WGU D412 PA - Help Desk Ticket Analysis: Troubleshooting
Network Issues Exam Questions with Correct Answers and
Explanations.
This pre-assessment evaluates the WGU D412 competencies in help desk ticket analysis and network
troubleshooting, including OSI/TCP-IP diagnosis, IP addressing, switching and routing, wireless issues, network
services, security access, and command-line diagnostics. It mirrors CompTIA Network+ (N10-008) objectives and
ITIL 4 incident management practices. It contains 50 multiple-choice questions, each with four distractors and a
fully worked rationale that explains why the keyed answer is correct. Questions are organized into clearly labelled
sections that mirror the major content areas of the course. Targeted learning outcomes include: Apply a
structured troubleshooting methodology to analyze help desk tickets and isolate network faults across OSI layers.;
Interpret command-line diagnostic output and protocol behavior to resolve connectivity, name resolution, and IP
configuration issues.; Differentiate switching, routing, wireless, and security-related causes of network incidents
and select appropriate remediation.. Every item has been reviewed for clinical accuracy, current guidelines, and
clarity so that students can study with confidence and self-correct as they work through the bank. Use it as a
high-yield review immediately before the exam, or as a structured practice tool during the unit - the rationales
double as concise teaching notes. The recommended writing time is 2 hours, with a passing score of 70%
(competent). Aligned with Aligned with US regional accreditation and WGU competency-based standards;
mapped to CompTIA Network+ (N10-008) and ITIL 4 Foundation. standards and reflects the question style
Section 1: General (Questions 1-50)
1 A ticket states 'no network access' but the PC shows a 169.254.x.x address. Which
OSI layer is most directly implicated?
A) Layer 1, because a link light is required before DHCP can respond
B) Layer 3, because APIPA indicates the DHCP server was unreachable
C) Layer 4, because TCP port 67 is blocked by the host firewall
D) Layer 7, because the browser cannot resolve the captive portal name
Answer: B
Rationale: APIPA (169.254.0.0/16) is self-assigned when a DHCP client receives no
offer, directly implicating Layer 3 address configuration. A link light (L1) may be
present, port 67 blocking (L4) would still allow other DHCP attempts, and name
resolution (L7) is irrelevant to APIPA assignment.
2 A user reports intermittent drops only when moving between floors. Which
wireless concept best explains this symptom?
A) Channel bonding reduced the 5 GHz range
B) Insufficient roaming handoff between access points
C) WPA3-SAE authentication rekey interval expired
D) MU-MIMO streams were saturated by neighboring clients
Answer: B
,Rationale: Intermittent drops tied to physical movement indicate poor roaming
handoff as the client reassociates across APs. Channel bonding affects
throughput/range but not movement-specific drops, WPA3 rekey would not correlate
with location, and MU-MIMO saturation does not produce floor-dependent
disconnects.
3 A ticket shows a user can ping 8.8.8.8 but not www.example.com. Which
command best isolates the fault?
A) arp -a
B) netstat -ano
C) nslookup www.example.com
D) tracert 8.8.8.8
Answer: C
Rationale: Successful IP ping with failed name resolution points to DNS; nslookup
directly queries the resolver. arp -a shows local MAC mappings, netstat lists local
connections, and tracert to an IP tests routing, none of which isolate DNS failure.
4 A switch port shows 'err-disabled' after a help desk ticket about a downed link.
Which cause is most likely?
A) BPDU guard triggered by an unauthorized switch
B) DHCP snooping rate limit exceeded on the port
C) Port security violation from a new MAC address
D) STP root guard misconfigured on the uplink
Answer: C
Rationale: Port security violations place the interface into err-disabled state when an
unapproved MAC appears. BPDU guard also err-disables but is specific to
spanning-tree BPDUs, DHCP snooping rate limits typically drop packets rather than
err-disable, and root guard affects the port role, not err-disable status.
5 A help desk ticket reports a /26 subnet cannot add new hosts. Which address
range is the valid host space?
