N10-009 Practice Test 18 — 15 Questions

Question 1

A network engineer configures an 802.1Q trunk between two switches. The trunk is up, but VLAN 10 traffic is not passing. The engineer checks and confirms that VLAN 10 exists on both switches. The show interfaces trunk command displays 'allowed VLANs: none'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The allowed VLAN list is empty. The 'show interfaces trunk' output showing 'allowed VLANs: none' explicitly indicates that the allowed VLAN list on the trunk has been manually cleared or set to none, which blocks all VLAN traffic including VLAN 10. Even though VLAN 10 exists on both switches, the trunk port's VLAN filter prevents any frames from being forwarded. This is the most direct cause of the issue.

Answer

The trunk encapsulation is not set to dot1q

Answer

The native VLAN mismatch

Answer

VLAN 10 is not created on one of the switches

Question 2

A network administrator needs to automatically back up the configuration files of all network devices (routers, switches, firewalls) to a central server every night. The administrator requires the transfer to be encrypted to protect sensitive configuration data. Which protocol should the administrator use to retrieve the configuration files?

Accepted Answer

SCP. SCP (Secure Copy Protocol) uses SSH for encrypted file transfers, making it ideal for securely retrieving configuration files from network devices to a central server. It ensures both authentication and data encryption, protecting sensitive configuration data during transit.

Answer

TFTP

Answer

FTP

Answer

HTTP

Question 3

A company wants to deploy a wireless network with the highest level of security for client authentication. The network will use a RADIUS server. Which authentication method should be used?

Accepted Answer

802.1X with EAP-TLS. 802.1X with EAP-TLS provides certificate-based mutual authentication, eliminating the risk of credential theft or dictionary attacks. This is the strongest authentication method for enterprise wireless networks, as it requires both the client and the RADIUS server to present valid X.509 certificates, ensuring a cryptographically verified identity on both sides.

Answer

WPA2-PSK

Answer

WPA3-SAE

Answer

802.1X with PEAP

Question 4

An engineer is configuring a network and needs to understand the default behavior of an IPv6 node. When an IPv6 interface is initialized, which type of address is automatically assigned without any configuration server?

Accepted Answer

Link-local address. When an IPv6 interface is initialized, it automatically generates a link-local address (fe80::/10) using Stateless Address Autoconfiguration (SLAAC) without requiring any external server (e.g., DHCPv6). This address is mandatory for neighbor discovery and other link-local communication, allowing the node to operate on the local network segment immediately.

Answer

Global unicast address

Answer

Unique local address

Answer

Multicast address

Question 5

A network administrator needs to automate the backup of router configuration files to a remote server over the internet. The backup must be encrypted and authenticated. Which protocol should the administrator use in the automated script?

Accepted Answer

SCP. SCP (Secure Copy Protocol) is the correct choice because it provides both encryption and authentication by operating over SSH (Secure Shell), which encrypts the entire session and verifies the server's identity using public-key cryptography. This makes it suitable for automating secure backups of router configuration files to a remote server over the internet, as it supports scripting with tools like expect or SSH keys without interactive password prompts.

Answer

TFTP

Answer

FTP

Answer

HTTP

Question 6

A network administrator needs to schedule a firmware upgrade on a core switch during the next maintenance window. According to best practices, which document should the administrator create and have approved before making the change?

Accepted Answer

A change request form with a rollback plan and approval signatures.. A change request form with a rollback plan and approval signatures ensures that the firmware upgrade follows the ITIL change management process, which is a best practice for network operations. This document provides a structured approach to assess risks, obtain authorization, and define steps to revert the switch to its previous state if the upgrade fails, minimizing downtime and impact on the network.

Answer

A network diagram showing the current topology.

Answer

An incident report detailing previous firmware issues.

Answer

A baseline performance report from the current firmware version.

Question 7

A network technician is explaining the concept of encapsulation to a junior technician. At which OSI layer does a packet get encapsulated with a source and destination IP address?

Accepted Answer

Layer 3. At Layer 3 (the Network layer), the packet is encapsulated with a source and destination IP address. This is defined by the Internet Protocol (IP), which handles logical addressing and routing across networks. The IP header is added to the payload from the upper layers, creating a packet that can be forwarded by routers.

Answer

Layer 2

Answer

Layer 4

Answer

Layer 1

Question 8

A network administrator needs to be notified immediately when a critical switch interface goes down. Which SNMP feature should be configured?

Accepted Answer

Traps. B is correct because SNMP traps are unsolicited messages sent from an SNMP agent to the network management system (NMS) to immediately notify the administrator of a critical event, such as a switch interface going down. Unlike polling, which requires the NMS to periodically request status information, traps provide real-time, event-driven alerts without delay, ensuring the administrator is notified as soon as the interface state changes.

