N10-009 Practice Test 12 — 15 Questions

Question 1

A security engineer notices that the company's web server is receiving an overwhelming number of HTTP GET requests from thousands of different IP addresses around the world. The requests are for legitimate pages and are well-formed. The server is becoming unresponsive. Which type of attack is most likely occurring?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DDoS attack. The attack involves a high volume of legitimate HTTP GET requests from many distinct IP addresses, overwhelming the web server. This is a classic distributed denial-of-service (DDoS) attack, where multiple compromised systems (a botnet) coordinate to flood the target with traffic, exhausting server resources and causing unresponsiveness. The key indicators are the distributed source IPs and the use of application-layer (HTTP) requests, which distinguishes it from network-layer floods.

Answer

ARP spoofing

Answer

SYN flood

Answer

DNS amplification

Question 2

A network technician needs to find which physical patch panel port in the server room connects to a specific office wall jack. Which type of network documentation should the technician consult?

Accepted Answer

Cabling diagram. A cabling diagram provides the physical layer (Layer 1) documentation that maps specific patch panel ports to wall jacks, including cable runs, termination points, and labeling. This is exactly what the technician needs to trace the physical connection from the server room patch panel to the office wall jack.

Answer

Logical topology diagram

Answer

Network baseline

Answer

Rack diagram

Question 3

A network administrator is deploying a new PoE security camera. The camera is connected to a PoE-enabled switch port, but the camera does not power on. The administrator confirms the switch port has PoE enabled and the cable is tested and functional. What is the most likely cause?

Accepted Answer

The camera requires 802.3bt (PoE++), but the switch only supports 802.3af (PoE).. The camera requires 802.3bt (PoE++) which can deliver up to 60W or 90W, but the switch only supports 802.3af (PoE) which provides a maximum of 15.4W per port. Since the camera's power demand exceeds the switch's capability, the camera will not power on even though PoE is enabled and the cable is functional.

Answer

The cable is a crossover cable.

Answer

The port is configured as an access port.

Answer

The camera is using a passive PoE injector.

Question 4

A company wants to prevent unauthorized devices from connecting to the wired network by authenticating users or devices before granting network access. Which of the following technologies should be implemented on the switch ports to achieve this?

Accepted Answer

A: 802.1X. 802.1X is an IEEE standard (802.1X-2020) for port-based Network Access Control (NAC). It authenticates users or devices via EAP (Extensible Authentication Protocol) before the switch port transitions from the unauthorized (blocking) state to the authorized (forwarding) state, effectively preventing unauthorized devices from accessing the wired network.

Answer

B: Port security with MAC address sticky

Answer

C: Access control lists (ACLs)

Answer

D: DHCP snooping

Question 5

Which of the following network topologies connects each node to exactly two other nodes, forming a closed loop?

Accepted Answer

Ring. In a ring topology, each node is connected to exactly two neighbors, forming a closed loop where data travels in one direction (or sometimes dual-ring for redundancy). This is the only topology among the options that inherently creates a circular path with each node having exactly two connections.

Answer

Star

Answer

Bus

Answer

Mesh

Question 6

A security team is deploying a new intrusion detection system (IDS) and wants to analyze all traffic entering and exiting the network without introducing latency or a single point of failure. How should the IDS be connected to the network?

Accepted Answer

Connected to a network tap or spanned port on the core switch. Connecting the IDS to a network tap or a spanned port (SPAN/mirror port) on the core switch allows it to receive a copy of all traffic entering and exiting the network without being in the data path. This passive deployment introduces zero latency because the IDS never forwards or blocks traffic, and it eliminates a single point of failure since the network continues to operate if the IDS fails or is taken offline.

Answer

Inline between the firewall and the core switch

Answer

Directly connected to the internet router

Answer

Connected to the management network

Question 7

A network administrator notices that a large number of ICMP echo request packets are being sent to the broadcast address of the network from a single host. This is causing performance degradation. Which type of attack is this?

Accepted Answer

Smurf attack. The smurf attack exploits ICMP by sending echo request packets to a network's broadcast address with a spoofed source IP of the victim. All hosts on the network then reply to the victim, overwhelming it with traffic and causing performance degradation. This matches the scenario of a single host sending ICMP echo requests to the broadcast address.

Answer

ARP spoofing

Answer

MAC flooding

Answer

DNS amplification

Question 8

An organization has separate VLANs for the HR and Finance departments. Both VLANs use a single Layer 3 switch to route between them. The HR department needs access to a shared printer located in the Finance VLAN, but all other traffic between the VLANs should be blocked. Which of the following should be configured?

