N10-009 Practice Test 17 — 15 Questions

Question 1

A network engineer is troubleshooting intermittent packet loss on a 10 km single-mode fiber link between two buildings. The link lights are on, but the interface shows a high number of CRC errors. The engineer has cleaned the fiber connectors and replaced the patch cables. What should the engineer check NEXT?

Accepted Answer

Check the transmit/receive optical power levels. CRC errors on a single-mode fiber link typically indicate physical-layer issues such as excessive attenuation or dispersion. Since cleaning connectors and replacing patch cables did not resolve the problem, the next logical step is to measure the optical power levels at both the transmitter and receiver using an optical power meter. This will confirm whether the received signal is within the acceptable range (e.g., -3 dBm to -20 dBm for 10GBASE-LR) and identify if a damaged transceiver or a splice loss is causing the errors.

Answer

Check the duplex settings on both ends

Answer

Verify the cable length is within specifications

Answer

Adjust the Spanning Tree Protocol priority

Question 2

A network administrator wants to centrally monitor the bandwidth utilization on a router's serial interface over time. The monitoring tool needs to periodically poll the router for current interface counters. Which protocol should be used for this polling?

Accepted Answer

SNMP. SNMP (Simple Network Management Protocol) is the correct choice because it is specifically designed for polling network devices to retrieve operational statistics such as interface counters (e.g., ifInOctets, ifOutOctets) from a Management Information Base (MIB). The network administrator can configure an SNMP manager to periodically poll the router's serial interface OIDs, enabling centralized bandwidth utilization monitoring over time.

Answer

Syslog

Answer

NetFlow

Answer

ICMP

Question 3

A network administrator is creating a new VLAN 50 on a switch. After creating the VLAN, the administrator notices that the switch does not send VLAN information to other switches in the network. Which of the following is the most likely reason?

Accepted Answer

VTP mode is set to transparent.. When VTP mode is set to transparent, the switch does not originate or forward VTP advertisements, so VLAN changes made on it are not propagated to other switches. This explains why VLAN 50 was created locally but not shared with the rest of the network.

Answer

The trunk link is not configured.

Answer

The VLAN is not allowed on the trunk.

Answer

STP is blocking the VLAN.

Question 4

A network administrator is configuring a trunk port between two switches. Both switches have been set with native VLAN 99. However, traffic from some VLANs is not passing over the trunk. What should the administrator verify?

Accepted Answer

The allowed VLAN list on the trunk port.. The trunk port's allowed VLAN list explicitly controls which VLANs are permitted to traverse the link. Even when both switches agree on the native VLAN (99), if a particular VLAN is not included in the allowed list on either side, its traffic will be dropped. This is a common misconfiguration that prevents specific VLAN traffic from passing over the trunk.

Answer

The VTP domain name matches on both switches.

Answer

The speed and duplex settings are identical.

Answer

The spanning tree protocol is disabled.

Question 5

A network administrator needs to identify which hosts are generating the most traffic on the network and what types of traffic (e.g., HTTP, FTP). Which monitoring technology should be deployed?

Accepted Answer

NetFlow. NetFlow is the correct choice because it provides detailed visibility into network traffic flows, including source/destination IPs, ports, protocols, and application-level information (e.g., HTTP, FTP). Unlike SNMP, which only gives aggregate interface statistics, or Syslog, which logs device events, NetFlow captures per-flow metadata that directly answers the question of which hosts are generating the most traffic and what types of traffic they are using.

Answer

SNMP

Answer

Syslog

Answer

ICMP

Question 6

A network administrator notices that several workstations on the network are receiving IP addresses from an unknown source, causing intermittent connectivity issues. The DHCP server is located in the server room and is the only authorized DHCP server. Which security feature should be implemented on the access switches to prevent rogue DHCP servers from distributing IP addresses?

Accepted Answer

DHCP Snooping. DHCP Snooping is the correct security feature because it filters untrusted DHCP messages on access switches. By configuring ports connected to end-user workstations as untrusted, the switch drops DHCP server responses (OFFER, ACK) received on those ports, preventing rogue DHCP servers from distributing IP addresses. This ensures only the authorized DHCP server in the server room can provide IP configurations.

Answer

Dynamic ARP Inspection

Answer

IP Source Guard

Answer

Port Security

Question 7

A network administrator is implementing a new wireless network that will use WPA2-Enterprise. Which of the following must be configured on the network to support this security method?

Accepted Answer

A RADIUS server. WPA2-Enterprise uses 802.1X authentication, which requires a RADIUS server to centralize authentication, authorization, and accounting (AAA). The RADIUS server validates user credentials (e.g., against Active Directory or LDAP) and distributes the Pairwise Master Key (PMK) to the access point, enabling per-user, per-session encryption keys. Without a RADIUS server, the enterprise authentication framework cannot function.

Answer

A pre-shared key

Answer

A certificate authority

Answer

A VPN concentrator

Question 8

A network administrator needs to be notified immediately when a critical switch interface goes down. Which SNMP feature should be configured?

