N10-009 Practice Test 12 — 15 Questions

Question 1

A user reports that their laptop is connected to the corporate Wi-Fi network but cannot access the internet. Other users in the same area are able to access the internet without issues. The laptop shows a valid IP address of 192.168.1.25/24 and the default gateway is 192.168.1.1. Which of the following should the technician check NEXT?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS server configuration on the laptop. Since the laptop has a valid IP address (192.168.1.25/24) and default gateway (192.168.1.1), and other users can access the internet, the issue is isolated to this laptop. A common cause is incorrect or missing DNS server configuration, which prevents domain name resolution even though IP-level connectivity exists. The technician should verify the DNS server addresses in the laptop's IPv4 settings or run 'nslookup' to confirm resolution.

Answer

DHCP server lease exhaustion

Answer

Access point channel utilization

Answer

Switch port status on the distribution switch

Question 2

At which layer of the OSI model does the conversion of data frames into electrical signals for transmission occur?

Accepted Answer

Layer 1 (Physical). Layer 1 (Physical) is responsible for the actual transmission of raw bits over a physical medium. This includes converting data frames received from Layer 2 into electrical signals (e.g., voltage levels on copper), light pulses (fiber optic), or radio waves (wireless). The Physical layer defines the hardware specifications, such as connectors, cable types, and signaling methods like Manchester encoding or NRZ.

Answer

Layer 2 (Data Link)

Answer

Layer 3 (Network)

Answer

Layer 4 (Transport)

Question 3

Users in a branch office report intermittent connectivity to the corporate data center. A technician runs a continuous ping from a workstation to the data center server and observes packet loss after the third hop. Which command should the technician run next to identify the specific router causing the issue?

Accepted Answer

tracert server_ip. The technician has already identified packet loss after the third hop using a continuous ping. The next logical step is to use `tracert` (or `traceroute` on Linux) to map the path and pinpoint which router (hop) is dropping packets. This command sends ICMP echo requests with incrementing TTL values, forcing each router along the path to reply with a Time Exceeded message, thereby revealing the specific hop where loss occurs.

Answer

ping -n 1000 server_ip

Answer

nslookup server_ip

Answer

ipconfig /all

Question 4

A company is deploying a wireless network that must support both 2.4 GHz and 5 GHz frequency bands. Which IEEE 802.11 standard supports both bands and is backward compatible with older devices?

Accepted Answer

C) 802.11n. 802.11n (Wi-Fi 4) is the correct answer because it was the first standard to natively support both 2.4 GHz and 5 GHz bands simultaneously, using MIMO (Multiple Input Multiple Output) technology. It also maintains backward compatibility with older 802.11a/b/g devices through mandatory support for legacy modulation schemes (DSSS/CCK for 2.4 GHz and OFDM for 5 GHz).

Answer

A) 802.11b

Answer

B) 802.11g

Answer

D) 802.11ac

Question 5

A company wants to ensure that only authorized employee computers can connect to the wired network. Each computer must be authenticated before it is granted access to the network. Which technology is designed to provide this port-based authentication?

Accepted Answer

802.1X. 802.1X is the IEEE standard for port-based Network Access Control (NAC). It uses the Extensible Authentication Protocol (EAP) over LAN (EAPoL) to authenticate a device at the switch port before granting full network access. Only after successful authentication does the switch open the port, ensuring that unauthorized computers cannot connect.

Answer

WPA2

Answer

MAC filtering

Answer

VPN

Question 6

A network administrator needs to document the physical placement of devices in a server room, including exact rack location, port labels, and cable connections between patch panels and switches. Which type of diagram is most appropriate?

Accepted Answer

Rack diagram. A rack diagram is specifically designed to document the physical placement of devices in a server room, including exact rack units, port labels, and cable connections between patch panels and switches. This type of diagram provides a visual representation of the physical layout, which is essential for asset management, troubleshooting, and maintenance planning.

Answer

Network topology map

Answer

Wiring schematic

Answer

Logical topology diagram

Question 7

A security analyst detects a large number of DNS queries for the same domain from multiple internal hosts. The responses contain large payloads. Which type of attack is likely occurring?

Accepted Answer

DNS amplification. DNS amplification is a type of reflection-based DDoS attack where an attacker sends a small query (e.g., ANY or DNSSEC-signed record request) with a spoofed source IP (the victim's address) to an open DNS resolver. The resolver responds with a large payload (often 50–100x larger than the query), flooding the victim's network. The scenario describes many internal hosts making queries to the same domain and receiving large responses, which matches the amplification effect from a compromised or misconfigured internal resolver.

Answer

DNS cache poisoning

Answer

DNS tunneling

Answer

DNS zone transfer

Question 8

A company is connecting two buildings that are 300 meters apart. The link must support 10 Gbps. Which combination of cable and transceiver should be used?

