N10-009 Practice Test 23 — 15 Questions

Question 1

A security analyst notices that a network switch is receiving DHCP discover messages from a rogue device offering IP addresses. The rogue device is causing clients to obtain invalid IP addresses and lose network connectivity. Which security feature should be implemented on the switch to prevent this type of attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DHCP snooping. B is correct because DHCP snooping is a security feature that filters untrusted DHCP messages on a switch. It distinguishes between trusted ports (connected to legitimate DHCP servers) and untrusted ports (connected to clients or rogue devices). When a rogue device sends DHCP discover messages offering IP addresses, DHCP snooping on untrusted ports drops those messages, preventing the rogue server from assigning invalid IP addresses.

Answer

Dynamic ARP inspection (DAI)

Answer

Port security

Answer

802.1X authentication

Question 2

A user's workstation shows an IP address of 169.254.15.7 with a subnet mask of 255.255.0.0. The user cannot access any network resources. Which of the following is the most likely cause?

Accepted Answer

The DHCP server is unreachable. The IP address 169.254.15.7 with a /16 subnet mask is an Automatic Private IP Addressing (APIPA) address, assigned by Windows when a DHCP client fails to obtain a lease. This indicates the workstation cannot reach a DHCP server, so the most likely cause is that the DHCP server is unreachable.

Answer

The DNS server is not responding

Answer

The subnet mask is incorrect

Answer

The default gateway is down

Question 3

Which SNMPv3 security level provides both authentication and encryption?

Accepted Answer

authPriv. (authPriv) is correct because SNMPv3 defines three security levels: noAuthNoPriv, authNoPriv, and authPriv. The authPriv level provides both authentication (using HMAC-MD5 or HMAC-SHA) and encryption (using CBC-DES or AES) to ensure data integrity, origin verification, and confidentiality. This is the highest security level defined in RFC 3414.

Answer

noAuthNoPriv

Answer

authNoPriv

Answer

noAuthPriv

Question 4

A company has a change management policy that requires all network changes to be approved and documented. An administrator needs to replace a faulty switch in the core network. According to best practices, which step should be performed after the replacement is complete?

Accepted Answer

Update the network diagram.. Updating the network diagram is the correct step because it ensures that the documentation accurately reflects the new switch's location, model, firmware version, and connections. This aligns with change management best practices, which require that all network changes be documented to maintain an accurate source of truth for troubleshooting, capacity planning, and future changes. Without this update, the diagram becomes stale, leading to potential misconfigurations or delays during incident response.

Answer

Roll back to the previous switch.

Answer

Notify users of the change.

Answer

Submit a change request.

Question 5

A network administrator needs to centrally collect and analyze log messages from multiple routers and switches. Which protocol should be used to forward these log messages to a central server?

Accepted Answer

Syslog. Syslog (B) is the correct protocol because it is specifically designed for centralized logging and event message collection from network devices. It uses UDP port 514 (or TCP 6514 for reliable delivery) to forward log messages from routers and switches to a central syslog server, enabling administrators to collect, analyze, and archive logs from multiple devices in a standardized format.

Answer

SNMP

Answer

SMTP

Answer

HTTP

Question 6

A network administrator is designing a Layer 2 network with redundant links between switches. Which protocol should be implemented to prevent loops in the network?

Accepted Answer

STP (Spanning Tree Protocol). STP (Spanning Tree Protocol) is the correct choice because it is specifically designed to prevent Layer 2 loops in networks with redundant links. It achieves this by placing redundant switch ports into a blocking state, creating a loop-free logical topology while maintaining physical redundancy for failover.

Answer

OSPF (Open Shortest Path First)

Answer

VRRP (Virtual Router Redundancy Protocol)

Answer

LACP (Link Aggregation Control Protocol)

Question 7

A network administrator is configuring BGP between two autonomous systems. Which BGP attribute is primarily used to influence inbound traffic to a particular AS?

Accepted Answer

MED (Multi-Exit Discriminator). The Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic from a neighboring AS when multiple entry points exist. A lower MED value is preferred, allowing an AS to advertise to its neighbor which path should be used to reach it, thereby influencing traffic entering the local AS.

Answer

AS_PATH

Answer

Next Hop

Answer

Local Preference

Question 8

A network security analyst notices that the firewall is logging traffic on the external interface that has a source IP address of 10.0.1.5, which is within the internal network range. This is most likely the result of which type of attack?

