N10-009 Practice Test 20 — 15 Questions

Question 1

A technician is troubleshooting a user's computer that cannot access any network resources. The technician runs ipconfig and sees an IP address of 169.254.18.33 with a subnet mask of 255.255.0.0. The computer is connected to a switch port configured for VLAN 10. The DHCP server is located in a different subnet (VLAN 200) and is reachable via a router. The technician confirms that the switch port is in the correct VLAN and that the cabling is good. Which of the following is the MOST likely cause of the issue?

Accepted Answer

The router does not have a DHCP relay (ip helper-address) configured. The 169.254.x.x address is an Automatic Private IP Addressing (APIPA) address, assigned when a DHCP client fails to receive a lease. Since the DHCP server is on VLAN 200 and the client is on VLAN 10, a DHCP relay (ip helper-address) must be configured on the router interface facing VLAN 10 to forward DHCP broadcast requests as unicast to the DHCP server. Without this relay, the DHCP server never receives the client's discover message, causing the client to self-assign an APIPA address.

Answer

The DHCP server is not authorized in Active Directory

Answer

The computer's NIC is faulty

Answer

The switch port is in the wrong VLAN

Question 2

At which layer of the OSI model does the conversion of data frames into electrical signals for transmission occur?

Accepted Answer

Layer 1 (Physical). Layer 1 (Physical) is responsible for the actual transmission of raw bits over a physical medium. This includes converting data frames received from Layer 2 into electrical signals (e.g., voltage levels on copper), light pulses (fiber optic), or radio waves (wireless). The Physical layer defines the hardware specifications, such as connectors, cable types, and signaling methods like Manchester encoding or NRZ.

Answer

Layer 2 (Data Link)

Answer

Layer 3 (Network)

Answer

Layer 4 (Transport)

Question 3

A network technician is configuring a small office network with two subnets: 10.0.1.0/24 and 10.0.2.0/24. Each subnet has its own switch, and both switches are connected to a router with interfaces 10.0.1.1 and 10.0.2.1. Hosts on subnet A can ping the router's interface in their subnet but cannot ping hosts on subnet B. Which of the following is the most likely cause?

Accepted Answer

IP routing is disabled on the router.. The hosts on subnet A can ping their default gateway (10.0.1.1) but cannot reach hosts on subnet B, which indicates that the router is not forwarding packets between the two directly connected subnets. This behavior is characteristic of a router with IP routing disabled, as the router will not perform inter-VLAN or inter-subnet forwarding unless the 'ip routing' command is enabled globally. Without IP routing, the router acts as a host and will only respond to traffic destined for its own interfaces, dropping any packets that require forwarding to another subnet.

Answer

The router is not configured with a routing protocol.

Answer

The hosts in subnet A have the wrong default gateway.

Answer

The switch in subnet A is blocking ICMP traffic.

Question 4

A user calls the help desk stating that they cannot access any network resources. The technician asks the user to run ipconfig and the output shows an IP address of 169.254.15.20 with a subnet mask of 255.255.0.0. Which of the following is the most likely cause?

Accepted Answer

The DHCP server is unreachable. The IP address 169.254.15.20 with a subnet mask of 255.255.0.0 is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when a DHCP client fails to receive a lease from a DHCP server. Since the user cannot access any network resources, the most likely cause is that the DHCP server is unreachable, preventing the client from obtaining a valid IP address, default gateway, and DNS server settings.

Answer

The DNS server is not responding

Answer

The default gateway is misconfigured

Answer

There is a duplicate IP address on the network

Question 5

A network technician is reviewing the OSI model to understand how data is encapsulated when a web request is sent from a client to a server. At which layer does the web browser's HTTP request data get encapsulated with a TCP segment header?

Accepted Answer

Transport layer. The Transport layer (Layer 4) is responsible for encapsulating application data with a TCP or UDP segment header. When a web browser sends an HTTP request, the HTTP data is passed down from the Application layer to the Transport layer, where the TCP segment header (including source/destination ports, sequence numbers, and checksum) is added. This encapsulation occurs at Layer 4, not at any higher layer.

Answer

Application layer

Answer

Presentation layer

Answer

Session layer

Question 6

A network operations center uses SNMP to monitor device health. An administrator needs to retrieve the current CPU utilization from a router. Which SNMP operation is most appropriate?

Accepted Answer

GET. The SNMP GET operation is used by an NMS (Network Management System) to actively request a specific variable from a managed device, such as the current CPU utilization from a router's OID. This is a poll-based retrieval, making it the correct choice for an administrator who needs to read a single value on demand.

Answer

SET

Answer

TRAP

Answer

INFORM

Question 7

A network monitoring tool uses SNMP to collect data from devices. What is the primary purpose of SNMP traps?

Accepted Answer

To enable devices to send unsolicited alerts to the management system. SNMP traps are unsolicited messages sent by an SNMP agent to the network management system (NMS) to immediately notify it of a significant event, such as a link failure or high CPU utilization. This push mechanism allows the NMS to react in real time without having to poll the device, reducing bandwidth and processing overhead. The correct answer is B because traps are specifically designed for asynchronous alerting, not for polling, encryption, or authentication.

Answer

To allow a manager to poll devices for current status

Answer

To encrypt SNMP communications

Answer

To provide authentication for SNMP messages

Question 8

A network technician is explaining the role of a network switch to a new employee. Which of the following best describes the primary function of a switch in a local area network?

Accepted Answer

It forwards data based on MAC addresses.. A network switch operates at Layer 2 of the OSI model and uses MAC addresses to make forwarding decisions. When a frame arrives, the switch examines the destination MAC address, looks it up in its MAC address table, and forwards the frame only to the port associated with that address, reducing collision domains and improving network efficiency.

Answer

It forwards data based on IP addresses.

