N10-009 Practice Test 17 — 15 Questions

Question 1

A security analyst is investigating a network anomaly. The analyst notices that the company's web server is receiving a large number of TCP SYN packets from random source IP addresses, all destined for port 80. The web server is responding with SYN-ACK packets, but the connections are never completed. This is causing the server's connection table to fill up, degrading performance for legitimate users. Which type of attack is being described?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SYN flood. The attack described is a SYN flood, a type of denial-of-service (DoS) attack that exploits the TCP three-way handshake. The attacker sends a high volume of TCP SYN packets with spoofed source IP addresses to the server's port 80. The server responds with SYN-ACK packets to each spoofed source and waits for the final ACK, which never arrives, causing the server's half-open connection table (backlog queue) to fill up and exhaust resources, degrading performance for legitimate users.

Answer

Ping of death

Answer

Smurf attack

Answer

DNS amplification

Question 2

A company wants to ensure that only authorized devices that comply with security policies (such as updated antivirus and OS patches) are allowed to connect to the internal network. Both wired and wireless connections are used. Which of the following security solutions would best enforce this requirement?

Accepted Answer

Network Access Control (NAC). Network Access Control (NAC) is the correct solution because it enforces security policies by inspecting the health and compliance of devices—such as checking for updated antivirus definitions and OS patches—before granting access to the network. NAC can operate on both wired (e.g., 802.1X) and wireless (e.g., WPA2-Enterprise with RADIUS) connections, blocking or quarantining non-compliant devices. This matches the requirement to ensure only authorized, policy-compliant devices connect.

Answer

VPN

Answer

Access control list (ACL)

Answer

Intrusion prevention system (IPS)

Question 3

A network technician sees that the link light on a switch port is not lit, even though the cable is connected to an active device. The port has been tested with a known good cable. Which of the following should the technician do next?

Accepted Answer

Check if the port is administratively disabled. When a link light is off despite a known good cable and an active device, the most likely cause is that the switch port is administratively disabled (shutdown). This is a common Layer 1/2 issue where the interface is configured with the 'shutdown' command, preventing the port from negotiating a link. Checking the interface status with 'show interfaces status' or 'show interfaces [interface]' will confirm if the port is in an 'administratively down' state.

Answer

Replace the switch

Answer

Check the VLAN configuration

Answer

Check the speed/duplex settings

Question 4

A network switch is experiencing a high number of collisions on a specific port. The connected device is configured for half-duplex. Which of the following is the most likely cause?

Accepted Answer

The switch port is configured for full-duplex. When a switch port is configured for full-duplex but the connected device operates in half-duplex, a duplex mismatch occurs. The switch transmits without checking for collisions (as full-duplex does not use CSMA/CD), while the half-duplex device expects to sense the carrier before sending, leading to collisions on the port. This is the most common cause of excessive collisions on a single switch port.

Answer

The cable length exceeds 100 meters

Answer

The device is using an incorrect VLAN

Answer

The switch port is configured for 1000BASE-T but the device only supports 100BASE-TX

Question 5

A network engineer is planning to connect two switches that are 150 meters apart. The link must support at least 1 Gbps and the budget is limited. Which cable type should be used?

Accepted Answer

Multimode fiber optic. Multimode fiber optic cable supports 1 Gbps over distances up to 550 meters (OM2) or more, easily covering the 150-meter requirement at a lower cost than single-mode fiber. It is the best choice for this distance and budget because twisted-pair copper (Cat5e/Cat6a) is limited to 100 meters for 1 Gbps, and single-mode fiber is more expensive due to laser-based transceivers.

Answer

Cat6a twisted-pair copper

Answer

Single-mode fiber optic

Answer

Cat5e twisted-pair copper

Question 6

A user reports that they cannot access the internet. The user's workstation has an IP address of 192.168.1.100/24, with a default gateway of 192.168.1.1. The user can ping the default gateway but cannot ping 8.8.8.8. Other users on the same subnet can ping 8.8.8.8. The technician checks the switch and sees the user's port is up. What should the technician check next?

Accepted Answer

Check the workstation's IP configuration for a misconfigured default gateway or DNS. Since the user can ping the default gateway (192.168.1.1) but not 8.8.8.8, while other users on the same subnet can reach 8.8.8.8, the issue is isolated to this workstation. The most likely cause is a misconfigured default gateway (e.g., wrong IP or subnet mask) or DNS settings, as the gateway is reachable but traffic is not being forwarded correctly. Option B directly addresses checking the workstation's IP configuration for these misconfigurations, which is the logical next step after verifying local connectivity.

Answer

Check the router's routing table for a route to the internet

Answer

Check the DNS server configuration on the workstation

Answer

Check the switch port for VLAN misconfiguration

Question 7

A network administrator is troubleshooting an intermittent link between two switches connected by single-mode fiber. The interface log shows "Link up / Link down" events multiple times per hour. Which of the following is the most likely cause?

Accepted Answer

Dirty fiber connectors. Dirty fiber connectors cause intermittent signal loss by scattering or absorbing light, which leads to CRC errors and repeated link flaps as the optical transceiver struggles to maintain synchronization. This matches the 'Link up / Link down' pattern seen in the logs, especially on single-mode fiber where precise alignment is critical.