A) 192.168.10.0 - 192.168.10.63
B) 192.168.10.1 - 192.168.10.62
C) 192.168.10.1 - 192.168.10.63
D) 192.168.10.0 - 192.168.10.62
Answer: B
Rationale: A /26 provides 64 addresses; the network address .0 and broadcast .63 are
unusable, leaving .1 through .62 for hosts. Options including .0 or .63 are invalid,
, and 192.168.10.0-63 spans the full block, not host range.
6 A user authenticates to Wi-Fi but gets no IP. Which DHCP message sequence
failure best explains this?
A) Client sends DISCOVER; server replies OFFER; client never sends REQUEST
B) Client sends REQUEST; server replies ACK; client never sends DISCOVER
C) Client sends OFFER; server replies DISCOVER; client sends ACK
D) Client sends ACK; server replies REQUEST; client sends DISCOVER
Answer: A
Rationale: The DORA sequence requires DISCOVER, OFFER, REQUEST, ACK;
failure after OFFER means the client did not complete REQUEST, so no lease is
bound. The other sequences invert roles or order and are not valid DHCP exchanges.
7 A ticket notes users can reach internal servers but not external sites. Which device
setting is most suspect?
A) The DHCP scope's DNS suffix
B) The default gateway on the client
C) The switch's native VLAN assignment
D) The AP's channel width configuration
Answer: B
Rationale: Internal access with no external reachability typically indicates a missing
or incorrect default gateway, preventing off-subnet routing. DNS suffix affects name
resolution, native VLAN affects layer-2 tagging, and channel width affects wireless
throughput, not external routing.
8 A ticket reports slow file transfers to a server on the same VLAN. Which tool best
identifies a duplex mismatch?
A) ipconfig /all
B) show interface status
C) nslookup
D) tracert
Answer: B
Rationale: Duplex mismatches appear as late collisions and CRC errors on switch
interface counters, visible via show interface status. ipconfig shows host IP settings,
nslookup tests DNS, and tracert tests path routing, none of which reveal duplex
errors.
Network Issues Exam Questions with Correct Answers and
Explanations.
This pre-assessment evaluates the WGU D412 competencies in help desk ticket analysis and network
troubleshooting, including OSI/TCP-IP diagnosis, IP addressing, switching and routing, wireless issues, network
services, security access, and command-line diagnostics. It mirrors CompTIA Network+ (N10-008) objectives and
ITIL 4 incident management practices. It contains 50 multiple-choice questions, each with four distractors and a
fully worked rationale that explains why the keyed answer is correct. Questions are organized into clearly labelled
sections that mirror the major content areas of the course. Targeted learning outcomes include: Apply a
structured troubleshooting methodology to analyze help desk tickets and isolate network faults across OSI layers.;
Interpret command-line diagnostic output and protocol behavior to resolve connectivity, name resolution, and IP
configuration issues.; Differentiate switching, routing, wireless, and security-related causes of network incidents
and select appropriate remediation.. Every item has been reviewed for clinical accuracy, current guidelines, and
clarity so that students can study with confidence and self-correct as they work through the bank. Use it as a
high-yield review immediately before the exam, or as a structured practice tool during the unit - the rationales
double as concise teaching notes. The recommended writing time is 2 hours, with a passing score of 70%
(competent). Aligned with Aligned with US regional accreditation and WGU competency-based standards;
mapped to CompTIA Network+ (N10-008) and ITIL 4 Foundation. standards and reflects the question style
Section 1: General (Questions 1-50)
1 A ticket states 'no network access' but the PC shows a 169.254.x.x address. Which
OSI layer is most directly implicated?
A) Layer 1, because a link light is required before DHCP can respond
B) Layer 3, because APIPA indicates the DHCP server was unreachable
C) Layer 4, because TCP port 67 is blocked by the host firewall
D) Layer 7, because the browser cannot resolve the captive portal name
Answer: B
Rationale: APIPA (169.254.0.0/16) is self-assigned when a DHCP client receives no
offer, directly implicating Layer 3 address configuration. A link light (L1) may be
present, port 67 blocking (L4) would still allow other DHCP attempts, and name
resolution (L7) is irrelevant to APIPA assignment.
