Data Analysis (30%)

300-445 · 90 questions

• Tests from a logistics hub stay clean in both directions until the hop at the far firewall, where loss begins. What should the analyst examine?
• On a hospital campus, path data is clean before one provider hop, and packet loss starts at that hop and stays high on every hop after it. Where does that evidence place the fault?
• A university test to a research archive changes to a new path, and packet loss appears only along that new path. What best explains the failure?
• A manufacturer fails over to the backup circuit, and only the tests that use that circuit show loss. Where is the fault?
• A bank's voice tests show high jitter while packet loss on the same path stays near zero, and the calls are breaking. What is the path problem?
• A retailer sees latency jump on a single provider hop toward a branch, while jitter on that hop stays low and earlier hops look unchanged. What does that pattern indicate?
• A SaaS company runs a path test for remote staff and sees loss that is random on every hop, including the first hop from the Enterprise Agent. What should the analyst conclude?
• On event days at a stadium, path tests show a healthy forward path and loss only where the return path takes a different route. Where should the analyst place the fault?
• A hospital campus runs path tests in which every MPLS hop stays clean and loss appears only at the internet exit. What should the analyst treat as the fault domain?
• A government agency's tests fail in the same minute a route flap is logged, and the path returns when the route stabilizes. What matches that failure?
• A retailer sees path tests fail at one branch while branches that use a different provider stay green to the same application. What does that pattern point to?
• A hotel chain sees extra delay only during the known busy hour, and only on one uplink, while other hours on that link look normal. What does the pattern show?
• A bank's path tests are dropped in one QoS queue while traffic in the other classes on the same circuit still passes. What should the analyst call the fault?
• A government agency's path test shows high latency and zero loss on one long-delay hop, while the other hops look ordinary. What should the analyst call the problem on that hop?
• At a logistics hub, tests to the warehouse application stay stable across the WAN, and the loss appears only on the segment inside the data center. What should the analyst conclude?
• A manufacturer sees loss on a path test, and fiber errors are climbing on the single interface whose counters match that loss. Where should the analyst point the fault?
• A university path test shows packet reordering together with jitter, while name lookup for the same target succeeds. What should the analyst treat as the problem?
• A hotel chain's tests to the reservation system start black-holing traffic at the moment a summary route appears on the path. What does the collected data point to?
• Branch stores at a retailer lose the inventory application, and every path trace from those stores stops responding at the same hop. What should the analyst investigate?
• A hospital campus sees packet loss on a path test only while the matching circuit is completely full, and the loss fades when that circuit has spare capacity again. What is the cause?
• On event days at a stadium, tests aimed at one anycast address start landing at a distant site, while the same address was reached at a nearby site on quiet days. What changed?
• On a hospital campus, a laptop is set with the wrong default gateway, and WAN tests sourced from the office agent stay green. What should be corrected?
• A university voice desk hears choppy calls only while the bulk data class is full, and the path view shows loss on that shared hop during the same intervals. What does the evidence indicate?
• At a SaaS company, two probes test the same application for remote staff. Only the probe behind a congested firewall shows loss, and the other probe stays clean. What does that pattern identify?
• At a manufacturer, the VPN client on one laptop does not establish, while path tests from the office agent stay healthy. Where should diagnosis focus?
• In a retail branch, wireless clients fail an application while wired clients at the same desk succeed. Where does that evidence place the failure?
• At a university, an endpoint resolves a service name to the wrong address while the data-center resolver returns the correct address for the same name. What is at fault?
• At a bank, a laptop proxy points at a host that does not answer, while office path tests to the application stay healthy. What should be fixed?
• At a logistics hub, real-time media fails on one soft client and succeeds on every other client that uses the same media servers. What does that isolate?
• A hotel chain sees high loss on the local network inside the property, before guest traffic reaches the WAN handoff. What should be repaired?
• Laptops at a hospital campus follow a PAC file that sends application traffic to a proxy, and a capture shows that proxy resetting the sessions. What should be corrected?
• A government agency finds that a split-tunnel VPN on staff laptops sends one required application out the local Internet path instead of through the tunnel. Where should diagnosis start?
