N10-009 Practice Test 19 — 15 Questions

Question 1

Users on a VLAN report intermittent network disconnections lasting a few seconds. The network technician checks the switch and notices a high number of CRC errors on the port connecting to the core switch. The cable test passes. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Duplex mismatch between the two switches. A duplex mismatch causes one side to send frames while the other is still transmitting, leading to collisions that are interpreted as CRC errors on the receiving interface. Since the cable test passes, the physical layer is fine, and the intermittent nature (lasting seconds) matches the symptom of a duplex mismatch where the half-duplex side backs off after collisions, causing brief outages.

Answer

STP reconvergence due to topology change

Answer

Broadcast storm caused by a loop

Answer

Faulty SFP transceiver on the core switch

Question 2

A network administrator is setting up a new branch office that will connect to the main headquarters over the Internet. The connection must be encrypted and allow the branch to access internal resources as if they were directly connected. Which of the following VPN types is BEST suited for this site-to-site connection?

Accepted Answer

IPsec. IPsec is the correct choice because it is specifically designed for site-to-site VPNs, providing encryption and authentication at the IP layer to create a secure tunnel between two networks. This allows the branch office to access internal resources at headquarters as if they were directly connected, using a gateway-to-gateway model that encrypts all traffic between the sites.

Answer

SSL VPN

Answer

PPTP

Answer

L2TP

Question 3

A network administrator wants to automate the backup of configuration files from multiple routers and switches. Which protocol is commonly used for this purpose and is supported by most network devices?

Accepted Answer

TFTP. TFTP (Trivial File Transfer Protocol) is the correct choice because it is a lightweight, connectionless UDP-based protocol (port 69) that is widely supported on network devices like routers and switches for automated configuration backups. Its simplicity and minimal overhead make it ideal for scripting backup operations, even though it lacks security features like authentication or encryption.

Answer

FTP

Answer

SFTP

Answer

HTTP

Question 4

A security analyst notices that the company's web server is receiving a high volume of TCP SYN packets from a single source IP address, but the server is not completing the three-way handshake. Which type of attack is most likely occurring?

Accepted Answer

A) SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets from a spoofed or single source IP without completing the handshake. The server allocates resources for each half-open connection, eventually exhausting its connection table and denying service to legitimate users. This matches the scenario where the server receives many SYN packets but never completes the handshake.

Answer

B) Smurf attack

Answer

C) Ping of death

Answer

D) ARP poisoning

Question 5

A company wants to deploy a wireless network for employee devices using the highest security standard. The network will use a RADIUS server for authentication. Which authentication method should be configured?

Accepted Answer

802.1X/EAP. B is correct because 802.1X/EAP is the only option that provides enterprise-grade authentication using a RADIUS server. It requires each user to present unique credentials (e.g., username/password or certificate), which are verified by the RADIUS server before granting network access. This meets the requirement for the highest security standard in a corporate environment.

Answer

WPA3-SAE

Answer

WPA2-PSK

Answer

WEP with RADIUS

Question 6

A client obtains an IP address from a DHCP server but cannot resolve hostnames. The client can ping the default gateway and external IP addresses successfully. What is the most likely cause?

Accepted Answer

DNS server misconfiguration. The client can ping external IP addresses and the default gateway, confirming that IP connectivity and routing are functional. However, the inability to resolve hostnames points directly to a DNS resolution failure, which occurs when the DNS server address is misconfigured or unreachable. Since DHCP provided the IP address, the DNS server setting is likely incorrect or missing in the DHCP scope.

Answer

Incorrect subnet mask

Answer

Default gateway not set

Answer

Firewall blocking DNS

Question 7

A network engineer needs to connect two buildings that are 200 meters apart with a 1 Gbps link. The path is outdoors and susceptible to lightning strikes. Which cable type is the most appropriate for this scenario?

Accepted Answer

Multimode fiber optic. Multimode fiber optic cable is the most appropriate choice because it supports 1 Gbps over distances up to 550 meters (using OM2/OM3 fiber) and is completely immune to electromagnetic interference (EMI) from lightning strikes. Unlike copper cabling, fiber uses light pulses for transmission, so it does not conduct electricity, making it ideal for outdoor runs between buildings where lightning is a risk.

Answer

Cat6a UTP

Answer

Cat5e UTP

Answer

Single-mode fiber optic

Question 8

A network technician needs to retrieve the operating system and uptime information from a router for inventory purposes. Which protocol is specifically designed for network management and monitoring?

Accepted Answer

SNMP. SNMP (Simple Network Management Protocol) is the standard protocol specifically designed for network management and monitoring. It allows a network management station to query managed devices (like routers) for system information, including operating system version and uptime, via OIDs (Object Identifiers) in the MIB (Management Information Base).

