N10-009 Network Implementation Practice Questions

Question 1

A network engineer needs to segment a single physical switch into multiple broadcast domains to improve security and reduce traffic. Which technology should be implemented?

Accepted Answer

Virtual LAN (VLAN). A VLAN (Virtual LAN) segments a physical switch into multiple isolated broadcast domains at Layer 2. By assigning ports to different VLANs, broadcast traffic is confined to each VLAN, improving security and reducing unnecessary traffic. This directly meets the requirement without requiring additional hardware.

Answer

Spanning Tree Protocol (STP)

Answer

VLAN Trunking Protocol (VTP)

Answer

Access Control List (ACL)

Question 2

A router receives a packet destined for 10.0.0.15. It has the following routes in the routing table: 10.0.0.0/8 via 192.168.1.1, 10.0.0.0/16 via 192.168.2.1, 0.0.0.0/0 via 192.168.3.1. Which route will be used?

Accepted Answer

10.0.0.0/16 via 192.168.2.1. The router will use the route 10.0.0.0/16 via 192.168.2.1 because it has the longest prefix match (16 bits) for the destination 10.0.0.15. The /16 route is more specific than the /8 route and the default route, so it is preferred regardless of administrative distance or metric.

Answer

Default route (0.0.0.0/0)

Answer

10.0.0.0/8 via 192.168.1.1

Answer

None; the packet is dropped

Question 3

A company has just installed a new fiber optic connection between two buildings 2 km apart. The connection is using multimode fiber. However, the signal is too weak at the receiving end. What is the most likely cause?

Accepted Answer

Attenuation due to distance. Multimode fiber (MMF) is designed for shorter distances, typically up to 550 meters for 10 Gbps (OM3/OM4) and up to 2 km only for lower speeds like 100 Mbps or 1 Gbps using older OM1/OM2 fiber. At 2 km, the signal attenuation exceeds the power budget of the MMF link, causing a weak signal at the receiver. Single-mode fiber (SMF) would be required for reliable transmission over this distance.

Answer

Electromagnetic interference

Answer

Incorrect termination

Answer

Crosstalk

Question 4

A small office uses a wireless router that provides both wired and wireless connectivity. The router's LAN IP is 192.168.1.1. A new printer with a static IP of 192.168.1.50 cannot be reached from a laptop obtaining an IP via DHCP. The laptop's IP is 192.168.1.100. Which of the following is the most likely cause?

Accepted Answer

The subnet mask is incorrect. The laptop obtains an IP address via DHCP, which typically assigns a subnet mask of 255.255.255.0 for a /24 network. If the printer has a static IP of 192.168.1.50 but is configured with an incorrect subnet mask (e.g., 255.255.255.252), the printer may believe it is on a different subnet than the laptop (192.168.1.100). This prevents the laptop from reaching the printer because the printer will not respond to ARP requests or will send traffic to its default gateway instead of directly to the laptop.

Answer

The printer is on a different VLAN

Answer

The default gateway is misconfigured

Answer

The DHCP scope is exhausted

Question 5

A network engineer has established an IPsec VPN tunnel between a branch office (10.0.0.0/24) and the main office (192.168.10.0/24). The tunnel shows as up and active, but users at the branch office cannot ping the main office server at 192.168.10.10. The main office can ping the branch office gateway successfully. What is the most likely cause of this issue?

Accepted Answer

Incorrect static route on the branch router for the 192.168.10.0/24 network. The tunnel is up and active, and the main office can ping the branch office gateway, which confirms that Phase 1 and Phase 2 of IPsec are correctly negotiated and that the tunnel is passing traffic from the main office toward the branch. However, branch users cannot reach 192.168.10.10, indicating that return traffic from the branch is not being routed into the tunnel. The most likely cause is that the branch router lacks a static route for 192.168.10.0/24 pointing to the tunnel interface (or the IPsec virtual interface), so packets from the branch destined for the main office are sent out the wrong interface or dropped instead of being encrypted and forwarded through the VPN.

