N10-009 Practice Test 16 — 15 Questions

Question 1

A network administrator has configured a router to send syslog messages to a server with the command 'logging trap 4'. The administrator notices that the syslog server is receiving messages with severity levels 0, 1, and 2. Which of the following best explains why these messages are being received?

Accepted Answer

Syslog severity levels are reversed; lower numbers indicate higher urgency, so trap 4 includes levels 0-4.. C is correct because in syslog, severity levels are inverted: lower numbers indicate higher urgency (0=emergency, 1=alert, 2=critical). The command 'logging trap 4' sets a threshold that includes all messages with a severity level of 4 or lower (i.e., more urgent), so levels 0, 1, and 2 are included. This is defined in RFC 5424 and is standard behavior on Cisco IOS devices.

Answer

The 'trap' level indicates the minimum severity; only messages with severity 4 and above are sent.

Answer

The router is misconfigured and sending all messages regardless of the trap level.

Answer

The syslog server is configured to accept only levels 0-2, so it filters out the others.

Question 2

A network administrator needs to automatically back up the configuration files of all network devices (routers, switches, firewalls) to a central server every night. The administrator requires the transfer to be encrypted to protect sensitive configuration data. Which protocol should the administrator use to retrieve the configuration files?

Accepted Answer

SCP. SCP (Secure Copy Protocol) uses SSH for encrypted file transfers, making it ideal for securely retrieving configuration files from network devices to a central server. It ensures both authentication and data encryption, protecting sensitive configuration data during transit.

Answer

TFTP

Answer

FTP

Answer

HTTP

Question 3

A network administrator needs to automate the backup of router configuration files to a remote server over the internet. The backup must be encrypted and authenticated. Which protocol should the administrator use in the automated script?

Accepted Answer

SCP. SCP (Secure Copy Protocol) is the correct choice because it provides both encryption and authentication by operating over SSH (Secure Shell), which encrypts the entire session and verifies the server's identity using public-key cryptography. This makes it suitable for automating secure backups of router configuration files to a remote server over the internet, as it supports scripting with tools like expect or SSH keys without interactive password prompts.

Answer

TFTP

Answer

FTP

Answer

HTTP

Question 4

A network administrator needs to collect traffic flow data from routers and switches to analyze bandwidth usage patterns. Which protocol should be implemented on the devices to export flow data to a collector?

Accepted Answer

NetFlow. NetFlow (or its standards-based equivalent, IPFIX) is the correct protocol because it is specifically designed to export traffic flow metadata—such as source/destination IPs, ports, and byte counts—from routers and switches to a collector for bandwidth usage analysis. SNMP can poll interface counters but does not provide per-flow granularity, making NetFlow the appropriate choice for detailed traffic pattern analysis.

Answer

SNMP

Answer

ICMP

Answer

LLDP

Question 5

A network administrator is configuring a new switch and needs to ensure that log messages are sent to a remote syslog server with a severity level of 'warning' (4) or higher. Which severity level should be set as the trap level on the switch?

Accepted Answer

4 (warning). Option B is correct because setting the trap level to 4 (warning) on a Cisco switch using the 'logging trap 4' command ensures that syslog messages with a severity of warning (4) and higher (i.e., emergency, alert, critical, error, and warning) are forwarded to the remote syslog server. The severity levels are defined in RFC 5424, where lower numbers indicate higher priority, so level 4 includes all messages from 0 through 4.

Answer

3 (error)

Answer

5 (notice)

Answer

7 (debug)

Question 6

A company wants to implement network access control that requires users to authenticate before gaining access to the network. The NAC solution uses a policy that checks for antivirus updates and OS patches. Which component enforces the policy?

Accepted Answer

Authenticator. The Authenticator (typically a switch or wireless access point) is the component that enforces the NAC policy by controlling access to the network port or SSID. It receives the authentication result from the Authentication Server and applies the policy (e.g., placing the endpoint in a quarantine VLAN if antivirus or OS patch checks fail). This enforcement is defined in IEEE 802.1X, where the Authenticator acts as the gatekeeper between the Supplicant and the network.

Answer

Supplicant

Answer

Authentication server

Answer

Policy server

Question 7

A network administrator reviews firewall logs and sees thousands of SYN packets coming from various source IP addresses to a single internal web server. No ACK or RST packets are observed from these sources. Which type of attack is most likely occurring?

Accepted Answer

SYN flood attack. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target server without completing the handshake (no ACK or RST). This exhausts the server's connection table resources, preventing legitimate connections. The observed pattern of many SYN packets from various sources with no subsequent ACK or RST is the hallmark of a SYN flood.

Answer

DNS amplification attack

Answer

ARP spoofing attack

Answer

Man-in-the-middle attack

Question 8

A network administrator is configuring IP addresses for a new subnet. The network address is 192.168.1.0 with a subnet mask of 255.255.255.240. How many usable host addresses are available on this subnet?

