W GU D 5 22 TASK 2 · PE R F OR MANC E ASSE SSME NT
C O M P L E T E 2 0 2 0 2 7 GUID E
Python Network
Remediation & DNS
System Recovery &
Validation
110-Question Competency Exam — Quad-Focus
Framework
01 Python Network Remediation 02 DNS Configuration
socket · subprocess · netmiko · zone files · records · BIND · DNSSEC
paramiko
03 System Recovery 04 Validation & Reporting
backups · snapshots · RTO/RPO dig · nslookup · logs · rubric
A 110-question final assessment aligned with the WGU D522 Task 2
performance assessment rubric for the 2026–2027 academic cycle.
Coverage spans network fundamentals, Python network automation
libraries, DNS zone configuration and hardening, system recovery
procedures, change control, validation tooling, and Task 2 submission
Trequirements
O TA L Q U E S T I—
O Nwith
S verified
S Eanswers
C T I O N S and rubric-aligned
F O R M AT rationales.
110 8 MCQ · A–D
Z .A I · C Y B E R S E C U R I T Y E D U C AT I O N S E R I E S TA S K 2 A L IGNED
,WGU D522 Task 2 · Python Network Remediation · DNS Configuration · System Recovery · Validation Complete 2026/2027 Guide
WGU D522 Task 2 Performance Assessment
Python Network Remediation, DNS Configuration, System Recovery & Validation | Complete 2026/2027
Guide
Total Questions 110
Total Sections 8
Format Multiple Choice (A–D), one correct answer per question
Cognitive Mix ~25% recall, ~50% application, ~25% analysis
Question Style ~75% scenario-based, ~25% direct recall
Quad-Focus Python Remediation · DNS Configuration · System Recovery · Validation
Coverage socket, subprocess, ipaddress, netmiko, paramiko; BIND; DNSSEC; 3-2-1 backups; dig/nslookup;
Task 2 rubric
Answer Format Correct answer marked with [CORRECT]; rationale with technical reasoning and Task 2 application
Section 1: Network Fundamentals and Remediation Principles
OSI Model, TCP/IP, Network Topology, & Remediation Strategy (Q1–Q14)
Q1: A network engineer is troubleshooting a connectivity issue where two hosts on the same subnet cannot
communicate, despite both having valid IP configurations. At which layer of the OSI model should the
engineer FIRST investigate?
A. Layer 1 (Physical) — check the cable, NIC link lights, and switch port status [CORRECT]
B. Layer 4 (Transport) — check TCP/UDP port states
C. Layer 7 (Application) — verify DNS resolution is working
D. Layer 3 (Network) — verify default gateway is reachable
Correct Answer: A
Rationale: OSI troubleshooting follows a bottom-up methodology because lower-layer failures always mask upper-layer
issues. Two hosts on the same subnet share Layer 2 (Data Link) and Layer 1 (Physical) infrastructure. If Layer 1 is down
(cable unplugged, port disabled, NIC off), no IP-level configuration matters. The other options assume lower layers are
functional. Verifying physical connectivity first avoids wasted effort on configuration debugging when the real issue is a
disconnected cable or a disabled switch port — a foundational WGU D522 remediation principle.
Q2: Which OSI layer is responsible for converting data into frames and using MAC addresses to deliver
data between nodes on the same local network segment?
A. Layer 1 (Physical)
B. Layer 2 (Data Link) [CORRECT]
C. Layer 3 (Network)
D. Layer 4 (Transport)
Correct Answer: B
Rationale: Layer 2 (Data Link) handles framing and physical addressing using MAC addresses for local delivery. Layer 1
only defines electrical/physical signaling. Layer 3 (Network) uses logical IP addresses for end-to-end delivery across multiple
Z.ai · Cybersecurity Education Series Page 1
,WGU D522 Task 2 · Python Network Remediation · DNS Configuration · System Recovery · Validation Complete 2026/2027 Guide
segments. Layer 4 (Transport) handles end-to-end process-to-process communication using ports. Knowing which layer uses
which addressing scheme is a D522 Task 2 foundational concept needed for accurate root cause analysis.
