N10-009 Practice Test 19 — 15 Questions

Question 1

A network administrator wants to be notified immediately when any interface on a core router goes down. The administrator has already configured SNMP community strings on the router. What additional configuration is necessary to receive these notifications?

Accepted Answer

Configure an SNMP trap receiver on the NMS and set the router to send traps to that receiver.. SNMP traps are unsolicited notifications sent from a managed device (the router) to a Network Management System (NMS) when a specific event occurs, such as an interface going down. Since the administrator already configured SNMP community strings (which provide authentication for SNMP messages), the missing piece is configuring the router to send traps to a specific trap receiver (the NMS) and ensuring the NMS is set up to listen for those traps. Without this trap receiver configuration, the router will not generate or forward the event-driven alerts.

Answer

Enable SNMP polling from the NMS at regular intervals.

Answer

Set up syslog to forward log messages to a centralized server.

Answer

Configure an access control list to allow the NMS to poll the router.

Question 2

A network administrator wants to ensure that only a specific laptop can connect to a particular switch port. The laptop's MAC address is known. Which security feature should be configured?

Accepted Answer

Port security. Port security is the correct feature because it allows the administrator to statically configure the allowed MAC address on a specific switch port. Once configured, the switch will only forward traffic from that MAC address, dropping frames from any other source MAC. This directly fulfills the requirement to restrict access to a single known laptop.

Answer

802.1X

Answer

DHCP snooping

Answer

BPDU guard

Question 3

A network technician is troubleshooting connectivity between two branch offices connected by a site-to-site VPN. The VPN tunnel shows as active and up. Users at Branch A can ping the VPN gateway IP at Branch B successfully, but they cannot access any servers behind the firewall at Branch B. The firewall at Branch B is stateful and its logs show that traffic from Branch A is being dropped. What is the most likely cause?

Accepted Answer

Asymmetric routing causing the stateful firewall to drop return traffic. The VPN tunnel is active and Branch A can ping the VPN gateway IP at Branch B, confirming that the tunnel itself and Layer 3 connectivity are functional. However, a stateful firewall tracks connection states based on source/destination IP and port; if traffic from Branch A enters the firewall on one interface but return traffic exits via a different path (asymmetric routing), the firewall sees the return packets as not belonging to any established session and drops them. This matches the log showing traffic being dropped despite the tunnel being up.

Answer

Mismatched encryption algorithms

Answer

Incorrect DNS configuration

Answer

MTU mismatch causing fragmentation issues

Question 4

A network architect is implementing a Software-Defined Networking (SDN) solution. The SDN controller needs to communicate with the physical switches to install flow rules. Which type of API is used for this communication?

Accepted Answer

Southbound API. The Southbound API is the correct interface because it enables the SDN controller to communicate with the underlying physical or virtual network devices (switches, routers) to install flow rules, modify forwarding tables, and gather telemetry. This API typically uses protocols such as OpenFlow, NETCONF, or OVSDB to translate controller decisions into device-level actions, making it the essential southbound channel in an SDN architecture.

Answer

Northbound API

Answer

Eastbound API

Answer

Westbound API

Question 5

A network administrator wants to evaluate the current bandwidth utilization on a core switch to determine if an upgrade is needed. The administrator needs to understand typical usage patterns. Which of the following should the administrator perform first?

Accepted Answer

Collect performance data over a period of time.. To evaluate bandwidth utilization and determine if an upgrade is needed, the administrator must first establish a baseline of typical usage patterns. This is done by collecting performance data over a period of time (e.g., using SNMP to poll interface counters or NetFlow/sFlow to capture traffic flows) to identify peak loads, average utilization, and trends. Without this historical data, any decision to upgrade or implement QoS would be based on guesswork rather than evidence.

Answer

Implement QoS policies to prioritize traffic.

Answer

Upgrade the switch to a higher capacity model.

Answer

Enable SNMP traps for link down events.

Question 6

A network switch that forwards frames based on MAC addresses operates at which layer of the OSI model?

Accepted Answer

Data Link. A network switch that forwards frames based on MAC addresses operates at Layer 2, the Data Link layer. This layer is responsible for node-to-node data transfer and error detection using MAC addresses, as defined by IEEE 802 standards. Switches build a MAC address table by learning source MAC addresses from incoming frames and use this table to make forwarding decisions.

Answer

Physical

Answer

Network

Answer

Transport

Question 7

A security analyst detects that an attacker is sending forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. What is this attack called?

Accepted Answer

ARP poisoning. ARP poisoning (also known as ARP spoofing) is the correct answer because the attacker sends forged ARP replies to associate their MAC address with the IP address of the default gateway. This causes the victim's switch to update its ARP cache with the attacker's MAC for the gateway's IP, enabling man-in-the-middle attacks where the attacker intercepts traffic destined for the gateway.

Answer

MAC flooding

Answer

DHCP snooping

Answer

DNS spoofing

Question 8

A technician connects a user's workstation to a switch port. The cable passes a physical test, and the switch port LED is green, but the workstation cannot establish a network connection. What is the most likely cause?

Accepted Answer

Duplex mismatch between the workstation and the switch. A duplex mismatch occurs when one side of a link is set to full-duplex and the other to half-duplex, often due to a failed autonegotiation. Even though the cable passes a physical test and the switch port LED is green (indicating link at Layer 1), the mismatch causes excessive collisions and frame errors at Layer 2, preventing successful network communication. The workstation cannot establish a connection because the switch and NIC are not coordinating their transmission/reception timing correctly.

