N10-009 Practice Test 16 — 15 Questions

Question 1

A technician is troubleshooting a user's computer that cannot access any network resources. The technician runs ipconfig and sees an IP address of 169.254.18.33 with a subnet mask of 255.255.0.0. The computer is connected to a switch port configured for VLAN 10. The DHCP server is located in a different subnet (VLAN 200) and is reachable via a router. The technician confirms that the switch port is in the correct VLAN and that the cabling is good. Which of the following is the MOST likely cause of the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The router does not have a DHCP relay (ip helper-address) configured. The 169.254.x.x address is an Automatic Private IP Addressing (APIPA) address, assigned when a DHCP client fails to receive a lease. Since the DHCP server is on VLAN 200 and the client is on VLAN 10, a DHCP relay (ip helper-address) must be configured on the router interface facing VLAN 10 to forward DHCP broadcast requests as unicast to the DHCP server. Without this relay, the DHCP server never receives the client's discover message, causing the client to self-assign an APIPA address.

Answer

The DHCP server is not authorized in Active Directory

Answer

The computer's NIC is faulty

Answer

The switch port is in the wrong VLAN

Question 2

A network engineer is designing a network for a large organization. The engineer needs to ensure that broadcast traffic from one VLAN does not propagate to other VLANs while still allowing inter-VLAN communication. Which of the following devices is required to route between VLANs?

Accepted Answer

Router. A router is required to route between VLANs because VLANs segment a Layer 2 broadcast domain, and inter-VLAN communication must occur at Layer 3. The router performs routing by receiving frames tagged with the source VLAN, stripping the tag, making a forwarding decision based on the destination IP, and then re-encapsulating the frame with the destination VLAN tag. This process is often implemented using a router-on-a-stick configuration with 802.1Q trunking.

Answer

Layer 2 switch

Answer

Bridge

Answer

Firewall

Question 3

A user reports that they can access the internet but cannot access the internal web server at 10.10.10.100. The technician can ping the server's IP from the router that serves as the user's default gateway. Which of the following is the MOST likely cause?

Accepted Answer

The server's default gateway is misconfigured. The user can reach the internet but not the internal web server at 10.10.10.100, while the technician can ping that server from the router (the default gateway). This indicates that the router has a valid route to the server's network and the server is reachable from the router's perspective. The most likely cause is that the server's default gateway is misconfigured: the server does not know how to send return traffic back to the user's subnet, so the TCP handshake fails (the SYN-ACK never reaches the user).

Answer

The user's workstation has a firewall blocking port 80

Answer

The router has a missing route to the server's network

Answer

The server's subnet mask is incorrect

Question 4

Users in a remote branch office report that they cannot access the company's cloud-based applications. The network administrator notices that the edge router's WAN interface is up but the branch's default route points to a next-hop IP that is unreachable. The administrator can ping the ISP's gateway IP from the router. What is the most likely cause?

Accepted Answer

The static default route has an incorrect next-hop IP. The scenario describes a static default route configured with a next-hop IP that is unreachable. The WAN interface is up and the ISP gateway is reachable (as confirmed by the ping), but the router cannot forward traffic to the cloud because the static route points to an incorrect next-hop address. This is a classic static route misconfiguration where the next-hop IP does not match the ISP gateway or is not in the directly connected subnet.

Answer

The routing protocol is not redistributing the default route

Answer

The WAN interface is administratively down

Answer

The firewall is blocking traffic to the cloud

Question 5

A network technician is troubleshooting connectivity between two branch offices connected by a site-to-site VPN. The VPN tunnel shows as active and up. Users at Branch A can ping the VPN gateway IP at Branch B successfully, but they cannot access any servers behind the firewall at Branch B. The firewall at Branch B is stateful and its logs show that traffic from Branch A is being dropped. What is the most likely cause?