• On stadium event days, endpoint drops line up with roaming between access points, and the same clients stay stable when they remain on one radio. Where does the evidence point?
• A retailer's VPN concentrator serves every store normally, except one laptop whose outdated client cannot complete the tunnel. Where should the fix be applied?
• Campus lab PCs at a university resolve a host when students type the full domain, and single-label names fail because the client search suffix is empty. What should be fixed?
• Remote staff at a SaaS company can reach their default gateway, yet the collaboration app on the laptop resolves to the wrong address. Which setting should be corrected?
• At a SaaS company, remote users lose an internal application at the same moment a proxy authentication prompt appears, and the application returns after they authenticate. What should diagnosis focus on?
• At a logistics hub, a dispatch video fails only while a laptop VPN is connected and plays as soon as that VPN drops. Where should diagnosis start?
• A packet capture on a bank laptop shows the TCP SYN for an internal app is not leaving the host, while other laptops that use the same gateway succeed. Where should diagnosis start?
• At a manufacturer, docking a laptop changes the path metrics, and a capture shows the flow leaving on a different NIC than it used before the dock. What does that evidence identify?
• At a government agency, trouble reports cluster on wireless clients in one building, while wired clients in that same building stay reachable. What does that pattern indicate?
• On one hotel subnet, hosts cannot complete ARP for the default gateway, and only devices on that subnet lose connectivity. What should the team treat as the fault domain?
• On a hospital campus, a patient-portal waterfall shows one third-party scheduling script consuming most of the page load while WAN loss counters stay quiet. What should the analyst treat as the cause?
• In a retail branch, a room system cannot reach a scheduling service while PCs on the same switch succeed, and the room system is configured with a different DNS server than the PCs. What should be checked?
• At a university, remote staff reach campus services with a public resolver, but the same laptops fail only while the home router is handing out its own DNS. Where should diagnosis start?
• On a hospital campus, a clinical laptop drops an application flow only while a local security agent is enabled, and the same flow succeeds when that agent is paused. Where is the fault?
• On event days at a stadium, one point-of-sale client fails when it uses IPv6, IPv4 tests from that client succeed, and neighboring clients that use IPv6 are fine. What should the team investigate?
• A retailer with branch stores sees a long time to first byte on the inventory page while the transfer after that byte is short. What does the waterfall indicate?
• At a logistics hub, the dispatch waterfall shows a long wait on the live API call while the static files are served from cache. What should the analyst treat as the delay?
• A government agency sees a fast browser waterfall from a data-center probe and a slow waterfall from the branch browser for the same intranet application. What should the team do before buying more bandwidth?
• A hotel chain's booking page stays blank until one web font finishes, and the waterfall shows every later resource waiting on that font. Which finding should the assurance team treat as the cause?
• A university course-site waterfall shows DNS as a small slice of load time, while one course image accounts for most of the bytes and the wait. What should be fixed first?
• A bank portal waterfall shows the TLS handshake taking most of the load time while the HTML document itself stays tiny. Which part of the waterfall explains the delay?
• At a manufacturer, the supplier portal spends most of its load time on a chain of redirects before any page content is returned. What does the waterfall identify as the cost?
• On event days, a stadium ticket page shows a waterfall in which one CSS file must finish before any later resource starts. Which finding should the team treat as the cause?
• A hospital campus waterfall for a clinical application shows connection reuse off, so every object pays a new handshake while the network path itself stays short. Which finding should the team treat as the cause?
• A retailer with branch stores captures a browser waterfall where network time is short and one call returns HTTP 500. Which finding should the team treat as the cause?
• A university portal waterfall shows compressed objects that stay small and uncompressed duplicates of those same objects that dominate the download. Which finding should the team treat as the cause?
• A bank's browser waterfall shows a short network row and a long main-thread stretch while the page paints. Which finding should the team treat as the cause?
• A SaaS company with remote staff reruns a slow portal test, and the repeat waterfall looks healthy because cached objects return at once. Which load should the team judge?
• A hotel chain compares two booking sites in browser waterfalls. Requests on the HTTP/1 site fan into a staggered set of bars, while the sister site on HTTP/2 overlaps that same kind of work. Which conclusion fits the HTTP/1 waterfall?