Q3: A remediation plan calls for replacing a UDP-based application with a TCP-based equivalent because
the application requires guaranteed delivery of each packet in sequence. Which property of TCP makes it
the appropriate choice?
A. TCP has lower overhead than UDP because it does not establish a session
B. TCP provides connection-oriented, reliable, sequenced delivery using SYN/ACK handshakes, sequence
numbers, and retransmission of lost segments [CORRECT]
C. TCP uses broadcast addressing for faster delivery than UDP unicast
D. TCP operates at Layer 2 of the OSI model, making it faster than UDP
Correct Answer: B
Rationale: TCP establishes a session via the three-way handshake (SYN → SYN-ACK → ACK), tracks sequence numbers,
acknowledges received segments, and retransmits lost data — guaranteeing ordered, lossless delivery. UDP is connectionless
and 'fire and forget' with no guarantees. TCP has higher overhead than UDP, operates at Layer 4 (not Layer 2), and does not
use broadcast. Choosing between TCP and UDP based on delivery guarantees is a core D522 network remediation decision.
Q4: An administrator must subnet the 192.168.10.0/24 network into subnets that each support at least 25
hosts. Which subnet mask meets the requirement while conserving address space?
A. /25 (255.255.255.128) — yields 126 usable hosts per subnet
B. /27 (255.255.255.224) — yields 30 usable hosts per subnet [CORRECT]
C. /28 (255.255.255.240) — yields 14 usable hosts per subnet
D. /26 (255.255.255.192) — yields 62 usable hosts per subnet
Correct Answer: B
Rationale: A /27 mask (255.255.255.224) creates 8 subnets of 32 addresses each (30 usable after subtracting network and
broadcast addresses), which meets the 25-host requirement while conserving the most address space. A /25 supports 126 hosts
(overkill), /26 supports 62 (overshoot), and /28 only supports 14 (insufficient). Subnetting calculations are an essential D522
skill for designing remediation plans that resize broadcast domains.
Q5: During remediation of a network outage, a junior technician recommends immediately rebooting all
switches to 'clear the problem.' A senior engineer should respond that this approach violates which
remediation principle?
A. Change management requires identification of root cause before corrective action is taken, to prevent
recurrence and to preserve evidence [CORRECT]
B. Switches should never be rebooted under any circumstances
C. Reboots must be performed only by the ISP
D. Network outages cannot be resolved without vendor support
Correct Answer: A
Rationale: Rebooting before diagnosing may temporarily mask the symptom while destroying valuable diagnostic evidence
(logs, port counters, ARP tables, CPU/mem snapshots). D522 remediation methodology emphasizes root cause identification
before corrective action, with all changes documented through change control. Premature 'fix and pray' actions violate both
evidence-preservation and change-management principles — a critical WGU Task 2 competency. Switches can absolutely be
rebooted, but only after diagnosis and through formal change procedures.
Q6: Which statement correctly distinguishes between a Layer 2 broadcast domain and a collision domain?
Z.ai · Cybersecurity Education Series Page 2
, WGU D522 Task 2 · Python Network Remediation · DNS Configuration · System Recovery · Validation Complete 2026/2027 Guide
A. A broadcast domain is bounded by routers; a collision domain is bounded by switches (each switch port
is its own collision domain) [CORRECT]
B. A broadcast domain is bounded by switches; a collision domain is bounded by routers
C. A broadcast domain equals the entire physical network; a collision domain only exists on wireless media
D. Broadcast and collision domains are interchangeable terms
Correct Answer: A
Rationale: Routers terminate broadcast domains — broadcasts do not cross Layer 3 boundaries. Each switch port constitutes a
separate collision domain (modern switched networks are effectively collision-free per port). Hubs, by contrast, place all ports
in a single collision domain. Understanding this distinction is critical in D522 for designing VLAN segmentation that limits
broadcast traffic and reduces the attack surface. The other options misapply the boundaries or treat the terms as synonymous.
Q7: A user reports that they cannot reach the server at 10.0.0.5, even though `ping 10.0.0.5` returns replies.
