N10-009 Practice Test 18 — 15 Questions

Question 1

A network engineer plans to change the routing protocol configuration on a core router that will affect connectivity to all branches. According to change management best practices, which step should the engineer perform BEFORE implementing the change?

Accepted Answer

Create a backout plan to revert the change if necessary. Creating a backout plan is a critical step in change management because it provides a documented procedure to revert the router to its previous operational state if the new routing protocol configuration causes connectivity loss or instability. Without a backout plan, the engineer risks prolonged outages across all branches while troubleshooting or attempting to reconstruct the original configuration from memory or incomplete logs. This aligns with ITIL change management best practices, which prioritize risk mitigation and service continuity.

Answer

Notify all branch users of the upcoming change

Answer

Document the current router configuration

Answer

Schedule the change during a maintenance window

Question 2

A network engineer is deploying a wireless network using 802.11ac. To allow clients to roam between access points without re-authenticating to the authentication server, which IEEE standard should be implemented?

Accepted Answer

802.11r. 802.11r, also known as Fast BSS Transition (FT), enables clients to roam between access points using a cached Pairwise Master Key (PMK) without requiring a full 802.1X/EAP re-authentication with the RADIUS server. This reduces roaming latency to under 50 ms, which is critical for voice and video applications.

Answer

802.1X

Answer

802.11i

Answer

802.11e

Question 3

A network administrator needs to monitor network traffic to identify which hosts are consuming the most bandwidth. Which of the following tools is BEST suited for this task?

Accepted Answer

NetFlow. NetFlow is the best tool for monitoring network traffic to identify bandwidth consumption by hosts because it collects and analyzes IP traffic flow data, providing detailed visibility into source/destination IPs, protocols, and byte counts. Unlike simple interface counters, NetFlow allows an administrator to pinpoint which specific hosts are generating the most traffic, making it ideal for bandwidth usage analysis.

Answer

Syslog server

Answer

SNMP trap

Answer

Traceroute

Question 4

A network technician is analyzing a small office network topology. An 8-port switch has 7 workstations directly connected. The remaining switch port is connected to a 4-port hub, which has 4 workstations attached. All devices are configured on the same VLAN and IP subnet. How many collision domains and broadcast domains are present in this network?

Accepted Answer

8 collision domains, 1 broadcast domain. Switches create a separate collision domain per port, so the 8-port switch provides 8 collision domains. The hub connected to one switch port extends that single collision domain to all its attached devices, but does not create new ones. All devices are on the same VLAN and IP subnet, so there is only one broadcast domain. Therefore, the network has 8 collision domains and 1 broadcast domain.

Answer

11 collision domains, 1 broadcast domain

Answer

12 collision domains, 5 broadcast domains

Answer

8 collision domains, 5 broadcast domains

Question 5

A network administrator wants to ensure all network devices have synchronized time for accurate log correlation and security event analysis. Which protocol should be implemented?

Accepted Answer

NTP. NTP (Network Time Protocol) is the correct choice because it is specifically designed to synchronize clocks across network devices using a hierarchical system of time sources, ensuring millisecond-level accuracy. Accurate time synchronization is critical for correlating logs and security events across multiple devices, as timestamps must match to reconstruct attack timelines or diagnose faults.

Answer

SNMP

Answer

FTP

Answer

HTTP

Question 6

A security analyst receives an alert that an internal user's workstation is sending a high volume of ARP requests for multiple IP addresses on the local subnet. The analyst suspects a man-in-the-middle attack. Which security mechanism is most effective at mitigating this type of attack on a switched network?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) is the correct answer because it validates ARP packets on a switched network, ensuring that only legitimate ARP replies are forwarded. In a man-in-the-middle attack, an attacker sends spoofed ARP replies to associate their MAC address with the IP address of a legitimate host. DAI intercepts all ARP packets and compares them against a trusted binding table (built by DHCP snooping), dropping any that are invalid, thus preventing ARP spoofing.

Answer

Port security

Answer

DHCP snooping

Answer

MAC address filtering

Question 7

A network administrator wants to prevent unauthorized devices from connecting to the network by limiting the number of MAC addresses allowed on a switch port. Which security feature should be configured?

Accepted Answer

Port security. Port security is the correct feature because it directly restricts the number of unique MAC addresses that can be learned on a switch port, preventing unauthorized devices from connecting. When the configured limit is exceeded, the switch can take actions such as shutdown, restrict, or protect, effectively blocking the unauthorized device. This is a Layer 2 access control mechanism that operates on the switch port itself.

Answer

802.1X

Answer

DHCP snooping

Answer

Dynamic ARP inspection

Question 8

A network administrator scheduled a change window to upgrade the firmware on a core switch. During the upgrade, the switch fails to boot properly. The administrator needs to restore the switch to its previous operational state. Which of the following should the administrator have done before the upgrade to facilitate a successful rollback?

Accepted Answer

Backed up the current configuration and firmware image.. Option B is correct because backing up both the current configuration and the firmware image ensures that the administrator can restore the switch to its exact previous operational state if the upgrade fails. Without a backup of the firmware image, the switch may not have a valid bootable image to revert to, even if the configuration is saved. This is a fundamental prerequisite for any firmware upgrade rollback plan.

Answer

Notified all users of the maintenance window.

Answer

Disconnected all redundant links.

