N10-009 Practice Test 4 — 25 Questions

Question 1

A security engineer is configuring port security on a switch to prevent unauthorized devices from connecting. The requirement is that only the first device to connect to a port is allowed, and if a different device connects, the port should be disabled. Which port security violation mode should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Shutdown. The 'shutdown' violation mode disables the port entirely when a violation occurs, which meets the requirement that the port be disabled if a different device connects. This is the only mode that physically err-disables the port, preventing any further traffic until manually re-enabled.

Answer

Protect

Answer

Restrict

Answer

Sticky

Question 2

A security auditor discovers that an unauthorized switch has been connected to an access port in the wiring closet. The rogue switch caused a network loop and disrupted connectivity. Which security feature, if enabled on the access port, would have prevented this by disabling the port when a BPDU is received?

Accepted Answer

BPDU guard. BPDU guard is the correct answer because it is specifically designed to protect against rogue switch connections on access ports. When enabled, if a port receives any Bridge Protocol Data Unit (BPDU), it immediately places the port into an errdisable state, effectively disabling it and preventing a potential network loop. This directly addresses the scenario where an unauthorized switch connected to an access port caused a loop.

Answer

Root guard

Answer

Loop guard

Answer

UDLD

Question 3

A network engineer needs to create subnets for four departments, each requiring at least 50 host addresses. The available network is 192.168.1.0/24. Which subnet mask should be used to satisfy the requirements while minimizing wasted addresses?

Accepted Answer

/26 (255.255.255.192). A /26 subnet mask (255.255.255.192) provides 62 usable host addresses per subnet (2^(32-26) - 2 = 62), which meets the requirement of at least 50 hosts per department. With a /24 network, you can create exactly four /26 subnets (192.168.1.0/26, 192.168.1.64/26, 192.168.1.128/26, 192.168.1.192/26), perfectly matching the four departments while minimizing wasted addresses.

Answer

/25 (255.255.255.128)

Answer

/27 (255.255.255.224)

Answer

/24 (255.255.255.0)

Question 4

A workstation with IP address 10.0.1.5/24 needs to communicate with a server at 10.0.2.10/24. The workstation's default gateway is configured as 10.0.1.1. Which of the following will the workstation do with the IP packets destined for the server?

Accepted Answer

Send the packets to the default gateway.. The workstation's IP address (10.0.1.5/24) and the server's IP address (10.0.2.10/24) are on different subnets (10.0.1.0/24 vs. 10.0.2.0/24). When a host determines that the destination is not on the same local network, it will not attempt direct delivery via ARP. Instead, it forwards the IP packet to its configured default gateway (10.0.1.1), which then routes the packet toward the server's subnet.

Answer

Send the packets directly to the server using ARP.

Answer

Send the packets to the DNS server for resolution.

Answer

Drop the packets because the server is on a different network.

Question 5

Users in a warehouse report that their wireless tablets lose connectivity when moving near large metal racks. The signal strength remains high but throughput drops significantly. What is the most likely cause?

Accepted Answer

Multipath interference. When wireless signals reflect off large metal surfaces, multiple copies of the signal arrive at the receiver at slightly different times, causing multipath interference. This phase cancellation effect corrupts the signal, forcing the 802.11 MAC layer to retransmit frames, which drastically reduces throughput even though the received signal strength indicator (RSSI) remains high. The metal racks in the warehouse act as reflective surfaces, creating a classic multipath environment.

Answer

Signal attenuation

Answer

Co-channel interference

Answer

Insufficient DHCP scope

Question 6

An organization wants to centrally manage and monitor network devices from a single interface. The solution should support auto-discovery, configuration management, and performance monitoring. Which type of system should be deployed?

Accepted Answer

Network Management System (NMS). A Network Management System (NMS) is the correct choice because it provides a centralized interface for auto-discovery (e.g., via SNMP or CDP/LLDP), configuration management (e.g., using NETCONF or CLI scripting), and performance monitoring (e.g., polling SNMP MIBs or streaming telemetry). This directly matches the requirement for a single-pane-of-glass solution for network device lifecycle management.

Answer

AAA server

Answer

SIEM

Answer

DHCP server

Question 7

Which of the following security mechanisms requires a user to authenticate before gaining access to the wired network at a switch port?

Accepted Answer

802.1X. 802.1X is a port-based Network Access Control (NAC) standard (IEEE 802.1X) that requires a user or device to authenticate via an authentication server (e.g., RADIUS) before the switch port transitions from an unauthorized to an authorized state, allowing full network access. It uses Extensible Authentication Protocol (EAP) over LAN (EAPoL) to carry authentication messages between the supplicant (client), authenticator (switch), and authentication server. This ensures that only authenticated users can access the wired network at the switch port level.

