? A. block in quick hme0 proto icmp from any to any icmp-type echo B. block out quick hme0 proto icmp from any to any icmp-type ping C. block in quick hme0 proto icmp from any to any icmp-type log D. block out quick hme0 proto icmp from any to any icmp-type echorep Answer: D QUESTION 191 DRAG DROP Match the ipnat configuration keyword of the NAT function of the Solaris IP Filter software with its associated function. A. B. C. D. Answer:

75 Reference: QUESTION 192 DRAG DROP Match the appropriate term to its correct layer of the Internet Protocol. A. B. C. D. Answer:

76 QUESTION 193 DRAG DROP Match the network component to the correct layer of the OSI model at which it operates. A. B. C. D. Answer:

77 QUESTION 194 DRAG DROP Place the following Ethernet frame options in the correct order to complete the structure of the Ethernet frame. A. B. C. D. Answer: QUESTION 195 DRAG DROP Match the appropriate TCP/IP protocol or standard to the associated layer of the OSI model.

78 A. B. C. D. Answer: QUESTION 196 DRAG DROP The Certkiller.com network contains a DHCP client that had previously been assigned the IP address When the client is rebooted, a number of DHCP packets to and from the client are shown when you run snoopon the DHCP server. Place the DHCP packets in the correct order that they would appear in the output from the snoopcommand.

79 A. B. C. D. Answer: Explanation: The.154 request received a negative response (NAK) then the normal DISCOVER-OFFER-REQEST-ACK is performed. QUESTION 197 DRAG DROP The CertKiller.com network has a Solaris 10 OS system that functions as a routing firewall that uses Solaris IP Filter and NAT. Place the following steps in correct processing order for a packet passing through this system. (Some steps must be used more than once.)

80 A. B. C. D. Answer: Explanation: Reference:

81 QUESTION 198 DRAG DROP Match the default minimum syslog logging level to the type of packet the Solaris IP Filter logs at that level. A. B. C. D. Answer: Explanation: Reference: QUESTION 199 You are creating filtering rule sets for a Solaris 10 OS IP Filter firewall. You want to create a rule that allows incoming RPC requests to the rpcbind daemon from the /24 network on the bge0 interface only. Which of the following rules meets your requirements? A. pass in quick bge0 proto tcp/udp from /24 to any port = 111 B. pass in quick bge0 proto tcp from any to /24 port = 111 C. pass in quick bge0 proto rcpbind from any to /24 port = 111 D. pass in quick bge0 proto rcp from /24 to any port = 111 Answer: A

82 QUESTION 200 DRAG DROP You have enabled and configured packet filtering on a Solaris 10 OS system. You also enable logging of Solaris IP Filter activity. You assume a role that includes the Solaris IP Filter Management right profile. Place the following commands in the correct order of execution to save logged packets to a file named ck_log, flush the packet log buffer, and print the content of the ck_log file to stdout. (You do not need to use all the options.) A. B. C. D. Answer:

83 QUESTION 201 You are creating filtering rule sets for a Solaris 10 OS IP Filter firewall. You want to create a rule that blocks, returns RST, and logs only incoming auth connections on TCP port 113. Which of the following rules meets your requirements? A. block retrun-rst in quick proto tcp/udp from any to any port = 113 B. block retrun-rst in quick proto tcp from any to any port = 113 C. block retrun-rst in log quick proto tcp from any to any port = 113 D. block in quick proto tcp from any to any port = 113 Answer: C QUESTION 202 DRAG DROP Place the following address fields in the correct order as they would appear in an aggregatable global unicast address format.

84 A. B. C. D. Answer: Explanation: Reference: QUESTION 203 DRAG DROP Match the following IPv6 address types to the correct description: A. B. C. D. Answer:

85 Explanation: Reference: QUESTION 204 You received instructions to configure an IPv6 router that will accommodate IPv6 to IPv4 communication. What should you do? (Each correct answer presents part of the solution. Select TWO options.) A. Run the ifconfig ip.6t04tun0 inet6 ndpd command. B. Run the ifconfig ip.6t04tun0 inet6 tsrc ffe80:d0c1:1e11 :ffff::1 /64 up command. C. Run the ifconfig ip.6t04tun0 inet6 plumb command. D. Run the ifconfig ip.6to4tun2 inet6 tsrc fec0:d0c1:1e11 :ffff::1 /64 up command. E. Run the ifconfig ip.6t04tun0 inet6 tsrc :d0c1:1e11 :ffff::1 /64 up command. Answer: CE Reference: QUESTION 205 DRAG DROP Place the appropriate option in the correct order that they would appear in the UDP header section. (You do not need to use all the options.)

