N10-009 Practice Test 16 — 15 Questions

Question 1

Users in a department report that the network is extremely slow. A technician checks the access switch and notices that a single port shows a high number of CRC errors and runts. The link LED is solid green. Which of the following is the most likely cause of the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Duplex mismatch between the switch port and the connected device. A duplex mismatch occurs when one device operates at full duplex and the other at half duplex. The full-duplex side does not perform Carrier Sense Multiple Access with Collision Detection (CSMA/CD), so it transmits without checking for collisions. The half-duplex side detects collisions, causing late collisions that manifest as CRC errors and runts on the switch port. The solid green link LED indicates Layer 1 connectivity is intact, ruling out a physical cable fault.

Answer

Faulty network cable

Answer

Broadcast storm

Answer

VLAN misconfiguration

Question 2

A network administrator is configuring dynamic routing between two routers in the same organization. The routers must support VLSM, converge quickly, and use a metric that is based on bandwidth and delay. Which routing protocol should be configured?

Accepted Answer

EIGRP. C is correct because EIGRP is a Cisco-proprietary hybrid routing protocol that supports Variable-Length Subnet Masking (VLSM), converges rapidly using the Diffusing Update Algorithm (DUAL), and uses a composite metric that by default includes bandwidth and delay. This makes it ideal for the scenario where both VLSM support and fast convergence are required with a metric based on bandwidth and delay.

Answer

RIP

Answer

OSPF

Answer

BGP

Question 3

A network technician is troubleshooting a workstation that is experiencing intermittent connectivity and slow file transfers. The technician has confirmed that the patch cable passes a cable tester, the switch port is not error-disabled, and the workstation's NIC is configured for autonegotiation. The switch port is also set to autonegotiate. Which of the following should the technician check next?

Accepted Answer

The duplex and speed settings on both ends. Intermittent connectivity and slow file transfers, despite a passing cable test and autonegotiation on both ends, strongly indicate a duplex mismatch. When both sides are set to autonegotiate but one side fails to negotiate correctly (e.g., due to a faulty NIC or switch port), they may fall back to half-duplex while the other remains full-duplex, causing collisions, CRC errors, and retransmissions. The technician should verify the actual negotiated duplex and speed on both the workstation NIC and the switch port using commands like 'show interfaces' or NIC driver properties.

Answer

The route table on the default gateway

Answer

The DNS server configuration

Answer

The MAC address filtering on the switch

Question 4

A network engineer needs to connect two switches that are located 450 meters apart. Which combination of fiber optic transceiver and cable type would support the highest data rate over this distance?

Accepted Answer

10GBASE-LR with single-mode fiber. 10GBASE-LR (Long Reach) supports 10 Gbps over single-mode fiber (SMF) up to 10 km, easily covering the 450-meter distance. Single-mode fiber has a smaller core (9 µm) that minimizes modal dispersion, enabling higher data rates over longer distances compared to multimode fiber. This combination provides the highest data rate (10 Gbps) among the options for the given distance.

Answer

10GBASE-SR with multimode fiber

Answer

1000BASE-LX with single-mode fiber

Answer

1000BASE-SX with multimode fiber

Question 5

A network technician is troubleshooting intermittent internet access for a single user. The user’s workstation can ping the default gateway consistently, but web pages fail to load intermittently. Which of the following should the technician check NEXT?

Accepted Answer

A) DNS server configuration. The user can ping the default gateway consistently, indicating Layer 3 connectivity to the local network is intact. However, intermittent web page failures suggest a name resolution issue, as DNS translates domain names to IP addresses. If the DNS server is misconfigured, unreachable, or returning stale records, the browser will fail to load pages even though basic IP connectivity works. Checking DNS server configuration is the logical next step because it directly addresses the symptom of name resolution failures.

Answer

B) DHCP lease time

Answer

C) Switch port speed and duplex settings

Answer

D) Firewall rules blocking ICMP

Question 6

A network administrator wants to prevent unauthorized devices from connecting to the company's Ethernet ports. The company uses a centralized authentication server. Which IEEE standard should be implemented?

Accepted Answer

802.1X. 802.1X is the IEEE standard for port-based Network Access Control (NAC) that authenticates devices before granting access to an Ethernet port. It uses a centralized authentication server (typically RADIUS) to verify credentials, preventing unauthorized devices from connecting to the network. This directly matches the requirement of controlling access at the port level with a centralized server.

Answer

802.11i

Answer

802.3af

Answer

802.1Q

Question 7

A network technician is troubleshooting communication between two switches. The trunk link between them is up, and both switches have the same list of allowed VLANs. However, devices in VLAN 10 on one switch cannot communicate with devices in VLAN 10 on the other switch. What is the MOST likely cause of this issue?

Accepted Answer

Native VLAN mismatch. A native VLAN mismatch is the most likely cause because when two switches have different native VLANs configured on a trunk, they will incorrectly tag or fail to tag frames for that VLAN. In this scenario, devices in VLAN 10 cannot communicate because the native VLAN frames (which are sent untagged) are being dropped or misinterpreted by the receiving switch, even though both switches list VLAN 10 as allowed. The trunk is up and the allowed VLAN list matches, so the issue points directly to a mismatch in the native VLAN configuration.

Answer

Speed or duplex mismatch

Answer

Spanning Tree Protocol blocking the port

Answer

VLAN 10 is not created on one of the switches

Question 8

A security analyst is investigating a network anomaly. The analyst notices that the company's web server is receiving a large number of TCP SYN packets from random source IP addresses, all destined for port 80. The web server is responding with SYN-ACK packets, but the connections are never completed. This is causing the server's connection table to fill up, degrading performance for legitimate users. Which type of attack is being described?