Answer

Port security

Answer

ACL

Answer

MAC authentication

Question 8

A router receives a packet destined for 10.0.0.15. It has the following routes in the routing table: 10.0.0.0/8 via 192.168.1.1, 10.0.0.0/16 via 192.168.2.1, 0.0.0.0/0 via 192.168.3.1. Which route will be used?

Accepted Answer

10.0.0.0/16 via 192.168.2.1. The router will use the route 10.0.0.0/16 via 192.168.2.1 because it has the longest prefix match (16 bits) for the destination 10.0.0.15. The /16 route is more specific than the /8 route and the default route, so it is preferred regardless of administrative distance or metric.

Answer

Default route (0.0.0.0/0)

Answer

10.0.0.0/8 via 192.168.1.1

Answer

None; the packet is dropped

Question 9

A network engineer needs to connect two devices that are 150 meters apart with a 10 Gbps link. Which cabling type is most suitable?

Accepted Answer

Single-mode fiber. Single-mode fiber (SMF) is the correct choice because it supports 10 Gbps transmission over distances well beyond 150 meters, typically up to 10 km or more using 10GBASE-LR optics. In contrast, copper cabling like Cat6a or Cat7 is limited to 100 meters for 10GBASE-T, and multimode fiber (MMF) with 10GBASE-SR is limited to about 300-400 meters depending on the fiber grade (e.g., OM3/OM4), but SMF provides the most reliable and future-proof solution for this distance.

Answer

Cat6a UTP

Answer

Cat7 STP

Answer

Multimode fiber

Question 10

A network technician configures an 802.1Q trunk link between two switches. After the configuration, VLAN 20 traffic is not passing across the trunk, although VLAN 10 traffic works fine. The technician verifies that both switches have VLAN 20 created and that the trunk is up. What is the most likely cause?

Accepted Answer

VLAN 20 is not included in the allowed VLAN list on the trunk.. The most likely cause is that VLAN 20 is not included in the allowed VLAN list on the trunk. By default, an 802.1Q trunk allows all VLANs, but if the allowed VLAN list has been manually configured or pruned, VLAN 20 may have been excluded. Since VLAN 10 works, the trunk is operational, and both switches have VLAN 20 created, the issue is specifically that the trunk is not permitting VLAN 20 traffic.

Answer

The native VLAN is mismatched between the switches.

Answer

The trunk port is set to dynamic desirable mode.

Answer

The encapsulation type is ISL instead of 802.1Q.

Question 11

A network administrator is configuring a router-on-a-stick to route between two VLANs (VLAN 10 and VLAN 20). The router has two subinterfaces: GigabitEthernet0/1.10 with encapsulation dot1Q 10 and IP 10.10.10.1/24, and GigabitEthernet0/1.20 with encapsulation dot1Q 20 and IP 10.10.20.1/24. The switch port connected to the router is configured as an access port in VLAN 10. Hosts in VLAN 10 can ping the router's VLAN 10 interface, but hosts in VLAN 20 cannot ping the router's VLAN 20 interface. What is the most likely cause?

Accepted Answer

The switch port connecting to the router should be configured as a trunk.. The router-on-a-stick design requires the switch port connecting to the router to be configured as a trunk port, not an access port. An access port only carries traffic for a single VLAN (VLAN 10 in this case), so frames from VLAN 20 are dropped at the switch port before reaching the router. Configuring the port as a trunk with allowed VLANs 10 and 20 would enable the router's subinterfaces to receive and forward traffic for both VLANs.

Answer

The router subinterface for VLAN 20 is not enabled.

Answer

The hosts in VLAN 20 do not have a default gateway configured.

Answer

The router's VLAN 20 subinterface has an incorrect IP address.

Question 12

A network engineer is troubleshooting a communication issue between two hosts. The engineer determines that the data is being segmented at the source and reassembled at the destination, but the segments are arriving out of order. Which OSI layer is responsible for sequencing the segments?

Accepted Answer

D) Transport layer. The Transport layer (Layer 4) is responsible for end-to-end communication, including segmentation, reassembly, and sequencing of data segments. Protocols like TCP use sequence numbers to order segments correctly at the destination, even if they arrive out of order. This ensures the upper layers receive a complete, ordered data stream.

Answer

A) Physical layer

Answer

B) Data Link layer

Answer

C) Network layer

Question 13

A network administrator is troubleshooting communication between two switches connected via a trunk port. The trunk link is up/up, but devices in VLAN 20 cannot communicate across the trunk. The administrator has verified that both switches have VLAN 20 created and that the access ports are configured correctly. Which command should the administrator run on each switch to verify the trunk's allowed VLAN list?

Accepted Answer

show interfaces trunk. The 'show interfaces trunk' command displays the trunking status, including the allowed VLAN list on the trunk port. Since the trunk link is up/up but VLAN 20 traffic fails, the most likely cause is that VLAN 20 is not included in the allowed VLAN list on one or both switches. This command directly shows which VLANs are permitted, pruned, or active on the trunk.