Answer

It connects different networks and performs routing.

Answer

It amplifies and repeats the signal to all ports.

Question 9

A user reports that they can access the internet but cannot access the internal web server at 10.10.10.100. The technician can ping the server's IP from the router that serves as the user's default gateway. Which of the following is the MOST likely cause?

Accepted Answer

The server's default gateway is misconfigured. The user can reach the internet but not the internal web server at 10.10.10.100, while the technician can ping that server from the router (the default gateway). This indicates that the router has a valid route to the server's network and the server is reachable from the router's perspective. The most likely cause is that the server's default gateway is misconfigured: the server does not know how to send return traffic back to the user's subnet, so the TCP handshake fails (the SYN-ACK never reaches the user).

Answer

The user's workstation has a firewall blocking port 80

Answer

The router has a missing route to the server's network

Answer

The server's subnet mask is incorrect

Question 10

A network technician is troubleshooting a router that is not forwarding packets to a remote destination network. The routing table shows a valid route learned via OSPF. The technician can successfully ping the next-hop IP address from the router. However, packets to the destination network are not being forwarded. Which of the following is the MOST likely cause?

Accepted Answer

CEF (Cisco Express Forwarding) is disabled or has a corruption. When a router has a valid OSPF-learned route and can ping the next-hop IP but still fails to forward packets, the issue is often with the forwarding plane rather than the control plane. CEF (Cisco Express Forwarding) is the default hardware-based switching mechanism that handles packet forwarding; if it is disabled or its Forwarding Information Base (FIB) becomes corrupted, the router will not forward packets even though the routing table (RIB) is correct. Disabling CEF forces the router to use process switching, which can also cause forwarding failures if the process is not properly handling the traffic.

Answer

The OSPF neighbor relationship is in the EXSTART state

Answer

The outbound interface has been administratively shut down

Answer

There is an ACL blocking the return traffic

Question 11

A technician is troubleshooting an intermittent connectivity issue between two switches connected by a fiber optic cable. The link status shows up/down flapping. The technician checks the optical power levels and finds they are within acceptable range. Which of the following is the most likely cause?

Accepted Answer

Dirty fiber connectors. Intermittent link flapping with acceptable optical power levels strongly indicates a physical-layer issue that is not related to signal strength. Dirty fiber connectors cause intermittent signal degradation due to scattering and absorption of light, leading to CRC errors and link flaps even when average power appears normal. Cleaning the connectors is the standard first step in such scenarios.

Answer

Duplex mismatch

Answer

Speed mismatch

Answer

VLAN mismatch

Question 12

A switch port is configured as a trunk with native VLAN 99. When a frame tagged with VLAN 99 is received on the trunk, the switch displays an error. What is the most likely issue?

Accepted Answer

The remote switch is tagging frames on the native VLAN. The native VLAN is the VLAN that carries untagged traffic on an 802.1Q trunk. By design, frames belonging to the native VLAN should be sent untagged. When a switch receives a frame tagged with the native VLAN ID (VLAN 99), it indicates a mismatch in native VLAN configuration between the two ends of the trunk. The switch logs an error because it expects native VLAN frames to be untagged, but the remote switch is incorrectly tagging them.

Answer

The trunk is using 802.1Q encapsulation and the remote switch expects ISL

Answer

The remote switch is sending frames on VLAN 99 as untagged

Answer

The allowed VLAN list does not include VLAN 99

Question 13

A user reports that they cannot access a web server at 10.0.1.200. The user can ping the server's IP address but cannot open the web page. The web server is known to be running and accessible from other users on the same subnet. What is the most likely cause?

Accepted Answer

ACL blocking port 80 or 443. The user can ping the server (ICMP works) but cannot access the web page, which indicates Layer 3 connectivity is fine but the specific TCP ports (80 for HTTP or 443 for HTTPS) are being blocked. An ACL applied on the server, a switch, or a router between the user and the server is the most likely cause, as it would permit ICMP echo requests while denying HTTP/HTTPS traffic. Other users on the same subnet can access the server, ruling out server-side or subnet-wide issues.

Answer

Default gateway is misconfigured

Answer

DNS resolution failure

Answer

Duplicate IP address

Question 14

A network security analyst notices that a switch's CPU utilization is spiking and that the switch is flooding unicast frames to all ports. The analyst suspects a MAC address table overflow attack. Which of the following security features should be configured on the switch's access ports to mitigate this type of attack?

Accepted Answer

Port security. Port security mitigates MAC address table overflow attacks by limiting the number of MAC addresses that can be learned on an access port. When the configured limit is exceeded, the switch can take action (e.g., shutdown or restrict) to prevent an attacker from flooding the CAM table with fake source MAC addresses, which would otherwise cause the switch to fail open and flood unicast frames out all ports.

Answer

BPDU guard

Answer

DHCP snooping

Answer

Dynamic ARP Inspection (DAI)

Question 15

A security analyst is investigating a user's complaint that their wireless connection keeps disconnecting. The analyst uses a wireless scanning tool and discovers two access points broadcasting the same SSID 'CorpNet' with different BSSIDs. One is the legitimate company AP on channel 1, and the other is on channel 11 with a strong signal and security set to 'Open'. Which of the following attacks is most likely occurring?

Accepted Answer

Evil twin. The presence of two access points broadcasting the same SSID 'CorpNet' with different BSSIDs, where the second AP is on channel 11 with a strong signal and security set to 'Open', is characteristic of an evil twin attack. The attacker sets up a fraudulent AP with the same SSID as the legitimate network but without encryption, tricking users into connecting to it and exposing their credentials or traffic. This differs from a rogue AP, which typically mimics the corporate network but may not necessarily use an open security setting or a different channel to lure victims.

Answer

War driving

Answer

Rogue access point

Answer

Bluesnarfing