N10-009 Practice Test 2 — 10 Questions

Question 1

A network technician is configuring a small office network with two subnets: 10.0.1.0/24 and 10.0.2.0/24. Each subnet has its own switch, and both switches are connected to a router with interfaces 10.0.1.1 and 10.0.2.1. Hosts on subnet A can ping the router's interface in their subnet but cannot ping hosts on subnet B. Which of the following is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IP routing is disabled on the router.. The hosts on subnet A can ping their default gateway (10.0.1.1) but cannot reach hosts on subnet B, which indicates that the router is not forwarding packets between the two directly connected subnets. This behavior is characteristic of a router with IP routing disabled, as the router will not perform inter-VLAN or inter-subnet forwarding unless the 'ip routing' command is enabled globally. Without IP routing, the router acts as a host and will only respond to traffic destined for its own interfaces, dropping any packets that require forwarding to another subnet.

Answer

The router is not configured with a routing protocol.

Answer

The hosts in subnet A have the wrong default gateway.

Answer

The switch in subnet A is blocking ICMP traffic.

Question 2

A network engineer is implementing OSPF on a router. All directly connected neighbors are listed with state FULL, but routes from another area are not appearing in the routing table. Which of the following is the most likely cause?

Accepted Answer

The router has an ACL blocking inbound OSPF updates. An ACL applied to the OSPF process or interface can filter inbound Type 3 LSAs (summary LSAs) from other areas. Even though neighbor adjacencies reach FULL state, the router will not install those inter-area routes into the routing table if the ACL blocks the LSA updates. This explains why directly connected neighbors are fine but routes from another area are missing.

Answer

The router is not configured with a router ID

Answer

The router is configured as an ABR but does not have a virtual-link configured

Answer

The link-state database is corrupted

Question 3

A company wants to increase the bandwidth between two switches without upgrading the existing 1 Gbps copper links. Both switches support 802.3ad. Which technology should be implemented?

Accepted Answer

Link aggregation (LACP). Link aggregation using LACP (802.3ad) allows multiple 1 Gbps copper links to be combined into a single logical link, increasing bandwidth between the two switches without upgrading the physical interfaces. Since both switches support 802.3ad, they can negotiate and manage the aggregated link dynamically, providing both increased throughput and link redundancy.

Answer

VLAN trunking

Answer

Port mirroring

Answer

StackWise

Question 4

Drag and drop the steps to configure a firewall rule allowing inbound HTTPS traffic to a web server into the correct order.

Accepted Answer

Define rule name & description, then specify protocol and port (TCP/443), then specify source and destination addresses, then set action to allow and apply the rule.. The correct sequence for configuring a firewall rule to allow inbound HTTPS traffic is to start with a descriptive rule name, then specify the protocol (TCP) and port (443) to identify the service, then define the source and destination IP addresses, and finally set the action to allow and apply the rule. This order follows logical firewall policy design: identification, service definition, addressing, and enforcement. Common mistakes include placing the protocol/port after addressing or delaying the rule name, which can lead to disorganized or incorrect firewall configurations.

Answer

Specify protocol and port (TCP/443), then define rule name & description, then specify source and destination addresses, then set action to allow and apply the rule.

Answer

Specify source and destination addresses, then specify protocol and port (TCP/443), then define rule name & description, then set action to allow and apply the rule.

Answer

Define rule name & description, then specify source and destination addresses, then specify protocol and port (TCP/443), then set action to allow and apply the rule.

Question 5

An organization's security policy requires that all remote access VPN connections use two-factor authentication and that the VPN clients are compliant with the latest patch levels before gaining network access. Which technology combination provides these capabilities?

Accepted Answer

VPN with RADIUS authentication and posture assessment. RADIUS authentication can enforce two-factor authentication (e.g., via token or OTP), and posture assessment (often via Network Access Control or a VPN posture plugin) checks the client's patch level before granting network access. This combination directly satisfies the policy requirements for both multi-factor authentication and endpoint compliance verification.

Answer

SSL VPN with client certificate authentication

Answer

IPsec VPN using preshared keys

Answer

NAC integrated with a reverse proxy

Question 6

A network engineer is reviewing RFC 1918 address ranges to plan a private IP addressing scheme. Which of the following IP addresses falls within the private address space for Class A?

Accepted Answer

10.10.10.1. RFC 1918 defines the Class A private address range as 10.0.0.0/8, which includes all addresses from 10.0.0.0 to 10.255.255.255. 10.10.10.1 falls within this range, making it a valid private IP address for internal network use.

Answer

172.16.0.1

Answer

192.168.1.1

Answer

172.32.0.1

Question 7

A security engineer is configuring a site-to-site VPN between two branch offices. The requirement is to encrypt all traffic between the two networks using IPsec. Which IPsec mode should be used to encrypt the entire IP packet including the original header?

Accepted Answer

Tunnel mode. Tunnel mode is the correct choice because it encrypts the entire original IP packet, including the original header, and then encapsulates it within a new IP header. This is required for site-to-site VPNs where the original source and destination IP addresses must be hidden or protected, and the new header is used for routing between the two VPN gateways.

Answer

Transport mode

Answer

AH only

Answer

ESP only

Question 8

A network technician is analyzing a small office network topology. An 8-port switch has 7 workstations directly connected. The remaining switch port is connected to a 4-port hub, which has 4 workstations attached. All devices are configured on the same VLAN and IP subnet. How many collision domains and broadcast domains are present in this network?

Accepted Answer

8 collision domains, 1 broadcast domain. Switches create a separate collision domain per port, so the 8-port switch provides 8 collision domains. The hub connected to one switch port extends that single collision domain to all its attached devices, but does not create new ones. All devices are on the same VLAN and IP subnet, so there is only one broadcast domain. Therefore, the network has 8 collision domains and 1 broadcast domain.

Answer

11 collision domains, 1 broadcast domain

Answer

12 collision domains, 5 broadcast domains

Answer

8 collision domains, 5 broadcast domains

Question 9

A security analyst receives an alert that an internal user's workstation is sending a high volume of ARP requests for multiple IP addresses on the local subnet. The analyst suspects a man-in-the-middle attack. Which security mechanism is most effective at mitigating this type of attack on a switched network?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) is the correct answer because it validates ARP packets on a switched network, ensuring that only legitimate ARP replies are forwarded. In a man-in-the-middle attack, an attacker sends spoofed ARP replies to associate their MAC address with the IP address of a legitimate host. DAI intercepts all ARP packets and compares them against a trusted binding table (built by DHCP snooping), dropping any that are invalid, thus preventing ARP spoofing.

Answer

Port security

Answer

DHCP snooping

Answer

MAC address filtering

Question 10

A security auditor recommends implementing a solution that authenticates users and devices before granting network access, regardless of the physical port they connect to. Which technology should be deployed?

Accepted Answer

802.1X. 802.1X is the correct technology because it provides port-based network access control (PNAC) that authenticates users and devices before granting network access, regardless of the physical port they connect to. It uses the Extensible Authentication Protocol (EAP) over LAN (EAPoL) to communicate with a RADIUS server, ensuring that only authenticated endpoints are allowed on the network. This meets the auditor's requirement for authentication at the port level, independent of the switch port used.

Answer

Port security

Answer

VLAN hopping

Answer

DHCP snooping