N10-009 Practice Test 13 — 15 Questions

Question 1

A network administrator notices that a large number of ICMP echo request packets are being sent to the broadcast address of the network from a single host. This is causing performance degradation. Which type of attack is this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Smurf attack. The smurf attack exploits ICMP by sending echo request packets to a network's broadcast address with a spoofed source IP of the victim. All hosts on the network then reply to the victim, overwhelming it with traffic and causing performance degradation. This matches the scenario of a single host sending ICMP echo requests to the broadcast address.

Answer

ARP spoofing

Answer

MAC flooding

Answer

DNS amplification

Question 2

An organization has separate VLANs for the HR and Finance departments. Both VLANs use a single Layer 3 switch to route between them. The HR department needs access to a shared printer located in the Finance VLAN, but all other traffic between the VLANs should be blocked. Which of the following should be configured?

Accepted Answer

Configure an ACL on the Layer 3 switch to permit specific traffic between VLANs. An ACL on the Layer 3 switch can filter inter-VLAN traffic at the routed interface (SVI or routed port). By permitting only the HR subnet’s traffic to the printer’s IP address and denying all other inter-VLAN traffic, you meet the requirement of selective access while blocking everything else. This is the standard method for policy-based segmentation between VLANs.

Answer

Place the printer in the HR VLAN

Answer

Create a separate VLAN for the printer

Answer

Use a wireless access point to bridge the VLANs

Question 3

A network administrator must monitor network devices using SNMP. The security policy mandates strong encryption for both authentication and data integrity. Which SNMP version and security level should be implemented?

Accepted Answer

SNMPv3 with authPriv. SNMPv3 with authPriv is correct because it provides both authentication (to verify the source of messages) and encryption (to ensure data integrity and confidentiality). The security policy mandates strong encryption for both authentication and data integrity, which only the authPriv security level fulfills by using HMAC-SHA/MD5 for authentication and AES/DES for encryption.

Answer

SNMPv1

Answer

SNMPv2c

Answer

SNMPv3 with noAuthNoPriv

Question 4

A network administrator is connecting two switches to increase bandwidth and provide redundancy. Which technology should be used to combine multiple physical links into a single logical link?

Accepted Answer

Link Aggregation Control Protocol. Link Aggregation Control Protocol (LACP) is the correct technology because it allows multiple physical Ethernet links to be combined into a single logical link, increasing aggregate bandwidth and providing redundancy. LACP (IEEE 802.3ad) automatically negotiates and manages the bundling of ports between switches, ensuring that traffic is load-balanced across the member links and that the bundle remains operational even if one physical link fails.

Answer

Spanning Tree Protocol

Answer

VLAN Trunking Protocol

Answer

Rapid Spanning Tree Protocol

Question 5

At which layer of the OSI model does a device provide flow control, error detection, and recovery for end-to-end communication?

Accepted Answer

A: Transport layer. The Transport layer (Layer 4) is responsible for end-to-end communication between source and destination hosts. It provides flow control (e.g., TCP's sliding window mechanism), error detection (via checksums in TCP and UDP headers), and recovery (through TCP retransmission of lost segments). These functions ensure reliable data delivery across the network, distinguishing it from lower layers that handle hop-by-hop or link-local tasks.

Answer

B: Network layer

Answer

C: Data Link layer

Answer

D: Session layer

Question 6

A company's wireless network currently uses WPA2-PSK with a shared passphrase. A security audit identifies that the passphrase is weak and shared among all employees. Which of the following would provide the MOST secure wireless access while addressing the shared passphrase issue?

Accepted Answer

Implement WPA2-Enterprise with 802.1X. WPA2-Enterprise with 802.1X eliminates the shared passphrase by using a RADIUS server to authenticate each user individually, typically via EAP methods such as PEAP or EAP-TLS. This provides per-user credentials (e.g., username/password or certificates), so compromising one user's credentials does not expose the entire network. It also supports dynamic per-session encryption keys, making it far more secure than any shared-passphrase solution.

Answer

Upgrade to WPA3-Personal with a strong passphrase

Answer

Disable SSID broadcast

Answer

Enable MAC address filtering

Question 7

A network administrator needs to replace a core switch that is nearing end-of-life. According to change management best practices, which step should the administrator perform FIRST?

Accepted Answer

D. According to change management best practices, the first step is to create a detailed change request or plan that documents the scope, risk assessment, rollback procedures, and approval requirements. This ensures all stakeholders review and authorize the replacement before any physical work begins, minimizing network downtime and operational impact.

Answer

A

Answer

B

Answer

C

Question 8

A network engineer is deploying 802.1X authentication for a wireless network. The security policy requires mutual authentication between the client and the network using certificates on both ends. Which EAP method should the engineer select?

Accepted Answer

EAP-TLS. EAP-TLS (Transport Layer Security) is the correct choice because it provides mutual authentication using certificates on both the client and the server, satisfying the security policy requirement. Unlike other EAP methods, EAP-TLS requires a PKI with certificates installed on both endpoints, ensuring that each side validates the other's identity before establishing the connection.

