N10-009 Practice Test 22 — 15 Questions

Question 1

A company is deploying a new wireless network for a small office. The network will consist of three access points. The IT manager wants the APs to automatically coordinate radio frequency settings and client roaming without a dedicated controller. Which technology should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud-managed access points. Cloud-managed access points (APs) are the correct choice because they can automatically coordinate radio frequency (RF) settings and client roaming without a dedicated on-premises controller. The cloud-based management platform handles channel selection, power adjustment, and fast roaming (e.g., 802.11r/k/v) by communicating with each AP over the internet, making it ideal for a small office with only three APs.

Answer

Mesh network

Answer

Controller-based wireless

Answer

Standalone APs

Question 2

A technician is troubleshooting an intermittent connectivity issue between two switches connected by a fiber optic cable. The link status shows up/down flapping. The technician checks the optical power levels and finds they are within acceptable range. Which of the following is the most likely cause?

Accepted Answer

Dirty fiber connectors. Intermittent link flapping with acceptable optical power levels strongly indicates a physical-layer issue that is not related to signal strength. Dirty fiber connectors cause intermittent signal degradation due to scattering and absorption of light, leading to CRC errors and link flaps even when average power appears normal. Cleaning the connectors is the standard first step in such scenarios.

Answer

Duplex mismatch

Answer

Speed mismatch

Answer

VLAN mismatch

Question 3

Which transport layer protocol is used by VoIP and streaming video because it provides low latency and does not require retransmission?

Accepted Answer

UDP. VoIP and streaming video use UDP (User Datagram Protocol) because it is connectionless and provides low-latency transmission without retransmission of lost packets. This is critical for real-time applications where a slight delay is more disruptive than occasional packet loss.

Answer

TCP

Answer

ICMP

Answer

IGMP

Question 4

A network engineer is deploying a wireless network using 802.11ac. To allow clients to roam between access points without re-authenticating to the authentication server, which IEEE standard should be implemented?

Accepted Answer

802.11r. 802.11r, also known as Fast BSS Transition (FT), enables clients to roam between access points using a cached Pairwise Master Key (PMK) without requiring a full 802.1X/EAP re-authentication with the RADIUS server. This reduces roaming latency to under 50 ms, which is critical for voice and video applications.

Answer

802.1X

Answer

802.11i

Answer

802.11e

Question 5

A network technician is troubleshooting an intermittent connectivity issue between two switches connected via fiber optic cable. The link status shows up/down flapping. The technician checks the optical power levels and finds they are within acceptable range. Which of the following is the most likely cause?

Accepted Answer

Dirty fiber connectors. Dirty fiber connectors cause intermittent connectivity by scattering or absorbing light, leading to bit errors and link flaps even when average optical power levels appear within acceptable range. The flapping occurs because transient contaminants (e.g., dust or oil) momentarily disrupt the optical signal, triggering link down events that recover when the connector is jostled or the contaminant shifts. Since the power meter measures average power, it may not detect brief attenuation spikes caused by dirt.

Answer

Electromagnetic interference

Answer

Incorrect VLAN configuration

Answer

Duplex mismatch

Question 6

A network administrator needs to allow multiple VLANs to traverse a single link between two switches. Which configuration must be applied on the switch ports?

Accepted Answer

Trunk port. A trunk port is configured to carry traffic for multiple VLANs over a single link by tagging frames with IEEE 802.1Q VLAN identifiers. This allows the switch to distinguish which VLAN each frame belongs to, enabling inter-switch VLAN connectivity without requiring separate physical links per VLAN.

Answer

Access port

Answer

Hybrid port

Answer

Routed port

Question 7

An organization wants to implement a security solution that uses a cloud-based service to inspect all incoming web traffic for malware and policy violations before it reaches the internal network. This type of solution is known as a:

Accepted Answer

Secure web gateway (SWG). A Secure Web Gateway (SWG) is a cloud-based security solution that inspects all outbound and inbound web traffic for malware, policy violations, and data loss. It operates at the application layer, typically using proxy-based or API-based inspection to enforce security policies before traffic reaches the internal network. This matches the requirement for a cloud service that inspects incoming web traffic for malware and policy violations.

Answer

Web application firewall (WAF)

Answer

Intrusion detection system (IDS)

Answer

VPN concentrator

Question 8

A security analyst notices that a network switch is receiving DHCP discover messages from a rogue device offering IP addresses. The rogue device is causing clients to obtain invalid IP addresses and lose network connectivity. Which security feature should be implemented on the switch to prevent this type of attack?

