N10-009 Practice Test 18 — 15 Questions

Question 1

A security analyst detects that an attacker is sending forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. What is this attack called?

Accepted Answer

ARP poisoning. ARP poisoning (also known as ARP spoofing) is the correct answer because the attacker sends forged ARP replies to associate their MAC address with the IP address of the default gateway. This causes the victim's switch to update its ARP cache with the attacker's MAC for the gateway's IP, enabling man-in-the-middle attacks where the attacker intercepts traffic destined for the gateway.

Answer

MAC flooding

Answer

DHCP snooping

Answer

DNS spoofing

Question 2

A security analyst notices a large number of incoming TCP packets to a server with the FIN, PSH, and URG flags set. This pattern is characteristic of which type of network scan?

Accepted Answer

Xmas tree scan. An Xmas tree scan sends TCP packets with the FIN, PSH, and URG flags set (the packet 'lights up' like a Christmas tree). This is a stealth scan technique used to probe open or closed ports based on RFC 793 behavior: closed ports should respond with an RST packet, while open ports may ignore the packet (or respond differently depending on the OS). The pattern described—FIN, PSH, and URG all set—is the definitive signature of an Xmas tree scan.

Answer

SYN scan

Answer

Null scan

Answer

ACK scan

Question 3

A technician is troubleshooting a wireless network that experiences intermittent disconnections. A spectrum analysis shows channel utilization consistently above 80% on the 2.4 GHz band. Which of the following is the most likely cause?

Accepted Answer

Too many access points are configured on the same or overlapping channels. A is correct because consistently high channel utilization above 80% on the 2.4 GHz band indicates co-channel or adjacent-channel interference, typically caused by too many access points (APs) operating on the same or overlapping channels (e.g., channels 1, 6, and 11 are non-overlapping in 802.11b/g/n). This leads to excessive contention, increased retransmissions, and intermittent disconnections as stations wait for clear channel access via CSMA/CA.

Answer

Access point output power is too high

Answer

Microwave ovens are interfering with the wireless signal

Answer

Client devices have weak signal strength

Question 4

Which security feature on a switch can prevent an attacker from sending forged ARP messages to redirect traffic?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) is the correct answer because it validates ARP packets against a trusted database (the DHCP snooping binding table) to ensure that the MAC-to-IP address mapping is legitimate. By intercepting and verifying all ARP requests and replies on untrusted ports, DAI prevents an attacker from sending forged ARP messages to redirect traffic (ARP spoofing).

Answer

Port security

Answer

DHCP snooping

Answer

VLAN segmentation

Question 5

A network administrator receives an automated alert from the network monitoring system indicating that the bandwidth utilization on a specific switch port has exceeded the threshold for the past 10 minutes. According to best practices for network operations, what should the administrator do FIRST?

Accepted Answer

Check the monitoring system logs to identify the traffic source and destination.. The first step in responding to a bandwidth utilization alert is to investigate the traffic causing the spike. Checking the monitoring system logs allows the administrator to identify the source and destination of the traffic, which is essential for determining whether the utilization is legitimate (e.g., a backup or large file transfer) or malicious (e.g., a DoS attack). This aligns with the network operations best practice of 'verify before acting' to avoid unnecessary disruptions.

Answer

Immediately block the port to prevent potential network congestion from affecting other users.

Answer

Reboot the switch to clear any temporary errors that might be causing the alert.

Answer

Increase the bandwidth on the port to accommodate the higher traffic load.

Question 6

A user reports that they cannot access any network resources. The technician checks the IP configuration on the workstation and sees an IP address of 169.254.10.55 with a subnet mask of 255.255.0.0. Which of the following should the technician check NEXT?

Accepted Answer

Verify that the DHCP server is available and reachable. The IP address 169.254.10.55 with a subnet mask of 255.255.0.0 is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when a DHCP server is unreachable. The next logical step is to verify that the DHCP server is available and reachable, as this directly addresses the root cause of the failed DHCP lease acquisition.

Answer

Configure a static IP address on the workstation

Answer

Check the DNS server configuration on the workstation

Answer

Replace the network cable

Question 7

An employee plugs a personal laptop into a network jack and then the laptop is infected with malware that spreads to other devices on the network. Which security control would have most effectively prevented this scenario?

Accepted Answer

802.1X authentication. 802.1X authentication requires devices to authenticate before gaining network access, typically via EAP (Extensible Authentication Protocol) over RADIUS. In this scenario, the employee's personal laptop would be blocked at the port level because it lacks valid credentials, preventing the malware from ever reaching the internal network and spreading to other devices.

Answer

MAC filtering on the switch

Answer

VLAN segmentation

Answer

Access control lists on the router

Question 8

A user reports that they can access the company's intranet website by IP address but not by its hostname (intranet.company.local). A technician checks the DNS server and finds that the A record exists and returns the correct IP. However, the user's browser still cannot resolve the hostname. Which of the following is the most likely cause?

