N10-009 Practice Test 26 — 15 Questions

Question 1

A company is implementing a DMZ to host public-facing web and email servers. The DMZ network uses private IP addresses, and the internal network also uses private IP addresses. The company has only one public IP address assigned to the border router's external interface. Which of the following should be configured to allow internet users to access the DMZ servers?

Accepted Answer

Port forwarding to the private IP addresses of the servers.. Port forwarding (often configured as static NAT with a single public IP) allows the border router to forward incoming traffic on specific TCP/UDP ports (e.g., 80 for web, 25 for SMTP) to the private IP addresses of the DMZ servers. Since the company has only one public IP, this is the only way to direct external requests to the correct internal server without requiring multiple public IPs.

Answer

NAT with overload to translate multiple internal addresses to the single public IP.

Answer

Static NAT mapping each DMZ server to a unique public IP.

Answer

A VPN tunnel between the DMZ and the internal network.

Question 2

A company wants to prevent unauthorized devices from connecting to the corporate network. The policy requires that only specific MAC addresses are permitted on switch ports. Which security feature should be implemented on the switches?

Accepted Answer

MAC filtering / Port security. MAC filtering, also known as port security, is the correct feature because it allows the switch to restrict access to a port based on the source MAC address of incoming frames. By configuring a list of allowed MAC addresses, the switch will drop traffic from any unauthorized device, directly enforcing the policy that only specific MAC addresses are permitted on switch ports.

Answer

802.1X authentication

Answer

VLAN hopping prevention

Answer

DHCP snooping

Question 3

A company wants to ensure that only devices with known MAC addresses can connect to the guest Wi-Fi network. Which security feature should be configured on the wireless controller?

Accepted Answer

MAC filtering. MAC filtering allows the wireless controller to maintain an allowlist of known MAC addresses, so only devices with those addresses can associate with the guest SSID. This directly meets the requirement to restrict access based on MAC addresses without requiring authentication credentials from users.

Answer

WPA2-Enterprise

Answer

802.1X

Answer

WPA3-Personal

Question 4

A network administrator needs to upgrade the firmware on a critical core router. The admin has downloaded the new firmware and verified its checksum. Which of the following should the admin do before proceeding with the installation?

Accepted Answer

Back up the current router configuration. Before upgrading firmware on a critical core router, backing up the current configuration ensures that if the upgrade fails or causes unexpected behavior, the original operational state can be restored quickly. This is a standard best practice in network operations to minimize downtime and avoid manual reconfiguration of complex routing protocols, ACLs, and interface settings.

Answer

Change the management IP address

Answer

Disable all physical interfaces

Answer

Remove the old firmware image

Question 5

A network administrator is configuring a new switch for management access via SSH. Which step must be performed FIRST?

Accepted Answer

Configure an IP address on the management VLAN.. Before SSH can function, the switch must have an IP address assigned to the management VLAN (typically VLAN 1 or a dedicated management VLAN) so that the switch is reachable over the network. Without this IP configuration, the switch cannot establish the TCP/IP connectivity required for SSH sessions, making it the foundational step that must be performed first.

Answer

Generate RSA key pair.

Answer

Configure a VTY password.

Answer

Enable SSH version 2.

Question 6

A technician is troubleshooting a user's inability to connect to a server. The technician runs 'tracert' from the user's workstation and sees that traffic stops at a particular router. The last hop shows a timeout. Which of the following is the most likely cause?

Accepted Answer

The next hop router is unreachable from that router.. The 'tracert' command relies on ICMP Time Exceeded messages from intermediate routers to map the path. When traffic stops at a particular router and the next hop shows a timeout, it indicates that the router cannot forward the packet to the next hop, meaning the next hop router is unreachable. This is the most direct cause because the traceroute fails to receive a response from the next hop, not because the destination is off or ICMP is blocked.

Answer

The destination server is powered off.

Answer

The router is blocking ICMP echo requests.

Answer

There is a routing loop.

Question 7

Which of the following is a characteristic of UDP?

Accepted Answer

Has lower overhead than TCP. UDP (User Datagram Protocol) is a connectionless transport-layer protocol that provides minimal overhead compared to TCP. It does not establish a connection before sending data, nor does it provide reliability, flow control, or error recovery, making it ideal for real-time applications like VoIP and streaming where speed is prioritized over guaranteed delivery.

Answer

Provides guaranteed delivery

Answer

Uses sequence numbers

Answer

Supports three-way handshake

Question 8

A network administrator has configured a switch with four VLANs: VLAN 10, 20, 30, and 99 (native). The switch is connected to a router via an 802.1Q trunk link. The router has subinterfaces for VLANs 10, 20, and 30, each with an IP address. VLAN 99 is used for management and does not have a router subinterface. How many Layer 3 broadcast domains exist in this network?