86 A. B. C. D. Answer: QUESTION 206 You received instructions to create a redirection rule that will translate your internal IP address to a single externally routeable IP address on a new Sun Solaris server that must be deployed as an Internal firewall. At present the IP address on the Internet facing interface, ge0, is assigned by DHCP. Internal IP addresses are part of the /24 subnet. You need to use the proper ipnat configuration keywords to create the appropriate rule to accomplish this task. What should you do? A. You should use the dhcp ge /24 -> 0/32 ipnat rule. B. You should use the map ge /32 -> any ipnat rule. C. You should use the rdr ge /24 -> 0/32 ipnat rule. D. You should use the map ge /24 -> 0/32 ipnat rule. E. You should use the map ge /32 -> any ipnat rule. Answer: D Reference: QUESTION 207 DRAG DROP Match the following objects to its associated description.

87 A. B. C. D. Answer: QUESTION 208 What should you do to display all current ARP table entries on a system that is connected to a server which you administer? A. Run the arp -a command. B. Run the arp -list command. C. Run the netstat -av command. D. Run the ndd -get /dev/arp ethers command. Answer: A QUESTION 209 Exhibit:

88 You need to reboot Certkiller -WS302. This reboot requires the mounting of a Certkiller -SR02 file system. Certkiller -SR02 is on the local subnet. Considering the above: which of the following represent the Certkiller -SR02 ARP reply? A. The address. B. The address. C. The 7:0:2a:5e:3f:46 address. D. The 7:0:2a:4a:1d:44 address. E. The address. Answer: C QUESTION 210 The Certkiller.com SPARC workstation has a single qfe Ethernet interface. What do you require to configure the interface at boot time? A. The /etc/hosts file. B. The /etc/nodename file. C. The /etc/inet/hosts file. D. The /etc/hostname.qfe0 file. E. The /etc/nodename.qfe0 file. Answer: D QUESTION 211 What is the term used to refer to the unique address that indicates the source of Ethernet frames? A. It is called an IP address. B. It is called the source VLAN. C. It is called the MAC address. D. It is called the Calling Party Address. Answer: C QUESTION 212 The exhibit shows a partial output of a /etc/inet/dhcpsvc.conf file:

89 What type of Solaris system would display this type of entry? A. A DHCP client. B. A DHCP server. C. A Solaris system that is running in.dhcpd -r. D. A Solaris system that is running in.dhcpd in debug mode. Answer: C QUESTION 213 You need to check on one of the Certkiller.com DHCP clients which have its interface down and were configured with a IP address. The exhibit shows the snoop output of a DHCP client after you ran the ifconfig qfe0 dhcp start command: You discover that the output does not include a DHCPDISCOVER packet. What caused this condition? A. The dhcpagent -r hme0 command was used to shut down the interface to not require a DHCPDISCOVER. B. The dhcpconfig -r hme0 command was used to shut down the interface to not require a DHCPDISCOVER. C. The ifconfig hme0 dhcp drop command was used to shut down the interface to not require a DHCPDISCOVER. D. The ifconfig hme0 dhcp release command was used to shut down the interface to not require a DHCPDISCOVER. Answer: C QUESTION 214 DHCP options are passed from DHCP servers to DHCP clients. These options are contained in the /etc/dhcp/inittab file. Which of the following data types are used to specify the type of data that may be assigned as a value for the DHCP options? (Select FOUR options.) A. The ASCII - a text string value. B. The VENDOR - this data type is a string representing the vendor class. C. The OCTET - this data type is the uninterpreted ASCII representation of binary data. D. The CLASS - this data type is an ASCII string representing the client machine type. E. The IP - this data type means one or more IP addresses in dotted decimal format (xxx.xxx.xxx.xxx). F. The BOOLEAN - this data type has no associated value but its presence indicates a true condition. Answer: ACEF QUESTION 215 Which of the following files require updating when DHCP clients on the network are assigned the wrong subnet mask? A. The DHCP server's /etc/netmasks file. B. The DHCP server's /var/dhcp/locale file.

