N10-009 Practice Test 5 — 10 Questions

Question 1

A network engineer plans to change the routing protocol configuration on a core router that will affect all branch connectivity. According to change management best practices, which step should the engineer perform BEFORE implementing the change?

Accepted Answer

Create a detailed rollback plan. Creating a detailed rollback plan is a fundamental change management best practice because it ensures that if the routing protocol reconfiguration (e.g., switching from EIGRP to OSPF or modifying redistribution) causes connectivity loss to all branches, the engineer can revert to the previous configuration quickly and safely. Without a rollback plan, a failed change could result in prolonged network downtime while troubleshooting from scratch, violating the principle of minimizing business impact. This step is performed before implementation to predefine the exact commands or backup configuration needed to restore the original routing state.

Answer

Implement the change during business hours to ensure staff availability

Answer

Notify all users after the change is complete

Answer

Test the change directly on the production router

Question 2

A network administrator notices that log timestamps from different switches are inconsistent, making correlation of events difficult. Which protocol should be implemented to ensure all devices have the same time?

Accepted Answer

NTP. NTP (Network Time Protocol) is the standard protocol used to synchronize clocks across network devices. By configuring all switches to use the same NTP server, timestamps in logs become consistent, enabling accurate correlation of events across the network.

Answer

SNMP

Answer

SMTP

Answer

RIP

Question 3

A network administrator wants to configure routers to send syslog messages only for events of severity 'error' (3) or higher (more severe). Which severity level should be set as the trap level?

Accepted Answer

3 (errors). Option B is correct because setting the trap level to 3 (errors) instructs the router to send syslog messages for severity 3 and all numerically lower (more severe) levels (0, 1, 2, 3). This matches the requirement to capture events of severity 'error' (3) or higher severity.

Answer

0 (emergencies)

Answer

2 (critical)

Answer

4 (warnings)

Question 4

A network administrator needs to monitor bandwidth utilization on a router interface in real time. Which of the following protocols is best suited for this purpose?

Accepted Answer

SNMP polling. SNMP polling is the best choice for real-time bandwidth monitoring because it allows the network management system (NMS) to actively query the router's interface MIB (e.g., ifInOctets, ifOutOctets) at short intervals, calculating utilization from the delta between successive polls. This provides near-real-time data without waiting for unsolicited events, making it ideal for live dashboards and threshold alerts.

Answer

Syslog

Answer

NetFlow

Answer

CDP

Question 5

A network security analyst notices that the firewall is logging traffic on the external interface that has a source IP address of 10.0.1.5, which is within the internal network range. This is most likely the result of which type of attack?

Accepted Answer

IP spoofing. The firewall is logging traffic on its external interface with a source IP address from the internal RFC 1918 range (10.0.1.5). This indicates the source IP has been forged, because private IP addresses should never appear as source addresses on a public-facing interface. This is the classic signature of an IP spoofing attack, where the attacker modifies the source IP in the packet header to impersonate an internal host.

Answer

DNS poisoning

Answer

ARP poisoning

Answer

VLAN hopping

Question 6

A network administrator needs to create a subnet that supports exactly 50 hosts. Which subnet mask provides the smallest subnet that meets this requirement?

Accepted Answer

B. Option B is correct because a /26 subnet mask (255.255.255.192) provides 62 usable host addresses (2^(32-26) - 2 = 64 - 2 = 62), which is the smallest subnet that supports at least 50 hosts. A /27 would only provide 30 usable addresses, which is insufficient.

Answer

A

Answer

C

Answer

D

Question 7

A network administrator needs to document the network for auditing purposes. Which type of documentation provides the most detailed information about the physical connections between devices, including cable types and patch panel ports?

Accepted Answer

Wiring schematic. A wiring schematic provides the most detailed information about physical connections, including cable types, patch panel ports, and exact pin-to-pin wiring. This level of detail is essential for auditing physical infrastructure, as it documents the actual cabling plant rather than logical or high-level connectivity.

Answer

Logical diagram

Answer

Network topology map

Answer

Asset management database

Question 8

A network administrator wants to collect and analyze logs from multiple network devices in a central location. Which of the following protocols should be used?

Accepted Answer

Syslog. Syslog is the correct protocol because it is specifically designed for centralized log collection and analysis from network devices. It uses UDP port 514 (or TCP 6514 for reliable delivery) to send event messages from routers, switches, and firewalls to a central syslog server, enabling administrators to aggregate and review logs for troubleshooting and security monitoring.

Answer

SNMP

Answer

SMTP

Answer

FTP

Question 9

A network security administrator is configuring authentication for network devices and wants to use a protocol that supports separate encryption of the entire authentication packet. Which of the following protocols is designed to encrypt the entire authentication packet and is commonly used with AAA services?

Accepted Answer

TACACS+. TACACS+ is the correct answer because it encrypts the entire authentication packet, including the username, password, and all other fields, using a shared secret key. This full-packet encryption is a key differentiator from RADIUS, which only encrypts the password field. TACACS+ is commonly used with AAA services to provide separate authentication, authorization, and accounting processes.

Answer

RADIUS

Answer

LDAP

Answer

Kerberos

Question 10

A security analyst discovers that an attacker is sending large numbers of incomplete TCP connection requests to a server, causing the server to run out of resources and stop responding to legitimate requests. Which type of attack is this, and which mitigation should be implemented?

Accepted Answer

SYN flood; enable TCP intercept or SYN cookies. This is a SYN flood attack, where the attacker sends a high volume of TCP SYN packets without completing the three-way handshake, exhausting the server's connection queue. Enabling TCP intercept (on Cisco devices) or SYN cookies (RFC 4987) allows the server to validate handshakes before allocating resources, mitigating the attack.

Answer

Ping flood; implement rate limiting

Answer

Smurf attack; disable IP-directed broadcasts

Answer

ARP poisoning; enable dynamic ARP inspection