Which Layer should the engineer suspect first?
A. Layer 3 (Network) — the IP path is functional, so the issue is likely port or service binding at Layer 4
[CORRECT]
B. Layer 1 (Physical) — the cable must be faulty
C. Layer 7 (Application) — the user's browser cache is corrupted
D. Layer 2 (Data Link) — the MAC address table is incorrect
Correct Answer: A
Rationale: A successful ICMP ping confirms Layer 1 (link up), Layer 2 (ARP/MAC resolution), and Layer 3 (IP routing) are
all functional. The next troubleshooting target is Layer 4 (Transport) — confirm the expected TCP/UDP port is listening and
not blocked by a firewall — followed by Layer 7 (Application service responding). D522 teaches this bottom-up progression;
jumping to Layer 1 or Layer 7 without checking intermediate layers wastes time and may overlook firewall or
service-configuration issues.
Q8: What is the role of the default gateway in a host's IP configuration?
A. It is the DNS resolver address used to translate hostnames to IP addresses
B. It is the next-hop router to which the host sends packets destined for IP addresses outside its local subnet
[CORRECT]
C. It is the DHCP server that leases IP addresses to the host
D. It is the local broadcast address used for ARP resolution
Correct Answer: B
Rationale: The default gateway is a router interface on the same subnet as the host; the host sends any packet destined to a
non-local IP to the gateway's MAC address (resolved via ARP), and the router forwards it toward the destination. DNS
servers, DHCP servers, and broadcast addresses are different configuration elements. A common D522 remediation scenario
is a host with an incorrect or missing default gateway — symptoms include reaching local hosts but failing to reach anything
off-subnet.
Q9: Which remediation step MUST precede implementing a corrective action on a production network?
A. Obtaining written approval through the change management process and scheduling a maintenance
window with rollback planning [CORRECT]
B. Notifying all users via email that the network may go down
C. Disabling all logging to maximize router CPU for the remediation
D. Backing up user documents on every workstation
Correct Answer: A
Z.ai · Cybersecurity Education Series Page 3
C O M P L E T E 2 0 2 0 2 7 GUID E
Python Network
Remediation & DNS
System Recovery &
Validation
110-Question Competency Exam — Quad-Focus
Framework
01 Python Network Remediation 02 DNS Configuration
socket · subprocess · netmiko · zone files · records · BIND · DNSSEC
paramiko
03 System Recovery 04 Validation & Reporting
backups · snapshots · RTO/RPO dig · nslookup · logs · rubric
A 110-question final assessment aligned with the WGU D522 Task 2
performance assessment rubric for the 2026–2027 academic cycle.
Coverage spans network fundamentals, Python network automation
libraries, DNS zone configuration and hardening, system recovery
procedures, change control, validation tooling, and Task 2 submission
Trequirements
O TA L Q U E S T I—
O Nwith
S verified
S Eanswers
C T I O N S and rubric-aligned
F O R M AT rationales.
110 8 MCQ · A–D
Z .A I · C Y B E R S E C U R I T Y E D U C AT I O N S E R I E S TA S K 2 A L IGNED
,WGU D522 Task 2 · Python Network Remediation · DNS Configuration · System Recovery · Validation Complete 2026/2027 Guide
WGU D522 Task 2 Performance Assessment
Python Network Remediation, DNS Configuration, System Recovery & Validation | Complete 2026/2027
Guide
Total Questions 110
Total Sections 8
Format Multiple Choice (A–D), one correct answer per question
Cognitive Mix ~25% recall, ~50% application, ~25% analysis
Question Style ~75% scenario-based, ~25% direct recall
Quad-Focus Python Remediation · DNS Configuration · System Recovery · Validation
Coverage socket, subprocess, ipaddress, netmiko, paramiko; BIND; DNSSEC; 3-2-1 backups; dig/nslookup;
Task 2 rubric
Answer Format Correct answer marked with [CORRECT]; rationale with technical reasoning and Task 2 application
Section 1: Network Fundamentals and Remediation Principles
OSI Model, TCP/IP, Network Topology, & Remediation Strategy (Q1–Q14)
Q1: A network engineer is troubleshooting a connectivity issue where two hosts on the same subnet cannot
communicate, despite both having valid IP configurations. At which layer of the OSI model should the
engineer FIRST investigate?
