N10-009 Practice Exam 2 — 20 Questions

Question 1

A security analyst receives an alert that an internal user's workstation is sending a high volume of ARP requests for multiple IP addresses on the local subnet. The analyst suspects a man-in-the-middle attack. Which security mechanism is most effective at mitigating this type of attack on a switched network?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) is the correct answer because it validates ARP packets on a switched network, ensuring that only legitimate ARP replies are forwarded. In a man-in-the-middle attack, an attacker sends spoofed ARP replies to associate their MAC address with the IP address of a legitimate host. DAI intercepts all ARP packets and compares them against a trusted binding table (built by DHCP snooping), dropping any that are invalid, thus preventing ARP spoofing.

Answer

Port security

Answer

DHCP snooping

Answer

MAC address filtering

Question 2

A user reports that they cannot access the internet. The technician tests connectivity: pinging the default gateway succeeds, but pinging a public IP address like 8.8.8.8 fails. Firewall logs show outbound ICMP to 8.8.8.8 is permitted. What is the most likely cause?

Accepted Answer

Missing default route on the router. The user can ping the default gateway (local connectivity) but cannot ping a public IP like 8.8.8.8. This indicates that the workstation has a valid route to its local subnet, but the router lacks a default route (0.0.0.0/0) to forward traffic to the internet. Firewall logs confirm outbound ICMP is permitted, so the issue is at Layer 3 routing, not filtering.

Answer

Incorrect DNS configuration on the workstation

Answer

Duplicate IP address on the local network

Answer

Proxy server configuration is required

Question 3

A network administrator is investigating reports of slow network performance. Which tool should the administrator use to capture and analyze individual packets to identify the cause of the latency?

Accepted Answer

Packet analyzer. A packet analyzer captures and decodes individual packets, allowing the administrator to inspect frame-level details, identify retransmissions, TCP window scaling issues, or application-layer delays that cause latency. This granularity is essential for pinpointing the exact cause of slow performance.

Answer

Throughput tester

Answer

Spectrum analyzer

Answer

NetFlow analyzer

Question 4

A security analyst is reviewing logs and finds that a single MAC address is rapidly requesting IP addresses from a DHCP server, each time with a different client ID. The DHCP server is exhausting its address pool. Which type of attack is occurring?

Accepted Answer

DHCP starvation attack. A DHCP starvation attack occurs when an attacker sends numerous DHCP discover messages, each with a unique client ID (chaddr), to exhaust the DHCP server's address pool. This prevents legitimate clients from obtaining IP addresses, as the server believes all leases are assigned. The rapid requests with different client IDs from a single MAC address are a hallmark of this attack.

Answer

MAC flooding attack

Answer

ARP spoofing

Answer

DNS poisoning

Question 5

A user reports that they cannot connect to a file server on the same subnet. The technician checks the workstation's IP configuration: IP 192.168.1.10, subnet mask 255.255.255.0, default gateway 192.168.1.1. The workstation can ping the gateway but cannot ping the file server at 192.168.1.50. Which of the following is the most likely cause?

Accepted Answer

The file server is powered off or disconnected from the network. The workstation can ping the gateway (192.168.1.1) but not the file server (192.168.1.50) on the same subnet. Since both are on the same subnet, the default gateway is not needed for local traffic. The inability to ping the server suggests the server itself is not responding. The most likely causes are that the server is powered off, its network cable is disconnected, or it has a failed network interface. A firewall blocking ICMP would also prevent ping, but the question specifies that the correct answer is the server being powered off or disconnected (option C). Therefore, the most likely cause is that the file server is powered off or has a disconnected cable.

Answer

Incorrect subnet mask on the workstation

Answer

Incorrect default gateway on the workstation

Answer

A firewall on the workstation is blocking traffic to the server

Question 6

A network administrator wants to ensure all network devices have synchronized time for accurate log correlation and security event analysis. Which protocol should be implemented?

Accepted Answer

NTP. NTP (Network Time Protocol) is the correct choice because it is specifically designed to synchronize clocks across network devices using a hierarchical system of time sources, ensuring millisecond-level accuracy. Accurate time synchronization is critical for correlating logs and security events across multiple devices, as timestamps must match to reconstruct attack timelines or diagnose faults.

Answer

SNMP

Answer

FTP

Answer

HTTP

Question 7

A switch is connected to a network printer. The switch port is manually configured for 100 Mbps and full duplex. The printer is configured for auto-negotiation. The link is up, but there are many FCS errors on the switch port. What is the most likely cause?

