N10-009 Practice Test 13 — 15 Questions

Question 1

A user reports that they cannot access a web server at 10.0.1.200. The user can ping the server's IP address but cannot open the web page. The web server is known to be running and accessible from other users on the same subnet. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ACL blocking port 80 or 443. The user can ping the server (ICMP works) but cannot access the web page, which indicates Layer 3 connectivity is fine but the specific TCP ports (80 for HTTP or 443 for HTTPS) are being blocked. An ACL applied on the server, a switch, or a router between the user and the server is the most likely cause, as it would permit ICMP echo requests while denying HTTP/HTTPS traffic. Other users on the same subnet can access the server, ruling out server-side or subnet-wide issues.

Answer

Default gateway is misconfigured

Answer

DNS resolution failure

Answer

Duplicate IP address

Question 2

A network engineer needs to securely transfer router configuration files to a central backup server. The backup server supports SCP and TFTP. Which protocol should the engineer use?

Accepted Answer

SCP. SCP (Secure Copy Protocol) is the correct choice because it encrypts both the authentication and the data transfer using SSH, ensuring confidentiality and integrity of the router configuration files during transit. TFTP, while simple and often used for network device backups, lacks any encryption or authentication, making it insecure for transferring sensitive configuration data over a network.

Answer

TFTP

Answer

HTTP

Answer

FTP

Question 3

A client and server are establishing a TCP connection. The client sends a SYN segment to the server. The server responds with a SYN-ACK segment. What is the next segment in the handshake?

Accepted Answer

ACK. The TCP three-way handshake requires the client to acknowledge the server's SYN-ACK by sending an ACK segment. This completes the handshake, establishing a full-duplex connection with synchronized sequence numbers. Without this final ACK, the server remains in a half-open state, unable to begin data transmission.

Answer

RST

Answer

FIN

Answer

SYN

Question 4

A user reports intermittent connectivity issues. The technician notices that the link lights on both the PC and the switch are solid, but the user experiences periodic drops. The technician runs a cable test and finds that one pair of wires is open. Which standard is the cable likely violating?

Accepted Answer

TIA/EIA-568. The TIA/EIA-568 standard specifies the wiring pinouts and performance requirements for twisted-pair cabling, including that all four pairs must be properly terminated and continuous. An open pair violates this standard because it breaks the required electrical continuity, leading to signal degradation and intermittent connectivity. The solid link lights indicate basic electrical connectivity on some pairs, but the open pair causes periodic drops when the network attempts to use that pair for data transmission.

Answer

IEEE 802.3

Answer

ISO 9001

Answer

RFC 1918

Question 5

A security auditor discovers that several unused switch ports are in default configuration. The auditor recommends implementing a security measure that will disable the port if an unauthorized device is connected, and then automatically re-enable the port after a specified time period. Which feature should be configured on the switch ports?

Accepted Answer

Port security with violation mode 'shutdown' and errdisable recovery interval. Port security with violation mode 'shutdown' disables the port when an unauthorized device is detected, and the errdisable recovery interval automatically re-enables the port after a specified time period. This directly matches the auditor's requirement to disable on unauthorized connection and auto-re-enable after a timeout.

Answer

802.1X with RADIUS authentication and guest VLAN

Answer

DHCP snooping and dynamic ARP inspection

Answer

Storm control and broadcast suppression

Question 6

Users in a remote office are experiencing slow file transfers to the data center. The network technician runs a traceroute and discovers high latency on a specific hop. The technician pings that hop and gets replies with varying latency. The technician also checks the interface error counters on the router at that hop and finds no errors. What is the most likely cause?

Accepted Answer

CPU overload on the router. High latency with varying values (jitter) combined with clean interface error counters points to a router that is overwhelmed by processing demands. When a router's CPU is overloaded, it queues packets for processing, introducing variable delays even though the physical layer shows no errors. This matches the symptom of a specific hop showing latency spikes without CRC or framing errors.

Answer

Duplex mismatch

Answer

Incorrect MTU

Answer

Route flapping

Question 7

A network monitoring tool uses SNMP to collect data from devices. What is the primary purpose of SNMP traps?

Accepted Answer

To enable devices to send unsolicited alerts to the management system. SNMP traps are unsolicited messages sent by an SNMP agent to the network management system (NMS) to immediately notify it of a significant event, such as a link failure or high CPU utilization. This push mechanism allows the NMS to react in real time without having to poll the device, reducing bandwidth and processing overhead. The correct answer is B because traps are specifically designed for asynchronous alerting, not for polling, encryption, or authentication.