A. Layer 1 (Physical) — check the cable, NIC link lights, and switch port status [CORRECT]
B. Layer 4 (Transport) — check TCP/UDP port states
C. Layer 7 (Application) — verify DNS resolution is working
D. Layer 3 (Network) — verify default gateway is reachable
Correct Answer: A
Rationale: OSI troubleshooting follows a bottom-up methodology because lower-layer failures always mask upper-layer
issues. Two hosts on the same subnet share Layer 2 (Data Link) and Layer 1 (Physical) infrastructure. If Layer 1 is down
(cable unplugged, port disabled, NIC off), no IP-level configuration matters. The other options assume lower layers are
functional. Verifying physical connectivity first avoids wasted effort on configuration debugging when the real issue is a
disconnected cable or a disabled switch port — a foundational WGU D522 remediation principle.
Q2: Which OSI layer is responsible for converting data into frames and using MAC addresses to deliver
data between nodes on the same local network segment?
A. Layer 1 (Physical)
B. Layer 2 (Data Link) [CORRECT]
C. Layer 3 (Network)
D. Layer 4 (Transport)
Correct Answer: B
Rationale: Layer 2 (Data Link) handles framing and physical addressing using MAC addresses for local delivery. Layer 1
only defines electrical/physical signaling. Layer 3 (Network) uses logical IP addresses for end-to-end delivery across multiple
Z.ai · Cybersecurity Education Series Page 1
,WGU D522 Task 2 · Python Network Remediation · DNS Configuration · System Recovery · Validation Complete 2026/2027 Guide
segments. Layer 4 (Transport) handles end-to-end process-to-process communication using ports. Knowing which layer uses
which addressing scheme is a D522 Task 2 foundational concept needed for accurate root cause analysis.
Q3: A remediation plan calls for replacing a UDP-based application with a TCP-based equivalent because
the application requires guaranteed delivery of each packet in sequence. Which property of TCP makes it
the appropriate choice?
A. TCP has lower overhead than UDP because it does not establish a session
B. TCP provides connection-oriented, reliable, sequenced delivery using SYN/ACK handshakes, sequence
numbers, and retransmission of lost segments [CORRECT]
C. TCP uses broadcast addressing for faster delivery than UDP unicast
D. TCP operates at Layer 2 of the OSI model, making it faster than UDP
Correct Answer: B
Rationale: TCP establishes a session via the three-way handshake (SYN → SYN-ACK → ACK), tracks sequence numbers,
acknowledges received segments, and retransmits lost data — guaranteeing ordered, lossless delivery. UDP is connectionless
and 'fire and forget' with no guarantees. TCP has higher overhead than UDP, operates at Layer 4 (not Layer 2), and does not
use broadcast. Choosing between TCP and UDP based on delivery guarantees is a core D522 network remediation decision.
Q4: An administrator must subnet the 192.168.10.0/24 network into subnets that each support at least 25
hosts. Which subnet mask meets the requirement while conserving address space?
A. /25 (255.255.255.128) — yields 126 usable hosts per subnet
B. /27 (255.255.255.224) — yields 30 usable hosts per subnet [CORRECT]
C. /28 (255.255.255.240) — yields 14 usable hosts per subnet
D. /26 (255.255.255.192) — yields 62 usable hosts per subnet
Correct Answer: B
Rationale: A /27 mask (255.255.255.224) creates 8 subnets of 32 addresses each (30 usable after subtracting network and
broadcast addresses), which meets the 25-host requirement while conserving the most address space. A /25 supports 126 hosts
(overkill), /26 supports 62 (overshoot), and /28 only supports 14 (insufficient). Subnetting calculations are an essential D522
skill for designing remediation plans that resize broadcast domains.