Answer

Incorrect VLAN assignment on the switch port

Answer

The workstation has a static IP address in the wrong subnet

Answer

A faulty cable

Question 9

A network technician is troubleshooting a switch port that shows a link light but has a high number of CRC errors in the interface statistics. The port is connected to a workstation's network interface card (NIC). Both devices are set to autonegotiate. What is the MOST likely cause of the CRC errors?

Accepted Answer

A: Duplex mismatch between the switch port and the workstation NIC. CRC errors indicate that frames received by the switch have failed the Ethernet frame check sequence (FCS) validation, meaning the data was corrupted during transmission. When both devices are set to autonegotiate but one fails to correctly negotiate the duplex setting, a duplex mismatch occurs: one side operates at full duplex while the other operates at half duplex. This causes collisions on the half-duplex side, which corrupts frames and generates CRC errors, while the full-duplex side does not detect collisions and retransmits, leading to a high error count.

Answer

B: VLAN mismatch between the switch and the workstation

Answer

C: Incorrect MTU setting on the switch port

Answer

D: Broadcast storm from a loop in the network

Question 10

A network technician is troubleshooting intermittent internet access for a single user. The user’s workstation can ping the default gateway consistently, but web pages fail to load intermittently. Which of the following should the technician check NEXT?

Accepted Answer

A) DNS server configuration. The user can ping the default gateway consistently, indicating Layer 3 connectivity to the local network is intact. However, intermittent web page failures suggest a name resolution issue, as DNS translates domain names to IP addresses. If the DNS server is misconfigured, unreachable, or returning stale records, the browser will fail to load pages even though basic IP connectivity works. Checking DNS server configuration is the logical next step because it directly addresses the symptom of name resolution failures.

Answer

B) DHCP lease time

Answer

C) Switch port speed and duplex settings

Answer

D) Firewall rules blocking ICMP

Question 11

A network security analyst notices high CPU utilization on the core switch and detects a large volume of ARP replies from a single IP address that claims to be the default gateway for all local subnets. Which type of attack is MOST likely occurring?

Accepted Answer

ARP poisoning. The attack described is ARP poisoning (also known as ARP spoofing), where an attacker sends forged ARP replies to associate their MAC address with the IP address of the default gateway. This causes all traffic destined for other subnets to be redirected to the attacker's machine, leading to high CPU utilization on the switch as it processes the flood of ARP packets and forwards the intercepted traffic.

Answer

DHCP starvation

Answer

MAC flooding

Answer

DNS amplification

Question 12

A network technician is explaining the process of resolving Layer 2 addresses to Layer 3 addresses on a local network. Which protocol is used by a host to determine the MAC address of another host given its IP address?

Accepted Answer

ARP. ARP (Address Resolution Protocol) is the correct answer because it is specifically designed to resolve a known Layer 3 (IP) address to an unknown Layer 2 (MAC) address on a local network. When a host needs to send a frame to another host, it first checks its ARP cache; if no entry exists, it broadcasts an ARP request containing the target IP, and the host with that IP responds with its MAC address. This process is defined in RFC 826 and operates at the data link layer, enabling direct communication within the same broadcast domain.

Answer

DNS

Answer

DHCP

Answer

ICMP

Question 13

A security analyst needs to deploy a device that can perform deep packet inspection and block specific application-layer attacks in real time. Which of the following devices is MOST appropriate for this purpose?

Accepted Answer

Intrusion Prevention System (IPS). An Intrusion Prevention System (IPS) is designed to inspect traffic in real time, perform deep packet inspection (DPI) up to Layer 7, and automatically block malicious traffic, including application-layer attacks such as SQL injection or cross-site scripting. Unlike a passive IDS, an IPS sits inline and can drop or reset sessions based on signature or anomaly detection, making it the most appropriate device for this requirement.

Answer

Stateful firewall

Answer

Proxy server

Answer

VPN concentrator

Question 14

A technician is troubleshooting a user's inability to access the internet. The user can successfully ping the default gateway and internal servers, but cannot ping a public IP address such as 8.8.8.8. The technician checks the firewall logs and confirms that outbound ICMP traffic to 8.8.8.8 is permitted. Which of the following is the most likely cause of the issue?

Accepted Answer

Missing default route on the router. The user can ping the default gateway and internal servers, which confirms that Layer 2 and Layer 3 connectivity within the local network is working. However, the inability to ping a public IP (8.8.8.8) indicates that traffic is not being forwarded beyond the local subnet. A missing default route on the router means the router does not know where to send packets destined for external networks, so it drops them. Since outbound ICMP is permitted on the firewall, the issue is routing, not filtering.

Answer

Incorrect DNS server configuration on the workstation

Answer

Incorrect subnet mask on the workstation

Answer

Malware on the workstation is blocking ICMP traffic

Question 15

A small office has multiple devices that need internet access but the ISP provides only a single public IPv4 address. Which network address translation (NAT) technique is most appropriate to allow all internal hosts to share that one public address?

Accepted Answer

PAT (Port Address Translation). PAT (Port Address Translation), also known as NAT overload, is the correct choice because it allows multiple internal hosts to share a single public IPv4 address by mapping each unique internal IP:port combination to a different source port on the public address. This is the only NAT technique that provides many-to-one address translation, which is exactly what a small office with more devices than public IPs requires.

Answer

Static NAT

Answer

Dynamic NAT

Answer

IP masquerading