In a split-tunnel VPN, only corporate traffic is sent through the VPN tunnel, while public internet traffic goes directly through the user's local ISP. This reduces bandwidth use on the corporate VPN concentrator and improves performance for non-work traffic.
* B. Separate tunnels for encrypted traffic describes multi-tunnel VPNs, not split tunneling.
* C. All traffic routed through on-site servers is a full-tunnel VPN, not split-tunnel.
* D. ACLs balancing traffic relates to routing or load balancing, not VPN split tunneling.
References (CompTIA Network+ N10-009):
* Domain: Networking Concepts - VPN types, split vs. full tunnel, remote access.

Port 587 is the standard default port for sending email (SMTP) with TLS encryption, which is used to secure email transmissions between mail servers or between clients and mail servers. Allowing traffic over port 587 enables secure email sending while maintaining standard protocol usage. (Reference: CompTIA Network+ Study Guide, Chapter on Ports and Protocols)

If a switch has port security enabled (such as sticky MAC or a configured allowed MAC), the port will only allow the original NIC's MAC address. When a new NIC with a different MAC address is installed, the port rejects traffic, preventing network connectivity.
* B. BPDU guard protects against rogue switches, not end hosts.
* C. Link aggregation applies when bundling multiple uplinks, not a single PC connection.
* D. PoE budget applies to powered devices like APs, not PCs.
References (CompTIA Network+ N10-009):
* Domain: Network Troubleshooting - Port security, MAC address filtering, switch security features.

* Definition of a Rogue DHCP Server:
* A rogue DHCP server is an unauthorized DHCP server on a network, which can assign IP addresses to devices without proper control, leading to IP address conflicts.
* Impact of a Rogue DHCP Server:
* IP Address Conflicts: Multiple devices may receive the same IP address from different DHCP servers, causing network connectivity issues.
* Network Disruption: Devices may be assigned incorrect network configuration settings, disrupting network services and connectivity.
* Comparison with Other Attacks:
* DNS poisoning: Alters DNS records to redirect traffic to malicious sites, but does not cause IP address conflicts.
* Social engineering: Involves manipulating individuals to gain unauthorized access or information, not directly related to IP address conflicts.
* Denial-of-service (DoS): Floods a network or service with excessive traffic to disrupt operations, but does not cause duplicate IP addresses.
* Prevention and Detection:
* Implement network access control measures to prevent unauthorized devices from acting as DHCP servers.
* Use DHCP snooping on switches to allow DHCP responses only from authorized DHCP servers.

The correct answer is hub-and-spoke. In this design, the head office serves as the hub, and all satellite or branch offices (the spokes) connect directly to the hub using leased lines or VPNs. Communication between spokes typically passes through the hub, which centralizes connectivity and simplifies management.
A . Mesh involves every site connecting to every other site, which is more redundant but costly.
B . Point-to-point describes a single dedicated link between two sites, not a multi-site topology.
D . Star is often used in LAN switching, with all devices connecting to a central switch, but it's not the WAN architecture typically used here.
Hub-and-spoke is a cost-effective WAN design, as fewer circuits are needed compared to full mesh. However, its main disadvantage is reliance on the hub site: if the hub goes down, inter-spoke communication fails.