Accepted Answer

Traps. B is correct because SNMP traps are unsolicited messages sent from an SNMP agent to the network management system (NMS) to immediately notify the administrator of a critical event, such as a switch interface going down. Unlike polling, which requires the NMS to periodically request status information, traps provide real-time, event-driven alerts without delay, ensuring the administrator is notified as soon as the interface state changes.

Answer

Polling

Answer

Informs

Answer

Set

Question 9

A network administrator is setting up SNMPv3 on a router for secure monitoring. Which of the following is required for SNMPv3 authentication?

Accepted Answer

Username and password. SNMPv3 introduces a security model that requires a username and password (authentication passphrase) for authentication, moving away from the community-string-based model of SNMPv1/v2c. The password is used with an authentication protocol like MD5 or SHA to verify the identity of the manager before allowing access. Without a valid username and password combination, SNMPv3 will reject the request.

Answer

Community string

Answer

Encryption key

Answer

Public key

Question 10

A network administrator needs to centrally collect and analyze log messages from multiple routers and switches. Which protocol should be used to forward these log messages to a central server?

Accepted Answer

Syslog. Syslog (B) is the correct protocol because it is specifically designed for centralized logging and event message collection from network devices. It uses UDP port 514 (or TCP 6514 for reliable delivery) to forward log messages from routers and switches to a central syslog server, enabling administrators to collect, analyze, and archive logs from multiple devices in a standardized format.

Answer

SNMP

Answer

SMTP

Answer

HTTP

Question 11

A network administrator needs to implement a solution that allows for centralized management of user authentication, authorization, and accounting for network device access. The solution must support encryption of the entire authentication process. Which protocol should be selected?

Accepted Answer

TACACS+. TACACS+ is the correct choice because it separates authentication, authorization, and accounting (AAA) into distinct processes and encrypts the entire authentication payload, including the username, password, and all other traffic between the client and the server. This full-packet encryption ensures that credentials and session details are protected during transit, meeting the requirement for centralized management with encrypted authentication.

Answer

RADIUS

Answer

LDAP

Answer

Kerberos

Question 12

A network device receives a frame and forwards it based on the destination MAC address. The device does not modify the frame and only floods unknown unicast frames. At which layer of the OSI model does this device operate?

Accepted Answer

Layer 2. This device operates at Layer 2 (Data Link Layer) because it forwards frames based on the destination MAC address, does not modify the frame, and floods unknown unicast frames. These behaviors are characteristic of a transparent bridge or switch, which uses a MAC address table to make forwarding decisions without examining IP addresses or modifying the frame. Layer 2 devices do not perform routing or alter the frame's content, distinguishing them from Layer 3 routers.

Answer

Layer 1

Answer

Layer 3

Answer

Layer 4

Question 13

A network administrator wants to collect logs from multiple routers and switches to a central server for analysis. Which protocol should be configured on the devices to send logs to the server?

Accepted Answer

Syslog. Syslog (RFC 5424) is the standard protocol for sending event messages (logs) from network devices like routers and switches to a central log server. It uses UDP port 514 by default (or TCP 6514 for reliable delivery) and allows administrators to collect, store, and analyze system messages from multiple devices in one location.

Answer

SNMP

Answer

NetFlow

Answer

TFTP

Question 14

A network administrator receives an automated alert from the network monitoring system indicating that the bandwidth utilization on a specific switch port has exceeded the threshold for the past 10 minutes. According to best practices for network operations, what should the administrator do FIRST?

Accepted Answer

Check the monitoring system logs to identify the traffic source and destination.. Option B is correct because the first step in responding to a bandwidth utilization alert is to investigate the traffic causing the spike. Checking the monitoring system logs allows the administrator to identify the source and destination of the traffic, which is essential for determining whether the utilization is legitimate (e.g., a backup or large file transfer) or malicious (e.g., a DoS attack). This aligns with the network operations best practice of 'verify before acting' to avoid unnecessary disruptions.

Answer

Immediately block the port to prevent potential network congestion from affecting other users.

Answer

Reboot the switch to clear any temporary errors that might be causing the alert.

Answer

Increase the bandwidth on the port to accommodate the higher traffic load.

Question 15

A network administrator is preparing documentation for a new branch office. The administrator needs a diagram that shows the logical relationships between network devices and how VLANs are trunked over inter-switch links. Which type of document should be created?

Accepted Answer

Logical topology diagram. A logical topology diagram is the correct choice because it illustrates how devices communicate across the network, including VLAN assignments and trunk links (e.g., 802.1Q tagging) between switches. This diagram abstracts physical locations to show Layer 2 and Layer 3 relationships, such as which VLANs traverse which inter-switch links, making it ideal for documenting VLAN trunking and logical connectivity.

Answer

Network baseline

Answer

Wiring diagram

Answer

Physical topology diagram