Answer

EAP-MD5

Answer

PEAP

Answer

EAP-FAST

Question 9

A technician is troubleshooting a connectivity issue. A client can successfully ping its default gateway but cannot ping a server located on a different subnet. The router's routing table shows a valid route to the server's network. What should the technician check NEXT?

Accepted Answer

The ACL applied to the router interface. Since the client can ping its default gateway but not a server on a different subnet, Layer 3 routing is working (the router has a valid route). The most likely cause is an ACL on the router interface that is blocking traffic to the server's network. ACLs filter traffic based on source/destination IP, protocol, or port, and can permit or deny packets even when a valid route exists.

Answer

The DNS resolution for the server

Answer

The ARP cache on the client

Answer

The duplex settings on the client NIC

Question 10

A user reports that they cannot access a web server at 10.0.1.200. The user can ping the server's IP address but cannot open the web page. The web server is known to be running and accessible from other users on the same subnet. What is the most likely cause?

Accepted Answer

ACL blocking port 80 or 443. The user can ping the server (ICMP works) but cannot access the web page, which indicates Layer 3 connectivity is fine but the specific TCP ports (80 for HTTP or 443 for HTTPS) are being blocked. An ACL applied on the server, a switch, or a router between the user and the server is the most likely cause, as it would permit ICMP echo requests while denying HTTP/HTTPS traffic. Other users on the same subnet can access the server, ruling out server-side or subnet-wide issues.

Answer

Default gateway is misconfigured

Answer

DNS resolution failure

Answer

Duplicate IP address

Question 11

A network engineer needs to securely transfer router configuration files to a central backup server. The backup server supports SCP and TFTP. Which protocol should the engineer use?

Accepted Answer

SCP. SCP (Secure Copy Protocol) is the correct choice because it encrypts both the authentication and the data transfer using SSH, ensuring confidentiality and integrity of the router configuration files during transit. TFTP, while simple and often used for network device backups, lacks any encryption or authentication, making it insecure for transferring sensitive configuration data over a network.

Answer

TFTP

Answer

HTTP

Answer

FTP

Question 12

A client and server are establishing a TCP connection. The client sends a SYN segment to the server. The server responds with a SYN-ACK segment. What is the next segment in the handshake?

Accepted Answer

ACK. The TCP three-way handshake requires the client to acknowledge the server's SYN-ACK by sending an ACK segment. This completes the handshake, establishing a full-duplex connection with synchronized sequence numbers. Without this final ACK, the server remains in a half-open state, unable to begin data transmission.

Answer

RST

Answer

FIN

Answer

SYN

Question 13

A user reports intermittent connectivity issues. The technician notices that the link lights on both the PC and the switch are solid, but the user experiences periodic drops. The technician runs a cable test and finds that one pair of wires is open. Which standard is the cable likely violating?

Accepted Answer

TIA/EIA-568. The TIA/EIA-568 standard specifies the wiring pinouts and performance requirements for twisted-pair cabling, including that all four pairs must be properly terminated and continuous. An open pair violates this standard because it breaks the required electrical continuity, leading to signal degradation and intermittent connectivity. The solid link lights indicate basic electrical connectivity on some pairs, but the open pair causes periodic drops when the network attempts to use that pair for data transmission.

Answer

IEEE 802.3

Answer

ISO 9001

Answer

RFC 1918

Question 14

A security auditor discovers that several unused switch ports are in default configuration. The auditor recommends implementing a security measure that will disable the port if an unauthorized device is connected, and then automatically re-enable the port after a specified time period. Which feature should be configured on the switch ports?

Accepted Answer

Port security with violation mode 'shutdown' and errdisable recovery interval. Port security with violation mode 'shutdown' disables the port when an unauthorized device is detected, and the errdisable recovery interval automatically re-enables the port after a specified time period. This directly matches the auditor's requirement to disable on unauthorized connection and auto-re-enable after a timeout.

Answer

802.1X with RADIUS authentication and guest VLAN

Answer

DHCP snooping and dynamic ARP inspection

Answer

Storm control and broadcast suppression

Question 15

Users in a remote office are experiencing slow file transfers to the data center. The network technician runs a traceroute and discovers high latency on a specific hop. The technician pings that hop and gets replies with varying latency. The technician also checks the interface error counters on the router at that hop and finds no errors. What is the most likely cause?

Accepted Answer

CPU overload on the router. High latency with varying values (jitter) combined with clean interface error counters points to a router that is overwhelmed by processing demands. When a router's CPU is overloaded, it queues packets for processing, introducing variable delays even though the physical layer shows no errors. This matches the symptom of a specific hop showing latency spikes without CRC or framing errors.

Answer

Duplex mismatch

Answer

Incorrect MTU

Answer

Route flapping