N10-009 Practice Test 25 — 15 Questions

Question 1

A network engineer is designing a data center network and needs to ensure high availability for the core switches. Which technology allows multiple physical switches to be combined into a single logical switch to simplify management and improve redundancy?

Accepted Answer

Switch stacking. Switch stacking combines multiple physical switches into a single logical unit, sharing a common control plane and management interface. This simplifies configuration and provides redundancy because if one switch in the stack fails, the remaining switches continue forwarding traffic without requiring STP convergence.

Answer

Spanning Tree Protocol (STP)

Answer

EtherChannel

Answer

Virtual Router Redundancy Protocol (VRRP)

Question 2

A company is implementing 802.1X port-based authentication on its wired network to control access. The network uses Active Directory for user accounts. Which type of server must be deployed to authenticate clients connecting to the switch ports?

Accepted Answer

A RADIUS server. 802.1X port-based authentication requires a RADIUS server to act as the authentication server that validates client credentials against the identity store (Active Directory). The switch (authenticator) forwards EAP frames from the client (supplicant) to the RADIUS server, which checks the credentials and instructs the switch to grant or deny port access.

Answer

A DNS server

Answer

A DHCP server

Answer

A Kerberos server

Question 3

A company is deploying VoIP phones and wants to ensure voice packets receive priority over data packets on the network. Which technology should be implemented on the switches and routers?

Accepted Answer

Quality of Service (QoS). Quality of Service (QoS) is the correct technology because it allows network devices to classify, mark, and prioritize voice traffic (e.g., using DSCP EF or CoS 5) over data traffic, ensuring low latency, jitter, and packet loss for VoIP. Switches and routers use QoS queuing mechanisms like LLQ or CBWFQ to guarantee bandwidth for voice packets, which is essential for real-time communications.

Answer

VLAN

Answer

Spanning Tree Protocol (STP)

Answer

Power over Ethernet (PoE)

Question 4

A company is extending its network to a new building located 200 meters away. The link must support 1 Gbps speeds. Which cabling type should be used?

Accepted Answer

Single-mode fiber. Single-mode fiber (SMF) is the correct choice because it supports 1 Gbps speeds over distances far exceeding 200 meters, typically up to 5 km or more using 1000BASE-LX optics. Copper cabling like Cat5e and Cat6 is limited to a maximum segment length of 100 meters for 1 Gbps (1000BASE-T), making them unsuitable for this 200-meter link.

Answer

Cat5e

Answer

Cat6

Answer

Coaxial cable

Question 5

A company is deploying a new wireless network in a warehouse. The network administrator needs to ensure that clients can seamlessly roam between access points without losing connectivity. Which of the following should be configured?

Accepted Answer

A) Same SSID and security settings on all APs. Configuring the same SSID and security settings on all access points (APs) is essential for seamless roaming because clients use the SSID to identify the network and the security credentials to authenticate. When a client moves between APs, it can re-associate without needing to re-authenticate or discover a new network, provided the SSID and security parameters (e.g., PSK or 802.1X configuration) are identical. This ensures a smooth handoff and maintains connectivity during roaming.

Answer

B) Different channels per AP to reduce interference

Answer

C) WPA2-Enterprise with RADIUS authentication

Answer

D) Mesh topology for AP interconnection

Question 6

Users at a remote branch office cannot access internet resources. The branch's edge router shows that the WAN interface is up. The default route is configured to point to next-hop 192.0.2.2, but the admin can successfully ping 192.0.2.1 from the router. What is the most likely cause?

Accepted Answer

The default route is missing or has an incorrect next-hop IP. The correct answer is B because the admin can ping 192.0.2.1 (the WAN interface IP) but not reach 192.0.2.2 (the next-hop), indicating that the default route is either missing or misconfigured. Since the WAN interface is up and the local IP is reachable, the issue is with the routing table entry pointing to the next-hop, not with the interface or subnet mask. Without a valid default route, the router cannot forward traffic destined for the internet.

Answer

The router's WAN interface is configured with the wrong subnet mask

Answer

NAT is not configured on the router

Answer

A firewall on the router is blocking outbound traffic

Question 7

Which of the following best describes the function of a default gateway?

Accepted Answer

It routes packets from a local subnet to destinations on other networks.. The default gateway is a router or Layer 3 device on a local subnet that serves as the next-hop IP address for packets destined to networks outside the local subnet. When a host determines that the destination IP is not on the same subnet (using its subnet mask), it forwards the packet to the default gateway's MAC address via ARP, which then routes the packet toward the remote network. Without a correctly configured default gateway, a host can only communicate within its own subnet.

Answer

It translates private IP addresses to public IP addresses.

Answer

It provides DHCP services to clients.

Answer

It performs DNS resolution for network clients.

Question 8

A company has deployed a WPA2-Enterprise wireless network. Users report that they cannot authenticate. The RADIUS server logs show that authentication attempts are received but no responses are sent back to the wireless controller. The wireless controller and RADIUS server are on different subnets, separated by a firewall. Which of the following is the MOST likely cause?

