N10-009 Practice Exam 3 — 20 Questions

Question 1

A network engineer plans to change the routing protocol configuration on a core router that will affect all branch connectivity. According to change management best practices, which step should the engineer perform BEFORE implementing the change?

Accepted Answer

Create a detailed rollback plan. Creating a detailed rollback plan is a fundamental change management best practice because it ensures that if the routing protocol reconfiguration (e.g., switching from EIGRP to OSPF or modifying redistribution) causes connectivity loss to all branches, the engineer can revert to the previous configuration quickly and safely. Without a rollback plan, a failed change could result in prolonged network downtime while troubleshooting from scratch, violating the principle of minimizing business impact. This step is performed before implementation to predefine the exact commands or backup configuration needed to restore the original routing state.

Answer

Implement the change during business hours to ensure staff availability

Answer

Notify all users after the change is complete

Answer

Test the change directly on the production router

Question 2

A network administrator notices that log timestamps from different switches are inconsistent, making correlation of events difficult. Which protocol should be implemented to ensure all devices have the same time?

Accepted Answer

NTP. NTP (Network Time Protocol) is the standard protocol used to synchronize clocks across network devices. By configuring all switches to use the same NTP server, timestamps in logs become consistent, enabling accurate correlation of events across the network.

Answer

SNMP

Answer

SMTP

Answer

RIP

Question 3

A network administrator wants to configure routers to send syslog messages only for events of severity 'error' (3) or higher (more severe). Which severity level should be set as the trap level?

Accepted Answer

3 (errors). Option B is correct because setting the trap level to 3 (errors) instructs the router to send syslog messages for severity 3 and all numerically lower (more severe) levels (0, 1, 2, 3). This matches the requirement to capture events of severity 'error' (3) or higher severity.

Answer

0 (emergencies)

Answer

2 (critical)

Answer

4 (warnings)

Question 4

A network administrator needs to monitor bandwidth utilization on a router interface in real time. Which of the following protocols is best suited for this purpose?

Accepted Answer

SNMP polling. SNMP polling is the best choice for real-time bandwidth monitoring because it allows the network management system (NMS) to actively query the router's interface MIB (e.g., ifInOctets, ifOutOctets) at short intervals, calculating utilization from the delta between successive polls. This provides near-real-time data without waiting for unsolicited events, making it ideal for live dashboards and threshold alerts.

Answer

Syslog

Answer

NetFlow

Answer

CDP

Question 5

A network security analyst notices that the firewall is logging traffic on the external interface that has a source IP address of 10.0.1.5, which is within the internal network range. This is most likely the result of which type of attack?

Accepted Answer

IP spoofing. The firewall is logging traffic on its external interface with a source IP address from the internal RFC 1918 range (10.0.1.5). This indicates the source IP has been forged, because private IP addresses should never appear as source addresses on a public-facing interface. This is the classic signature of an IP spoofing attack, where the attacker modifies the source IP in the packet header to impersonate an internal host.

Answer

DNS poisoning

Answer

ARP poisoning

Answer

VLAN hopping

Question 6

A network administrator needs to create a subnet that supports exactly 50 hosts. Which subnet mask provides the smallest subnet that meets this requirement?

Accepted Answer

B. Option B is correct because a /26 subnet mask (255.255.255.192) provides 62 usable host addresses (2^(32-26) - 2 = 64 - 2 = 62), which is the smallest subnet that supports at least 50 hosts. A /27 would only provide 30 usable addresses, which is insufficient.

Answer

A

Answer

C

Answer

D

Question 7

A network administrator needs to document the network for auditing purposes. Which type of documentation provides the most detailed information about the physical connections between devices, including cable types and patch panel ports?

Accepted Answer

Wiring schematic. A wiring schematic provides the most detailed information about physical connections, including cable types, patch panel ports, and exact pin-to-pin wiring. This level of detail is essential for auditing physical infrastructure, as it documents the actual cabling plant rather than logical or high-level connectivity.

Answer

Logical diagram

Answer

Network topology map

Answer

Asset management database

Question 8

A network administrator wants to collect and analyze logs from multiple network devices in a central location. Which of the following protocols should be used?

Accepted Answer

Syslog. Syslog is the correct protocol because it is specifically designed for centralized log collection and analysis from network devices. It uses UDP port 514 (or TCP 6514 for reliable delivery) to send event messages from routers, switches, and firewalls to a central syslog server, enabling administrators to aggregate and review logs for troubleshooting and security monitoring.

