N10-009 Practice Test 2 — 10 Questions

Question 1

A network engineer has successfully established an IPsec site-to-site VPN tunnel between a branch office (10.0.1.0/24) and the main office (192.168.1.0/24). The tunnel status shows as active, and both sides can ping each other's tunnel interface IP addresses. However, users at the branch office cannot ping the main office server at 192.168.1.10, and the main office cannot ping the branch office server at 10.0.1.10. The firewall rules on both sides permit IPsec traffic and all internal traffic. What should the engineer check NEXT?

Accepted Answer

Verify routing entries on both routers to ensure the remote internal subnets are reachable via the tunnel.. The tunnel is active and both sides can ping each other's tunnel interface IPs, confirming that IPsec phase 1 and phase 2 are established and the tunnel itself is functional. However, users cannot reach the remote internal subnets (10.0.1.0/24 and 192.168.1.0/24), which indicates a routing problem: the routers likely lack routes for those remote subnets pointing to the tunnel interface. Without proper routing entries, traffic destined for the remote LAN is sent out the wrong interface or dropped, even though the tunnel is up.

Answer

Check the IPsec security associations for encryption algorithm mismatch.

Answer

Disable the firewall on the internal interfaces temporarily.

Answer

Regenerate the pre-shared key on both sides.

Question 2

A user reports slow network performance on their workstation. The technician checks the switch port and sees a high number of CRC errors. Which of the following is the MOST likely cause of this issue?

Accepted Answer

Duplex mismatch. CRC errors indicate data corruption at the data link layer, typically caused by collisions or electrical interference. A duplex mismatch occurs when one device operates at full duplex and the other at half duplex, leading to collisions on a full-duplex link that corrupt frames and generate CRC errors. This is the most common cause of CRC errors on a switch port.

Answer

A faulty cable

Answer

VLAN mismatch

Answer

Incorrect MTU setting

Question 3

Which of the following network protocols operates at the Transport layer of the OSI model and provides connection-oriented, reliable data delivery?

Accepted Answer

TCP. TCP (Transmission Control Protocol) operates at the Transport layer (Layer 4) of the OSI model and provides connection-oriented, reliable data delivery through mechanisms such as three-way handshake, sequence numbers, acknowledgments, and retransmission of lost segments. This ensures that data is delivered in order and without errors, making TCP the correct choice for the question.

Answer

UDP

Answer

IP

Answer

ARP

Question 4

A security engineer is configuring port security on a switch to prevent unauthorized devices from connecting. The requirement is that only the first device to connect to a port is allowed, and if a different device connects, the port should be disabled. Which port security violation mode should be configured?

Accepted Answer

Shutdown. The 'shutdown' violation mode disables the port entirely when a violation occurs, which meets the requirement that the port be disabled if a different device connects. This is the only mode that physically err-disables the port, preventing any further traffic until manually re-enabled.

Answer

Protect

Answer

Restrict

Answer

Sticky

Question 5

A user reports intermittent inability to access websites. When the issue occurs, the user can ping external IP addresses (e.g., 8.8.8.8) but cannot ping domain names like google.com. The user's IP configuration shows a DNS server address of 8.8.8.8. What is the most likely cause?

Accepted Answer

The DNS server is reachable but not responding due to high load.. The user can ping external IP addresses (e.g., 8.8.8.8) but cannot resolve domain names like google.com, which indicates that IP connectivity is working but DNS resolution is failing. Since the DNS server address is 8.8.8.8 and the user can ping it, the server is reachable; however, intermittent failures suggest the server is overwhelmed and dropping or not responding to queries. This matches the symptom of a reachable but unresponsive DNS server due to high load, where ICMP (ping) succeeds but UDP/53 DNS queries time out.

Answer

The default gateway is down.

Answer

The corporate firewall is blocking UDP port 53.

Answer

The user's machine has a corrupted DNS cache.

Question 6

Which of the following is a characteristic of a connectionless protocol at the transport layer?

Accepted Answer

It does not require a virtual circuit. Connectionless protocols at the transport layer, such as UDP (User Datagram Protocol), do not establish a virtual circuit or session before sending data. Each datagram is sent independently without prior coordination, making the protocol stateless and reducing overhead. This characteristic is fundamental to UDP's design, as defined in RFC 768.

Answer

It establishes a session before sending data

Answer

It guarantees delivery using acknowledgments

Answer

It retransmits lost segments

Question 7

Which of the following uniquely identifies a hardware network interface on a device?

Accepted Answer

MAC address. A MAC (Media Access Control) address is a hardware-embedded, globally unique identifier assigned to a network interface controller (NIC) by the manufacturer. It operates at Layer 2 (Data Link Layer) of the OSI model and is used for local network communication, ensuring that no two devices on the same broadcast domain have the same MAC address.

Answer

IP address

Answer

Subnet mask

Answer

Default gateway

Question 8

A company wants to allow inbound HTTPS traffic to a web server located in the DMZ from the Internet. The firewall has three interfaces: Inside (corporate network), Outside (Internet), and DMZ (web server). Which of the following firewall rules is required?

Accepted Answer

Allow traffic from Outside to DMZ on port 443. The correct rule is to allow traffic from the Outside (Internet) interface to the DMZ interface on TCP port 443 (HTTPS). This permits inbound web requests to reach the web server while keeping the corporate Inside network isolated. The firewall must explicitly permit this traffic because the default implicit deny rule would otherwise block all inbound connections from the Outside zone.

Answer

Allow traffic from DMZ to Outside on port 443

Answer

Allow traffic from Inside to DMZ on port 443

Answer

Allow traffic from Outside to Inside on port 443

Question 9

Which of the following network devices operates at Layer 1 of the OSI model and forwards all incoming electrical signals to all of its ports?

Accepted Answer

Hub. A hub operates at Layer 1 (Physical layer) of the OSI model and is a multiport repeater. It regenerates and forwards every incoming electrical signal out of all ports except the incoming port, regardless of the intended destination, because it has no intelligence to process MAC addresses or frames.

Answer

Router

Answer

Switch

Answer

Bridge

Question 10

A network administrator is configuring OSPF on routers in a multi-area network. The administrator wants to ensure that a router in area 1 does not learn external routes (Type 5 LSAs) injected by an ASBR in area 0, but it must still learn inter-area routes (Type 3 LSAs). The administrator wants to reduce the routing table size. Which OSPF area type should be configured for area 1?

Accepted Answer

Stub area. A stub area blocks Type 5 LSAs (external routes) from entering the area while still allowing Type 3 LSAs (inter-area routes). This meets the requirement of preventing external routes from the ASBR in area 0 from being learned by routers in area 1, while still permitting inter-area routing and reducing the routing table size.

Answer

Totally stubby area

Answer

Not-so-stubby-area (NSSA)

Answer

Normal area