N10-009 Practice Test 4 — 25 Questions

Question 1

A network technician configures an 802.1Q trunk link between two switches. After the configuration, VLAN 20 traffic is not passing across the trunk, although VLAN 10 traffic works fine. The technician verifies that both switches have VLAN 20 created and that the trunk is up. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VLAN 20 is not included in the allowed VLAN list on the trunk.. The most likely cause is that VLAN 20 is not included in the allowed VLAN list on the trunk. By default, an 802.1Q trunk allows all VLANs, but if the allowed VLAN list has been manually configured or pruned, VLAN 20 may have been excluded. Since VLAN 10 works, the trunk is operational, and both switches have VLAN 20 created, the issue is specifically that the trunk is not permitting VLAN 20 traffic.

Answer

The native VLAN is mismatched between the switches.

Answer

The trunk port is set to dynamic desirable mode.

Answer

The encapsulation type is ISL instead of 802.1Q.

Question 2

A network administrator is configuring a router-on-a-stick to route between two VLANs (VLAN 10 and VLAN 20). The router has two subinterfaces: GigabitEthernet0/1.10 with encapsulation dot1Q 10 and IP 10.10.10.1/24, and GigabitEthernet0/1.20 with encapsulation dot1Q 20 and IP 10.10.20.1/24. The switch port connected to the router is configured as an access port in VLAN 10. Hosts in VLAN 10 can ping the router's VLAN 10 interface, but hosts in VLAN 20 cannot ping the router's VLAN 20 interface. What is the most likely cause?

Accepted Answer

The switch port connecting to the router should be configured as a trunk.. The router-on-a-stick design requires the switch port connecting to the router to be configured as a trunk port, not an access port. An access port only carries traffic for a single VLAN (VLAN 10 in this case), so frames from VLAN 20 are dropped at the switch port before reaching the router. Configuring the port as a trunk with allowed VLANs 10 and 20 would enable the router's subinterfaces to receive and forward traffic for both VLANs.

Answer

The router subinterface for VLAN 20 is not enabled.

Answer

The hosts in VLAN 20 do not have a default gateway configured.

Answer

The router's VLAN 20 subinterface has an incorrect IP address.

Question 3

A network engineer is troubleshooting a communication issue between two hosts. The engineer determines that the data is being segmented at the source and reassembled at the destination, but the segments are arriving out of order. Which OSI layer is responsible for sequencing the segments?

Accepted Answer

D) Transport layer. The Transport layer (Layer 4) is responsible for end-to-end communication, including segmentation, reassembly, and sequencing of data segments. Protocols like TCP use sequence numbers to order segments correctly at the destination, even if they arrive out of order. This ensures the upper layers receive a complete, ordered data stream.

Answer

A) Physical layer

Answer

B) Data Link layer

Answer

C) Network layer

Question 4

A network administrator is troubleshooting communication between two switches connected via a trunk port. The trunk link is up/up, but devices in VLAN 20 cannot communicate across the trunk. The administrator has verified that both switches have VLAN 20 created and that the access ports are configured correctly. Which command should the administrator run on each switch to verify the trunk's allowed VLAN list?

Accepted Answer

show interfaces trunk. The 'show interfaces trunk' command displays the trunking status, including the allowed VLAN list on the trunk port. Since the trunk link is up/up but VLAN 20 traffic fails, the most likely cause is that VLAN 20 is not included in the allowed VLAN list on one or both switches. This command directly shows which VLANs are permitted, pruned, or active on the trunk.

Answer

show vlan brief

Answer

show running-config interface

Answer

show mac address-table

Question 5

A security administrator is configuring a wireless network to use WPA3-Enterprise. Which authentication server protocol is required for WPA3-Enterprise?

Accepted Answer

RADIUS. WPA3-Enterprise requires 802.1X/EAP authentication, which uses RADIUS as the backend authentication server protocol. RADIUS handles the exchange of EAP frames between the authenticator (access point) and the authentication server, enforcing per-user credentials and supporting the mandatory 192-bit security suite for WPA3-Enterprise. Without RADIUS, the 802.1X framework cannot operate, making it the only required protocol for this deployment.

Answer

LDAP

Answer

TACACS+

Answer

Kerberos

Question 6

A user reports that they can connect to the corporate Wi-Fi network but cannot access any network resources including the intranet and internet. The IP configuration shows an IP address of 169.254.25.100 with a subnet mask of 255.255.0.0. What is the most likely cause?

Accepted Answer

The DHCP server is unavailable or the request is not reaching it. The IP address 169.254.25.100 with a subnet mask of 255.255.0.0 is an Automatic Private IP Addressing (APIPA) address, which is assigned by the operating system when a DHCP server is unavailable or the DHCP request fails. Since the user can connect to Wi-Fi but cannot access any network resources, the most likely cause is that the DHCP server is not responding or the DHCP discover/offer/request/ack sequence is failing, leaving the device with a link-local address that cannot route to the corporate network or internet.

