N10-009 Practice Test 19 — 15 Questions

Question 1

A user reports that they can access the company's intranet website by IP address but not by its hostname (intranet.company.local). A technician checks the DNS server and finds that the A record exists and returns the correct IP. However, the user's browser still cannot resolve the hostname. Which of the following is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The DNS cache on the user's workstation is corrupt.. The user can access the intranet by IP but not by hostname, which indicates that name resolution is failing. Since the DNS server has the correct A record, the issue is likely on the client side. A corrupt DNS cache on the workstation can cause the browser to use stale or invalid cached data, preventing successful resolution even though the authoritative DNS server returns the correct IP. Flushing the DNS cache with `ipconfig /flushdns` would resolve this.

Answer

The web server's certificate is expired.

Answer

The default gateway is misconfigured.

Answer

The file server is overloaded.

Question 2

A company wants to allow inbound HTTPS traffic to a web server located in the DMZ from the Internet. The firewall has three interfaces: Inside (corporate network), Outside (Internet), and DMZ (web server). Which of the following firewall rules is required?

Accepted Answer

Allow traffic from Outside to DMZ on port 443. The correct rule is to allow traffic from the Outside (Internet) interface to the DMZ interface on TCP port 443 (HTTPS). This permits inbound web requests to reach the web server while keeping the corporate Inside network isolated. The firewall must explicitly permit this traffic because the default implicit deny rule would otherwise block all inbound connections from the Outside zone.

Answer

Allow traffic from DMZ to Outside on port 443

Answer

Allow traffic from Inside to DMZ on port 443

Answer

Allow traffic from Outside to Inside on port 443

Question 3

A company is deploying a new wireless network in a warehouse. The network administrator needs to ensure that clients can seamlessly roam between access points without losing connectivity. Which of the following should be configured?

Accepted Answer

A) Same SSID and security settings on all APs. Configuring the same SSID and security settings on all access points (APs) is essential for seamless roaming because clients use the SSID to identify the network and the security credentials to authenticate. When a client moves between APs, it can re-associate without needing to re-authenticate or discover a new network, provided the SSID and security parameters (e.g., PSK or 802.1X configuration) are identical. This ensures a smooth handoff and maintains connectivity during roaming.

Answer

B) Different channels per AP to reduce interference

Answer

C) WPA2-Enterprise with RADIUS authentication

Answer

D) Mesh topology for AP interconnection

Question 4

A network administrator needs to perform a critical firmware upgrade on a core switch during a maintenance window. Which of the following should the administrator do FIRST before making the change?

Accepted Answer

Test the firmware in a lab environment. Before making any change to a production device, the firmware should first be tested in a lab environment that mirrors the production setup. This validates compatibility with existing hardware, software features, and configurations, preventing unexpected behavior such as boot loops, protocol failures, or hardware incompatibility that could cause extended outages.

Answer

Notify all users of the planned outage

Answer

Create a backup of the current switch configuration

Answer

Submit a change request for approval

Question 5

An organization uses a AAA server for network device authentication. The security team requires that all authentication traffic be fully encrypted and that authorization commands be logged per user. Which protocol is best suited for this requirement?

Accepted Answer

TACACS+. TACACS+ is the best choice because it encrypts the entire authentication packet (including username, password, and all other fields) and supports per-user command authorization logging. This meets the requirement for fully encrypted authentication traffic and detailed audit trails for each user's commands.

Answer

RADIUS with EAP-TLS

Answer

LDAP over SSL

Answer

Kerberos

Question 6

A technician is troubleshooting an issue where a wireless client can associate with an access point but cannot obtain an IP address via DHCP. The technician checks the DHCP server and sees no lease requests from the client's MAC address. Which of the following is the most likely cause?

Accepted Answer

The AP is not configured with a DHCP relay. The client can associate with the AP but cannot obtain an IP address, and the DHCP server shows no lease requests from the client's MAC. This indicates that DHCP discovery broadcasts are not reaching the DHCP server, which is common when the client and server are on different subnets and the AP (or a Layer 3 device) is not configured with a DHCP relay (ip helper-address). Without a relay, broadcast DHCP messages are dropped at the router, so the server never sees the request.

Answer

The client's wireless adapter is faulty

Answer

The client's SSID is incorrect

Answer

The AP's radio is operating on the wrong channel

Question 7

A network engineer is planning a wireless LAN for an open office with 50 users. To maximize performance by using multiple non-overlapping channels, which frequency band should be primarily used?

Accepted Answer

5 GHz. The 5 GHz band is the best choice for maximizing performance in an open office with 50 users because it offers up to 23 non-overlapping channels (using 20 MHz channels) compared to only 3 in the 2.4 GHz band. This allows for better channel reuse, reduced co-channel interference, and higher aggregate throughput in a dense user environment.

Answer

2.4 GHz

Answer

6 GHz

Answer

900 MHz

Question 8

A technician is troubleshooting a loss of network connectivity for a single workstation. The workstation has a valid IP address but cannot ping its default gateway. The link lights on both the workstation and the switch are solid. Which of the following should the technician check NEXT?