• A manufacturer opens a browser waterfall for a slow supplier portal. The document and the other objects finish quickly, and the long bar is the cookie-banner script. Which conclusion fits this waterfall?
• A logistics hub finds regional tracking pages stay slow. The browser waterfall shows a long bar for images pulled from a distant image host, with the page's other objects much shorter. Which conclusion fits this waterfall?
• A government agency traces a slow benefits page in a browser waterfall. The page's own objects are short, and the long row is the call to the identity provider. Which conclusion fits this waterfall?
• Remote staff at a SaaS company, working on a constrained link, report a slow home page. The browser waterfall shows most of the time spent downloading a very large video banner. Which conclusion fits this waterfall?
• On event days at a stadium, the browser waterfall shows the document finishing quickly, then a late request that repaints the page long after that document. Which conclusion fits this waterfall?
• A hospital campus sees traffic toward its public site surge from many sources while real users time out. What should the team conclude from that pattern?
• On a hospital campus, a browser waterfall shows a service worker serving a stale application shell, and the network row for that page does not run. Which conclusion fits this waterfall?
• A retailer with branch stores compares two variants of the same promotion and finds different long bars in the browser waterfall. Which conclusion fits these waterfalls?
• A bank sees prefixes that are supposed to stay inside the enterprise being advertised toward the internet. What does that evidence indicate?
• Branch stores at a retailer start resolving a corporate name to an unexpected address, and users reach the wrong site. Which reading fits that evidence?
• A university's public prefix shows up at an unexpected BGP origin while users say the campus site is unreliable. What does that routing evidence indicate?
• At a manufacturer, one public name is slow while other names on the same circuit stay healthy. What should the team conclude?
• At a government agency, the resolver returns an address for a critical name that the authoritative server does not publish, and users are sent to an unexpected host. Which conclusion fits that evidence?
• A SaaS company with remote staff sees an unexpected more-specific prefix appear and pull their traffic off the provider path those sessions normally follow. Which conclusion fits the evidence?
• On event day at a stadium, partner prefixes that should stay private show up in the provider routing table and shift spectator traffic. What does that evidence indicate?
• At a logistics hub, tests left the normal path during the same minutes a prefix was announced from an unexpected origin. What explains that shift?
• A hotel chain's internet link fills with volumetric noise, and loss hits every flow on that link. What does the pattern indicate?
• A retailer with branch stores sees tests fail while a bad route is present and recover at every store as soon as that route is withdrawn, with no application change. What caused the failure?
• A bank's users cannot reach a partner site, Internet Insights reports a disruption inside that destination network, and the bank's own path tests toward its edge stay clean. What explains the failure?
• At a university, two DNS views for the same name disagree, and the address users receive matches a known sinkhole. Which interpretation fits the evidence?
• On a hospital campus the application team wants a code rollback, but path measurements show a denial-of-service flood toward the application and the running build is not the source of the loss. Which response fits the evidence?
• A manufacturer sees packet loss only toward one anycast site that is under attack, while paths to every other destination stay clean. Which response fits that evidence?
• A logistics hub saw a route leak for about ten minutes, paths then returned to normal, and a teammate opened a month-long capacity project. Which response fits the evidence?
• A SaaS company finds internal route summaries visible to external peers, and latency for those prefixes collapsed at the same moment. What should analysts name as the cause?
• A government agency sees one of its prefixes originated by an unexpected autonomous system, and the local router configuration did not change. What should the team call this event?
• Branch stores of a retailer are slow, and routing data shows the service prefix originated by an unexpected network. What should the team name as the cause of the slowness?
• Hotel guests who request the chain booking name are sent to a look-alike address that still answers HTTP, while other names resolve as usual. Which response fits that evidence?
• A stadium circuit saturated during a distributed denial-of-service attack. After the attack ended, the same circuit carried normal event traffic again. Which response fits that evidence?
• At a hospital, the security log and the network path data both change in the same minute, when traffic moves onto an unexpected route. Two teams want two root-cause projects. Which response fits the timestamps?