Answer

show vlan brief

Answer

show running-config interface

Answer

show mac address-table

Question 14

A security administrator is configuring a wireless network to use WPA3-Enterprise. Which authentication server protocol is required for WPA3-Enterprise?

Accepted Answer

RADIUS. WPA3-Enterprise requires 802.1X/EAP authentication, which uses RADIUS as the backend authentication server protocol. RADIUS handles the exchange of EAP frames between the authenticator (access point) and the authentication server, enforcing per-user credentials and supporting the mandatory 192-bit security suite for WPA3-Enterprise. Without RADIUS, the 802.1X framework cannot operate, making it the only required protocol for this deployment.

Answer

LDAP

Answer

TACACS+

Answer

Kerberos

Question 15

A user reports that they can connect to the corporate Wi-Fi network but cannot access any network resources including the intranet and internet. The IP configuration shows an IP address of 169.254.25.100 with a subnet mask of 255.255.0.0. What is the most likely cause?

Accepted Answer

The DHCP server is unavailable or the request is not reaching it. The IP address 169.254.25.100 with a subnet mask of 255.255.0.0 is an Automatic Private IP Addressing (APIPA) address, which is assigned by the operating system when a DHCP server is unavailable or the DHCP request fails. Since the user can connect to Wi-Fi but cannot access any network resources, the most likely cause is that the DHCP server is not responding or the DHCP discover/offer/request/ack sequence is failing, leaving the device with a link-local address that cannot route to the corporate network or internet.

Answer

The DNS server is not responding

Answer

The subnet mask is incorrect

Answer

The switch port has port security enabled that has blocked the device

Question 16

A network technician is explaining the difference between TCP and UDP to a junior technician. Which of the following correctly identifies a characteristic of TCP but NOT of UDP?

Accepted Answer

It uses a three-way handshake to establish a connection before data transfer.. TCP is a connection-oriented protocol that uses a three-way handshake (SYN, SYN-ACK, ACK) to establish a reliable connection before any data is transmitted, ensuring ordered delivery and error recovery. UDP, in contrast, is connectionless and sends datagrams without any prior setup, making the three-way handshake a defining characteristic of TCP only.

Answer

It provides connectionless communication with minimal overhead.

Answer

It supports multicast and broadcast transmissions.

Answer

It is commonly used for real-time applications like VoIP and video streaming.

Question 17

A security analyst notices that a user's workstation is sending encrypted DNS queries to an external IP address over TCP port 853. This traffic is being used to establish a covert communication channel to bypass the company's security controls. Which technique is being employed?

Accepted Answer

DNS tunneling. DNS tunneling is the correct answer because the analyst observed encrypted DNS queries over TCP port 853 (DNS over TLS) being used to establish a covert communication channel. This technique encapsulates non-DNS data (e.g., command-and-control traffic) within DNS query and response packets, allowing the attacker to bypass security controls by hiding malicious traffic inside legitimate DNS traffic.

Answer

DNS poisoning

Answer

DNS amplification

Answer

DNS zone transfer

Question 18

A network administrator wants to collect logs from multiple routers and switches to a central server for analysis. Which protocol should be configured on the devices to send logs to the server?

Accepted Answer

Syslog. Syslog (RFC 5424) is the standard protocol for sending event messages (logs) from network devices like routers and switches to a central log server. It uses UDP port 514 by default (or TCP 6514 for reliable delivery) and allows administrators to collect, store, and analyze system messages from multiple devices in one location.

Answer

SNMP

Answer

NetFlow

Answer

TFTP

Question 19

A network engineer needs to install 15 wireless access points that each require 25W of power. The available switch provides PoE+ (802.3at) with a total power budget of 740W. The engineer also needs to connect 10 IP cameras that each require 12W. Which of the following should the engineer verify before proceeding with the installation?

Accepted Answer

The total power consumption of all devices does not exceed the switch's power budget.. The total power required is 15 APs × 25W + 10 cameras × 12W = 375W + 120W = 495W, which is well below the switch's 740W PoE+ budget. However, the engineer must verify that the cumulative power draw does not exceed the budget, as exceeding it would cause some ports to be denied power or shut down. This is the fundamental prerequisite for any PoE deployment.

Answer

The switch supports LLDP-MED for power negotiation.

Answer

All PoE devices are from the same manufacturer.

Answer

The cable length does not exceed 150 meters.

Question 20

A network has a single switch with VLANs 10, 20, and 30 configured. The switch is connected to a router that has three subinterfaces, each in a different VLAN. How many broadcast domains are present?

Accepted Answer

3. Each VLAN is a separate Layer 2 broadcast domain. With VLANs 10, 20, and 30 configured on the switch and a router using subinterfaces to route between them, there are exactly three broadcast domains — one per VLAN. Broadcasts are confined to their VLAN and do not cross VLAN boundaries without a Layer 3 device.

Answer

1

Answer

4

Answer

5