Accepted Answer

Duplex mismatch. The most likely cause is a duplex mismatch. The switch port is manually set to full duplex, while the printer is using auto-negotiation. When one side is manually configured and the other is set to auto-negotiation, the auto-negotiating side fails to detect the manual setting and defaults to half duplex. This mismatch causes collisions and frame check sequence (FCS) errors on the full-duplex side, as the half-duplex side does not properly handle simultaneous transmission.

Answer

Bad Ethernet cable

Answer

Speed mismatch

Answer

Printer driver issues

Question 8

Which of the following uniquely identifies a hardware network interface on a device?

Accepted Answer

MAC address. A MAC (Media Access Control) address is a hardware-embedded, globally unique identifier assigned to a network interface controller (NIC) by the manufacturer. It operates at Layer 2 (Data Link Layer) of the OSI model and is used for local network communication, ensuring that no two devices on the same broadcast domain have the same MAC address.

Answer

IP address

Answer

Subnet mask

Answer

Default gateway

Question 9

A network administrator has configured a switch with four VLANs: VLAN 10, 20, 30, and 99 (native). The switch is connected to a router via an 802.1Q trunk link. The router has subinterfaces for VLANs 10, 20, and 30, each with an IP address. VLAN 99 is used for management and does not have a router subinterface. How many Layer 3 broadcast domains exist in this network?

Accepted Answer

3. A Layer 3 broadcast domain corresponds to a routed IP subnet. Without a router subinterface, VLAN 99 has no Layer 3 termination, so only VLANs 10, 20, and 30 (with subinterfaces) form separate broadcast domains. Thus, there are 3 Layer 3 broadcast domains.

Answer

1

Answer

2

Answer

4

Question 10

Which of the following is a characteristic of UDP?

Accepted Answer

Has lower overhead than TCP. UDP (User Datagram Protocol) is a connectionless transport-layer protocol that provides minimal overhead compared to TCP. It does not establish a connection before sending data, nor does it provide reliability, flow control, or error recovery, making it ideal for real-time applications like VoIP and streaming where speed is prioritized over guaranteed delivery.

Answer

Provides guaranteed delivery

Answer

Uses sequence numbers

Answer

Supports three-way handshake

Question 11

A network engineer is troubleshooting connectivity issues between two data center switches that are configured to support jumbo frames with an MTU of 9000. The link is a 10 Gigabit Ethernet fiber connection. Large file transfers fail, but small transfers succeed. What is the most likely cause?

Accepted Answer

C. The most likely cause is that an intermediate device (such as a router or another switch) along the Layer 2 path is not configured for jumbo frames and has a standard MTU of 1500. Since both end switches support an MTU of 9000, large frames are sent but are dropped when they reach the intermediate device that cannot handle them. Small frames (≤1500 bytes) pass through successfully because they fit within the standard MTU.

Answer

A

Answer

B

Answer

D

Question 12

A network administrator is configuring a new switch to carry traffic for multiple VLANs on a single link to a router. Which IEEE standard is used for VLAN tagging on Ethernet trunks?

Accepted Answer

802.1Q. 802.1Q is the IEEE standard that defines VLAN tagging on Ethernet trunks, inserting a 4-byte tag into the Ethernet frame to identify VLAN membership. This allows multiple VLANs to traverse a single link between a switch and a router, enabling inter-VLAN routing without separate physical interfaces.

Answer

802.3af

Answer

802.1D

Answer

802.11ac

Question 13

A user can access a website by its IP address (e.g., 203.0.113.5) but cannot access it by its domain name (example.com). Other users on the same subnet can access the website by domain name. Which of the following should the technician check FIRST?

Accepted Answer

Check the local hosts file. The issue is isolated to a single user who can reach the website by IP but not by domain name, while other users on the same subnet have no problem. This indicates a client-side DNS resolution problem. The first thing to check is the local hosts file (e.g., C:\Windows\System32\drivers\etc\hosts) for any incorrect or outdated entries that might be overriding DNS resolution. If the hosts file has an incorrect mapping for example.com, the browser will use that instead of querying the DNS server, causing the failure. Checking DNS server configuration is appropriate if the hosts file is clean.

Answer

Check the DNS server configuration on the network

Answer

Check the website's DNS records

Answer

Check the user's browser proxy settings

Question 14

A network engineer wants to segment a LAN into multiple broadcast domains without purchasing additional hardware. Which of the following technologies should be implemented?

Accepted Answer

VLANs. VLANs (Virtual Local Area Networks) allow a network engineer to logically segment a single physical LAN switch into multiple isolated broadcast domains without purchasing additional hardware. By assigning switch ports to different VLAN IDs, broadcast traffic is confined to ports within the same VLAN, effectively creating separate Layer 2 networks on the same switch infrastructure.