Q5: During remediation of a network outage, a junior technician recommends immediately rebooting all
switches to 'clear the problem.' A senior engineer should respond that this approach violates which
remediation principle?
A. Change management requires identification of root cause before corrective action is taken, to prevent
recurrence and to preserve evidence [CORRECT]
B. Switches should never be rebooted under any circumstances
C. Reboots must be performed only by the ISP
D. Network outages cannot be resolved without vendor support
Correct Answer: A
Rationale: Rebooting before diagnosing may temporarily mask the symptom while destroying valuable diagnostic evidence
(logs, port counters, ARP tables, CPU/mem snapshots). D522 remediation methodology emphasizes root cause identification
before corrective action, with all changes documented through change control. Premature 'fix and pray' actions violate both
evidence-preservation and change-management principles — a critical WGU Task 2 competency. Switches can absolutely be
rebooted, but only after diagnosis and through formal change procedures.
Q6: Which statement correctly distinguishes between a Layer 2 broadcast domain and a collision domain?
Z.ai · Cybersecurity Education Series Page 2
, WGU D522 Task 2 · Python Network Remediation · DNS Configuration · System Recovery · Validation Complete 2026/2027 Guide
A. A broadcast domain is bounded by routers; a collision domain is bounded by switches (each switch port
is its own collision domain) [CORRECT]
B. A broadcast domain is bounded by switches; a collision domain is bounded by routers
C. A broadcast domain equals the entire physical network; a collision domain only exists on wireless media
D. Broadcast and collision domains are interchangeable terms
Correct Answer: A
Rationale: Routers terminate broadcast domains — broadcasts do not cross Layer 3 boundaries. Each switch port constitutes a
separate collision domain (modern switched networks are effectively collision-free per port). Hubs, by contrast, place all ports
in a single collision domain. Understanding this distinction is critical in D522 for designing VLAN segmentation that limits
broadcast traffic and reduces the attack surface. The other options misapply the boundaries or treat the terms as synonymous.
Q7: A user reports that they cannot reach the server at 10.0.0.5, even though `ping 10.0.0.5` returns replies.
Which Layer should the engineer suspect first?
A. Layer 3 (Network) — the IP path is functional, so the issue is likely port or service binding at Layer 4
[CORRECT]
B. Layer 1 (Physical) — the cable must be faulty
C. Layer 7 (Application) — the user's browser cache is corrupted
D. Layer 2 (Data Link) — the MAC address table is incorrect
Correct Answer: A
Rationale: A successful ICMP ping confirms Layer 1 (link up), Layer 2 (ARP/MAC resolution), and Layer 3 (IP routing) are
all functional. The next troubleshooting target is Layer 4 (Transport) — confirm the expected TCP/UDP port is listening and
not blocked by a firewall — followed by Layer 7 (Application service responding). D522 teaches this bottom-up progression;
jumping to Layer 1 or Layer 7 without checking intermediate layers wastes time and may overlook firewall or
service-configuration issues.
Q8: What is the role of the default gateway in a host's IP configuration?
A. It is the DNS resolver address used to translate hostnames to IP addresses
B. It is the next-hop router to which the host sends packets destined for IP addresses outside its local subnet
[CORRECT]
C. It is the DHCP server that leases IP addresses to the host
D. It is the local broadcast address used for ARP resolution
Correct Answer: B
Rationale: The default gateway is a router interface on the same subnet as the host; the host sends any packet destined to a
non-local IP to the gateway's MAC address (resolved via ARP), and the router forwards it toward the destination. DNS
servers, DHCP servers, and broadcast addresses are different configuration elements. A common D522 remediation scenario
is a host with an incorrect or missing default gateway — symptoms include reaching local hosts but failing to reach anything
off-subnet.
Q9: Which remediation step MUST precede implementing a corrective action on a production network?
A. Obtaining written approval through the change management process and scheduling a maintenance
window with rollback planning [CORRECT]
B. Notifying all users via email that the network may go down
C. Disabling all logging to maximize router CPU for the remediation
D. Backing up user documents on every workstation
Correct Answer: A
Z.ai · Cybersecurity Education Series Page 3