Accepted Answer

The DNS cache on the user's workstation is corrupt.. The user can access the intranet by IP but not by hostname, which indicates that name resolution is failing. Since the DNS server has the correct A record, the issue is likely on the client side. A corrupt DNS cache on the workstation can cause the browser to use stale or invalid cached data, preventing successful resolution even though the authoritative DNS server returns the correct IP. Flushing the DNS cache with `ipconfig /flushdns` would resolve this.

Answer

The web server's certificate is expired.

Answer

The default gateway is misconfigured.

Answer

The file server is overloaded.

Question 9

A company wants to allow inbound HTTPS traffic to a web server located in the DMZ from the Internet. The firewall has three interfaces: Inside (corporate network), Outside (Internet), and DMZ (web server). Which of the following firewall rules is required?

Accepted Answer

Allow traffic from Outside to DMZ on port 443. The correct rule is to allow traffic from the Outside (Internet) interface to the DMZ interface on TCP port 443 (HTTPS). This permits inbound web requests to reach the web server while keeping the corporate Inside network isolated. The firewall must explicitly permit this traffic because the default implicit deny rule would otherwise block all inbound connections from the Outside zone.

Answer

Allow traffic from DMZ to Outside on port 443

Answer

Allow traffic from Inside to DMZ on port 443

Answer

Allow traffic from Outside to Inside on port 443

Question 10

A company is deploying a new wireless network in a warehouse. The network administrator needs to ensure that clients can seamlessly roam between access points without losing connectivity. Which of the following should be configured?

Accepted Answer

A) Same SSID and security settings on all APs. Configuring the same SSID and security settings on all access points (APs) is essential for seamless roaming because clients use the SSID to identify the network and the security credentials to authenticate. When a client moves between APs, it can re-associate without needing to re-authenticate or discover a new network, provided the SSID and security parameters (e.g., PSK or 802.1X configuration) are identical. This ensures a smooth handoff and maintains connectivity during roaming.

Answer

B) Different channels per AP to reduce interference

Answer

C) WPA2-Enterprise with RADIUS authentication

Answer

D) Mesh topology for AP interconnection

Question 11

A network administrator needs to perform a critical firmware upgrade on a core switch during a maintenance window. Which of the following should the administrator do FIRST before making the change?

Accepted Answer

Test the firmware in a lab environment. Before making any change to a production device, the firmware should first be tested in a lab environment that mirrors the production setup. This validates compatibility with existing hardware, software features, and configurations, preventing unexpected behavior such as boot loops, protocol failures, or hardware incompatibility that could cause extended outages.

Answer

Notify all users of the planned outage

Answer

Create a backup of the current switch configuration

Answer

Submit a change request for approval

Question 12

An organization uses a AAA server for network device authentication. The security team requires that all authentication traffic be fully encrypted and that authorization commands be logged per user. Which protocol is best suited for this requirement?

Accepted Answer

TACACS+. TACACS+ is the best choice because it encrypts the entire authentication packet (including username, password, and all other fields) and supports per-user command authorization logging. This meets the requirement for fully encrypted authentication traffic and detailed audit trails for each user's commands.

Answer

RADIUS with EAP-TLS

Answer

LDAP over SSL

Answer

Kerberos

Question 13

A technician is troubleshooting an issue where a wireless client can associate with an access point but cannot obtain an IP address via DHCP. The technician checks the DHCP server and sees no lease requests from the client's MAC address. Which of the following is the most likely cause?

Accepted Answer

The AP is not configured with a DHCP relay. The client can associate with the AP but cannot obtain an IP address, and the DHCP server shows no lease requests from the client's MAC. This indicates that DHCP discovery broadcasts are not reaching the DHCP server, which is common when the client and server are on different subnets and the AP (or a Layer 3 device) is not configured with a DHCP relay (ip helper-address). Without a relay, broadcast DHCP messages are dropped at the router, so the server never sees the request.

Answer

The client's wireless adapter is faulty

Answer

The client's SSID is incorrect

Answer

The AP's radio is operating on the wrong channel

Question 14

A network engineer is planning a wireless LAN for an open office with 50 users. To maximize performance by using multiple non-overlapping channels, which frequency band should be primarily used?

Accepted Answer

5 GHz. The 5 GHz band is the best choice for maximizing performance in an open office with 50 users because it offers up to 23 non-overlapping channels (using 20 MHz channels) compared to only 3 in the 2.4 GHz band. This allows for better channel reuse, reduced co-channel interference, and higher aggregate throughput in a dense user environment.

Answer

2.4 GHz

Answer

6 GHz

Answer

900 MHz

Question 15

A technician is troubleshooting a loss of network connectivity for a single workstation. The workstation has a valid IP address but cannot ping its default gateway. The link lights on both the workstation and the switch are solid. Which of the following should the technician check NEXT?

Accepted Answer

The switch port configuration, such as VLAN assignment. The workstation has a valid IP address and solid link lights, indicating Layer 1 (physical) and Layer 3 (IP configuration) are functional. The inability to ping the default gateway points to a Layer 2 issue, such as the switch port being in the wrong VLAN or having a misconfigured access/trunk setting. Checking the switch port configuration is the logical next step because VLAN mismatches prevent frames from reaching the gateway's subnet.

Answer

The cable integrity with a tester

Answer

The DNS server settings

Answer

The workstation's ARP cache