Answer

Subnetting

Answer

VPN

Answer

NAT

Question 15

A network engineer is reviewing RFC 1918 address ranges to plan a private IP addressing scheme. Which of the following IP addresses falls within the private address space for Class A?

Accepted Answer

10.10.10.1. RFC 1918 defines the Class A private address range as 10.0.0.0/8, which includes all addresses from 10.0.0.0 to 10.255.255.255. 10.10.10.1 falls within this range, making it a valid private IP address for internal network use.

Answer

172.16.0.1

Answer

192.168.1.1

Answer

172.32.0.1

Question 16

A network administrator needs to ensure high availability for a critical server that has two network interfaces connected to two different switches. Which configuration should be implemented to provide failover and load balancing at the network layer?

Accepted Answer

Link aggregation (LACP). Link Aggregation (LACP) allows multiple physical network interfaces to be combined into a single logical link, providing both failover and load balancing at Layer 2. In this scenario, the server's two NICs are connected to two different switches; LACP can be configured across the two switches (if they support Multi-chassis Link Aggregation) or the NICs can be set up in an active/standby team for failover. This satisfies the requirement for high availability and load balancing at the network layer (Layer 2/3 boundary). Virtual IP protocols like VRRP/HSRP are designed for gateway redundancy, not for server NIC failover.

Answer

Virtual IP (VRRP/HSRP)

Answer

Spanning Tree Protocol (STP)

Answer

Port mirroring

Question 17

A switch port is configured as a trunk with native VLAN 99. When a frame tagged with VLAN 99 is received on the trunk, the switch displays an error. What is the most likely issue?

Accepted Answer

The remote switch is tagging frames on the native VLAN. The native VLAN is the VLAN that carries untagged traffic on an 802.1Q trunk. By design, frames belonging to the native VLAN should be sent untagged. When a switch receives a frame tagged with the native VLAN ID (VLAN 99), it indicates a mismatch in native VLAN configuration between the two ends of the trunk. The switch logs an error because it expects native VLAN frames to be untagged, but the remote switch is incorrectly tagging them.

Answer

The trunk is using 802.1Q encapsulation and the remote switch expects ISL

Answer

The remote switch is sending frames on VLAN 99 as untagged

Answer

The allowed VLAN list does not include VLAN 99

Question 18

A network administrator has just connected a new access switch to the core switch via a trunk port. The administrator configured the trunk port on both switches with the same allowed VLAN list. However, hosts on VLAN 10 connected to the new access switch cannot communicate with hosts on VLAN 10 on the core switch. The trunk is operational and shows up/up. What is the most likely cause?

Accepted Answer

A) VLAN 10 has not been created on the new access switch. The most likely cause is that VLAN 10 has not been created on the new access switch. Even though the trunk port is up/up and the allowed VLAN list matches, a switch will not forward traffic for a VLAN that does not exist in its local VLAN database. Without the VLAN being created, the switch drops all frames tagged with VLAN 10, preventing communication between hosts on that VLAN across the trunk.

Answer

B) Native VLAN mismatch on the trunk

Answer

C) Trunk encapsulation mismatch (ISL vs 802.1Q)

Answer

D) STP is blocking the VLAN 10 traffic on the trunk

Question 19

A network administrator is preparing to upgrade the firmware on a critical router. Which document should the administrator consult to understand the steps required to minimize downtime and ensure a successful upgrade?

Accepted Answer

Change management plan. The change management plan documents the approved procedures, rollback steps, and communication protocols for performing maintenance on critical infrastructure. Consulting this plan ensures the administrator follows the organization's predefined steps to minimize downtime and mitigate risks during the firmware upgrade.

Answer

SLA

Answer

Network diagram

Answer

Baseline performance report

Question 20

After replacing a faulty network cable, a user reports that they can access local resources but not the internet. The technician verifies that the user's IP address is 192.168.1.100 with a subnet mask of 255.255.255.0 and a default gateway of 192.168.1.1. The technician can ping the default gateway successfully. Which of the following should the technician check NEXT?

Accepted Answer

A) DNS configuration. The user can access local resources and successfully ping the default gateway, which confirms that Layer 2 and Layer 3 connectivity to the local network is working. The inability to access the internet while local access works points to a name resolution failure, as the browser relies on DNS to translate domain names to IP addresses. Checking DNS configuration is the logical next step because a misconfigured or missing DNS server would prevent internet access even when IP connectivity is intact.

Answer

B) DHCP server

Answer

C) Router's firewall ACLs

Answer

D) Switch port VLAN assignment