Answer: A. The loop is identify, determine, implement, verify. After identifying the symptom you DETERMINE likely causes before changing anything. Local apps are fine, so the device is not resource-starved at all times; an evening-only, online-only symptom points to a scheduled task or evening congestion. The other choices implement a fix before diagnosing.

Answer: B. Internet works but device-to-device does not, so the upstream link is fine, ruling out the ISP. Storage and monitor issues do not affect reachability between hosts. Subnet separation or guest-network client isolation is the classic configuration cause of this exact pattern.

Answer: C. A screen lock with strong authentication is a device-level protective control. Changing the router channel and adding an access point are network configuration; upgrading bandwidth is a service change, not a security control.

Answer: D. VLANs let one set of switches carry multiple logically separated networks, isolating departments without separate physical hardware. Separate buildings is wasteful; identical IPs cause address conflicts; bypassing switches does not scale and breaks segmentation.

Answer: D. High failure volume in a short window, an off-hours timestamp, and an unfamiliar single source are classic indicators of a password attack, and the trailing success suggests it worked. A successful login does not make the preceding burst normal; the pattern is not explained by hardware or an outage.

Answer: C. A restart can clear a runaway process, which is why it temporarily helps and fools people. But the loop requires you to DETERMINE the cause and VERIFY a durable fix. Because the cause (e.g. a scheduled process) was never found, the symptom returns. Restarting is fine as a step, not as the whole loop.

Answer: B. DHCP automatically assigns IP addresses to hosts and DNS resolves human-readable names to addresses, so devices can locate each other at scale. The other pairs are productivity, security, or maintenance tools unrelated to addressing and name resolution.

Answer: A. Defense-in-depth layers independent controls so the failure of one is caught by another: perimeter filtering, device-level authentication, and monitoring together. A single firewall is one point of failure; universal admin rights and disabling logging weaken security.

Answer: B. The course frames AI as a collaboration and diagnostic tool, not an oracle. Suggestions are a starting point you verify through the loop. Implementing blindly skips verification; ignoring AI wastes a tool the framework endorses; humans, not the AI, set roles and accountability.

Answer: A. A resource monitor showing one process consuming most CPU or memory is direct cause-to-symptom evidence and supports the DETERMINE step. Ending random apps changes more than one variable; reformatting is a drastic fix applied before diagnosis; a user's guess is not measured evidence.

Answer: D. Storage (long-term, non-volatile) and memory (working space, volatile) are distinct resources with different failure signatures, so a tool reading must be interpreted for which one is exhausted. They are not the same; the permanence description is reversed; both clearly affect performance.

Answer: C. Detective controls identify activity as or after it happens; an intrusion detection system is the textbook example. Deterrents discourage, protective controls prevent, and recovery controls restore after the fact. The question specifically asks about detection.

Answer: C. Slowness confined to one wing points to a specific segment, so isolating and testing that segment changes one variable and narrows the cause efficiently. Replacing everything and rebooting at peak hours are costly and unfocused; assuming an ISP fault ignores that the problem is localized.

Answer: A. Subnetting divides address space into right-sized blocks per segment, resolving exhaustion while keeping the network organized. Identical addresses cause conflicts; DNS resolves names and does not consume host addresses that way; disabling devices avoids the design problem instead of solving it.

Answer: B. Publicly posting credentials actively destroys security and protects nothing. Encryption, secure authenticated protocols, and verifying the remote endpoint all protect data in transit. The question asks which does the LEAST, and the answer is the one that creates exposure.

Answer: D. Verify confirmed the first fix worked, so that cycle is closed. A new problem starts its own loop: identify it, determine its cause, implement, and verify. Declaring done ignores a real issue; undoing a working fix is counterproductive; ignoring the new problem is not professional practice.

Answer: D. Documentation records addressing, topology, and configuration so anyone, including a technician who did not build the network, can understand and troubleshoot it. It is not a billing tool, cannot prevent failures, and does not replace ongoing monitoring.

Answer: A. Certain data types are governed by regulation; payment card data security is mandated by the PCI DSS standard, which shapes required controls. The data is not exempt, location/device age does not satisfy a standard, and protection is continuous, not limited to business hours.

Answer: C. A router forwards packets between networks, making it the device that directs traffic between the local network and the internet. A screen lock is device authentication; a backup utility and a spreadsheet have no role in routing traffic between networks.

Answer: B. The collaboration skill begins with developing clear, shared team objectives, then defining roles and responsibilities. Starting at random, outsourcing the whole task to AI, or competing individually all skip the shared-objective foundation the course emphasizes.