N10-009 Practice Test 5 — 25 Questions

Question 1

A network administrator needs to identify which devices are generating the most traffic on a WAN link. The administrator requires detailed flow data including source and destination IP addresses, ports, and protocols. Which technology should be deployed?

Accepted Answer

NetFlow. NetFlow is the correct technology because it provides detailed flow-level data, including source and destination IP addresses, ports, and protocols, which is exactly what the administrator needs to identify which devices are generating the most traffic on a WAN link. Unlike SNMP or Syslog, NetFlow exports metadata about network flows, allowing for granular traffic analysis and bandwidth usage per conversation.

Answer

SNMP polling

Answer

Syslog

Answer

ICMP

Question 2

A network engineer is designing a new switched network and needs to ensure that broadcast traffic from one department does not reach another department's workstations. The engineer plans to use VLANs. Which of the following must be configured on the switches to isolate broadcast domains as intended?

Accepted Answer

Assign each department's workstations to a unique VLAN and configure their switch ports as access ports in that VLAN.. VLANs segment a switched network into separate broadcast domains at Layer 2. By assigning each department's workstations to a unique VLAN and configuring their switch ports as access ports in that VLAN, broadcast traffic from one VLAN is confined to that VLAN and cannot reach workstations in another VLAN. This achieves the isolation required without additional filtering devices.

Answer

Configure all switch ports as trunk ports and use VLAN 1 for all departments.

Answer

Place all workstations in the same VLAN and use a firewall to filter broadcast traffic between departments.

Answer

Configure each switch port as a trunk and use a different native VLAN for each department.

Question 3

A network administrator is experiencing issues where unauthorized devices are offering IP addresses to clients, causing connectivity problems. Which security feature should be enabled on switches to prevent this?

Accepted Answer

DHCP Snooping. C is correct because DHCP Snooping is a security feature that filters untrusted DHCP messages on a per-port basis, preventing unauthorized DHCP servers from offering IP addresses to clients. By configuring trusted ports (typically uplinks to legitimate DHCP servers) and untrusted ports (access ports), the switch drops DHCPOFFER and DHCPACK messages received on untrusted ports, directly stopping rogue DHCP server attacks.

Answer

Dynamic ARP Inspection (DAI)

Answer

IP Source Guard

Answer

Port Security

Question 4

A network administrator is troubleshooting a connectivity issue and suspects the problem is related to the physical cabling. At which layer of the OSI model should the administrator begin their investigation?

Accepted Answer

Physical layer. The Physical layer (Layer 1) is the correct starting point because the administrator suspects the problem is related to physical cabling. The Physical layer defines the electrical, mechanical, and procedural specifications for transmitting raw bits over a physical medium, such as copper or fiber optic cables. Troubleshooting at this layer involves checking for cable faults, signal degradation, or improper termination before moving up the OSI stack.

Answer

Transport layer

Answer

Data Link layer

Answer

Network layer

Question 5

A network administrator needs to schedule a firmware upgrade for a critical switch during a maintenance window. After the upgrade is completed and verified, which document should the administrator update to reflect the new firmware version?

Accepted Answer

Configuration baseline document. The configuration baseline document records the approved configuration of a network device, including firmware versions. After a firmware upgrade is verified, updating this document ensures that the baseline reflects the current, known-good state for change management and troubleshooting. The administrator must update the baseline to maintain configuration consistency and audit compliance.

Answer

Incident response plan

Answer

Network topology diagram

Answer

Change request form

Question 6

A network administrator needs to replace a core switch that is nearing end-of-life. According to change management best practices, which step should the administrator perform FIRST?

Accepted Answer

D. Option D is correct because, according to change management best practices, the first step is to create a detailed change request or plan that documents the scope, risk assessment, rollback procedures, and approval requirements. This ensures all stakeholders review and authorize the replacement before any physical work begins, minimizing network downtime and operational impact.

Answer

A

Answer

B

Answer

C

Question 7

A network engineer is implementing OSPF on a router. All directly connected neighbors are listed with state FULL, but routes from another area are not appearing in the routing table. Which of the following is the most likely cause?

Accepted Answer

The router has an ACL blocking inbound OSPF updates. Option B is correct because an ACL applied to the OSPF process or interface can filter inbound Type 3 LSAs (summary LSAs) from other areas. Even though neighbor adjacencies reach FULL state, the router will not install those inter-area routes into the routing table if the ACL blocks the LSA updates. This explains why directly connected neighbors are fine but routes from another area are missing.