90 C. The DHCP server's /etc/inet/dhcpsvc.conf file. D. The DHCP clients' /var/dhcp/sunwfiles1_dhcptab file. E. The DHCP server's /var/dhcp/sunwfiles1_dhcptab file. Answer: E QUESTION 216 The exhibit shows the /var/adm/messages file of a Certkiller.com NTP client. Mar 28 11:15:51 cobra xntpd[6079]: time reset (step) s Mar 28 11:18:11 cobra xntpd[6079]: time reset (step) s Mar 28 11:24:41 cobra xntpd[6079]: time reset (step) s Mar 28 11:30:12 cobra xntpd[6079]: time reset (step) s Mar 28 11:35:21 cobra xntpd[6079]: time reset (step) s Mar 28 11:42:11 cobra xntpd[6079]: time reset (step) s Mar 28 11:48:19 cobra xntpd[6079]: time reset (step) s It is clear from the time reset (step) messages that this NTP client has been reset at regular intervals with the sign of the step alternating positive and negative with an approximate similar amount. Which of the following commands will yield results in finding the origin of these messages? (Select THREE options.) A. The ntpq command. B. The xntpdc command. C. The ntpstat command. D. The ntpdate command. E. The ntptrace command. Answer: ABE QUESTION 217 The exhibit shows the output of the system administrator command ntpq -p (standard Network Time Protocol query program) of a system that is configured as an NTP client on the Certkiller.com network: Which of the following statements are valid? (Select TWO options.) A. The NTP server is ns1. B. The type of the peer is multicast. C. The polling interval is 15 seconds. D. The current estimated delay is 0.75 seconds. E. The current estimated offset is milliseconds. Answer: BE QUESTION 218 Certkiller.com has a Solaris 10 OS web server. The web server's IP address is You need to ensure that the web server only accept incoming traffic requests from ssh and http ports and should configure the Solaris IP Filter

91 accordingly. What should you do? (Each correct answer presents part of the solution. Select TWO options.) A. Add pass in from to port = 22 to the Solaris OP Filter configuration file. B. Add pass in from to port = 80 to the Solaris OP Filter configuration file. C. Add pass in from any to port = 80 to the Solaris OP Filter configuration file. D. Add pass in from any to port = 22 to the Solaris OP Filter configuration file. E. Add pass in from any to port = 25 to the Solaris OP Filter configuration file. Answer: CD QUESTION 219 DRAG DROP Rearrange the following Solaris IP Filter configuration to improve its performance without changing its functionality. A. B. C. D. Answer:

92 QUESTION 220 Following is a breakdown of the Certkiller.com current organization: 1. There are 7 departments. 2. Each department has between 25 and 400 employees. 3. Each department must get its own separate range of network addresses. 4. Certkiller.com has a single registered Class B address range. You need to apply the appropriate network strategy to make efficient use of the addresses allocated to Certkiller.com. What should you do? A. You should configure static routing tables on all hosts and routers. B. You should use switches with more ports in the larger departments. C. You should divide the address space using variable length subnet masks. D. You should obtain some Class A address ranges for the smaller departments. E. You should create network names for each department using the /etc/netgroup. Answer: C QUESTION 221 You must ensure that a Solaris system that is configured with multiple interfaces that are connected to different networks are enabled to forward packages between these networks. What should you do? A. Run the route -a enable command. B. Run the route -u -e ipv4-forwarding command. C. Run the ndd -set /dev/ip ip_ire_status command. D. Run the ndd -set /dev/ip ip_forwarding 1 command. E. Run the ndd -set /dev/tcp ip_forwarding 1 command.

93 Answer: D QUESTION 222 You are instructed to configure the qfe0 interface with an IPv6 address and the prefix ckc0. What should you do? (Each correct answer presents part of the solution. Select TWO options.) A. The file /etc/ Certkiller 6.qfe0:1 contains a host name, which is defined in the /etc/hosts file. This entry has an IPv6 address prefix of ckc0. B. The file /etc/ Certkiller 6.qfe0 contains a host name defined in the /etc/inet/ipnodes file. This entry has an IPv6 address prefix of ckc0. C. The file /etc/ Certkiller 6.qfe0:1 contains a host name, which is defined in the /etc/inet/ipnodes file. This entry has an IPv6 address prefix of ckc0. D. The file /etc/ Certkiller 6.qfe0 contains an addif hostname entry in addition to the normal host name. This cross-references an entry in /etc/inet/ipnodes with IPv6 address prefix ckc0:. Answer: CD QUESTION 223 Exhibit: With regard to the exhibit, what would be the name of the interface that is used to pass network traffic when the if_mpadm -d qfe1 command is executed? A. hme0 B. hme0:1 C. qfe0:2 D. qfe1:1 Answer: C

