N10-009 Practice Test 15 — 15 Questions

Question 1

A user's computer obtains an IP address from DHCP, can ping the default gateway, but cannot access any external websites. The technician runs 'tracert 8.8.8.8' from the user's computer. The first hop shows the default gateway with low latency, but the second hop shows a timeout. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The router's default route pointing to the ISP is missing or incorrectly configured.. The traceroute shows that the user's computer can reach the default gateway (first hop) but times out at the second hop, which is the ISP's router. This indicates that the local router does not have a valid default route pointing to the ISP, so it cannot forward traffic beyond the local subnet. Without a correct default route, packets destined for external networks (like 8.8.8.8) are dropped, even though the user's computer can ping the gateway and obtain an IP via DHCP.

Answer

The user's computer firewall is blocking outbound web traffic.

Answer

The DNS server is not resolving domain names.

Answer

The ISP's DNS server is unreachable.

Question 2

A network technician is troubleshooting a router that is not forwarding packets to a remote destination network. The routing table shows a valid route learned via OSPF. The technician can successfully ping the next-hop IP address from the router. However, packets to the destination network are not being forwarded. Which of the following is the MOST likely cause?

Accepted Answer

Hardware switching/forwarding is disabled or the forwarding table is corrupted. When a router has a valid OSPF-learned route and can ping the next-hop IP but still fails to forward packets, the issue is often with the data plane rather than the control plane. Hardware switching mechanisms (such as fast switching or generic forwarding engines) handle packet forwarding; if they are disabled or the forwarding information base (FIB) becomes corrupted, the router will not forward packets even though the routing table (RIB) is correct. Disabling hardware switching forces the router to use process switching, which can also cause forwarding failures.

Answer

The OSPF neighbor relationship is in the EXSTART state

Answer

The outbound interface has been administratively shut down

Answer

There is an ACL blocking the return traffic

Question 3

A user reports that they can access internal websites but cannot access any external websites. Other users in the same subnet can access external sites. The user's IP configuration shows a correct IP, subnet mask, and default gateway. What is the most likely cause?

Accepted Answer

The proxy server settings are incorrect.. The user can access internal websites but not external ones, while other users in the same subnet have no issues. This points to a client-specific configuration problem rather than a network-wide issue. Incorrect proxy server settings on the user's machine can prevent external HTTP/HTTPS traffic from being routed correctly, even though internal traffic (which may bypass the proxy) works fine.

Answer

The DNS server is not reachable.

Answer

The default gateway is misconfigured.

Answer

The web browser has a corrupted cache.

Question 4

A user reports that they cannot access the company's internal web application at https://apps.internal.company.com. The technician can ping the server's IP address (10.10.10.20) successfully and also successfully telnet to 10.10.10.20 on port 443. However, the web browser displays 'Unable to connect'. What is the most likely cause?

Accepted Answer

The browser is configured to use an incorrect proxy server. The technician can ping the server IP and telnet to port 443, proving the server is reachable and the HTTPS service is listening. However, the browser fails to load the page, which points to a client-side issue. An incorrect proxy server configuration in the browser would cause the browser to send requests to a proxy that cannot reach the internal server, resulting in 'Unable to connect' despite successful network-level connectivity tests.

Answer

The web server service is stopped

Answer

DNS resolution is failing for the FQDN

Answer

A firewall is blocking TCP port 443

Question 5

A user reports that they can access internal resources such as file shares and printers by name, but they cannot access any external websites. The technician checks the IP configuration and finds the workstation has a valid IP address, subnet mask, default gateway, and DNS server addresses. The technician can successfully ping the default gateway and an external IP address like 8.8.8.8. Which of the following should the technician check NEXT?

Accepted Answer

Verify that the DNS server can resolve external domain names.. The user can access internal resources by name and can ping an external IP address (8.8.8.8), which confirms that IP routing, the default gateway, and basic network connectivity are working. The inability to access external websites by name, despite having DNS server addresses configured, points directly to a DNS resolution failure for external domains. Therefore, the next logical step is to verify that the configured DNS server can resolve external domain names, such as by using `nslookup` or `dig` to query a public domain like google.com.