Answer

The DNS server is not responding

Answer

The subnet mask is incorrect

Answer

The switch port has port security enabled that has blocked the device

Question 7

A network technician is explaining the difference between TCP and UDP to a junior technician. Which of the following correctly identifies a characteristic of TCP but NOT of UDP?

Accepted Answer

It uses a three-way handshake to establish a connection before data transfer.. TCP is a connection-oriented protocol that uses a three-way handshake (SYN, SYN-ACK, ACK) to establish a reliable connection before any data is transmitted, ensuring ordered delivery and error recovery. UDP, in contrast, is connectionless and sends datagrams without any prior setup, making the three-way handshake a defining characteristic of TCP only.

Answer

It provides connectionless communication with minimal overhead.

Answer

It supports multicast and broadcast transmissions.

Answer

It is commonly used for real-time applications like VoIP and video streaming.

Question 8

A security analyst notices that a user's workstation is sending encrypted DNS queries to an external IP address over TCP port 853. This traffic is being used to establish a covert communication channel to bypass the company's security controls. Which technique is being employed?

Accepted Answer

DNS tunneling. DNS tunneling is the correct answer because the analyst observed encrypted DNS queries over TCP port 853 (DNS over TLS) being used to establish a covert communication channel. This technique encapsulates non-DNS data (e.g., command-and-control traffic) within DNS query and response packets, allowing the attacker to bypass security controls by hiding malicious traffic inside legitimate DNS traffic.

Answer

DNS poisoning

Answer

DNS amplification

Answer

DNS zone transfer

Question 9

A network administrator wants to collect logs from multiple routers and switches to a central server for analysis. Which protocol should be configured on the devices to send logs to the server?

Accepted Answer

Syslog. Syslog (RFC 5424) is the standard protocol for sending event messages (logs) from network devices like routers and switches to a central log server. It uses UDP port 514 by default (or TCP 6514 for reliable delivery) and allows administrators to collect, store, and analyze system messages from multiple devices in one location.

Answer

SNMP

Answer

NetFlow

Answer

TFTP

Question 10

A network engineer needs to install 15 wireless access points that each require 25W of power. The available switch provides PoE+ (802.3at) with a total power budget of 740W. The engineer also needs to connect 10 IP cameras that each require 12W. Which of the following should the engineer verify before proceeding with the installation?

Accepted Answer

The total power consumption of all devices does not exceed the switch's power budget.. The total power required is 15 APs × 25W + 10 cameras × 12W = 375W + 120W = 495W, which is well below the switch's 740W PoE+ budget. However, the engineer must verify that the cumulative power draw does not exceed the budget, as exceeding it would cause some ports to be denied power or shut down. This is the fundamental prerequisite for any PoE deployment.

Answer

The switch supports LLDP-MED for power negotiation.

Answer

All PoE devices are from the same manufacturer.

Answer

The cable length does not exceed 150 meters.

Question 11

A network has a single switch with VLANs 10, 20, and 30 configured. The switch is connected to a router that has three subinterfaces, each in a different VLAN. How many broadcast domains are present?

Accepted Answer

3. Each VLAN is a separate Layer 2 broadcast domain. With VLANs 10, 20, and 30 configured on the switch and a router using subinterfaces to route between them, there are exactly three broadcast domains — one per VLAN. Broadcasts are confined to their VLAN and do not cross VLAN boundaries without a Layer 3 device.

Answer

1

Answer

4

Answer

5

Question 12

A network engineer needs to connect two switches located 400 meters apart. The cable run includes high electromagnetic interference from nearby machinery. The engineer decides to use fiber optic cabling. Which transceiver type and fiber combination should be used to ensure the link reaches 400 meters while remaining cost-effective?

Accepted Answer

Multimode fiber with 1000BASE-SX transceivers. 1000BASE-SX transceivers over multimode fiber (typically OM2 or OM3) can reliably reach 400 meters at 1 Gbps, and this combination is cost-effective for short-to-medium distances. Multimode fiber uses a larger core that is cheaper to terminate and pair with lower-cost VCSEL-based SX optics, making it ideal for runs under 550 meters in environments with high EMI.

Answer

Single-mode fiber with 1000BASE-LX transceivers

Answer

Multimode fiber with 10GBASE-SR transceivers

Answer

Single-mode fiber with 1000BASE-EX transceivers

Question 13

A network engineer is configuring a new wireless LAN for a high-density environment such as a conference hall. The engineer needs to minimize co-channel interference. Which of the following should be configured on the access points?

Accepted Answer

Decrease transmit power. In a high-density environment like a conference hall, decreasing transmit power on access points reduces the cell size, which allows for more APs to be placed closer together without their coverage areas overlapping excessively. This minimizes co-channel interference by ensuring that APs on the same channel are physically separated, improving overall throughput and client performance.