94 QUESTION 224 The exhibit shows the IP routing table of a Solaris 10 OS system named Certkiller -WS310: Where will the packets generated by running the ping -s command on Certkiller -WS310 be forwarded? A. Packets will be forwarded to ckrouter1. B. Packets will be forwarded to ckrouter2. C. Packets will be forwarded to ckrouter3. D. Packets will be forwarded to ckrouter4. E. No packets will be forwarded since there is no route to this address. Answer: A QUESTION 225 Exhibit: In this scenario, Certkiller -SR01 must send data to Certkiller -PR01. However Certkiller -SR01 has no entry in its routing table for Certkiller -PR01 or for the network. Which would be the next entry the routing algorithm will look for in its attempts to send data to Certkiller -PR01? A. RARP B. loopback C. default D. ARP cache E Answer: C QUESTION 226

95 Consider the following: 1. A Solaris OS system has two physical network interfaces as well as a loopback interface. 2. The IP forwarding properties have not been manually modified. Which of the following statements are valid? (Select TWO options.) A. IP forwarding between the interfaces is always enabled. B. IP forwarding between the two interfaces is disabled. C. IP forwarding was configured with the routeadm command. D. If the file /etc/notrouter exists the IP forwarding is enabled. E. If the file /etc/defaultrouter exists then IP forwarding is enabled. Answer: BC QUESTION 227 You receive instructions to configure two IP subnets for the Certkiller.com network. In your solution you must ensure that the one subnet will have 200 IP addresses and the other 600 IP addresses. Which of the following configurations will provide you with the most efficient use of IP space? A /24 and 10.10/16 B /21 and /22 C /24 and D /22 and /23 Answer: B Explanation: There are two network ranges required: 200 and /21 can make 2,048 IP addresses /22 can make 1,024 IP address which is more efficient for the subnet which requires 600 QUESTION 228 The exhibit shows the IPv6 IPMP configuration of a Certkiller.com system named Certkiller -SR04: # grep failover /etc/ Certkiller -sr04* /etc/ Certkiller -sr04.hme0: -failover group mgrp6 /etc/ Certkiller -sr04.qfe0: -failover group mgrp6-1 /etc/ Certkiller -sr04.qfe1: -failover group mgrp6-1 With regard to the above exhibit, which of the following statements is true? A. There was an error when the hme0 interface was configured. B. The hme0 interface is a spare interface for the mgrp6-1 failover group. C. In the event of a failover being conducted the hme0 interface has priority over qfe0/qfe1. D. Notifications will be generated in the event of the hme0 interface failing. Answer: D QUESTION 229 DRAG DROP In the TCP/IP network model the Transport layer is responsible for transporting data to and from the correct application. Which of the following are the protocols are found in the Transport layer? (To answer: select from the column on the left and place the correct choice in the column on the right.)

96 A. B. C. D. Answer: QUESTION 230 Where does an authoritative DNS server get its name resolution information from? A. Name resolution answers are sourced from cache. B. Name resolution answers are sourced from a root server. C. Name resolution answers are sourced from a disk-based file. D. Name resolution answers are sourced from the loopback device. Answer: C

97 QUESTION 231 Which of the following NTP client configuration file entries is true if the NTP server IP address is ? A. multicastclient B. unicastclient C. multicastclient D. broadcastclient Answer: A QUESTION 232 DRAG DROP Which of the following statements regarding the graphical dhcpmgr utility is true? (To answer: select the statements from the column on the left and place the correct choice in the column on the right.) A. B. C.

98 D. Answer: QUESTION 233 One of the Certkiller.com DHCP clients are NOT able to get an IP address from the DHCP server on the network. You need to investigate and find that it is only the one DHCP client on the same network that is experiencing the problem. You now need to diagnose the problem. What should you do? (Select TWO options.) A. Run the snoop -v dhcp command on the DHCP server. B. Run the dhcpagent -f -d 2 command on the DHCP client. C. Run the snoop -V port bootps command on the DHCP server. D. Run the ifconfig hme0 dhcp start verbose command on the DHCP client. E. Run the svcadm -d restart svc:/network/dhcp-server command on the DHCP server. Answer: BC QUESTION 234 You have been instructed to configure a Solaris system to operate as an NTP server.