Accepted Answer

The switch port configuration, such as VLAN assignment. The workstation has a valid IP address and solid link lights, indicating Layer 1 (physical) and Layer 3 (IP configuration) are functional. The inability to ping the default gateway points to a Layer 2 issue, such as the switch port being in the wrong VLAN or having a misconfigured access/trunk setting. Checking the switch port configuration is the logical next step because VLAN mismatches prevent frames from reaching the gateway's subnet.

Answer

The cable integrity with a tester

Answer

The DNS server settings

Answer

The workstation's ARP cache

Question 9

Users on a VLAN report intermittent network disconnections lasting a few seconds. The network technician checks the switch and notices a high number of CRC errors on the port connecting to the core switch. The cable test passes. What is the most likely cause?

Accepted Answer

Duplex mismatch between the two switches. A duplex mismatch causes one side to send frames while the other is still transmitting, leading to collisions that are interpreted as CRC errors on the receiving interface. Since the cable test passes, the physical layer is fine, and the intermittent nature (lasting seconds) matches the symptom of a duplex mismatch where the half-duplex side backs off after collisions, causing brief outages.

Answer

STP reconvergence due to topology change

Answer

Broadcast storm caused by a loop

Answer

Faulty SFP transceiver on the core switch

Question 10

A network administrator is setting up a new branch office that will connect to the main headquarters over the Internet. The connection must be encrypted and allow the branch to access internal resources as if they were directly connected. Which of the following VPN types is BEST suited for this site-to-site connection?

Accepted Answer

IPsec. IPsec is the correct choice because it is specifically designed for site-to-site VPNs, providing encryption and authentication at the IP layer to create a secure tunnel between two networks. This allows the branch office to access internal resources at headquarters as if they were directly connected, using a gateway-to-gateway model that encrypts all traffic between the sites.

Answer

SSL VPN

Answer

PPTP

Answer

L2TP

Question 11

A network administrator wants to automate the backup of configuration files from multiple routers and switches. Which protocol is commonly used for this purpose and is supported by most network devices?

Accepted Answer

TFTP. TFTP (Trivial File Transfer Protocol) is the correct choice because it is a lightweight, connectionless UDP-based protocol (port 69) that is widely supported on network devices like routers and switches for automated configuration backups. Its simplicity and minimal overhead make it ideal for scripting backup operations, even though it lacks security features like authentication or encryption.

Answer

FTP

Answer

SFTP

Answer

HTTP

Question 12

A security analyst notices that the company's web server is receiving a high volume of TCP SYN packets from a single source IP address, but the server is not completing the three-way handshake. Which type of attack is most likely occurring?

Accepted Answer

A) SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets from a spoofed or single source IP without completing the handshake. The server allocates resources for each half-open connection, eventually exhausting its connection table and denying service to legitimate users. This matches the scenario where the server receives many SYN packets but never completes the handshake.

Answer

B) Smurf attack

Answer

C) Ping of death

Answer

D) ARP poisoning

Question 13

A company wants to deploy a wireless network for employee devices using the highest security standard. The network will use a RADIUS server for authentication. Which authentication method should be configured?

Accepted Answer

802.1X/EAP. B is correct because 802.1X/EAP is the only option that provides enterprise-grade authentication using a RADIUS server. It requires each user to present unique credentials (e.g., username/password or certificate), which are verified by the RADIUS server before granting network access. This meets the requirement for the highest security standard in a corporate environment.

Answer

WPA3-SAE

Answer

WPA2-PSK

Answer

WEP with RADIUS

Question 14

A client obtains an IP address from a DHCP server but cannot resolve hostnames. The client can ping the default gateway and external IP addresses successfully. What is the most likely cause?

Accepted Answer

DNS server misconfiguration. The client can ping external IP addresses and the default gateway, confirming that IP connectivity and routing are functional. However, the inability to resolve hostnames points directly to a DNS resolution failure, which occurs when the DNS server address is misconfigured or unreachable. Since DHCP provided the IP address, the DNS server setting is likely incorrect or missing in the DHCP scope.

Answer

Incorrect subnet mask

Answer

Default gateway not set

Answer

Firewall blocking DNS

Question 15

A network engineer needs to connect two buildings that are 200 meters apart with a 1 Gbps link. The path is outdoors and susceptible to lightning strikes. Which cable type is the most appropriate for this scenario?

Accepted Answer

Multimode fiber optic. Multimode fiber optic cable is the most appropriate choice because it supports 1 Gbps over distances up to 550 meters (using OM2/OM3 fiber) and is completely immune to electromagnetic interference (EMI) from lightning strikes. Unlike copper cabling, fiber uses light pulses for transmission, so it does not conduct electricity, making it ideal for outdoor runs between buildings where lightning is a risk.

Answer

Cat6a UTP

Answer

Cat5e UTP

Answer

Single-mode fiber optic