Accepted Answer

IP spoofing. The firewall is logging traffic on its external interface with a source IP address from the internal RFC 1918 range (10.0.1.5). This indicates the source IP has been forged, because private IP addresses should never appear as source addresses on a public-facing interface. This is the classic signature of an IP spoofing attack, where the attacker modifies the source IP in the packet header to impersonate an internal host.

Answer

DNS poisoning

Answer

ARP poisoning

Answer

VLAN hopping

Question 9

In a network, a collision domain is a network segment where which of the following is true?

Accepted Answer

A: Only one device can transmit at a time to avoid data collisions. In a collision domain, only one device can transmit at a time because if two or more devices transmit simultaneously, their signals collide, corrupting the data. This is a fundamental characteristic of half-duplex Ethernet segments, such as those using hubs or legacy bus topologies, where the medium is shared and CSMA/CD (Carrier Sense Multiple Access with Collision Detection) is used to manage access.

Answer

B: All devices share the same IP subnet

Answer

C: Broadcast traffic is confined to that segment

Answer

D: MAC addresses are resolved to IP addresses

Question 10

A network administrator needs to ensure that data sent from a host arrives at the correct destination on a different network. Which of the following provides the logical address used for this purpose in IPv4?

Accepted Answer

IP address. In IPv4, the logical address used to route data between different networks is the IP address. The IP address contains a network portion that routers use to forward packets across network boundaries, ensuring the data reaches the correct destination network and host.

Answer

MAC address

Answer

Port number

Answer

Default gateway

Question 11

An organization is implementing a network monitoring solution that uses SNMP. The administrator wants to receive traps from all devices but is concerned about the security of SNMPv1/v2c community strings. Which SNMP version should be used to provide authentication and encryption?

Accepted Answer

SNMPv3. SNMPv3 is the correct choice because it is the only version of SNMP that provides both authentication and encryption, addressing the security concerns with SNMPv1/v2c community strings. SNMPv3 supports user-based security models (USM) with features like message integrity, authentication, and encryption (e.g., using SHA/MD5 for auth and AES/DES for privacy). This ensures that traps are sent securely, preventing unauthorized access or tampering.

Answer

SNMPv1

Answer

SNMPv2c

Answer

SNMPv4

Question 12

Which of the following protocols is used to automatically assign IP addresses to devices on a network?

Accepted Answer

B) DHCP. DHCP (Dynamic Host Configuration Protocol) is the correct answer because it is specifically designed to automatically assign IP addresses and other network configuration parameters (such as subnet mask, default gateway, and DNS servers) to devices on a network. When a client device connects, it sends a DHCP Discover broadcast, and the DHCP server responds with an Offer, followed by a Request and Acknowledgment (DORA process), enabling plug-and-play connectivity.

Answer

A) DNS

Answer

C) ARP

Answer

D) ICMP

Question 13

A network administrator wants to logically segment a single physical switch into multiple separate broadcast domains without purchasing additional hardware. Which concept should be used?

Accepted Answer

Virtual LAN (VLAN). A VLAN logically segments a physical switch into multiple isolated broadcast domains by assigning switch ports to specific VLAN IDs (802.1Q). This prevents broadcast traffic from crossing VLAN boundaries without requiring additional hardware, as each VLAN functions as its own Layer 2 network.

Answer

Spanning Tree Protocol (STP)

Answer

Subnetting

Answer

Quality of Service (QoS)

Question 14

A network administrator is creating a new VLAN that will contain 20 devices. The administrator wants to use the most efficient subnet that provides enough usable IP addresses while minimizing waste. Which of the following subnet masks should be used?

Accepted Answer

255.255.255.224 (/27). A /27 subnet mask (255.255.255.224) provides 32 total addresses, of which 30 are usable (2^5 - 2 = 30). This is the most efficient choice for 20 devices because it offers exactly enough usable IPs with minimal waste (only 10 unused addresses), whereas a /28 would provide only 14 usable addresses (insufficient) and a /29 would provide only 6 usable addresses (also insufficient).

Answer

255.255.255.240 (/28)

Answer

255.255.255.248 (/29)

Answer

255.255.255.192 (/26)

Question 15

A network administrator is planning a maintenance window to upgrade the firmware on critical switches. Which step should the administrator perform first to ensure minimal downtime?

Accepted Answer

Test the new firmware in a lab environment. Testing the new firmware in a lab environment first validates compatibility and stability without risking production network downtime. This step identifies potential issues such as configuration incompatibilities or hardware-specific bugs before the maintenance window, ensuring a smooth upgrade process.

Answer

Download the firmware from the vendor website

Answer

Back up the current configuration and firmware image

Answer

Notify users of the upcoming maintenance