Answer

SMTP

Answer

HTTP

Answer

FTP

Question 9

A network administrator is creating a new VLAN 50 on a switch. After creating the VLAN, the administrator notices that the switch does not send VLAN information to other switches in the network. Which of the following is the most likely reason?

Accepted Answer

VTP mode is set to transparent.. When VTP mode is set to transparent, the switch does not originate or forward VTP advertisements, so VLAN changes made on it are not propagated to other switches. This explains why VLAN 50 was created locally but not shared with the rest of the network.

Answer

The trunk link is not configured.

Answer

The VLAN is not allowed on the trunk.

Answer

STP is blocking the VLAN.

Question 10

A network technician is troubleshooting a switch port that shows a link light but has a high number of CRC errors in the interface statistics. The port is connected to a workstation's network interface card (NIC). Both devices are set to autonegotiate. What is the MOST likely cause of the CRC errors?

Accepted Answer

A: Duplex mismatch between the switch port and the workstation NIC. CRC errors indicate that frames received by the switch have failed the Ethernet frame check sequence (FCS) validation, meaning the data was corrupted during transmission. When both devices are set to autonegotiate but one fails to correctly negotiate the duplex setting, a duplex mismatch occurs: one side operates at full duplex while the other operates at half duplex. This causes collisions on the half-duplex side, which corrupts frames and generates CRC errors, while the full-duplex side does not detect collisions and retransmits, leading to a high error count.

Answer

B: VLAN mismatch between the switch and the workstation

Answer

C: Incorrect MTU setting on the switch port

Answer

D: Broadcast storm from a loop in the network

Question 11

An organization needs to authenticate network administrators and control which commands each administrator can execute on routers and switches. The solution must support granular per-command authorization and encrypt the entire session. Which protocol is best suited for this requirement?

Accepted Answer

TACACS+. TACACS+ is the correct choice because it separates authentication, authorization, and accounting (AAA) functions, allowing granular per-command authorization on routers and switches. It encrypts the entire session, including the username, password, and all command traffic, unlike RADIUS which only encrypts the password. This makes TACACS+ ideal for environments requiring strict command-level control and full session encryption.

Answer

RADIUS

Answer

LDAP

Answer

Kerberos

Question 12

A network administrator notices that several workstations on the network are receiving IP addresses from an unknown source, causing intermittent connectivity issues. The DHCP server is located in the server room and is the only authorized DHCP server. Which security feature should be implemented on the access switches to prevent rogue DHCP servers from distributing IP addresses?

Accepted Answer

DHCP Snooping. DHCP Snooping is the correct security feature because it filters untrusted DHCP messages on access switches. By configuring ports connected to end-user workstations as untrusted, the switch drops DHCP server responses (OFFER, ACK) received on those ports, preventing rogue DHCP servers from distributing IP addresses. This ensures only the authorized DHCP server in the server room can provide IP configurations.

Answer

Dynamic ARP Inspection

Answer

IP Source Guard

Answer

Port Security

Question 13

An organization uses OSPF as its interior gateway protocol in a multi-area design. After a core router failure, the network takes several seconds to reconverge. Which technology can be implemented to improve convergence speed?

Accepted Answer

Configure BFD (Bidirectional Forwarding Detection). BFD provides sub-second failure detection times (as low as 50 ms) independent of the routing protocol, allowing OSPF to reconverge much faster than relying on its default dead timer intervals. By detecting link failures in milliseconds, BFD triggers OSPF to immediately recalculate routes, drastically reducing the convergence delay after a core router failure.

Answer

Implement LSA throttling

Answer

Enable OSPF fast hello timers

Answer

Convert all areas to stub areas

Question 14

A network administrator has completed a scheduled firmware upgrade on a core switch. After verifying successful operation, which document should the administrator update to reflect the new firmware version?

Accepted Answer

Change management log. The change management log is the correct document to update because it records all modifications to the network, including firmware upgrades, along with details such as the date, reason, and new version. This log ensures compliance with ITIL change management processes and provides an audit trail for troubleshooting and future changes. Updating it after a successful firmware upgrade is a standard operational procedure to maintain accurate change history.

Answer

Network logical topology diagram

Answer

Rack diagram

Answer

Inventory management system

Question 15

A network administrator is creating documentation for a new data center. Which type of diagram is BEST for showing the logical relationships between VLANs and their associated subnets?

Accepted Answer

Logical topology diagram. A logical topology diagram is the correct choice because it illustrates how devices communicate across the network, including the mapping of VLANs to their associated IP subnets. This type of diagram abstracts away physical cabling and device locations to focus on Layer 2 and Layer 3 relationships, such as VLAN IDs, subnet masks, and default gateways. It is essential for documenting network segmentation and troubleshooting inter-VLAN routing.

Answer

Physical topology diagram

Answer

Wiring diagram

Answer

Rack elevation diagram