Accepted Answer

Single-mode fiber with 10GBASE-LR. Single-mode fiber (SMF) with 10GBASE-LR supports 10 Gbps over distances up to 10 km, easily covering the 300-meter requirement. 10GBASE-LR uses 1310 nm laser optics over single-mode fiber, providing low signal loss and high bandwidth for long-reach links.

Answer

Cat6a UTP with 10GBASE-T

Answer

Cat5e UTP with 1000BASE-T

Answer

Multimode fiber with 10GBASE-SR

Question 9

A network technician is explaining network segmentation to a junior technician. Which of the following devices increases the number of collision domains but does not increase the number of broadcast domains?

Accepted Answer

Switch. A switch creates a separate collision domain for each port, so multiple devices can transmit simultaneously without collisions, but it does not segment broadcast domains; all ports remain in the same broadcast domain unless VLANs are configured. This directly matches the question's requirement: increasing collision domains without increasing broadcast domains.

Answer

Hub

Answer

Router

Answer

Repeater

Question 10

A security engineer notices that the company's web server is receiving an overwhelming number of HTTP GET requests from thousands of different IP addresses around the world. The requests are for legitimate pages and are well-formed. The server is becoming unresponsive. Which type of attack is most likely occurring?

Accepted Answer

DDoS attack. The attack involves a high volume of legitimate HTTP GET requests from many distinct IP addresses, overwhelming the web server. This is a classic distributed denial-of-service (DDoS) attack, where multiple compromised systems (a botnet) coordinate to flood the target with traffic, exhausting server resources and causing unresponsiveness. The key indicators are the distributed source IPs and the use of application-layer (HTTP) requests, which distinguishes it from network-layer floods.

Answer

ARP spoofing

Answer

SYN flood

Answer

DNS amplification

Question 11

A network technician needs to find which physical patch panel port in the server room connects to a specific office wall jack. Which type of network documentation should the technician consult?

Accepted Answer

Cabling diagram. A cabling diagram provides the physical layer (Layer 1) documentation that maps specific patch panel ports to wall jacks, including cable runs, termination points, and labeling. This is exactly what the technician needs to trace the physical connection from the server room patch panel to the office wall jack.

Answer

Logical topology diagram

Answer

Network baseline

Answer

Rack diagram

Question 12

A network administrator is deploying a new PoE security camera. The camera is connected to a PoE-enabled switch port, but the camera does not power on. The administrator confirms the switch port has PoE enabled and the cable is tested and functional. What is the most likely cause?

Accepted Answer

The camera requires 802.3bt (PoE++), but the switch only supports 802.3af (PoE).. The camera requires 802.3bt (PoE++) which can deliver up to 60W or 90W, but the switch only supports 802.3af (PoE) which provides a maximum of 15.4W per port. Since the camera's power demand exceeds the switch's capability, the camera will not power on even though PoE is enabled and the cable is functional.

Answer

The cable is a crossover cable.

Answer

The port is configured as an access port.

Answer

The camera is using a passive PoE injector.

Question 13

A company wants to prevent unauthorized devices from connecting to the wired network by authenticating users or devices before granting network access. Which of the following technologies should be implemented on the switch ports to achieve this?

Accepted Answer

A: 802.1X. 802.1X is an IEEE standard (802.1X-2020) for port-based Network Access Control (NAC). It authenticates users or devices via EAP (Extensible Authentication Protocol) before the switch port transitions from the unauthorized (blocking) state to the authorized (forwarding) state, effectively preventing unauthorized devices from accessing the wired network.

Answer

B: Port security with MAC address sticky

Answer

C: Access control lists (ACLs)

Answer

D: DHCP snooping

Question 14

Which of the following network topologies connects each node to exactly two other nodes, forming a closed loop?

Accepted Answer

Ring. In a ring topology, each node is connected to exactly two neighbors, forming a closed loop where data travels in one direction (or sometimes dual-ring for redundancy). This is the only topology among the options that inherently creates a circular path with each node having exactly two connections.

Answer

Star

Answer

Bus

Answer

Mesh

Question 15

A security team is deploying a new intrusion detection system (IDS) and wants to analyze all traffic entering and exiting the network without introducing latency or a single point of failure. How should the IDS be connected to the network?

Accepted Answer

Connected to a network tap or spanned port on the core switch. Connecting the IDS to a network tap or a spanned port (SPAN/mirror port) on the core switch allows it to receive a copy of all traffic entering and exiting the network without being in the data path. This passive deployment introduces zero latency because the IDS never forwards or blocks traffic, and it eliminates a single point of failure since the network continues to operate if the IDS fails or is taken offline.

Answer

Inline between the firewall and the core switch

Answer

Directly connected to the internet router

Answer

Connected to the management network