Answer

Perform a traceroute to the external website to identify the point of failure.

Answer

Check the Windows Firewall on the workstation to ensure it is not blocking outbound HTTP traffic.

Answer

Renew the DHCP lease on the workstation.

Question 6

An NOC technician observes that the CPU usage on a core switch has been consistently above 90% for the past hour. Which SNMP operation should the technician use to monitor the CPU load over time with minimal network overhead?

Accepted Answer

SNMP TRAP. D is correct because SNMP TRAP is an unsolicited notification sent from the agent (the switch) to the NMS, which allows the NOC to receive CPU load alerts only when a threshold is exceeded, minimizing network overhead by avoiding continuous polling. In this scenario, the technician wants to monitor CPU load over time with minimal overhead, and traps provide event-driven reporting rather than periodic requests, reducing bandwidth and processing load on both the switch and the network.

Answer

SNMP GET

Answer

SNMP GETNEXT

Answer

SNMP WALK

Question 7

A security administrator is configuring a firewall to allow remote employees to access the company's internal web server (port 443) from the internet. The web server has an internal IP address of 10.0.0.5. The firewall has a public IP of 203.0.113.10. Which type of firewall rule should be created?

Accepted Answer

A) Port forwarding (DNAT) rule. A port forwarding (DNAT) rule is required because the web server uses a private RFC 1918 IP address (10.0.0.5), which is not routable on the public internet. The firewall must translate the destination IP from its public address (203.0.113.10) to the internal server's private address, allowing inbound traffic on port 443 to reach the correct internal host.

Answer

B) Allow rule with source any, destination 10.0.0.5, port 443

Answer

C) Access control list on the internal interface

Answer

D) VPN rule to require remote access VPN

Question 8

A network administrator wants to ensure that only a specific laptop can connect to a particular switch port. The laptop's MAC address is known. Which security feature should be configured?

Accepted Answer

Port security. Port security is the correct feature because it allows the administrator to statically configure the allowed MAC address on a specific switch port. Once configured, the switch will only forward traffic from that MAC address, dropping frames from any other source MAC. This directly fulfills the requirement to restrict access to a single known laptop.

Answer

802.1X

Answer

DHCP snooping

Answer

BPDU guard

Question 9

A network administrator wants to be notified immediately when any interface on a core router goes down. The administrator has already configured SNMP community strings on the router. What additional configuration is necessary to receive these notifications?

Accepted Answer

Configure an SNMP trap receiver on the NMS and set the router to send traps to that receiver.. SNMP traps are unsolicited notifications sent from a managed device (the router) to a Network Management System (NMS) when a specific event occurs, such as an interface going down. Since the administrator already configured SNMP community strings (which provide authentication for SNMP messages), the missing piece is configuring the router to send traps to a specific trap receiver (the NMS) and ensuring the NMS is set up to listen for those traps. Without this trap receiver configuration, the router will not generate or forward the event-driven alerts.

Answer

Enable SNMP polling from the NMS at regular intervals.

Answer

Set up syslog to forward log messages to a centralized server.

Answer

Configure an access control list to allow the NMS to poll the router.

Question 10

Which of the following is a characteristic of a Layer 2 broadcast domain?

Accepted Answer

Broadcast frames are forwarded to all ports within the domain.. A Layer 2 broadcast domain consists of all devices that receive a broadcast frame sent by any device within that domain. Switches forward broadcast frames (destination MAC FF:FF:FF:FF:FF:FF) out all ports except the ingress port, ensuring every device in the same VLAN or collision-free segment sees the broadcast. This is why option C is correct.

Answer

Devices can communicate using MAC addresses alone.

Answer

All devices must be on the same IP subnet.

Answer

Routers are required to communicate between devices in the same domain.