Accepted Answer

The firewall is blocking RADIUS traffic on UDP ports 1812 and 1813.. The RADIUS server logs show authentication attempts are received but no responses are sent back, indicating the request reached the server but the reply is being dropped. Since the wireless controller and RADIUS server are on different subnets separated by a firewall, the most likely cause is that the firewall is blocking the return RADIUS traffic. RADIUS uses UDP ports 1812 for authentication and 1813 for accounting, and these must be open in both directions for successful communication.

Answer

The wireless clients do not support the correct EAP method.

Answer

The RADIUS server is not in the same broadcast domain as the wireless controller.

Answer

The SSID is not being broadcast.

Question 9

A client and server are establishing a TCP connection. The client sends a SYN segment to the server. The server responds with a SYN-ACK segment. What is the next segment in the handshake?

Accepted Answer

ACK. The TCP three-way handshake requires the client to acknowledge the server's SYN-ACK by sending an ACK segment. This completes the handshake, establishing a full-duplex connection with synchronized sequence numbers. Without this final ACK, the server remains in a half-open state, unable to begin data transmission.

Answer

RST

Answer

FIN

Answer

SYN

Question 10

A company needs a subnet that will support exactly 50 devices. Which subnet mask provides the minimum number of usable host addresses while still accommodating the requirement?

Accepted Answer

255.255.255.192 (/26). Option B (255.255.255.192, /26) provides 2^(32-26) - 2 = 62 usable host addresses, which is the smallest subnet that supports exactly 50 devices. A /27 yields only 30 usable addresses (too few), while a /25 yields 126 usable addresses (wasteful). The requirement is to minimize waste while meeting the need.

Answer

255.255.255.128 (/25)

Answer

255.255.255.224 (/27)

Answer

255.255.255.240 (/28)

Question 11

A client obtains an IP address from a DHCP server but cannot resolve hostnames. The client can ping the default gateway and external IP addresses successfully. What is the most likely cause?

Accepted Answer

DNS server misconfiguration. The client can ping external IP addresses and the default gateway, confirming that IP connectivity and routing are functional. However, the inability to resolve hostnames points directly to a DNS resolution failure, which occurs when the DNS server address is misconfigured or unreachable. Since DHCP provided the IP address, the DNS server setting is likely incorrect or missing in the DHCP scope.

Answer

Incorrect subnet mask

Answer

Default gateway not set

Answer

Firewall blocking DNS

Question 12

A company is setting up a new branch office and needs to connect it to the main office over the internet using a secure VPN. The branch office has a dynamic public IP address. Which type of VPN should be configured?

Accepted Answer

Dynamic Multipoint VPN (DMVPN). C is correct because Dynamic Multipoint VPN (DMVPN) is designed to handle sites with dynamic public IP addresses, such as a branch office with a dynamically assigned IP. DMVPN uses mGRE (multipoint Generic Routing Encapsulation) and NHRP (Next Hop Resolution Protocol) to dynamically establish tunnels between spoke routers without requiring static IP configurations on each spoke, making it ideal for this scenario.

Answer

Site-to-site IPsec VPN with static IPs

Answer

Remote access VPN using SSL

Answer

Policy-based VPN

Question 13

A company has a change management policy that requires all network changes to be approved and documented. An administrator needs to replace a faulty switch in the core network. According to best practices, which step should be performed after the replacement is complete?

Accepted Answer

Update the network diagram.. Updating the network diagram is the correct step because it ensures that the documentation accurately reflects the new switch's location, model, firmware version, and connections. This aligns with change management best practices, which require that all network changes be documented to maintain an accurate source of truth for troubleshooting, capacity planning, and future changes. Without this update, the diagram becomes stale, leading to potential misconfigurations or delays during incident response.

Answer

Roll back to the previous switch.

Answer

Notify users of the change.

Answer

Submit a change request.

Question 14

A company wants to allow employees to securely access internal resources (email, file servers) when working from home over the internet. Which technology should be implemented to create an encrypted tunnel between the employee's remote computer and the corporate network?

Accepted Answer

VPN concentrator. A VPN concentrator is the correct technology because it terminates VPN tunnels from remote users, creating an encrypted tunnel (using protocols like IPsec or TLS) between the employee's remote computer and the corporate network. This ensures that all traffic to internal resources such as email and file servers is securely encapsulated and protected from interception over the internet.

Answer

Firewall

Answer

DMZ

Answer

Intrusion detection system (IDS)

Question 15

A company wants to increase the bandwidth between two switches without upgrading the existing 1 Gbps copper links. Both switches support 802.3ad. Which technology should be implemented?

Accepted Answer

Link aggregation (LACP). Link aggregation using LACP (802.3ad) allows multiple 1 Gbps copper links to be combined into a single logical link, increasing bandwidth between the two switches without upgrading the physical interfaces. Since both switches support 802.3ad, they can negotiate and manage the aggregated link dynamically, providing both increased throughput and link redundancy.

Answer

VLAN trunking

Answer

Port mirroring

Answer

StackWise