Answer

Set the switch to boot from an alternative image.

Question 9

A network technician is explaining the difference between a hub and a switch to a junior technician. Which statement correctly describes a key difference between these devices?

Accepted Answer

A hub sends frames out all ports except the incoming port; a switch sends frames only to the port with the matching MAC address.. B is correct because a hub operates at Layer 1 (physical layer) and blindly repeats electrical signals out all ports except the incoming port, creating a single collision domain. In contrast, a switch operates at Layer 2 (data link layer) and uses the MAC address table to forward frames only to the specific port associated with the destination MAC address, reducing unnecessary traffic and creating separate collision domains per port.

Answer

A hub operates at Layer 2, while a switch operates at Layer 1.

Answer

A hub uses MAC addresses to make forwarding decisions, while a switch uses IP addresses.

Answer

A hub creates a separate collision domain for each port, while a switch creates a single collision domain.

Question 10

A security administrator observes that an employee's workstation is sending large amounts of data to an external IP address on TCP port 443. The workstation is not supposed to initiate outbound connections, and there is no business need for it. What is the most likely cause?

Accepted Answer

The workstation is part of a botnet and is communicating with a command-and-control server. The workstation is sending large amounts of data to an external IP on TCP port 443, which is commonly used for HTTPS traffic. Since the workstation is not authorized to initiate outbound connections and has no business need for this traffic, the most likely cause is that it has been compromised and is part of a botnet, using HTTPS to communicate with a command-and-control (C2) server to evade detection by blending in with legitimate encrypted web traffic.

Answer

A legitimate software update is being downloaded

Answer

The workstation is acting as a VPN client connecting to a corporate VPN server

Answer

The workstation is hosting a web server that is being accessed externally

Question 11

A router has two routes to the same destination network: one learned via OSPF with a metric of 10, and another learned via EIGRP with a composite metric of 3072. The default administrative distances are OSPF=110, EIGRP=90. Which route will be installed in the routing table?

Accepted Answer

The EIGRP route because it has a lower administrative distance. The EIGRP route is installed because administrative distance (AD) is the primary tiebreaker when multiple routing protocols provide routes to the same destination. EIGRP has a default AD of 90, which is lower than OSPF's AD of 110, so the router prefers the EIGRP route regardless of metric values. Metrics are only compared when routes come from the same protocol.

Answer

The OSPF route because it has a lower metric

Answer

Both routes will be installed for load balancing

Answer

The OSPF route because it is a link-state protocol

Question 12

A network switch is experiencing a high number of collisions on a specific port. The connected device is configured for half-duplex. Which of the following is the most likely cause?

Accepted Answer

The switch port is configured for full-duplex. When a switch port is configured for full-duplex but the connected device operates in half-duplex, a duplex mismatch occurs. The switch transmits without checking for collisions (as full-duplex does not use CSMA/CD), while the half-duplex device expects to sense the carrier before sending, leading to collisions on the port. This is the most common cause of excessive collisions on a single switch port.

Answer

The cable length exceeds 100 meters

Answer

The device is using an incorrect VLAN

Answer

The switch port is configured for 1000BASE-T but the device only supports 100BASE-TX

Question 13

A network administrator wants to prevent unauthorized DHCP servers from offering IP addresses to clients on a switch. Which security feature should be enabled?

Accepted Answer

DHCP snooping. DHCP snooping is the correct answer because it is a security feature specifically designed to filter untrusted DHCP messages on a switch. By configuring trusted and untrusted ports, DHCP snooping drops DHCP server responses (OFFER, ACK) received on untrusted ports, effectively preventing rogue DHCP servers from assigning IP addresses to clients.

Answer

BPDU guard

Answer

Dynamic ARP inspection

Answer

Port security

Question 14

A security analyst is reviewing DHCP server logs and notices that a single MAC address is sending an extremely high number of DHCP discover packets. The DHCP server is responding, but the client never sends a DHCP request. Which type of attack is most likely occurring?

Accepted Answer

A) DHCP starvation. A DHCP starvation attack works by flooding the DHCP server with DHCPDISCOVER packets from spoofed MAC addresses, exhausting the server's IP address pool. In this scenario, a single MAC address sending excessive DHCPDISCOVER packets without completing the DORA handshake (no DHCPREQUEST) is a classic indicator of a starvation attack, as the attacker aims to consume all available leases and cause a denial of service for legitimate clients.

Answer

B) ARP poisoning

Answer

C) MAC flooding

Answer

D) DNS spoofing

Question 15

A network monitoring system uses SNMP to poll interface statistics from switches every 5 minutes. This polling is causing high CPU utilization on the switches. Which of the following actions would BEST reduce the CPU load on the switches while still providing monitoring data?

Accepted Answer

Use SNMP traps instead of polling. SNMP traps are push-based notifications sent by the switch only when a significant event occurs (e.g., link up/down, threshold crossing), eliminating the need for the NMS to poll every 5 minutes. This reduces CPU load because the switch no longer processes periodic GET requests, which require CPU cycles to gather interface statistics from the MIB. Traps still provide monitoring data by alerting the NMS to changes, though they may not offer the same granularity as polling for all counters.

Answer

Increase the SNMP community string

Answer

Disable SNMP on unused interfaces

Answer

Change the SNMP version to v1