Shoulder surfing is a social engineering attack where attackers observe someone's private information by looking over their shoulder or using tools like cameras to capture input.
From Andrew Ramdayal's guide:
"Shoulder surfing is the act of watching someone enter confidential information, such as PINs or passwords, often using direct line-of-sight or surveillance equipment."

See the solution in Explanation below.
Explanation:
Switch 1
spanning-tree vlan 10 root primary
spanning-tree vlan 20 root secondary
Switch 2
spanning-tree vlan 20 root primary
spanning-tree vlan 10 root secondary
This PBQ is pointing to a switching loop / MAC flapping problem. The biggest clues are the high CPU utilization and the fact that the MAC table is continuously changing. That behavior is classic for a Layer 2 loop when redundant links exist between switches and no proper spanning-tree root role has been established.
The available commands shown in the screenshots are limited to spanning-tree vlan, so this is not an interface shutdown question. The fix is to use STP per VLAN and make one switch the preferred root for one VLAN and the other switch the preferred root for the other VLAN. That prevents both uplinks from forwarding in an uncontrolled loop while still giving redundancy.
A clean design is:
Switch 1 root primary for VLAN 10
Switch 2 root primary for VLAN 20
Make each opposite switch root secondary for failover
That stabilizes Layer 2 forwarding, stops MAC address flapping, reduces CPU load, and restores normal connectivity. After applying the STP root settings, the user should be able to ping 192.168.1.31 from PC 1 successfully. If your simulator asks for validation, run the ping again from PC 1 to the database server.

A rogue DHCP server occurs when an unauthorized or misconfigured DHCP server assigns incorrect IP addresses, default gateways, or DNS settings to clients.
*In this scenario:
*The user can ping the gateway, meaning local network communication is working.
*However, they cannot access network resources, which suggests incorrect IP configuration (likely due to a rogue DHCP server assigning the wrong gateway or DNS).
*Why not the other options?
*VLAN hopping (A): This is an attack that exploits VLAN configurations to gain access to unauthorized VLANs. It would not typically cause multiple users to lose network access.
*Distributed DoS (C): A DDoS attack floods a network or service with traffic, but this issue is more likely misconfigured IP settings than an actual attack.
*Evil twin (D): This refers to a fraudulent Wi-Fi network mimicking a legitimate one. Since the users are on a wired network (ipconfig output checked), this is not applicable.
Reference:
CompTIA Network+ (N10-009) Official Guide - Chapter 11: Network Security Threats

The correct answer is Identify the problem, which is always the first step in the CompTIA Network+ N10-009 troubleshooting methodology. Before forming theories, creating action plans, or documenting outcomes, technicians must clearly understand what is happening, who is affected, and what symptoms are present.
In this scenario, the symptoms-inaccessible files and a changed wallpaper-are serious and potentially indicative of a security incident such as ransomware. However, at this stage, there is disagreement between the network administrator and the security analyst regarding the nature of the issue. That reinforces the need to begin with problem identification, which includes gathering information, determining the scope of impact, identifying recent changes, and assessing whether the incident is isolated or widespread.
Establishing a theory comes after the problem has been clearly defined. Creating a plan of action and documenting findings occur later in the process, once the issue has been confirmed and remediation steps are determined. Jumping ahead without properly identifying the problem could result in delayed containment or an incorrect response-especially critical in potential security incidents.
The Network+ objectives emphasize following the structured troubleshooting process precisely to reduce risk, prevent escalation, and ensure accurate resolution-particularly when malware or ransomware may be involved.

LDAP over SSL (LDAPS) uses port 636 to provide secure, encrypted authentication for directory services.
Breakdown of Options:
A). SMTP (Simple Mail Transfer Protocol) - Uses port 25, not 636.
B). Syslog - Uses port 514 (UDP), not 636.
C). TFTP (Trivial File Transfer Protocol) - Uses port 69 (UDP), not 636.
D). LDAPS (Lightweight Directory Access Protocol Secure) - # Correct answer. Uses port 636 for secure directory authentication.
Reference:
CompTIA Network+ (N10-009) Official Study Guide - Domain 3.1: Compare and contrast network protocols.
RFC 4511: Lightweight Directory Access Protocol (LDAP)