Question 11

A network administrator is configuring OSPF on routers in a multi-area network. The administrator wants to ensure that a router in area 1 does not learn external routes (Type 5 LSAs) injected by an ASBR in area 0, but it must still learn inter-area routes (Type 3 LSAs). The administrator wants to reduce the routing table size. Which OSPF area type should be configured for area 1?

Accepted Answer

Stub area. A stub area blocks Type 5 LSAs (external routes) from entering the area while still allowing Type 3 LSAs (inter-area routes). This meets the requirement of preventing external routes from the ASBR in area 0 from being learned by routers in area 1, while still permitting inter-area routing and reducing the routing table size.

Answer

Totally stubby area

Answer

Not-so-stubby-area (NSSA)

Answer

Normal area

Question 12

A network administrator is configuring a trunk link between a switch and a router to support multiple VLANs. The switch's trunk port is set to dot1q encapsulation. Which configuration must match on the router to ensure proper communication?

Accepted Answer

The native VLAN on the router subinterface must be consistent with the switch's native VLAN. The native VLAN on the router subinterface must match the switch's native VLAN to ensure untagged frames are handled consistently. On a dot1q trunk, the native VLAN is the only VLAN whose frames are sent untagged; if the router expects a different native VLAN, it will drop or misclassify those frames, breaking communication for that VLAN.

Answer

The IP address of the router interface must be in the same subnet as the management VLAN

Answer

The subinterface encapsulation must match the switch's native VLAN default

Answer

The router must be configured with inter-VLAN routing static routes

Question 13

Users in VLAN 10 cannot obtain IP addresses from a DHCP server located in VLAN 20. The router has an ip helper-address configured on VLAN 10 interface pointing to the DHCP server. Users can ping the DHCP server IP from the router. However, users are receiving APIPA addresses. What is the most likely cause?

Accepted Answer

The DHCP server scope does not include the VLAN 10 subnet. The DHCP server must have a scope configured for the subnet of the requesting clients (VLAN 10) to assign IP addresses from that range. Since users receive APIPA addresses (169.254.x.x), the DHCP discovery process is failing, which typically occurs when the server receives the request via the ip helper-address but has no matching scope for VLAN 10. The router's ability to ping the server confirms Layer 3 reachability, isolating the issue to the server's scope configuration.

Answer

The DHCP server is not reachable from the router

Answer

The router's ip helper-address is configured incorrectly

Answer

The switch ports are not configured for VLAN 10

Question 14

A security auditor is reviewing firewall logs and notices repeated login attempts from a single external IP address to the company's SSH server. Which type of attack is likely occurring?

Accepted Answer

Brute force attack. Repeated login attempts from a single external IP to an SSH server are characteristic of a brute force attack, where an attacker systematically tries many username/password combinations to gain unauthorized access. SSH (port 22) is a common target because it provides remote shell access, and automated tools like Hydra or Medusa can rapidly test credentials. The firewall logs show multiple failed authentication attempts from the same source, which is the hallmark of this attack type.

Answer

Man-in-the-middle attack

Answer

ARP poisoning

Answer

DDoS attack

Question 15

A user reports that they cannot access the internal web server by its fully qualified domain name (intranet.company.com). The workstation's IP configuration shows a DNS server of 8.8.8.8, but the internal DNS server is 10.0.0.10. The user can successfully ping the server's IP address (10.0.0.50). What is the MOST likely cause of the issue?

Accepted Answer

A: The workstation is using the wrong DNS server address. The workstation's DNS server is set to 8.8.8.8 (a public Google DNS server), which cannot resolve the internal domain name 'intranet.company.com' because that zone is only hosted on the internal DNS server at 10.0.0.10. Since the user can ping the server's IP address (10.0.0.50), network connectivity is fine, confirming the issue is name resolution. The most likely cause is that the workstation is using the wrong DNS server address.

Answer

B: The subnet mask on the workstation is incorrect

Answer

C: The network cable is faulty

Answer

D: The default gateway is misconfigured