Answer

Incorrect VLAN configuration on the switch ports

Answer

Crossed fiber pairs

Answer

Duplex mismatch between the switches

Question 8

A network architect is designing a Software-Defined Networking (SDN) based network. Which of the following components is responsible for making centralized forwarding decisions and communicating those decisions to the physical switches using southbound APIs?

Accepted Answer

Control layer. In SDN architecture, the control layer (also known as the SDN controller) is the centralized entity responsible for making all forwarding decisions. It communicates these decisions to the physical switches via southbound APIs, such as OpenFlow, which program the flow tables in the data plane. This separation of the control plane from the data plane is the fundamental principle of SDN.

Answer

Application layer

Answer

Data plane

Answer

East-west interfaces

Question 9

A network administrator wants to configure routers to send syslog messages only for events of severity 'error' (3) or higher (more severe). Which severity level should be set as the trap level?

Accepted Answer

3 (errors). Setting the trap level to 3 (errors) instructs the router to send syslog messages for severity 3 and all numerically lower (more severe) levels (0, 1, 2, 3). This matches the requirement to capture events of severity 'error' (3) or higher severity.

Answer

0 (emergencies)

Answer

2 (critical)

Answer

4 (warnings)

Question 10

A network technician is reviewing the OSI model to understand how data is encapsulated when a web request is sent from a client to a server. At which layer does the web browser's HTTP request data get encapsulated with a TCP segment header?

Accepted Answer

Transport layer. The Transport layer (Layer 4) is responsible for encapsulating application data with a TCP or UDP segment header. When a web browser sends an HTTP request, the HTTP data is passed down from the Application layer to the Transport layer, where the TCP segment header (including source/destination ports, sequence numbers, and checksum) is added. This encapsulation occurs at Layer 4, not at any higher layer.

Answer

Application layer

Answer

Presentation layer

Answer

Session layer

Question 11

After replacing a faulty switch, several users in the same VLAN report that they cannot communicate with the server that is on a different subnet. The switch is connected to the router via a trunk port. Which command should the administrator run on the router to verify that the VLAN is allowed on the trunk?

Accepted Answer

show interfaces trunk. The `show interfaces trunk` command displays which VLANs are allowed on each trunk port. Since the switch is connected to the router via a trunk, this command verifies whether the VLAN of the affected users is permitted on that trunk. If the VLAN is missing from the allowed list, traffic to the server on a different subnet will be dropped at the router interface.

Answer

show vlan

Answer

show mac address-table

Answer

show ip route

Question 12

During a security audit, a consultant discovers that encrypted traffic between a client and a web server is being decrypted and re-encrypted by an intermediate device on the network path. Which type of attack best describes this scenario?

Accepted Answer

Man-in-the-middle. The scenario describes a classic man-in-the-middle (MITM) attack where an intermediary intercepts, decrypts, and re-encrypts traffic between the client and server. This allows the attacker to read or modify the data while both endpoints believe they have a secure TLS session. The key indicator is the decryption and re-encryption step, which is the hallmark of an active MITM proxy.

Answer

ARP poisoning

Answer

SSL stripping

Answer

Rogue DHCP

Question 13

Users in a small office can access external websites normally, but they cannot reach the internal company wiki server at 192.168.10.25. A technician can successfully ping the server's IP address from a user's workstation. The DNS resolution for the wiki's hostname (wiki.company.local) returns the correct IP. The company's firewall permits HTTP traffic to the server. What is the most likely cause of the issue?

Accepted Answer

The web server service is not running or is listening on a different port. Since the technician can successfully ping the server's IP address from the user's workstation, Layer 3 connectivity is confirmed, ruling out routing or gateway issues. DNS resolution returns the correct IP, so name resolution is not the problem. The firewall permits HTTP traffic, so access control is not blocking the connection. The most likely cause is that the web server service (e.g., Apache, IIS) is not running or is listening on a non-standard port (e.g., 8080 instead of 80), preventing the HTTP request from reaching the service even though the host is reachable.

Answer

The default gateway on the server is misconfigured

Answer

The user's workstation has a duplicate IP address

Answer

The DNS cache on the workstation is poisoned

Question 14

An attacker intercepts communication between two parties and is able to modify the data in transit without either party's knowledge. Which type of attack is this?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MITM) attack occurs when an adversary secretly intercepts and potentially alters the communication between two parties who believe they are directly communicating with each other. The attacker can modify data in transit without either party's knowledge by placing themselves in the logical or physical path of the data flow, often by exploiting weaknesses in authentication or encryption. This matches the scenario described, where the attacker both intercepts and modifies the data.

Answer

ARP spoofing

Answer

DNS poisoning

Answer

Replay attack

Question 15

A user reports that they can access the company's intranet but not the internet. The technician checks the IP configuration and finds that the default gateway is set to 192.168.1.1, and the user can ping that IP. Which of the following is the most likely cause?

Accepted Answer

The router's NAT configuration is faulty.. Since the user can ping the default gateway (192.168.1.1) and access the intranet, Layer 3 connectivity to the local router is functional. The inability to reach the internet, despite having a valid gateway, points to a failure in the router's NAT (Network Address Translation) configuration. NAT is required to translate private RFC 1918 addresses (like 192.168.1.x) to a public IP for internet access; without it, packets are routed to the gateway but cannot be forwarded beyond the local network.

Answer

The DNS server address is incorrect.

Answer

The DHCP server is not providing a default gateway.

Answer

The user's workstation has a static IP address.