99 This system's purpose would be to support peer NTP servers and clients on a local subnet. What does it mean when enable auth is included in the NTP configuration file? A. In an NTP configuration it means that the system is authoritative for a reference clock. B. In an NTP configuration it means that the NTP server IP address must be broadcast by a network router. C. In an NTP configuration it means that all the NTP clients on the local subnet must be able to support key negotiation. D. In an NTP configuration it means that all the NTP servers on the local subnet must be able to support key negotiation. Answer: D QUESTION 235 The exhibit shows the output of a DHCP server debug: 3cdbc797: Datagram received on network device: hme1 3cdbc797: No more IP addresses on network network ( F81CE0) Which of the following statements are valid? (Select TWO options.) A. A timeout of the DHCPOFFER occurred. B. The client does not have DHCP configured. C. All the available IP addresses have been allocated to other hosts. D. There are no IP addresses available from the DHCP network table. E. There is no DHCP network table for the DHCP client's network. Answer: CD QUESTION 236 The exhibit shows the Routing Table output of one of the Certkiller.com systems that has a default gateway set. How would you set the default gateway? A. Set the default gateway by running in.routed command through the RDISC protocol. B. Set the default gateway manually by running the route add Certkiller -SR03 default command. C. Set the default gateway by running inetd command through the use of configuration text files. D. Set the default gateway by running the routeadm add default -UG Certkiller -SR03 command. Answer: A QUESTION 237 Exhibit:

100 Taking the above exhibit into consideration, how would you add a routing table entry for the network? A. Run the route -net command. B. Run the route add -netmask Certkiller -SR05 command. C. Run the route add net Certkiller -SR05 -netmask command. D. Run the route add net Certkiller -SR05 -netmask command. E. Run the ifconfig qfe0 inet netmask broadcast command. Answer: D QUESTION 238 Certkiller.com requires a new IP subnet on their network. In your solution you must ensure that the new subnet will be able to accommodate 1,600 IP addresses. What should you do? A. Use the /23 CIDR notation. B. Use the /22 CIDR notation. C. Use the /21 CIDR notation. D. Use the /32 CIDR notation. Answer: C QUESTION 239 You need to allow users to access a Solaris system that has as its IP address whilst denying access to other systems on the /24 network. What should you do? A. Run the route add ckrouter command. B. Run the route add net ckrouter command. C. Run the netstat -a command. D. Run the route add host ckrouter command. E. Run the ifconfig -a qfe broadcast command. Answer: D QUESTION 240 Referring to IPMP being used with IPv6, which of the following statements are valid? (Select TWO options.) A. Successful communication will only occur when all interfaces have a unique MAC address. B. Successful communication will only occur when all test interfaces are marked as DEPRECATED. C. IPMP can only be configured successfully on a single network interface. D. It is only possible to have multiple test addresses when using the same link-local address.

101 E. Successful communication will only occur when all test addresses have a manually assigned unique link-local address. Answer: AC QUESTION 241 You are currently working on a system that only used local files for hostname lookups. You need to display the IP address of a remote system named Certkiller -WS302. What should you do? (Select TWO options.) A. Run the arp -a grep Certkiller -WS302 command. B. Run the getent hosts Certkiller -WS302 command. C. Run the netstat -rn grep Certkiller -WS302 command. D. Run the ypcat hosts grep Certkiller -WS302 command. E. Run the grep Certkiller -WS302 /etc/inet/hosts command. Answer: BE QUESTION 242 The exhibit shows the configuration of a JumpStart server: You have been instructed to install a client machine. You need to comply with the instruction, however when you attempt to install the client, the Jumpstart server starts booting, but it fails to continue before the boot sequence is complete. You need to diagnose the problem. What should you do? A. Run the snoop dhcp command on the JumpStart server. B. Run the snoop -d eri0 command on the JumpStart server. C. Run the snoop 9:0:3a:54:ad:8c command on the JumpStart server. D. Run the /usr/sbin/in.rarpd -d -a command on the JumpStart server. E. Run the ndd -get /dev/eri0 errors command on the JumpStart server. Answer: C