Accepted Answer

14. The subnet mask 255.255.255.240 (or /28) provides 16 total addresses per subnet. The network address (192.168.1.0) and the broadcast address (192.168.1.15) are reserved, leaving 16 - 2 = 14 usable host addresses. This is calculated as 2^(32-28) - 2 = 2^4 - 2 = 16 - 2 = 14.

Answer

16

Answer

30

Answer

62

Question 9

A network administrator is configuring dynamic routing between two routers in the same organization. The routers must support VLSM, converge quickly, and use a metric that is based on bandwidth and delay. Which routing protocol should be configured?

Accepted Answer

EIGRP. C is correct because EIGRP is a Cisco-proprietary hybrid routing protocol that supports Variable-Length Subnet Masking (VLSM), converges rapidly using the Diffusing Update Algorithm (DUAL), and uses a composite metric that by default includes bandwidth and delay. This makes it ideal for the scenario where both VLSM support and fast convergence are required with a metric based on bandwidth and delay.

Answer

RIP

Answer

OSPF

Answer

BGP

Question 10

A network administrator needs to create a diagram that shows the IP addressing scheme, VLAN assignments, and routing protocols used in the network. This diagram will be used for troubleshooting and future planning. Which type of documentation should the administrator create?

Accepted Answer

Logical topology diagram. A logical topology diagram is correct because it documents the IP addressing scheme, VLAN assignments, and routing protocols—abstract elements that define how data flows through the network, independent of physical device locations. This type of diagram is essential for troubleshooting Layer 3 issues and planning changes to the network's logical design.

Answer

Physical topology diagram

Answer

Rack elevation diagram

Answer

Cable management plan

Question 11

A network administrator needs to document the physical placement of devices in a server room, including exact rack location, port labels, and cable connections between patch panels and switches. Which type of diagram is most appropriate?

Accepted Answer

Rack diagram. A rack diagram is specifically designed to document the physical placement of devices in a server room, including exact rack units, port labels, and cable connections between patch panels and switches. This type of diagram provides a visual representation of the physical layout, which is essential for asset management, troubleshooting, and maintenance planning.

Answer

Network topology map

Answer

Wiring schematic

Answer

Logical topology diagram

Question 12

A network administrator configures a router to send syslog messages to a central log server. The administrator can ping the server from the router, but the server is not receiving any logs. What is the most likely cause?

Accepted Answer

UDP port 514 is blocked between the router and the server. Syslog messages are sent via UDP port 514 by default. Since the administrator can ping the server (ICMP works), but no logs arrive, the most likely cause is that a firewall or ACL is blocking UDP port 514 between the router and the server. This is a classic connectivity issue where Layer 3 reachability exists but the specific transport-layer port is filtered.

Answer

The syslog server is using the wrong protocol (TCP instead of UDP)

Answer

The syslog service on the server is not running

Answer

The router's clock is not synchronized with the server

Question 13

A network administrator needs to analyze bandwidth usage by application and identify top talkers on the network. Which protocol or technology should be used to export detailed traffic flow information from routers and switches to a central collector?

Accepted Answer

NetFlow. NetFlow is the correct choice because it is a Cisco-developed protocol designed specifically to export detailed IP traffic flow information—including source/destination IPs, ports, protocols, and byte counts—from routers and switches to a central collector for bandwidth usage analysis and top talker identification. Unlike simpler monitoring tools, NetFlow provides per-flow granularity, enabling administrators to pinpoint which applications and hosts are consuming the most bandwidth.

Answer

SNMP

Answer

ICMP

Answer

SMTP

Question 14

A network administrator has just connected a new access switch to the core switch via a trunk port. The administrator configured the trunk port on both switches with the same allowed VLAN list. However, hosts on VLAN 10 connected to the new access switch cannot communicate with hosts on VLAN 10 on the core switch. The trunk is operational and shows up/up. What is the most likely cause?

Accepted Answer

A) VLAN 10 has not been created on the new access switch. The most likely cause is that VLAN 10 has not been created on the new access switch. Even though the trunk port is up/up and the allowed VLAN list matches, a switch will not forward traffic for a VLAN that does not exist in its local VLAN database. Without the VLAN being created, the switch drops all frames tagged with VLAN 10, preventing communication between hosts on that VLAN across the trunk.

Answer

B) Native VLAN mismatch on the trunk

Answer

C) Trunk encapsulation mismatch (ISL vs 802.1Q)

Answer

D) STP is blocking the VLAN 10 traffic on the trunk

Question 15

A network administrator is creating a standard operating procedure for firmware upgrades. Which step should be performed FIRST according to best practices?

Accepted Answer

Test the firmware in a lab environment. According to best practices for firmware upgrades, the first step should always be to test the new firmware in a non-production lab environment that mirrors the production setup. This validates compatibility, identifies potential bugs, and ensures the upgrade process works without risking network downtime or data loss. Only after successful lab testing should you proceed to backup the current configuration and schedule the upgrade during a maintenance window.

Answer

Schedule the upgrade during a maintenance window

Answer

Back up the current configuration

Answer

Notify users of the planned outage