Answer

Increase transmit power

Answer

Decrease beacon interval

Answer

Implement channel bonding

Question 14

A network administrator is configuring OSPF on a router that has interfaces in only one area and does not perform route redistribution. Which OSPF router type best describes this router?

Accepted Answer

Internal router. An internal router has all its interfaces in a single OSPF area and does not perform route redistribution. Since the router's interfaces are confined to one area and it does not connect to other routing domains, it fits the definition of an internal router. This type of router maintains a single link-state database for that area and does not generate Type 3 or Type 5 LSAs.

Answer

Backbone router

Answer

Area Border Router (ABR)

Answer

Autonomous System Boundary Router (ASBR)

Question 15

A user calls the help desk stating that they cannot access any network resources. The technician asks the user to run ipconfig and the output shows an IP address of 169.254.15.20 with a subnet mask of 255.255.0.0. Which of the following is the most likely cause?

Accepted Answer

The DHCP server is unreachable. The IP address 169.254.15.20 with a subnet mask of 255.255.0.0 is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when a DHCP client fails to receive a lease from a DHCP server. Since the user cannot access any network resources, the most likely cause is that the DHCP server is unreachable, preventing the client from obtaining a valid IP address, default gateway, and DNS server settings.

Answer

The DNS server is not responding

Answer

The default gateway is misconfigured

Answer

There is a duplicate IP address on the network

Question 16

Which device operates at Layer 1 (Physical) of the OSI model and regenerates electrical signals to extend the distance of a network segment?

Accepted Answer

Hub. A hub operates at Layer 1 (Physical) of the OSI model. It receives incoming electrical signals on one port and regenerates (repeats) those signals out to all other ports, effectively extending the physical reach of a network segment. Unlike switches or routers, it performs no frame inspection or forwarding decisions.

Answer

Switch

Answer

Router

Answer

Bridge

Question 17

A network engineer is configuring a router to provide IPv6 addressing via SLAAC for hosts on a subnet. The ISP has delegated a prefix 2001:db8:1::/48 and requires the router to advertise a specific prefix 2001:db8:1:1::/64. Which command must be configured on the router's interface to advertise this prefix?

Accepted Answer

ipv6 nd prefix. The 'ipv6 nd prefix' command is used on a router interface to advertise a specific IPv6 prefix in Router Advertisement (RA) messages for Stateless Address Autoconfiguration (SLAAC). This command allows the network engineer to override the default prefix derived from the interface address and explicitly advertise the delegated prefix 2001:db8:1:1::/64 as required by the ISP.

Answer

ipv6 address autoconfig

Answer

ipv6 unicast-routing

Answer

ipv6 dhcp server

Question 18

A network engineer plans to change the routing protocol configuration on a core router that will affect all branch connectivity. According to change management best practices, which step should the engineer perform BEFORE implementing the change?

Accepted Answer

Create a detailed rollback plan. Creating a detailed rollback plan is a fundamental change management best practice because it ensures that if the routing protocol reconfiguration (e.g., switching from EIGRP to OSPF or modifying redistribution) causes connectivity loss to all branches, the engineer can revert to the previous configuration quickly and safely. Without a rollback plan, a failed change could result in prolonged network downtime while troubleshooting from scratch, violating the principle of minimizing business impact. This step is performed before implementation to predefine the exact commands or backup configuration needed to restore the original routing state.

Answer

Implement the change during business hours to ensure staff availability

Answer

Notify all users after the change is complete

Answer

Test the change directly on the production router

Question 19

A network administrator has configured a router to send syslog messages to a server with the command 'logging trap 4'. The administrator notices that the syslog server is receiving messages with severity levels 0, 1, and 2. Which of the following best explains why these messages are being received?

Accepted Answer

Syslog severity levels are reversed; lower numbers indicate higher urgency, so trap 4 includes levels 0-4.. C is correct because in syslog, severity levels are inverted: lower numbers indicate higher urgency (0=emergency, 1=alert, 2=critical). The command 'logging trap 4' sets a threshold that includes all messages with a severity level of 4 or lower (i.e., more urgent), so levels 0, 1, and 2 are included. This is defined in RFC 5424 and is standard behavior on Cisco IOS devices.

Answer

The 'trap' level indicates the minimum severity; only messages with severity 4 and above are sent.

Answer

The router is misconfigured and sending all messages regardless of the trap level.

Answer

The syslog server is configured to accept only levels 0-2, so it filters out the others.

Question 20

A network technician needs to discover directly connected network devices and their capabilities for documentation purposes. Which protocol should be used?

Accepted Answer

LLDP. LLDP (Link Layer Discovery Protocol) is the correct choice because it is an IEEE 802.1AB standard protocol specifically designed to discover directly connected network devices and their capabilities, such as system name, port description, VLAN information, and management addresses. Unlike proprietary protocols, LLDP operates at Layer 2 and allows any vendor's equipment to advertise and learn about neighbors without requiring IP connectivity or a management station.

Answer

SNMP

Answer

ICMP

Answer

ARP