102 QUESTION 243 The following exhibit shows a portion of the ARP table for Certkiller -SR01: What should you do to remove this particular entry from the ARP table? A. Run the rarp Certkiller -SR01 command. B. Run the arp -d Certkiller -SR01 command. C. Run the rm -a command. D. Run the rarp 7:0:2a:5e:42:a4 command. E. Run the rmarp -r command. Answer: B QUESTION 244 You work as the network administrator for Certkiller.com. You have been to implement DNS zones on the Certkiller.com network. Why is it important to have a primary server for each DNS zone? (Select TWO options.) A. All data regarding top-level zones are maintained on primary servers. B. All zone changes are made on the primary server in that particular zone. C. Apart from the loopback address, primary servers are non-authoritative for any domain. D. The primary servers are responsible for the appropriate responses such as update information and synchronizing secondary servers in the DNS zone. Answer: BD QUESTION 245 Following is an Ethernet address: 20:0:2e:47:b6:8a showing that Ethernet addresses are 48 bits long, are displayed as 12 hexadecimal digits (usually depicted as 6 groups of two digits) that are separated by colons. What are two functions of the first three octets? (Select TWO options.) A. It identifies the vendor. B. It determines the interface driver. C. It determines if the address is multicast. D. It determines the multicast's group identity. E. It determines the size of the Ethernet frame. Answer: AC QUESTION 246

103 The following exhibit represents the error message that you encounter while trying to configure an interface: # ifconfig qf1 Certkiller -SR netmask up ifconfig: SOCIALADDR: qfe1: Cannot assign requested address Which of the following is a possible explanation why this error occurs? A. There is no broadcast address. B. There is no such thing as interface qfe1. C. Other options are given with the Certkiller -SR02 option. D. The IP address is an invalid unicast address. Answer: D QUESTION 247 The following exhibit shows a SOA record that rendered a Certkiller.com DNS server unable to resolve hosts: Referring to the SOA record what is causing the error? A. The {} bracket pair should be used instead of the () bracket pair. B. A serial number of 1002 is too small. C. The final ")" must be on its own line. D. The wrong order is used for the soa and in fields. Answer: D QUESTION 248 Your Solaris system contains two Solaris zones named Zone 1 and Zone 2. Zone 1 uses the IP address on the interface hme0:1 while Zone 2 uses the IP address on the interface hme0:2. You create and activate Solaris IP Filter rules that filter all UDP traffic between two zones. The Solaris IP Filter rules are shown below: block in quick proto udp from to block in quick proto udp from to You later discover that UDP traffic is still allowed between the two zones. What is the cause of this problem? A. You need to apply at least one pass in rule. B. You need to remove the quick option in both rules. C. Solaris IP Filter is NOT able to filter traffic on HME interfaces. D. Solaris IP Filter is NOT able to filter UDP traffic. E. Solaris IP Filter is NOT able to filter traffic between zones on the same system. Answer: E

104 QUESTION 249 DRAG DROP The CertKiller.com network has a Solaris 10 OS system that functions as a routing firewall that uses Solaris IP Filter and NAT. Place the following steps in correct processing order for a packet passing through this system. (Some steps must be used more than once.) A. B. C. D. Answer:

105 Explanation: Reference: QUESTION 250 You are currently working on a system that only used local files for hostname lookups. You need to display the IP address of a remote system named Certkiller -WS302. What should you do? (Select TWO options.) A. Run the arp -a grep Certkiller -WS302 command. B. Run the getent hosts Certkiller -WS302 command. C. Run the netstat -rn grep Certkiller -WS302 command. D. Run the ypcat hosts grep Certkiller -WS302 command. E. Run the grep Certkiller -WS302 /etc/inet/hosts command. Answer: BE QUESTION 251 You work as the network administrator for Certkiller.com. You have been to implement DNS zones on the Certkiller.com network. Why is it important to have a primary server for each DNS zone? (Select TWO options.) A. All data regarding top-level zones are maintained on primary servers. B. All zone changes are made on the primary server in that particular zone. C. Apart from the loopback address, primary servers are non-authoritative for any domain. D. The primary servers are responsible for the appropriate responses such as update information and synchronizing secondary servers in the DNS zone. Answer: BD