2 A user reports intermittent drops only when moving between floors. Which
wireless concept best explains this symptom?
A) Channel bonding reduced the 5 GHz range
B) Insufficient roaming handoff between access points
C) WPA3-SAE authentication rekey interval expired
D) MU-MIMO streams were saturated by neighboring clients
Answer: B
,Rationale: Intermittent drops tied to physical movement indicate poor roaming
handoff as the client reassociates across APs. Channel bonding affects
throughput/range but not movement-specific drops, WPA3 rekey would not correlate
with location, and MU-MIMO saturation does not produce floor-dependent
disconnects.
3 A ticket shows a user can ping 8.8.8.8 but not www.example.com. Which
command best isolates the fault?
A) arp -a
B) netstat -ano
C) nslookup www.example.com
D) tracert 8.8.8.8
Answer: C
Rationale: Successful IP ping with failed name resolution points to DNS; nslookup
directly queries the resolver. arp -a shows local MAC mappings, netstat lists local
connections, and tracert to an IP tests routing, none of which isolate DNS failure.
4 A switch port shows 'err-disabled' after a help desk ticket about a downed link.
Which cause is most likely?
A) BPDU guard triggered by an unauthorized switch
B) DHCP snooping rate limit exceeded on the port
C) Port security violation from a new MAC address
D) STP root guard misconfigured on the uplink
Answer: C
Rationale: Port security violations place the interface into err-disabled state when an
unapproved MAC appears. BPDU guard also err-disables but is specific to
spanning-tree BPDUs, DHCP snooping rate limits typically drop packets rather than
err-disable, and root guard affects the port role, not err-disable status.
5 A help desk ticket reports a /26 subnet cannot add new hosts. Which address
range is the valid host space?
A) 192.168.10.0 - 192.168.10.63
B) 192.168.10.1 - 192.168.10.62
C) 192.168.10.1 - 192.168.10.63
D) 192.168.10.0 - 192.168.10.62
Answer: B
Rationale: A /26 provides 64 addresses; the network address .0 and broadcast .63 are
unusable, leaving .1 through .62 for hosts. Options including .0 or .63 are invalid,
, and 192.168.10.0-63 spans the full block, not host range.
6 A user authenticates to Wi-Fi but gets no IP. Which DHCP message sequence
failure best explains this?
A) Client sends DISCOVER; server replies OFFER; client never sends REQUEST
B) Client sends REQUEST; server replies ACK; client never sends DISCOVER
C) Client sends OFFER; server replies DISCOVER; client sends ACK
D) Client sends ACK; server replies REQUEST; client sends DISCOVER
Answer: A
Rationale: The DORA sequence requires DISCOVER, OFFER, REQUEST, ACK;
failure after OFFER means the client did not complete REQUEST, so no lease is
bound. The other sequences invert roles or order and are not valid DHCP exchanges.
7 A ticket notes users can reach internal servers but not external sites. Which device
setting is most suspect?
A) The DHCP scope's DNS suffix
B) The default gateway on the client
C) The switch's native VLAN assignment
D) The AP's channel width configuration
Answer: B
Rationale: Internal access with no external reachability typically indicates a missing
or incorrect default gateway, preventing off-subnet routing. DNS suffix affects name
resolution, native VLAN affects layer-2 tagging, and channel width affects wireless
throughput, not external routing.
8 A ticket reports slow file transfers to a server on the same VLAN. Which tool best
identifies a duplex mismatch?
A) ipconfig /all
B) show interface status
C) nslookup
D) tracert
Answer: B
Rationale: Duplex mismatches appear as late collisions and CRC errors on switch
interface counters, visible via show interface status. ipconfig shows host IP settings,
nslookup tests DNS, and tracert tests path routing, none of which reveal duplex
errors.