Answer

Mismatched encryption algorithms between the two VPN peers

Answer

Firewall on the main office server blocking ICMP

Answer

Incorrect IKE authentication settings

Question 6

A network administrator adds a new server to VLAN 20. The switch port is configured as an access port in VLAN 20, and the server has a correct static IP address in that subnet. However, the server cannot communicate with other devices in the same VLAN. The VLAN exists on the switch and other devices in VLAN 20 are working. What is the most likely cause of this issue?

Accepted Answer

The switch port is configured as a trunk port instead of an access port. The scenario states the switch port is configured as an access port in VLAN 20, but the server cannot communicate with other devices in the same VLAN. If the port were actually configured as a trunk port, it would expect frames to be tagged with a VLAN ID. An untagged frame from the server would be placed into the native VLAN (typically VLAN 1), not VLAN 20, causing a mismatch. This explains why the server, despite having a correct static IP in VLAN 20's subnet, cannot reach other devices in VLAN 20.

Answer

VLAN 20 is not allowed on the trunk to the router

Answer

The server does not have a default gateway configured

Answer

The port is administratively down

Question 7

A network administrator has just connected a new access switch to the core switch via a trunk port. The administrator configured the trunk port on both switches with the same allowed VLAN list. However, hosts on VLAN 10 connected to the new access switch cannot communicate with hosts on VLAN 10 on the core switch. The trunk is operational and shows up/up. What is the most likely cause?

Accepted Answer

A) VLAN 10 has not been created on the new access switch. The most likely cause is that VLAN 10 has not been created on the new access switch. Even though the trunk port is up/up and the allowed VLAN list matches, a switch will not forward traffic for a VLAN that does not exist in its local VLAN database. Without the VLAN being created, the switch drops all frames tagged with VLAN 10, preventing communication between hosts on that VLAN across the trunk.

Answer

B) Native VLAN mismatch on the trunk

Answer

C) Trunk encapsulation mismatch (ISL vs 802.1Q)

Answer

D) STP is blocking the VLAN 10 traffic on the trunk

Question 8

A company is deploying a new wireless network in a warehouse. The network administrator needs to ensure that clients can seamlessly roam between access points without losing connectivity. Which of the following should be configured?

Accepted Answer

A) Same SSID and security settings on all APs. Configuring the same SSID and security settings on all access points (APs) is essential for seamless roaming because clients use the SSID to identify the network and the security credentials to authenticate. When a client moves between APs, it can re-associate without needing to re-authenticate or discover a new network, provided the SSID and security parameters (e.g., PSK or 802.1X configuration) are identical. This ensures a smooth handoff and maintains connectivity during roaming.

Answer

B) Different channels per AP to reduce interference

Answer

C) WPA2-Enterprise with RADIUS authentication

Answer

D) Mesh topology for AP interconnection

Question 9

A company is setting up a new branch office and needs to connect it to the main office over the internet using a secure VPN. The branch office has a dynamic public IP address. Which type of VPN should be configured?

Accepted Answer

Dynamic Multipoint VPN (DMVPN). C is correct because Dynamic Multipoint VPN (DMVPN) is designed to handle sites with dynamic public IP addresses, such as a branch office with a dynamically assigned IP. DMVPN uses mGRE (multipoint Generic Routing Encapsulation) and NHRP (Next Hop Resolution Protocol) to dynamically establish tunnels between spoke routers without requiring static IP configurations on each spoke, making it ideal for this scenario.

Answer

Site-to-site IPsec VPN with static IPs

Answer

Remote access VPN using SSL

Answer

Policy-based VPN

Question 10

A company is implementing a wireless network and needs to support high-density client environments with minimal interference. Which IEEE 802.11 standard operates in the 5 GHz band and provides the highest throughput among the options?

Accepted Answer

802.11ac. 802.11ac (Wi-Fi 5) operates exclusively in the 5 GHz band and supports up to 8 spatial streams, 256-QAM modulation, and channel bonding up to 160 MHz, yielding theoretical throughput exceeding 6.9 Gbps. This makes it the highest-throughput option among the listed standards for high-density environments with minimal interference, as the 5 GHz band offers more non-overlapping channels and less co-channel contention than 2.4 GHz.

Answer

802.11n

Answer

802.11g

Answer

802.11b

Network Implementation

N10-009 Network Implementation — Key Topics

Where candidates lose marks on Network Implementation