Answer

SNMP

Answer

SMTP

Answer

FTP

Question 9

A network security administrator is configuring authentication for network devices and wants to use a protocol that supports separate encryption of the entire authentication packet. Which of the following protocols is designed to encrypt the entire authentication packet and is commonly used with AAA services?

Accepted Answer

TACACS+. TACACS+ is the correct answer because it encrypts the entire authentication packet, including the username, password, and all other fields, using a shared secret key. This full-packet encryption is a key differentiator from RADIUS, which only encrypts the password field. TACACS+ is commonly used with AAA services to provide separate authentication, authorization, and accounting processes.

Answer

RADIUS

Answer

LDAP

Answer

Kerberos

Question 10

A security analyst discovers that an attacker is sending large numbers of incomplete TCP connection requests to a server, causing the server to run out of resources and stop responding to legitimate requests. Which type of attack is this, and which mitigation should be implemented?

Accepted Answer

SYN flood; enable TCP intercept or SYN cookies. This is a SYN flood attack, where the attacker sends a high volume of TCP SYN packets without completing the three-way handshake, exhausting the server's connection queue. Enabling TCP intercept (on Cisco devices) or SYN cookies (RFC 4987) allows the server to validate handshakes before allocating resources, mitigating the attack.

Answer

Ping flood; implement rate limiting

Answer

Smurf attack; disable IP-directed broadcasts

Answer

ARP poisoning; enable dynamic ARP inspection

Question 11

A network engineer is configuring IPv6 on a router interface. Which of the following is a valid global unicast IPv6 address?

Accepted Answer

2001:db8::1. 2001:db8::1 is a valid global unicast IPv6 address because it falls within the 2000::/3 range defined by RFC 4291 for global unicast addresses. The address is routable on the public internet, making it suitable for global communication.

Answer

fe80::1

Answer

ff02::1

Answer

::1

Question 12

A network technician is assigned a subnet mask of 255.255.255.248. How many usable host addresses are available in this subnet?

Accepted Answer

A) 6. The subnet mask 255.255.255.248 corresponds to a /29 prefix length, which provides 2^(32-29) = 8 total addresses. Subtracting the network address and broadcast address leaves 8 - 2 = 6 usable host addresses.

Answer

B) 8

Answer

C) 14

Answer

D) 30

Question 13

A router receives a packet destined for 10.0.0.15. It has the following routes in the routing table: 10.0.0.0/8 via 192.168.1.1, 10.0.0.0/16 via 192.168.2.1, 0.0.0.0/0 via 192.168.3.1. Which route will be used?

Accepted Answer

10.0.0.0/16 via 192.168.2.1. The router will use the route 10.0.0.0/16 via 192.168.2.1 because it has the longest prefix match (16 bits) for the destination 10.0.0.15. The /16 route is more specific than the /8 route and the default route, so it is preferred regardless of administrative distance or metric.

Answer

Default route (0.0.0.0/0)

Answer

10.0.0.0/8 via 192.168.1.1

Answer

None; the packet is dropped

Question 14

A network technician is troubleshooting an intermittent connectivity issue between two switches connected via fiber optic cable. The link status shows up/down flapping. The technician checks the optical power levels and finds they are within acceptable range. Which of the following is the most likely cause?

Accepted Answer

Dirty fiber connectors. Dirty fiber connectors cause intermittent connectivity by scattering or absorbing light, leading to bit errors and link flaps even when average optical power levels appear within acceptable range. The flapping occurs because transient contaminants (e.g., dust or oil) momentarily disrupt the optical signal, triggering link down events that recover when the connector is jostled or the contaminant shifts. Since the power meter measures average power, it may not detect brief attenuation spikes caused by dirt.

Answer

Electromagnetic interference

Answer

Incorrect VLAN configuration

Answer

Duplex mismatch

Question 15

A security administrator is configuring a firewall to allow remote employees to access the company's internal web server (port 443) from the internet. The web server has an internal IP address of 10.0.0.5. The firewall has a public IP of 203.0.113.10. Which type of firewall rule should be created?