Accepted Answer

Asymmetric routing causing the stateful firewall to drop return traffic. The VPN tunnel is active and Branch A can ping the VPN gateway IP at Branch B, confirming that the tunnel itself and Layer 3 connectivity are functional. However, a stateful firewall tracks connection states based on source/destination IP and port; if traffic from Branch A enters the firewall on one interface but return traffic exits via a different path (asymmetric routing), the firewall sees the return packets as not belonging to any established session and drops them. This matches the log showing traffic being dropped despite the tunnel being up.

Answer

Mismatched encryption algorithms

Answer

Incorrect DNS configuration

Answer

MTU mismatch causing fragmentation issues

Question 6

A small business uses a wireless network for employees and guests. The owner wants to ensure that guest devices cannot access internal resources such as file servers and printers. Which network security technique should be implemented?

Accepted Answer

VLAN segmentation with separate SSID for guests. VLAN segmentation with a separate SSID for guests is the correct approach because it creates a logical network boundary that isolates guest traffic from internal resources. By assigning the guest SSID to a distinct VLAN, the network can enforce access control lists (ACLs) at the Layer 3 switch or firewall, preventing guest devices from reaching file servers, printers, or other internal subnets while still allowing internet access.

Answer

MAC address filtering

Answer

WPA2 encryption

Answer

Disabling SSID broadcast

Question 7

A user reports that they can access the internet but cannot connect to an internal file server at IP address 192.168.1.50. The technician successfully pings the file server's IP address from the user's workstation. The file server is on the same subnet as the user. What is the most likely cause of this issue?

Accepted Answer

The file server's firewall is blocking the file-sharing protocol while allowing ICMP.. The technician can ping the file server (ICMP success) but the user cannot connect to it using the file-sharing protocol (e.g., SMB on TCP/445). This indicates network-layer reachability is fine, but the application-layer service is blocked. The most likely cause is the file server's host-based firewall (e.g., Windows Defender Firewall) allowing ICMP Echo Requests while blocking inbound SMB traffic, which is a common misconfiguration.

Answer

The file server has an incorrect default gateway configured.

Answer

The user's workstation has an incorrect DNS server configured.

Answer

The user's workstation has a duplicate IP address assigned.

Question 8

A security analyst is investigating a potential breach. A network device shows logs indicating that it received packets with a source IP address belonging to the internal network range on its external (internet-facing) interface. This is a classic indication of which type of attack?

Accepted Answer

IP spoofing. B is correct because receiving packets with a source IP address from the internal network range on an external (internet-facing) interface is a classic sign of IP spoofing. In IP spoofing, an attacker forges the source IP address in packet headers to impersonate a trusted internal host, often to bypass access controls or launch reflection attacks. This violates the expected behavior of ingress filtering, where external interfaces should never see internal source addresses.

Answer

Denial-of-service (DoS) attack

Answer

Man-in-the-middle (MITM) attack

Answer

ARP poisoning

Question 9

Users in a department report that the network is extremely slow. A technician checks the access switch and notices that a single port shows a high number of CRC errors and runts. The link LED is solid green. Which of the following is the most likely cause of the issue?

Accepted Answer

Duplex mismatch between the switch port and the connected device. A duplex mismatch occurs when one device operates at full duplex and the other at half duplex. The full-duplex side does not perform Carrier Sense Multiple Access with Collision Detection (CSMA/CD), so it transmits without checking for collisions. The half-duplex side detects collisions, causing late collisions that manifest as CRC errors and runts on the switch port. The solid green link LED indicates Layer 1 connectivity is intact, ruling out a physical cable fault.

Answer

Faulty network cable

Answer

Broadcast storm

Answer

VLAN misconfiguration

Question 10

A network administrator is configuring dynamic routing between two routers in the same organization. The routers must support VLSM, converge quickly, and use a metric that is based on bandwidth and delay. Which routing protocol should be configured?

Accepted Answer

EIGRP. C is correct because EIGRP is a Cisco-proprietary hybrid routing protocol that supports Variable-Length Subnet Masking (VLSM), converges rapidly using the Diffusing Update Algorithm (DUAL), and uses a composite metric that by default includes bandwidth and delay. This makes it ideal for the scenario where both VLSM support and fast convergence are required with a metric based on bandwidth and delay.