Accepted Answer

DHCP snooping. B is correct because DHCP snooping is a security feature that filters untrusted DHCP messages on a switch. It distinguishes between trusted ports (connected to legitimate DHCP servers) and untrusted ports (connected to clients or rogue devices). When a rogue device sends DHCP discover messages offering IP addresses, DHCP snooping on untrusted ports drops those messages, preventing the rogue server from assigning invalid IP addresses.

Answer

Dynamic ARP inspection (DAI)

Answer

Port security

Answer

802.1X authentication

Question 9

A user's workstation shows an IP address of 169.254.15.7 with a subnet mask of 255.255.0.0. The user cannot access any network resources. Which of the following is the most likely cause?

Accepted Answer

The DHCP server is unreachable. The IP address 169.254.15.7 with a /16 subnet mask is an Automatic Private IP Addressing (APIPA) address, assigned by Windows when a DHCP client fails to obtain a lease. This indicates the workstation cannot reach a DHCP server, so the most likely cause is that the DHCP server is unreachable.

Answer

The DNS server is not responding

Answer

The subnet mask is incorrect

Answer

The default gateway is down

Question 10

Which SNMPv3 security level provides both authentication and encryption?

Accepted Answer

authPriv. (authPriv) is correct because SNMPv3 defines three security levels: noAuthNoPriv, authNoPriv, and authPriv. The authPriv level provides both authentication (using HMAC-MD5 or HMAC-SHA) and encryption (using CBC-DES or AES) to ensure data integrity, origin verification, and confidentiality. This is the highest security level defined in RFC 3414.

Answer

noAuthNoPriv

Answer

authNoPriv

Answer

noAuthPriv

Question 11

A company has a change management policy that requires all network changes to be approved and documented. An administrator needs to replace a faulty switch in the core network. According to best practices, which step should be performed after the replacement is complete?

Accepted Answer

Update the network diagram.. Updating the network diagram is the correct step because it ensures that the documentation accurately reflects the new switch's location, model, firmware version, and connections. This aligns with change management best practices, which require that all network changes be documented to maintain an accurate source of truth for troubleshooting, capacity planning, and future changes. Without this update, the diagram becomes stale, leading to potential misconfigurations or delays during incident response.

Answer

Roll back to the previous switch.

Answer

Notify users of the change.

Answer

Submit a change request.

Question 12

A network administrator needs to centrally collect and analyze log messages from multiple routers and switches. Which protocol should be used to forward these log messages to a central server?

Accepted Answer

Syslog. Syslog (B) is the correct protocol because it is specifically designed for centralized logging and event message collection from network devices. It uses UDP port 514 (or TCP 6514 for reliable delivery) to forward log messages from routers and switches to a central syslog server, enabling administrators to collect, analyze, and archive logs from multiple devices in a standardized format.

Answer

SNMP

Answer

SMTP

Answer

HTTP

Question 13

A network administrator is designing a Layer 2 network with redundant links between switches. Which protocol should be implemented to prevent loops in the network?

Accepted Answer

STP (Spanning Tree Protocol). STP (Spanning Tree Protocol) is the correct choice because it is specifically designed to prevent Layer 2 loops in networks with redundant links. It achieves this by placing redundant switch ports into a blocking state, creating a loop-free logical topology while maintaining physical redundancy for failover.

Answer

OSPF (Open Shortest Path First)

Answer

VRRP (Virtual Router Redundancy Protocol)

Answer

LACP (Link Aggregation Control Protocol)

Question 14

A network administrator is configuring BGP between two autonomous systems. Which BGP attribute is primarily used to influence inbound traffic to a particular AS?

Accepted Answer

MED (Multi-Exit Discriminator). The Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic from a neighboring AS when multiple entry points exist. A lower MED value is preferred, allowing an AS to advertise to its neighbor which path should be used to reach it, thereby influencing traffic entering the local AS.

Answer

AS_PATH

Answer

Next Hop

Answer

Local Preference

Question 15

A network security analyst notices that the firewall is logging traffic on the external interface that has a source IP address of 10.0.1.5, which is within the internal network range. This is most likely the result of which type of attack?

Accepted Answer

IP spoofing. The firewall is logging traffic on its external interface with a source IP address from the internal RFC 1918 range (10.0.1.5). This indicates the source IP has been forged, because private IP addresses should never appear as source addresses on a public-facing interface. This is the classic signature of an IP spoofing attack, where the attacker modifies the source IP in the packet header to impersonate an internal host.

Answer

DNS poisoning

Answer

ARP poisoning

Answer

VLAN hopping