N10-009 Practice Exam 1 — 20 Questions

Question 1

A network technician runs the command "traceroute 8.8.8.8" from a workstation. The output shows the first hop as the default gateway, the second hop as an internal router, and then a series of asterisks (* * *) before reaching the destination. What does the series of asterisks indicate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The intermediate routers are not responding to ICMP time-exceeded messages. The series of asterisks indicates that intermediate routers beyond the second hop are not responding with ICMP Time-Exceeded messages when the TTL expires. Traceroute relies on these ICMP responses to identify each hop; if a router is configured to drop ICMP or not send the message, the output shows asterisks for that hop. The destination is still reachable, as the final hop succeeds, so the asterisks do not indicate unreachability.

Answer

The destination is unreachable

Answer

The TTL expired at the last hop

Answer

The connection is encrypted

Question 2

A network engineer is designing a network and needs to ensure that broadcast traffic is contained within a single broadcast domain. Which of the following devices should be used to create these separate broadcast domains?

Accepted Answer

Router. A router operates at Layer 3 of the OSI model and does not forward broadcast frames by default, making it the correct device to segment a network into separate broadcast domains. Each interface on a router creates a distinct broadcast domain, ensuring that broadcast traffic is contained within that interface's subnet.

Answer

Hub

Answer

Bridge

Answer

Switch

Question 3

A network administrator is experiencing issues where unauthorized devices are offering IP addresses to clients, causing connectivity problems. Which security feature should be enabled on switches to prevent this?

Accepted Answer

DHCP Snooping. C is correct because DHCP Snooping is a security feature that filters untrusted DHCP messages on a per-port basis, preventing unauthorized DHCP servers from offering IP addresses to clients. By configuring trusted ports (typically uplinks to legitimate DHCP servers) and untrusted ports (access ports), the switch drops DHCPOFFER and DHCPACK messages received on untrusted ports, directly stopping rogue DHCP server attacks.

Answer

Dynamic ARP Inspection (DAI)

Answer

IP Source Guard

Answer

Port Security

Question 4

A company wants to prevent unauthorized devices from connecting to the corporate network. The policy requires that only specific MAC addresses are permitted on switch ports. Which security feature should be implemented on the switches?

Accepted Answer

MAC filtering / Port security. MAC filtering, also known as port security, is the correct feature because it allows the switch to restrict access to a port based on the source MAC address of incoming frames. By configuring a list of allowed MAC addresses, the switch will drop traffic from any unauthorized device, directly enforcing the policy that only specific MAC addresses are permitted on switch ports.

Answer

802.1X authentication

Answer

VLAN hopping prevention

Answer

DHCP snooping

Question 5

A network administrator is connecting two switches and wants to increase the bandwidth between them while also providing redundancy in case one link fails. Which technology should be configured on the switch ports?

Accepted Answer

Link Aggregation Control Protocol (LACP). Link Aggregation Control Protocol (LACP) allows multiple physical links between two switches to be combined into a single logical link, increasing aggregate bandwidth and providing redundancy: if one physical link fails, traffic continues over the remaining links. This directly meets the requirement for both higher bandwidth and link-level fault tolerance.

Answer

Spanning Tree Protocol (STP)

Answer

VLAN trunking (802.1Q)

Answer

Power over Ethernet (PoE)

Question 6

An organization uses OSPF as its interior gateway protocol in a multi-area design. After a core router failure, the network takes a long time to reconverge. Which technology can be implemented to improve convergence speed?

Accepted Answer

Implement Bidirectional Forwarding Detection (BFD). BFD provides sub-second failure detection by sending rapid, lightweight hello packets independently of OSPF's own hello mechanism. When a core router fails, BFD detects the link down in milliseconds and immediately signals OSPF to trigger reconvergence, drastically reducing the time OSPF would otherwise spend waiting for its own dead timer to expire.

Answer

Use static routes instead of OSPF

Answer

Increase OSPF hello and dead timers

Answer

Configure all routers in a single OSPF area

Question 7

A network administrator needs to connect two switches located in separate buildings 150 meters apart. The connection must support 10 Gbps speeds. Which cabling type is most appropriate?

Accepted Answer

Multi-mode fiber optic. Multi-mode fiber optic (MMF) is the most appropriate choice because it supports 10 Gbps speeds over distances up to 300 meters (using OM3 or OM4 fiber) with cost-effective transceivers (e.g., 10GBASE-SR). The 150-meter distance exceeds the 100-meter maximum for twisted-pair copper cabling (Cat6a or Cat7) at 10 Gbps, making fiber the only viable option among the choices.

