N10-009 Practice Test 22 — 15 Questions

Question 1

A user can ping the default gateway (192.168.1.1) but cannot ping the external IP address 8.8.8.8. Other users on the same subnet can ping 8.8.8.8 without issue. The user's IP configuration is correct: IP 192.168.1.10/24, default gateway 192.168.1.1, DNS 8.8.8.8. What is the most likely cause?

Accepted Answer

The computer's firewall is blocking outbound ICMP. The user can ping the default gateway (192.168.1.1) but not the external IP 8.8.8.8, while other users on the same subnet can ping 8.8.8.8 without issue. This isolates the problem to the user's specific host, not the network infrastructure. A local firewall on the user's computer blocking outbound ICMP (Internet Control Message Protocol) traffic would prevent ping to external IPs while still allowing local subnet communication, as ICMP is often restricted by default in some security policies.

Answer

The router is missing a default route to the internet

Answer

The DNS server is not resolving the hostname

Answer

The network cable is loose or faulty

Question 2

A technician is troubleshooting intermittent connectivity issues on a fiber link between two switches. The link light on both switches is green. Which of the following tools should the technician use to further investigate the issue?

Accepted Answer

Optical power meter. The correct tool is an optical power meter because the link lights are green, indicating Layer 1 signal presence, but intermittent connectivity suggests the signal strength may be marginal or fluctuating. An optical power meter measures the exact light level in dBm to verify it falls within the receiver's sensitivity range, which a simple link LED cannot detect.

Answer

Multimeter

Answer

Tone generator

Answer

Cable certifier

Question 3

An employee plugs a personal laptop into a network jack and then the laptop is infected with malware that spreads to other devices on the network. Which security control would have most effectively prevented this scenario?

Accepted Answer

802.1X authentication. 802.1X authentication requires devices to authenticate before gaining network access, typically via EAP (Extensible Authentication Protocol) over RADIUS. In this scenario, the employee's personal laptop would be blocked at the port level because it lacks valid credentials, preventing the malware from ever reaching the internal network and spreading to other devices.

Answer

MAC filtering on the switch

Answer

VLAN segmentation

Answer

Access control lists on the router

Question 4

A technician is troubleshooting a loss of network connectivity for a single workstation. The workstation has a valid IP address but cannot ping its default gateway. The link lights on both the workstation and the switch are solid. Which of the following should the technician check NEXT?

Accepted Answer

The switch port configuration, such as VLAN assignment. The workstation has a valid IP address and solid link lights, indicating Layer 1 (physical) and Layer 3 (IP configuration) are functional. The inability to ping the default gateway points to a Layer 2 issue, such as the switch port being in the wrong VLAN or having a misconfigured access/trunk setting. Checking the switch port configuration is the logical next step because VLAN mismatches prevent frames from reaching the gateway's subnet.

Answer

The cable integrity with a tester

Answer

The DNS server settings

Answer

The workstation's ARP cache

Question 5

During a security audit, a consultant discovers that encrypted traffic between a client and a web server is being decrypted and re-encrypted by an intermediate device on the network path. Which type of attack best describes this scenario?

Accepted Answer

Man-in-the-middle. Option C is correct because the scenario describes a classic man-in-the-middle (MITM) attack where an intermediary intercepts, decrypts, and re-encrypts traffic between the client and server. This allows the attacker to read or modify the data while both endpoints believe they have a secure TLS session. The key indicator is the decryption and re-encryption step, which is the hallmark of an active MITM proxy.

Answer

ARP poisoning

Answer

SSL stripping

Answer

Rogue DHCP

Question 6

A user reports that they can browse to a website by typing its IP address (e.g., 93.184.216.34) but cannot access it by typing the domain name (e.g., www.example.com). The user's workstation receives IP configuration via DHCP. Which of the following is the most likely cause?

Accepted Answer

The DNS server address is incorrect or unreachable.. The user can reach the website by IP address but not by domain name, which isolates the issue to name resolution. DNS translates domain names to IP addresses; if the DNS server address provided by DHCP is incorrect or unreachable, the workstation cannot resolve www.example.com to 93.184.216.34. This is the most likely cause because all other connectivity (default gateway, web server) is confirmed working by the successful IP-based access.

Answer

The default gateway is misconfigured.

Answer

The web server's SSL certificate is expired.

Answer

The workstation's hosts file has an incorrect entry.

Question 7

A user can access a website by its IP address (e.g., 203.0.113.5) but cannot access it by its domain name (example.com). Other users on the same subnet can access the website by domain name. Which of the following should the technician check FIRST?

Accepted Answer

A. The issue is isolated to a single user who can reach the website by IP but not by domain name, while other users on the same subnet have no problem. This points to a client-side DNS resolution failure, most likely a misconfigured or missing DNS server address in the user's network settings. The technician should first check the user's DNS configuration (e.g., `ipconfig /all` on Windows or `cat /etc/resolv.conf` on Linux) to ensure it points to a valid DNS server.

Answer

B

Answer

C

Answer

D

Question 8

A user reports that they can access the company's internal web server by IP address (10.10.10.100) but cannot access it by its hostname (intranet.company.com). The user's workstation is configured with the correct internal DNS server address. Which of the following should the technician do FIRST?