Answer

To allow a manager to poll devices for current status

Answer

To encrypt SNMP communications

Answer

To provide authentication for SNMP messages

Question 8

A network administrator wants to automate IP address assignment for client devices. Which protocol should be used?

Accepted Answer

DHCP. DHCP (Dynamic Host Configuration Protocol) automates IP address assignment by leasing IP configurations to client devices from a defined pool. This eliminates the need for manual static IP configuration, making it the correct protocol for automated IP address management.

Answer

DNS

Answer

ARP

Answer

ICMP

Question 9

A network architect is implementing a Software-Defined Networking (SDN) solution. The SDN controller needs to communicate with the physical switches to install flow rules. Which type of API is used for this communication?

Accepted Answer

Southbound API. The Southbound API is the correct interface because it enables the SDN controller to communicate with the underlying physical or virtual network devices (switches, routers) to install flow rules, modify forwarding tables, and gather telemetry. This API typically uses protocols such as OpenFlow, NETCONF, or OVSDB to translate controller decisions into device-level actions, making it the essential southbound channel in an SDN architecture.

Answer

Northbound API

Answer

Eastbound API

Answer

Westbound API

Question 10

A junior network technician asks which device operates at Layer 2 of the OSI model and uses MAC addresses to forward frames. Which device is the technician describing?

Accepted Answer

Switch. A switch operates at Layer 2 (Data Link layer) of the OSI model and uses MAC addresses to make forwarding decisions. It builds a MAC address table by learning source MAC addresses from incoming frames and then forwards frames only to the specific port associated with the destination MAC address, reducing collision domains and improving network efficiency.

Answer

Hub

Answer

Router

Answer

Firewall

Question 11

Which of the following best describes the purpose of the TCP three-way handshake?

Accepted Answer

To establish a reliable connection between two hosts. The TCP three-way handshake is the process by which two hosts synchronize sequence numbers and establish a reliable connection before data transfer begins. It involves the exchange of SYN, SYN-ACK, and ACK segments, ensuring both sides are ready to communicate and agree on initial sequence numbers (ISNs) as defined in RFC 793.

Answer

To terminate a connection gracefully

Answer

To resolve an IP address to a MAC address

Answer

To encrypt data between two devices

Question 12

Drag and drop the steps in the DHCP lease process (DORA) into the correct order.

Accepted Answer

Discover, Offer, Request, Acknowledge. The DHCP lease process follows the DORA sequence: Discover, Offer, Request, Acknowledge. The client initiates by broadcasting a Discover packet. DHCP servers reply with an Offer containing an IP address. The client then sends a Request to formally accept one offer. Finally, the server sends an Acknowledge to confirm the lease and provide additional configuration parameters. This order ensures proper negotiation and avoids conflicts.

Answer

Discover, Request, Offer, Acknowledge

Answer

Offer, Discover, Request, Acknowledge

Answer

Discover, Offer, Acknowledge, Request

Question 13

A network administrator needs to monitor network devices using SNMP. The security policy requires that both authentication and data encryption must be enforced for all SNMP operations. Which SNMPv3 security level should be configured?

Accepted Answer

authPriv. The authPriv security level is correct because it enforces both authentication (via HMAC-MD5 or HMAC-SHA) and data encryption (via DES or AES) for SNMPv3 operations, satisfying the security policy requirement. SNMPv3 defines three security levels: noAuthNoPriv, authNoPriv, and authPriv, with authPriv being the only one that provides both authentication and encryption.

Answer

noAuthNoPriv

Answer

authNoPriv

Answer

noAuthPriv

Question 14

A network technician needs to connect two switches to support multiple VLANs between them. The technician wants to use a single link to carry traffic for all VLANs. Which protocol should be used to tag frames with VLAN information?

Accepted Answer

802.1Q. 802.1Q is the IEEE standard for VLAN tagging, which inserts a 4-byte tag into the Ethernet frame header to identify the VLAN membership of the frame. This allows a single trunk link between two switches to carry traffic for multiple VLANs by tagging each frame with its corresponding VLAN ID (1-4094).

Answer

802.1X

Answer

802.11

Answer

802.3

Question 15

A company wants to ensure that only devices with known MAC addresses can connect to the guest Wi-Fi network. Which security feature should be configured on the wireless controller?

Accepted Answer

MAC filtering. MAC filtering allows the wireless controller to maintain an allowlist of known MAC addresses, so only devices with those addresses can associate with the guest SSID. This directly meets the requirement to restrict access based on MAC addresses without requiring authentication credentials from users.

Answer

WPA2-Enterprise

Answer

802.1X

Answer

WPA3-Personal