Answer

The router is not configured with a router ID

Answer

The router is configured as an ABR but does not have a virtual-link configured

Answer

The link-state database is corrupted

Question 8

A network administrator needs to schedule a firmware upgrade for a critical router. Which document should be used to formally communicate the change, seek approval, and track the implementation?

Accepted Answer

A) Change management request. A change management request is the formal document used to communicate, seek approval, and track the implementation of a firmware upgrade on a critical router. This process ensures that the change is reviewed by stakeholders, risks are assessed, and a rollback plan is documented, which is essential for maintaining network stability and compliance with ITIL or organizational change control policies.

Answer

B) Network diagram

Answer

C) Service level agreement (SLA)

Answer

D) Baseline performance report

Question 9

A network administrator needs to update the firmware on a critical core switch. According to change management best practices, which step should be completed FIRST?

Accepted Answer

Test the firmware update in a lab environment. Before any change is applied to a production network device, the firmware update must first be validated in a controlled lab environment that mirrors the production configuration. This step ensures that the new firmware does not introduce compatibility issues with existing protocols (e.g., spanning-tree, VLAN configurations, or routing protocols like OSPF) and that the update process itself does not cause unexpected behavior. Skipping lab validation risks an outage that could have been prevented, making it the foundational step in change management.

Answer

Notify all users of a scheduled outage

Answer

Create a detailed rollback plan

Answer

Schedule the update during a maintenance window

Question 10

A company hosts a web server in a DMZ. The firewall has three interfaces: inside (corporate network), outside (Internet), and DMZ. Which firewall rule is necessary to allow external users to access the web server?

Accepted Answer

Allow traffic from the outside interface to the DMZ interface on port 80. Option A is correct because external users on the Internet (outside interface) need to reach the web server located in the DMZ. The firewall must permit inbound traffic from the outside zone to the DMZ zone on TCP port 80 (HTTP) to allow web requests while keeping the corporate network (inside) isolated from direct external access.

Answer

Allow traffic from the inside interface to the DMZ interface on port 80

Answer

Allow traffic from the outside interface to the inside interface on port 80

Answer

Deny all traffic by default and create no specific rules

Question 11

A company is connecting two buildings that are 300 meters apart. The link must support 10 Gbps. Which combination of cable and transceiver should be used?

Accepted Answer

Single-mode fiber with 10GBASE-LR. Option C is correct because single-mode fiber (SMF) with 10GBASE-LR supports 10 Gbps over distances up to 10 km, easily covering the 300-meter requirement. 10GBASE-LR uses 1310 nm laser optics over single-mode fiber, providing low signal loss and high bandwidth for long-reach links.

Answer

Cat6a UTP with 10GBASE-T

Answer

Cat5e UTP with 1000BASE-T

Answer

Multimode fiber with 10GBASE-SR

Question 12

A network engineer is configuring a new wireless LAN for a high-density environment such as a conference hall. The engineer needs to minimize co-channel interference. Which of the following should be configured on the access points?

Accepted Answer

Decrease transmit power. In a high-density environment like a conference hall, decreasing transmit power on access points reduces the cell size, which allows for more APs to be placed closer together without their coverage areas overlapping excessively. This minimizes co-channel interference by ensuring that APs on the same channel are physically separated, improving overall throughput and client performance.

Answer

Increase transmit power

Answer

Decrease beacon interval

Answer

Implement channel bonding

Question 13

A network engineer is troubleshooting connectivity issues between two data center switches that are configured to support jumbo frames with an MTU of 9000. The link is a 10 Gigabit Ethernet fiber connection. Large file transfers fail, but small transfers succeed. What is the most likely cause?

Accepted Answer

C. The most likely cause is that the MTU mismatch is causing large frames to be dropped. Jumbo frames of 9000 bytes require a consistent MTU across the entire Layer 2 path. If one switch is configured for 9000 and the other for the standard 1500, large frames will be silently discarded because the receiving switch cannot reassemble them. Small transfers succeed because they fit within the standard MTU.

Answer

A

Answer

B

Answer

D

Question 14

A network administrator wants to prevent unauthorized devices from connecting to the network through a switch port. Which security feature should be enabled on the switch?