Answer

Cat6a twisted pair

Answer

Cat7 twisted pair

Answer

Single-mode fiber optic

Question 8

A security analyst notices that a web server is receiving a large number of ICMP echo reply packets from many different external hosts. The server did not send any echo requests. Which type of attack is most likely occurring?

Accepted Answer

Smurf attack. A Smurf attack exploits IP broadcast addressing and ICMP. The attacker sends a large number of ICMP echo request packets with a spoofed source IP (the victim's IP) to a network's broadcast address. All hosts on that network then send ICMP echo reply packets to the victim, overwhelming it with traffic. Since the server never sent any echo requests, the unsolicited flood of echo replies is the hallmark of a Smurf attack.

Answer

Ping flood

Answer

ICMP tunneling

Answer

Fraggle attack

Question 9

A network administrator is preparing documentation for a new branch office. The administrator needs a diagram that shows the logical relationships between network devices and how VLANs are trunked over inter-switch links. Which type of document should be created?

Accepted Answer

Logical topology diagram. A logical topology diagram is the correct choice because it illustrates how devices communicate across the network, including VLAN assignments and trunk links (e.g., 802.1Q tagging) between switches. This diagram abstracts physical locations to show Layer 2 and Layer 3 relationships, such as which VLANs traverse which inter-switch links, making it ideal for documenting VLAN trunking and logical connectivity.

Answer

Network baseline

Answer

Wiring diagram

Answer

Physical topology diagram

Question 10

A network technician is configuring a small office network with two subnets: 10.0.1.0/24 and 10.0.2.0/24. Each subnet has its own switch, and both switches are connected to a router with interfaces 10.0.1.1 and 10.0.2.1. Hosts on subnet A can ping the router's interface in their subnet but cannot ping hosts on subnet B. Which of the following is the most likely cause?

Accepted Answer

IP routing is disabled on the router.. The hosts on subnet A can ping their default gateway (10.0.1.1) but cannot reach hosts on subnet B, which indicates that the router is not forwarding packets between the two directly connected subnets. This behavior is characteristic of a router with IP routing disabled, as the router will not perform inter-VLAN or inter-subnet forwarding unless the 'ip routing' command is enabled globally. Without IP routing, the router acts as a host and will only respond to traffic destined for its own interfaces, dropping any packets that require forwarding to another subnet.

Answer

The router is not configured with a routing protocol.

Answer

The hosts in subnet A have the wrong default gateway.

Answer

The switch in subnet A is blocking ICMP traffic.

Question 11

A network engineer is implementing OSPF on a router. All directly connected neighbors are listed with state FULL, but routes from another area are not appearing in the routing table. Which of the following is the most likely cause?

Accepted Answer

The router has an ACL blocking inbound OSPF updates. An ACL applied to the OSPF process or interface can filter inbound Type 3 LSAs (summary LSAs) from other areas. Even though neighbor adjacencies reach FULL state, the router will not install those inter-area routes into the routing table if the ACL blocks the LSA updates. This explains why directly connected neighbors are fine but routes from another area are missing.

Answer

The router is not configured with a router ID

Answer

The router is configured as an ABR but does not have a virtual-link configured

Answer

The link-state database is corrupted

Question 12

A company wants to increase the bandwidth between two switches without upgrading the existing 1 Gbps copper links. Both switches support 802.3ad. Which technology should be implemented?

Accepted Answer

Link aggregation (LACP). Link aggregation using LACP (802.3ad) allows multiple 1 Gbps copper links to be combined into a single logical link, increasing bandwidth between the two switches without upgrading the physical interfaces. Since both switches support 802.3ad, they can negotiate and manage the aggregated link dynamically, providing both increased throughput and link redundancy.

Answer

VLAN trunking

Answer

Port mirroring

Answer

StackWise

Question 13

Drag and drop the steps to configure a firewall rule allowing inbound HTTPS traffic to a web server into the correct order.

Accepted Answer

Define rule name & description, then specify protocol and port (TCP/443), then specify source and destination addresses, then set action to allow and apply the rule.. The correct sequence for configuring a firewall rule to allow inbound HTTPS traffic is to start with a descriptive rule name, then specify the protocol (TCP) and port (443) to identify the service, then define the source and destination IP addresses, and finally set the action to allow and apply the rule. This order follows logical firewall policy design: identification, service definition, addressing, and enforcement. Common mistakes include placing the protocol/port after addressing or delaying the rule name, which can lead to disorganized or incorrect firewall configurations.

Answer

Specify protocol and port (TCP/443), then define rule name & description, then specify source and destination addresses, then set action to allow and apply the rule.