Accepted Answer

Configure an ACL on the Layer 3 switch to permit specific traffic between VLANs. An ACL on the Layer 3 switch can filter inter-VLAN traffic at the routed interface (SVI or routed port). By permitting only the HR subnet’s traffic to the printer’s IP address and denying all other inter-VLAN traffic, you meet the requirement of selective access while blocking everything else. This is the standard method for policy-based segmentation between VLANs.

Answer

Place the printer in the HR VLAN

Answer

Create a separate VLAN for the printer

Answer

Use a wireless access point to bridge the VLANs

Question 9

A network administrator must monitor network devices using SNMP. The security policy mandates strong encryption for both authentication and data integrity. Which SNMP version and security level should be implemented?

Accepted Answer

SNMPv3 with authPriv. SNMPv3 with authPriv is correct because it provides both authentication (to verify the source of messages) and encryption (to ensure data integrity and confidentiality). The security policy mandates strong encryption for both authentication and data integrity, which only the authPriv security level fulfills by using HMAC-SHA/MD5 for authentication and AES/DES for encryption.

Answer

SNMPv1

Answer

SNMPv2c

Answer

SNMPv3 with noAuthNoPriv

Question 10

A network administrator is connecting two switches to increase bandwidth and provide redundancy. Which technology should be used to combine multiple physical links into a single logical link?

Accepted Answer

Link Aggregation Control Protocol. Link Aggregation Control Protocol (LACP) is the correct technology because it allows multiple physical Ethernet links to be combined into a single logical link, increasing aggregate bandwidth and providing redundancy. LACP (IEEE 802.3ad) automatically negotiates and manages the bundling of ports between switches, ensuring that traffic is load-balanced across the member links and that the bundle remains operational even if one physical link fails.

Answer

Spanning Tree Protocol

Answer

VLAN Trunking Protocol

Answer

Rapid Spanning Tree Protocol

Question 11

At which layer of the OSI model does a device provide flow control, error detection, and recovery for end-to-end communication?

Accepted Answer

A: Transport layer. The Transport layer (Layer 4) is responsible for end-to-end communication between source and destination hosts. It provides flow control (e.g., TCP's sliding window mechanism), error detection (via checksums in TCP and UDP headers), and recovery (through TCP retransmission of lost segments). These functions ensure reliable data delivery across the network, distinguishing it from lower layers that handle hop-by-hop or link-local tasks.

Answer

B: Network layer

Answer

C: Data Link layer

Answer

D: Session layer

Question 12

A company's wireless network currently uses WPA2-PSK with a shared passphrase. A security audit identifies that the passphrase is weak and shared among all employees. Which of the following would provide the MOST secure wireless access while addressing the shared passphrase issue?

Accepted Answer

Implement WPA2-Enterprise with 802.1X. WPA2-Enterprise with 802.1X eliminates the shared passphrase by using a RADIUS server to authenticate each user individually, typically via EAP methods such as PEAP or EAP-TLS. This provides per-user credentials (e.g., username/password or certificates), so compromising one user's credentials does not expose the entire network. It also supports dynamic per-session encryption keys, making it far more secure than any shared-passphrase solution.

Answer

Upgrade to WPA3-Personal with a strong passphrase

Answer

Disable SSID broadcast

Answer

Enable MAC address filtering

Question 13

A network administrator needs to replace a core switch that is nearing end-of-life. According to change management best practices, which step should the administrator perform FIRST?

Accepted Answer

D. According to change management best practices, the first step is to create a detailed change request or plan that documents the scope, risk assessment, rollback procedures, and approval requirements. This ensures all stakeholders review and authorize the replacement before any physical work begins, minimizing network downtime and operational impact.

Answer

A

Answer

B

Answer

C

Question 14

A network engineer is deploying 802.1X authentication for a wireless network. The security policy requires mutual authentication between the client and the network using certificates on both ends. Which EAP method should the engineer select?

Accepted Answer

EAP-TLS. EAP-TLS (Transport Layer Security) is the correct choice because it provides mutual authentication using certificates on both the client and the server, satisfying the security policy requirement. Unlike other EAP methods, EAP-TLS requires a PKI with certificates installed on both endpoints, ensuring that each side validates the other's identity before establishing the connection.

Answer

EAP-MD5

Answer

PEAP

Answer

EAP-FAST

Question 15

A technician is troubleshooting a connectivity issue. A client can successfully ping its default gateway but cannot ping a server located on a different subnet. The router's routing table shows a valid route to the server's network. What should the technician check NEXT?

Accepted Answer

The ACL applied to the router interface. Since the client can ping its default gateway but not a server on a different subnet, Layer 3 routing is working (the router has a valid route). The most likely cause is an ACL on the router interface that is blocking traffic to the server's network. ACLs filter traffic based on source/destination IP, protocol, or port, and can permit or deny packets even when a valid route exists.

Answer

The DNS resolution for the server

Answer

The ARP cache on the client

Answer

The duplex settings on the client NIC