Accepted Answer

802.1X. 802.1X is the correct answer because it provides port-based network access control (PNAC) that authenticates devices before granting network access. It uses the Extensible Authentication Protocol (EAP) over LAN (EAPoL) to communicate with a RADIUS server, ensuring only authorized users or devices can connect through the switch port. This prevents unauthorized devices from accessing the network at Layer 2, regardless of MAC address or IP configuration.

Answer

Port security

Answer

MAC filtering

Answer

Storm control

Question 15

A company is deploying a wireless network that must support both 2.4 GHz and 5 GHz frequency bands. Which IEEE 802.11 standard supports both bands and is backward compatible with older devices?

Accepted Answer

C) 802.11n. 802.11n (Wi-Fi 4) is the correct answer because it was the first standard to natively support both 2.4 GHz and 5 GHz bands simultaneously, using MIMO (Multiple Input Multiple Output) technology. It also maintains backward compatibility with older 802.11a/b/g devices through mandatory support for legacy modulation schemes (DSSS/CCK for 2.4 GHz and OFDM for 5 GHz).

Answer

A) 802.11b

Answer

B) 802.11g

Answer

D) 802.11ac

Question 16

A company wants to ensure that only authorized devices that comply with security policies (such as updated antivirus and OS patches) are allowed to connect to the internal network. Both wired and wireless connections are used. Which of the following security solutions would best enforce this requirement?

Accepted Answer

Network Access Control (NAC). Network Access Control (NAC) is the correct solution because it enforces security policies by inspecting the health and compliance of devices—such as checking for updated antivirus definitions and OS patches—before granting access to the network. NAC can operate on both wired (e.g., 802.1X) and wireless (e.g., WPA2-Enterprise with RADIUS) connections, blocking or quarantining non-compliant devices. This matches the requirement to ensure only authorized, policy-compliant devices connect.

Answer

VPN

Answer

Access control list (ACL)

Answer

Intrusion prevention system (IPS)

Question 17

A company wants to allow external users to access a web server located in the DMZ. The firewall has three interfaces: inside, outside, and DMZ. Which firewall rule is necessary?

Accepted Answer

B. Option B is correct because it allows traffic from the outside (external users) to the DMZ web server while keeping the inside network protected. In a three-legged firewall setup, the necessary rule permits inbound HTTP/HTTPS traffic from the outside interface to the DMZ interface, typically with a destination IP of the web server and port 80/443. This ensures external access is isolated from the internal network, adhering to the principle of least privilege.

Answer

A

Answer

C

Answer

D

Question 18

A network administrator needs to analyze bandwidth usage on a WAN link to determine which applications are generating the most traffic. The administrator requires detailed flow-level data including source/destination IP, ports, and protocol. Which technology should be used to collect this information?

Accepted Answer

NetFlow. NetFlow is the correct choice because it provides detailed flow-level data, including source and destination IP addresses, ports, and protocols, which is exactly what the administrator needs to analyze bandwidth usage per application on a WAN link. Unlike SNMP or Syslog, NetFlow captures per-flow metadata that allows identification of which applications are generating the most traffic.

Answer

SNMP

Answer

Syslog

Answer

ICMP

Question 19

A company wants to deploy a wireless network for employee devices using the highest security standard. The network will use a RADIUS server for authentication. Which authentication method should be configured?

Accepted Answer

802.1X/EAP. B is correct because 802.1X/EAP is the only option that provides enterprise-grade authentication using a RADIUS server. It requires each user to present unique credentials (e.g., username/password or certificate), which are verified by the RADIUS server before granting network access. This meets the requirement for the highest security standard in a corporate environment.

Answer

WPA3-SAE

Answer

WPA2-PSK

Answer

WEP with RADIUS

Question 20

A company wants to ensure that only users who have successfully authenticated Active Directory credentials can access the wired network. The network switches support IEEE 802.1X. Which additional component must be deployed to complete the solution?

Accepted Answer

A RADIUS server. IEEE 802.1X port-based authentication requires a RADIUS server to act as the authentication server. The switch (authenticator) forwards the user's credentials to the RADIUS server, which validates them against Active Directory and returns an accept or reject decision. Without a RADIUS server, the switch has no way to verify the user's credentials against the central identity store.

Answer

A DHCP server

Answer

A certificate authority

Answer

A TACACS+ server