Answer

Specify source and destination addresses, then specify protocol and port (TCP/443), then define rule name & description, then set action to allow and apply the rule.

Answer

Define rule name & description, then specify source and destination addresses, then specify protocol and port (TCP/443), then set action to allow and apply the rule.

Question 14

A security analyst notices that the DHCP server is responding to a large number of DHCP Discover messages from a single MAC address, but that client never sends a DHCP Request to complete the lease. This pattern repeats continuously. Which type of attack is most likely occurring?

Accepted Answer

DHCP starvation. The described behavior—a single MAC address sending continuous DHCP Discover messages without completing the lease with a DHCP Request—is the hallmark of a DHCP starvation attack. The attacker exhausts the DHCP server's IP address pool by claiming all available leases, preventing legitimate clients from obtaining IP addresses. This attack targets the DHCP protocol's four-step DORA (Discover, Offer, Request, Acknowledge) process by never completing the handshake.

Answer

ARP poisoning

Answer

DNS amplification

Answer

Rogue DHCP server

Question 15

Which of the following protocols is used to automatically assign IP addresses to devices on a network and also provides the subnet mask and default gateway?

Accepted Answer

DHCP. DHCP (Dynamic Host Configuration Protocol) is the correct answer because it is specifically designed to automatically assign IP addresses to devices on a network, along with essential configuration parameters such as the subnet mask and default gateway. When a DHCP client sends a discover message, the DHCP server responds with an offer that includes these details, allowing the client to fully participate in network communication without manual configuration.

Answer

DNS

Answer

ARP

Answer

ICMP

Question 16

A network administrator wants to collect performance data from network devices over time and receive alerts when thresholds are exceeded. Which protocol should be used?

Accepted Answer

SNMP. SNMP (Simple Network Management Protocol) is designed to collect performance data from network devices by polling MIB (Management Information Base) objects and can generate traps or inform requests to send alerts when thresholds are exceeded. This makes it the correct choice for proactive monitoring and threshold-based alerting.

Answer

syslog

Answer

NetFlow

Answer

ICMP

Question 17

A security engineer is configuring a site-to-site VPN between two branch offices. The requirement is to encrypt all traffic between the two networks using IPsec. Which IPsec mode should be used to encrypt the entire IP packet including the original header?

Accepted Answer

Tunnel mode. Tunnel mode is the correct choice because it encrypts the entire original IP packet, including the original header, and then encapsulates it within a new IP header. This is required for site-to-site VPNs where the original source and destination IP addresses must be hidden or protected, and the new header is used for routing between the two VPN gateways.

Answer

Transport mode

Answer

AH only

Answer

ESP only

Question 18

Which layer of the OSI model is responsible for logical addressing and routing of packets between networks?

Accepted Answer

Network layer. The Network layer (Layer 3) is responsible for logical addressing (e.g., IPv4/IPv6 addresses) and routing packets between different networks by determining the best path using routing protocols such as OSPF, BGP, or static routes. Unlike the Data Link layer, which handles physical addressing (MAC) within a single network segment, the Network layer enables end-to-end delivery across multiple hops.

Answer

Data Link layer

Answer

Transport layer

Answer

Application layer

Question 19

A network administrator reviews firewall logs and sees thousands of SYN packets coming from various source IP addresses to a single internal web server. No ACK or RST packets are observed from these sources. Which type of attack is most likely occurring?

Accepted Answer

SYN flood attack. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target server without completing the handshake (no ACK or RST). This exhausts the server's connection table resources, preventing legitimate connections. The observed pattern of many SYN packets from various sources with no subsequent ACK or RST is the hallmark of a SYN flood.

Answer

DNS amplification attack

Answer

ARP spoofing attack

Answer

Man-in-the-middle attack

Question 20

A new switch is installed in a remote wiring closet. It has been configured with a management IP address of 10.1.2.50/24. The switch is connected via a trunk to the distribution switch, and the management station (10.1.1.0/24) is on a different subnet. The switch cannot be pinged from the management station. The distribution switch has routing to the 10.1.2.0/24 subnet. What is the most likely cause?

Accepted Answer

The default gateway is not configured on the new switch.. The management station is on subnet 10.1.1.0/24, while the switch's management IP is 10.1.2.50/24. For the switch to reply to pings from a different subnet, it must have a default gateway configured so it knows where to send return traffic. Without a default gateway, the switch will only respond to traffic on its local subnet, making it unreachable from the management station.

Answer

The management VLAN is not allowed on the trunk.

Answer

The switch port to the distribution switch is in access mode.

Answer

The management IP is configured on the wrong VLAN.