Accepted Answer

4. Each VLAN is a separate Layer 2 broadcast domain, and a router subinterface provides the default gateway for that VLAN, creating a corresponding Layer 3 broadcast domain. VLAN 99 (native) has no router subinterface, so it does not have a Layer 3 broadcast domain. Therefore, only VLANs 10, 20, and 30 have Layer 3 broadcast domains, totaling 3.

Answer

1

Answer

2

Answer

3

Question 9

A company is deploying a new wireless network for a small office. The network will consist of three access points. The IT manager wants the APs to automatically coordinate radio frequency settings and client roaming without a dedicated controller. Which technology should be implemented?

Accepted Answer

Cloud-managed access points. Cloud-managed access points (APs) are the correct choice because they can automatically coordinate radio frequency (RF) settings and client roaming without a dedicated on-premises controller. The cloud-based management platform handles channel selection, power adjustment, and fast roaming (e.g., 802.11r/k/v) by communicating with each AP over the internet, making it ideal for a small office with only three APs.

Answer

Mesh network

Answer

Controller-based wireless

Answer

Standalone APs

Question 10

A network administrator discovers that client workstations are receiving IP addresses from an unknown device, causing network connectivity issues. Which security feature should be configured on switches to prevent rogue DHCP servers from assigning IP addresses?

Accepted Answer

DHCP snooping. DHCP snooping is the correct security feature because it acts as a firewall between untrusted hosts and trusted DHCP servers. By configuring ports as trusted (where legitimate DHCP servers are connected) and untrusted (client-facing ports), the switch drops all DHCP server messages (OFFER, ACK, NAK) received on untrusted ports, effectively blocking rogue DHCP servers from assigning IP addresses.

Answer

Dynamic ARP Inspection

Answer

Port security

Answer

BPDU guard

Question 11

A network administrator is configuring a firewall to allow external users to securely access an internal web server. Which security technique should be used to place the web server in a separate, isolated network segment that is still accessible from the internet?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a separate, isolated network segment that exposes internal services, such as a web server, to external users while keeping the internal LAN secure. By placing the web server in the DMZ, the firewall can allow inbound traffic from the internet to the DMZ while blocking direct access to the internal network, enforcing strict access control policies.

Answer

VLAN

Answer

VPN

Answer

NAT

Question 12

A network administrator is configuring a syslog server to receive logs from network devices. The administrator wants to capture all messages with a severity level of 'critical' (2) and higher (more severe). What severity threshold should be set on the devices?

Accepted Answer

2 (critical). Syslog severity levels are numbered 0 (most severe) through 7 (least severe). When you set a severity threshold on a device, it captures messages at that level and all lower-numbered (more severe) levels. To capture 'critical' (2) and higher (i.e., levels 0, 1, and 2), you must set the threshold to 2. Option C is correct because level 2 includes itself and all more severe levels (0 and 1).

Answer

0 (emergency)

Answer

1 (alert)

Answer

3 (error)

Question 13

A network administrator is configuring a trunk link between a switch and a router to support multiple VLANs. The switch's trunk port is set to dot1q encapsulation. Which configuration must match on the router to ensure proper communication?

Accepted Answer

The native VLAN on the router subinterface must be consistent with the switch's native VLAN. Option C is correct because the native VLAN on the router subinterface must match the switch's native VLAN to ensure untagged frames are handled consistently. On a dot1q trunk, the native VLAN is the only VLAN whose frames are sent untagged; if the router expects a different native VLAN, it will drop or misclassify those frames, breaking communication for that VLAN.

Answer

The IP address of the router interface must be in the same subnet as the management VLAN

Answer

The subinterface encapsulation must match the switch's native VLAN default

Answer

The router must be configured with inter-VLAN routing static routes

Question 14

A network administrator is connecting two switches and wants to increase the bandwidth between them while also providing redundancy in case one link fails. Which technology should be configured on the switch ports?

Accepted Answer

Link Aggregation Control Protocol (LACP). Link Aggregation Control Protocol (LACP) allows multiple physical links between two switches to be combined into a single logical link, increasing aggregate bandwidth and providing redundancy: if one physical link fails, traffic continues over the remaining links. This directly meets the requirement for both higher bandwidth and link-level fault tolerance.

Answer

Spanning Tree Protocol (STP)

Answer

VLAN trunking (802.1Q)

Answer

Power over Ethernet (PoE)

Question 15

A network administrator is creating documentation for a new data center. Which type of diagram is BEST for showing the logical relationships between VLANs and their associated subnets?

Accepted Answer

Logical topology diagram. A logical topology diagram is the correct choice because it illustrates how devices communicate across the network, including the mapping of VLANs to their associated IP subnets. This type of diagram abstracts away physical cabling and device locations to focus on Layer 2 and Layer 3 relationships, such as VLAN IDs, subnet masks, and default gateways. It is essential for documenting network segmentation and troubleshooting inter-VLAN routing.

Answer

Physical topology diagram

Answer

Wiring diagram

Answer

Rack elevation diagram