Answer

RIP

Answer

OSPF

Answer

BGP

Question 11

A network technician is troubleshooting a workstation that is experiencing intermittent connectivity and slow file transfers. The technician has confirmed that the patch cable passes a cable tester, the switch port is not error-disabled, and the workstation's NIC is configured for autonegotiation. The switch port is also set to autonegotiate. Which of the following should the technician check next?

Accepted Answer

The duplex and speed settings on both ends. Intermittent connectivity and slow file transfers, despite a passing cable test and autonegotiation on both ends, strongly indicate a duplex mismatch. When both sides are set to autonegotiate but one side fails to negotiate correctly (e.g., due to a faulty NIC or switch port), they may fall back to half-duplex while the other remains full-duplex, causing collisions, CRC errors, and retransmissions. The technician should verify the actual negotiated duplex and speed on both the workstation NIC and the switch port using commands like 'show interfaces' or NIC driver properties.

Answer

The route table on the default gateway

Answer

The DNS server configuration

Answer

The MAC address filtering on the switch

Question 12

A network engineer needs to connect two switches that are located 450 meters apart. Which combination of fiber optic transceiver and cable type would support the highest data rate over this distance?

Accepted Answer

10GBASE-LR with single-mode fiber. 10GBASE-LR (Long Reach) supports 10 Gbps over single-mode fiber (SMF) up to 10 km, easily covering the 450-meter distance. Single-mode fiber has a smaller core (9 µm) that minimizes modal dispersion, enabling higher data rates over longer distances compared to multimode fiber. This combination provides the highest data rate (10 Gbps) among the options for the given distance.

Answer

10GBASE-SR with multimode fiber

Answer

1000BASE-LX with single-mode fiber

Answer

1000BASE-SX with multimode fiber

Question 13

A network technician is troubleshooting intermittent internet access for a single user. The user’s workstation can ping the default gateway consistently, but web pages fail to load intermittently. Which of the following should the technician check NEXT?

Accepted Answer

A) DNS server configuration. The user can ping the default gateway consistently, indicating Layer 3 connectivity to the local network is intact. However, intermittent web page failures suggest a name resolution issue, as DNS translates domain names to IP addresses. If the DNS server is misconfigured, unreachable, or returning stale records, the browser will fail to load pages even though basic IP connectivity works. Checking DNS server configuration is the logical next step because it directly addresses the symptom of name resolution failures.

Answer

B) DHCP lease time

Answer

C) Switch port speed and duplex settings

Answer

D) Firewall rules blocking ICMP

Question 14

A network administrator wants to prevent unauthorized devices from connecting to the company's Ethernet ports. The company uses a centralized authentication server. Which IEEE standard should be implemented?

Accepted Answer

802.1X. 802.1X is the IEEE standard for port-based Network Access Control (NAC) that authenticates devices before granting access to an Ethernet port. It uses a centralized authentication server (typically RADIUS) to verify credentials, preventing unauthorized devices from connecting to the network. This directly matches the requirement of controlling access at the port level with a centralized server.

Answer

802.11i

Answer

802.3af

Answer

802.1Q

Question 15

A network technician is troubleshooting communication between two switches. The trunk link between them is up, and both switches have the same list of allowed VLANs. However, devices in VLAN 10 on one switch cannot communicate with devices in VLAN 10 on the other switch. What is the MOST likely cause of this issue?

Accepted Answer

Native VLAN mismatch. A native VLAN mismatch is the most likely cause because when two switches have different native VLANs configured on a trunk, they will incorrectly tag or fail to tag frames for that VLAN. In this scenario, devices in VLAN 10 cannot communicate because the native VLAN frames (which are sent untagged) are being dropped or misinterpreted by the receiving switch, even though both switches list VLAN 10 as allowed. The trunk is up and the allowed VLAN list matches, so the issue points directly to a mismatch in the native VLAN configuration.

Answer

Speed or duplex mismatch

Answer

Spanning Tree Protocol blocking the port

Answer

VLAN 10 is not created on one of the switches