N10-009 Practice Test 26 — 15 Questions

Question 1

An IPv6 address has the prefix 2001:db8::/32. Which of the following IP addresses belongs to the same prefix?

Accepted Answer

2001:db8:1::1. The prefix 2001:db8::/32 means the first 32 bits of the address must be 2001:0db8. Option A (2001:db8:1::1) expands to 2001:0db8:0001:0000:0000:0000:0000:0001, which matches the first 32 bits exactly, so it belongs to the same /32 prefix.

Answer

2001:db9::1

Answer

2001:db7::1

Answer

fe80::1

Question 2

A security analyst is investigating a potential data exfiltration. The analyst notices that a server is sending DNS queries to an external IP address on TCP port 53, and the DNS responses are unusually large. The server is not a DNS server. Which technique is most likely being used?

Accepted Answer

DNS tunneling. DNS tunneling encodes non-DNS data (e.g., exfiltrated files) within DNS queries and responses, often using TCP port 53 to bypass firewalls. The unusually large responses are a hallmark of tunneled data being returned in DNS payloads, and the fact that the server is not a DNS server strongly indicates it is being used as a client for covert data transfer.

Answer

DNS amplification attack

Answer

DNS zone transfer

Answer

DNS cache poisoning

Question 3

A company has deployed a WPA2-Enterprise wireless network. Users report that they cannot authenticate. The RADIUS server logs show that authentication attempts are received but no responses are sent back to the wireless controller. The wireless controller and RADIUS server are on different subnets, separated by a firewall. Which of the following is the MOST likely cause?

Accepted Answer

The firewall is blocking RADIUS traffic on UDP ports 1812 and 1813.. The RADIUS server logs show authentication attempts are received but no responses are sent back, indicating the request reached the server but the reply is being dropped. Since the wireless controller and RADIUS server are on different subnets separated by a firewall, the most likely cause is that the firewall is blocking the return RADIUS traffic. RADIUS uses UDP ports 1812 for authentication and 1813 for accounting, and these must be open in both directions for successful communication.

Answer

The wireless clients do not support the correct EAP method.

Answer

The RADIUS server is not in the same broadcast domain as the wireless controller.

Answer

The SSID is not being broadcast.

Question 4

A network administrator needs to analyze bandwidth utilization and application traffic patterns on a WAN link. The administrator requires detailed flow-level data, including source/destination IP addresses, ports, and protocol. Which technology should be deployed?

Accepted Answer

NetFlow. NetFlow is the correct choice because it provides detailed flow-level data, including source/destination IP addresses, ports, and protocol information, which is essential for analyzing bandwidth utilization and application traffic patterns on a WAN link. Unlike simpler monitoring tools, NetFlow captures metadata about each network flow, allowing administrators to identify which applications and hosts are consuming bandwidth.

Answer

SNMP

Answer

Syslog

Answer

ICMP

Question 5

A network administrator wants to prevent unauthorized DHCP servers from offering IP addresses to clients on a switch. Which security feature should be enabled?

Accepted Answer

DHCP snooping. DHCP snooping is the correct answer because it is a security feature specifically designed to filter untrusted DHCP messages on a switch. By configuring trusted and untrusted ports, DHCP snooping drops DHCP server responses (OFFER, ACK) received on untrusted ports, effectively preventing rogue DHCP servers from assigning IP addresses to clients.

Answer

BPDU guard

Answer

Dynamic ARP inspection

Answer

Port security

Question 6

A company is implementing a new wireless network for employees. The network must support seamless roaming between access points. Which protocol should be configured on the wireless controller?

Accepted Answer

802.11r. 802.11r, also known as Fast BSS Transition (FT), enables seamless roaming by allowing a client to authenticate and derive encryption keys with a new access point before or during the reassociation process, reducing the time-sensitive handshake overhead. This is essential for real-time applications like VoIP or video calls where roaming delays must be under 50 ms to avoid perceptible drops.