Answer

Polling

Answer

Informs

Answer

Set

Question 9

A security analyst detects that an attacker is sending forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. What is this attack called?

Accepted Answer

ARP poisoning. ARP poisoning (also known as ARP spoofing) is the correct answer because the attacker sends forged ARP replies to associate their MAC address with the IP address of the default gateway. This causes the victim's switch to update its ARP cache with the attacker's MAC for the gateway's IP, enabling man-in-the-middle attacks where the attacker intercepts traffic destined for the gateway.

Answer

MAC flooding

Answer

DHCP snooping

Answer

DNS spoofing

Question 10

A security analyst notices a large number of incoming TCP packets to a server with the FIN, PSH, and URG flags set. This pattern is characteristic of which type of network scan?

Accepted Answer

Xmas tree scan. An Xmas tree scan sends TCP packets with the FIN, PSH, and URG flags set (the packet 'lights up' like a Christmas tree). This is a stealth scan technique used to probe open or closed ports based on RFC 793 behavior: closed ports should respond with an RST packet, while open ports may ignore the packet (or respond differently depending on the OS). The pattern described—FIN, PSH, and URG all set—is the definitive signature of an Xmas tree scan.

Answer

SYN scan

Answer

Null scan

Answer

ACK scan

Question 11

A technician is troubleshooting a wireless network that experiences intermittent disconnections. A spectrum analysis shows channel utilization consistently above 80% on the 2.4 GHz band. Which of the following is the most likely cause?

Accepted Answer

Too many access points are configured on the same or overlapping channels. A is correct because consistently high channel utilization above 80% on the 2.4 GHz band indicates co-channel or adjacent-channel interference, typically caused by too many access points (APs) operating on the same or overlapping channels (e.g., channels 1, 6, and 11 are non-overlapping in 802.11b/g/n). This leads to excessive contention, increased retransmissions, and intermittent disconnections as stations wait for clear channel access via CSMA/CA.

Answer

Access point output power is too high

Answer

Microwave ovens are interfering with the wireless signal

Answer

Client devices have weak signal strength

Question 12

Which security feature on a switch can prevent an attacker from sending forged ARP messages to redirect traffic?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) is the correct answer because it validates ARP packets against a trusted database (the DHCP snooping binding table) to ensure that the MAC-to-IP address mapping is legitimate. By intercepting and verifying all ARP requests and replies on untrusted ports, DAI prevents an attacker from sending forged ARP messages to redirect traffic (ARP spoofing).

Answer

Port security

Answer

DHCP snooping

Answer

VLAN segmentation

Question 13

A network administrator receives an automated alert from the network monitoring system indicating that the bandwidth utilization on a specific switch port has exceeded the threshold for the past 10 minutes. According to best practices for network operations, what should the administrator do FIRST?

Accepted Answer

Check the monitoring system logs to identify the traffic source and destination.. The first step in responding to a bandwidth utilization alert is to investigate the traffic causing the spike. Checking the monitoring system logs allows the administrator to identify the source and destination of the traffic, which is essential for determining whether the utilization is legitimate (e.g., a backup or large file transfer) or malicious (e.g., a DoS attack). This aligns with the network operations best practice of 'verify before acting' to avoid unnecessary disruptions.

Answer

Immediately block the port to prevent potential network congestion from affecting other users.

Answer

Reboot the switch to clear any temporary errors that might be causing the alert.

Answer

Increase the bandwidth on the port to accommodate the higher traffic load.

Question 14

A user reports that they cannot access any network resources. The technician checks the IP configuration on the workstation and sees an IP address of 169.254.10.55 with a subnet mask of 255.255.0.0. Which of the following should the technician check NEXT?

Accepted Answer

Verify that the DHCP server is available and reachable. The IP address 169.254.10.55 with a subnet mask of 255.255.0.0 is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when a DHCP server is unreachable. The next logical step is to verify that the DHCP server is available and reachable, as this directly addresses the root cause of the failed DHCP lease acquisition.

Answer

Configure a static IP address on the workstation

Answer

Check the DNS server configuration on the workstation

Answer

Replace the network cable

Question 15

An employee plugs a personal laptop into a network jack and then the laptop is infected with malware that spreads to other devices on the network. Which security control would have most effectively prevented this scenario?

Accepted Answer

802.1X authentication. 802.1X authentication requires devices to authenticate before gaining network access, typically via EAP (Extensible Authentication Protocol) over RADIUS. In this scenario, the employee's personal laptop would be blocked at the port level because it lacks valid credentials, preventing the malware from ever reaching the internal network and spreading to other devices.

Answer

MAC filtering on the switch

Answer

VLAN segmentation

Answer

Access control lists on the router