Accepted Answer

A) Port forwarding (DNAT) rule. A port forwarding (DNAT) rule is required because the web server uses a private RFC 1918 IP address (10.0.0.5), which is not routable on the public internet. The firewall must translate the destination IP from its public address (203.0.113.10) to the internal server's private address, allowing inbound traffic on port 443 to reach the correct internal host.

Answer

B) Allow rule with source any, destination 10.0.0.5, port 443

Answer

C) Access control list on the internal interface

Answer

D) VPN rule to require remote access VPN

Question 16

A security analyst notices that a user's workstation is sending encrypted DNS queries to an external IP address over TCP port 853. This traffic is being used to establish a covert communication channel to bypass the company's security controls. Which technique is being employed?

Accepted Answer

DNS tunneling. DNS tunneling is the correct answer because the analyst observed encrypted DNS queries over TCP port 853 (DNS over TLS) being used to establish a covert communication channel. This technique encapsulates non-DNS data (e.g., command-and-control traffic) within DNS query and response packets, allowing the attacker to bypass security controls by hiding malicious traffic inside legitimate DNS traffic.

Answer

DNS poisoning

Answer

DNS amplification

Answer

DNS zone transfer

Question 17

A network technician runs the command "traceroute 8.8.8.8" from a workstation. The output shows the first hop as the default gateway, the second hop as an internal router, and then a series of asterisks (* * *) before reaching the destination. What does the series of asterisks indicate?

Accepted Answer

The intermediate routers are not responding to ICMP time-exceeded messages. The series of asterisks indicates that intermediate routers beyond the second hop are not responding with ICMP Time-Exceeded messages when the TTL expires. Traceroute relies on these ICMP responses to identify each hop; if a router is configured to drop ICMP or not send the message, the output shows asterisks for that hop. The destination is still reachable, as the final hop succeeds, so the asterisks do not indicate unreachability.

Answer

The destination is unreachable

Answer

The TTL expired at the last hop

Answer

The connection is encrypted

Question 18

A security auditor discovers that several unused switch ports are in default configuration. The auditor recommends implementing a security measure that will disable the port if an unauthorized device is connected, and then automatically re-enable the port after a specified time period. Which feature should be configured on the switch ports?

Accepted Answer

Port security with violation mode 'shutdown' and errdisable recovery interval. Port security with violation mode 'shutdown' disables the port when an unauthorized device is detected, and the errdisable recovery interval automatically re-enables the port after a specified time period. This directly matches the auditor's requirement to disable on unauthorized connection and auto-re-enable after a timeout.

Answer

802.1X with RADIUS authentication and guest VLAN

Answer

DHCP snooping and dynamic ARP inspection

Answer

Storm control and broadcast suppression

Question 19

A network technician is installing a new wireless access point in a warehouse. The AP requires PoE+ (802.3at) for full operation. The technician connects the AP using a Cat5e cable run of 200 feet to a switch that only supports 802.3af (PoE). The AP powers on but has intermittent connectivity issues. What is the most likely cause?

Accepted Answer

The switch does not support the required PoE standard. The switch only supports 802.3af (PoE), which provides up to 15.4W per port, while the AP requires 802.3at (PoE+) for full operation, which supplies up to 30W. Although the AP powers on, it may not receive sufficient power to operate all radios or features, leading to intermittent connectivity issues. The cable length of 200 feet is within the 100-meter (328-foot) limit for Cat5e, so length is not the problem.

Answer

The cable length exceeds the maximum for PoE

Answer

The AP is experiencing interference from metal racks

Answer

The AP is configured with the wrong SSID

Question 20

A user at a branch office reports that they cannot connect to a file server at the main office. The branch office connects to the main office via a site-to-site VPN, and the VPN tunnel shows as active. The user can ping the main office's default gateway but not the file server. Which of the following should the technician check NEXT?

Accepted Answer

A) Check the routing tables on the branch router. The VPN tunnel is active and the user can ping the main office's default gateway, which confirms that Layer 3 connectivity exists across the tunnel. However, the file server is unreachable, indicating that the traffic destined for the file server's subnet is not being forwarded correctly. The next logical step is to check the routing tables on the branch router to ensure there is a specific route (or a default route) pointing to the VPN tunnel interface for the file server's network. Without this route, the branch router may be dropping the packets or sending them out the wrong interface.

Answer

B) Check the DNS resolution for the file server

Answer

C) Check the VPN encryption settings

Answer

D) Check the file server's antivirus software