Accepted Answer

SYN flood. The attack described is a SYN flood, a type of denial-of-service (DoS) attack that exploits the TCP three-way handshake. The attacker sends a high volume of TCP SYN packets with spoofed source IP addresses to the server's port 80. The server responds with SYN-ACK packets to each spoofed source and waits for the final ACK, which never arrives, causing the server's half-open connection table (backlog queue) to fill up and exhaust resources, degrading performance for legitimate users.

Answer

Ping of death

Answer

Smurf attack

Answer

DNS amplification

Question 9

A company wants to ensure that only authorized devices that comply with security policies (such as updated antivirus and OS patches) are allowed to connect to the internal network. Both wired and wireless connections are used. Which of the following security solutions would best enforce this requirement?

Accepted Answer

Network Access Control (NAC). Network Access Control (NAC) is the correct solution because it enforces security policies by inspecting the health and compliance of devices—such as checking for updated antivirus definitions and OS patches—before granting access to the network. NAC can operate on both wired (e.g., 802.1X) and wireless (e.g., WPA2-Enterprise with RADIUS) connections, blocking or quarantining non-compliant devices. This matches the requirement to ensure only authorized, policy-compliant devices connect.

Answer

VPN

Answer

Access control list (ACL)

Answer

Intrusion prevention system (IPS)

Question 10

A network technician sees that the link light on a switch port is not lit, even though the cable is connected to an active device. The port has been tested with a known good cable. Which of the following should the technician do next?

Accepted Answer

Check if the port is administratively disabled. When a link light is off despite a known good cable and an active device, the most likely cause is that the switch port is administratively disabled (shutdown). This is a common Layer 1/2 issue where the interface is configured with the 'shutdown' command, preventing the port from negotiating a link. Checking the interface status with 'show interfaces status' or 'show interfaces [interface]' will confirm if the port is in an 'administratively down' state.

Answer

Replace the switch

Answer

Check the VLAN configuration

Answer

Check the speed/duplex settings

Question 11

A network switch is experiencing a high number of collisions on a specific port. The connected device is configured for half-duplex. Which of the following is the most likely cause?

Accepted Answer

The switch port is configured for full-duplex. When a switch port is configured for full-duplex but the connected device operates in half-duplex, a duplex mismatch occurs. The switch transmits without checking for collisions (as full-duplex does not use CSMA/CD), while the half-duplex device expects to sense the carrier before sending, leading to collisions on the port. This is the most common cause of excessive collisions on a single switch port.

Answer

The cable length exceeds 100 meters

Answer

The device is using an incorrect VLAN

Answer

The switch port is configured for 1000BASE-T but the device only supports 100BASE-TX

Question 12

A network engineer is planning to connect two switches that are 150 meters apart. The link must support at least 1 Gbps and the budget is limited. Which cable type should be used?

Accepted Answer

Multimode fiber optic. Multimode fiber optic cable supports 1 Gbps over distances up to 550 meters (OM2) or more, easily covering the 150-meter requirement at a lower cost than single-mode fiber. It is the best choice for this distance and budget because twisted-pair copper (Cat5e/Cat6a) is limited to 100 meters for 1 Gbps, and single-mode fiber is more expensive due to laser-based transceivers.

Answer

Cat6a twisted-pair copper

Answer

Single-mode fiber optic

Answer

Cat5e twisted-pair copper

Question 13

A user reports that they cannot access the internet. The user's workstation has an IP address of 192.168.1.100/24, with a default gateway of 192.168.1.1. The user can ping the default gateway but cannot ping 8.8.8.8. Other users on the same subnet can ping 8.8.8.8. The technician checks the switch and sees the user's port is up. What should the technician check next?

Accepted Answer

Check the workstation's IP configuration for a misconfigured default gateway or DNS. Since the user can ping the default gateway (192.168.1.1) but not 8.8.8.8, while other users on the same subnet can reach 8.8.8.8, the issue is isolated to this workstation. The most likely cause is a misconfigured default gateway (e.g., wrong IP or subnet mask) or DNS settings, as the gateway is reachable but traffic is not being forwarded correctly. Option B directly addresses checking the workstation's IP configuration for these misconfigurations, which is the logical next step after verifying local connectivity.

Answer

Check the router's routing table for a route to the internet

Answer

Check the DNS server configuration on the workstation

Answer

Check the switch port for VLAN misconfiguration

Question 14

A network administrator is troubleshooting an intermittent link between two switches connected by single-mode fiber. The interface log shows "Link up / Link down" events multiple times per hour. Which of the following is the most likely cause?

Accepted Answer

Dirty fiber connectors. Dirty fiber connectors cause intermittent signal loss by scattering or absorbing light, which leads to CRC errors and repeated link flaps as the optical transceiver struggles to maintain synchronization. This matches the 'Link up / Link down' pattern seen in the logs, especially on single-mode fiber where precise alignment is critical.

Answer

Incorrect VLAN configuration on the switch ports

Answer

Crossed fiber pairs

Answer

Duplex mismatch between the switches

Question 15

A network architect is designing a Software-Defined Networking (SDN) based network. Which of the following components is responsible for making centralized forwarding decisions and communicating those decisions to the physical switches using southbound APIs?

Accepted Answer

Control layer. In SDN architecture, the control layer (also known as the SDN controller) is the centralized entity responsible for making all forwarding decisions. It communicates these decisions to the physical switches via southbound APIs, such as OpenFlow, which program the flow tables in the data plane. This separation of the control plane from the data plane is the fundamental principle of SDN.

Answer

Application layer

Answer

Data plane

Answer

East-west interfaces