Accepted Answer

Check the DNS server's A record for intranet.company.com. The user can reach the server by IP but not by hostname, which indicates a DNS resolution problem. Since the workstation is configured with the correct internal DNS server, the most likely cause is a missing or incorrect A record for intranet.company.com on that DNS server. Checking the A record is the logical first step before other troubleshooting.

Answer

Review the firewall rules on the server

Answer

Run ipconfig /flushdns on the workstation

Answer

Verify the default gateway configuration

Question 9

Users in a branch office report that file transfers to the data center are slow. A technician runs a traceroute and sees consistently high latency on hop 5. The technician then pings hop 5 and gets replies with varying response times. There are no errors reported on the interface. What is the most likely cause?

Accepted Answer

Interface congestion causing queuing delays.. High latency on hop 5 with varying response times and no interface errors indicates that the router at hop 5 is experiencing congestion, causing packets to be queued before transmission. This queuing delay results in increased and variable round-trip times (RTT), which is a classic symptom of interface congestion. The absence of errors rules out physical-layer issues, and the consistent latency on that specific hop points to a bottleneck at that router's egress interface.

Answer

Routing loop causing packets to be dropped.

Answer

DNS server misconfiguration causing lookup delays.

Answer

Firewall inspecting traffic and adding latency.

Question 10

A user reports that they cannot access any network resources. The technician checks the IP configuration on the workstation and sees an IP address of 169.254.10.55 with a subnet mask of 255.255.0.0. Which of the following should the technician check NEXT?

Accepted Answer

Verify that the DHCP server is available and reachable. The IP address 169.254.10.55 with a subnet mask of 255.255.0.0 is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when a DHCP server is unreachable. The next logical step is to verify that the DHCP server is available and reachable, as this directly addresses the root cause of the failed DHCP lease acquisition.

Answer

Configure a static IP address on the workstation

Answer

Check the DNS server configuration on the workstation

Answer

Replace the network cable

Question 11

An organization wants to implement a security solution that uses a cloud-based service to inspect all incoming web traffic for malware and policy violations before it reaches the internal network. This type of solution is known as a:

Accepted Answer

Secure web gateway (SWG). A Secure Web Gateway (SWG) is a cloud-based security solution that inspects all outbound and inbound web traffic for malware, policy violations, and data loss. It operates at the application layer, typically using proxy-based or API-based inspection to enforce security policies before traffic reaches the internal network. This matches the requirement for a cloud service that inspects incoming web traffic for malware and policy violations.

Answer

Web application firewall (WAF)

Answer

Intrusion detection system (IDS)

Answer

VPN concentrator

Question 12

Users in a warehouse report that their wireless tablets lose connectivity when moving near large metal racks. The signal strength remains high but throughput drops significantly. What is the most likely cause?

Accepted Answer

Multipath interference. When wireless signals reflect off large metal surfaces, multiple copies of the signal arrive at the receiver at slightly different times, causing multipath interference. This phase cancellation effect corrupts the signal, forcing the 802.11 MAC layer to retransmit frames, which drastically reduces throughput even though the received signal strength indicator (RSSI) remains high. The metal racks in the warehouse act as reflective surfaces, creating a classic multipath environment.

Answer

Signal attenuation

Answer

Co-channel interference

Answer

Insufficient DHCP scope

Question 13

After replacing a faulty switch, several users in the same VLAN report that they cannot communicate with the server that is on a different subnet. The switch is connected to the router via a trunk port. Which command should the administrator run on the router to verify that the VLAN is allowed on the trunk?

Accepted Answer

show interfaces trunk. The `show interfaces trunk` command displays which VLANs are allowed on each trunk port. Since the switch is connected to the router via a trunk, this command verifies whether the VLAN of the affected users is permitted on that trunk. If the VLAN is missing from the allowed list, traffic to the server on a different subnet will be dropped at the router interface.

Answer

show vlan

Answer

show mac address-table

Answer

show ip route

Question 14

A user reports that they cannot access any company resources. The technician runs 'ipconfig' and sees that the workstation has an IP address of 169.254.100.25 with a subnet mask of 255.255.0.0. The technician also notices that the 'Default Gateway' is blank. What is the most likely cause?

Accepted Answer

The DHCP server is unavailable or unreachable.. The IP address 169.254.100.25 with a subnet mask of 255.255.0.0 is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when a DHCP client fails to obtain a lease. The blank Default Gateway confirms that no DHCP server responded, so the workstation cannot reach any company resources beyond its local subnet.

Answer

The DNS server is not responding.

Answer

The workstation has a static IP address configured.

Answer

The network cable is unplugged.

Question 15

In the OSI model, which layer is responsible for establishing, managing, and terminating sessions between applications, as well as providing checkpoints and recovery?

Accepted Answer

Session layer. The Session layer (Layer 5) of the OSI model is explicitly responsible for establishing, managing, and terminating sessions between applications, as well as providing checkpointing and recovery mechanisms. This layer uses protocols like NetBIOS, RPC, and PPTP to coordinate dialog control, synchronization points, and session restoration after failures, ensuring that long-lived transactions can resume from a checkpoint rather than restarting entirely.

Answer

Transport layer

Answer

Network layer

Answer

Data link layer