Answer

802.1X

Answer

802.11n

Answer

802.3af

Question 7

Match each cable type to its maximum segment length (Ethernet).

Accepted Answer

Cat5e: 100 meters. The correct matches are: Cat5e=100m, 10BASE2=185m, Multimode fiber=550m. Common confusions involve swapping lengths between copper and fiber types.

Answer

Cat6: 185 meters

Answer

10BASE5: 100 meters

Answer

Single-mode fiber: 550 meters

Question 8

A network security analyst notices high CPU utilization on the core switch and detects a large volume of ARP replies from a single IP address that claims to be the default gateway for all local subnets. Which type of attack is MOST likely occurring?

Accepted Answer

ARP poisoning. The attack described is ARP poisoning (also known as ARP spoofing), where an attacker sends forged ARP replies to associate their MAC address with the IP address of the default gateway. This causes all traffic destined for other subnets to be redirected to the attacker's machine, leading to high CPU utilization on the switch as it processes the flood of ARP packets and forwards the intercepted traffic.

Answer

DHCP starvation

Answer

MAC flooding

Answer

DNS amplification

Question 9

A network technician is troubleshooting an issue where users on VLAN 20 can access internal servers and the default gateway but cannot reach any external websites. The router's ACL is configured to permit all outbound traffic. What is the most likely cause of this issue?

Accepted Answer

NAT is not configured or is misconfigured on the router. Since users can access internal servers and the default gateway, Layer 3 connectivity within the VLAN is working, and the router's ACL permits all outbound traffic. The inability to reach external websites while internal resources are reachable strongly indicates that Network Address Translation (NAT) is either not configured or misconfigured on the router. Without NAT, private IP addresses from VLAN 20 cannot be translated to a public IP, so return traffic from external web servers has no route back to the internal hosts.

Answer

The DNS server is unreachable from the VLAN

Answer

The DHCP server is not providing a default gateway

Answer

The switch port for the router is in the wrong VLAN

Question 10

A company wants to protect its internal network by placing web servers that need to be accessible from the internet in a separate network segment. Which security architecture best describes this setup?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a network segment that sits between the internal trusted network and the external untrusted internet. By placing web servers in the DMZ, the company ensures that external users can access the servers without directly exposing the internal network, as traffic must pass through a firewall that enforces strict access control policies. This architecture is specifically designed to isolate public-facing services from internal assets, reducing the attack surface.

Answer

Intranet

Answer

VPN

Answer

Extranet

Question 11

A network administrator has configured SNMPv3 on a router to send traps to a central management server. The administrator notices that no traps are being received. The management server is reachable via ping from the router. Which configuration step is most likely missing?

Accepted Answer

Configure SNMPv3 authentication and privacy credentials on both the router and the server. SNMPv3 requires authentication and encryption (privacy) to be configured on both the router and the management server. Without matching credentials, the server will reject or ignore the traps, even if the network path is reachable. This is the most likely missing step because SNMPv3 does not use community strings and relies on security models (authNoPriv, authPriv, or noAuthNoPriv) that must be consistent between endpoints.

Answer

Configure the SNMP community string on the router

Answer

Set the SNMP trap destination IP address on the router

Answer

Ensure the SNMP agent is enabled on the router

Question 12

A company wants to implement network access control that requires users to authenticate before gaining access to the network. The NAC solution uses a policy that checks for antivirus updates and OS patches. Which component enforces the policy?

Accepted Answer

Authenticator. The Authenticator (typically a switch or wireless access point) is the component that enforces the NAC policy by controlling access to the network port or SSID. It receives the authentication result from the Authentication Server and applies the policy (e.g., placing the endpoint in a quarantine VLAN if antivirus or OS patch checks fail). This enforcement is defined in IEEE 802.1X, where the Authenticator acts as the gatekeeper between the Supplicant and the network.

Answer

Supplicant

Answer

Authentication server

Answer

Policy server

Question 13

A user reports they can access internal servers and the default gateway but cannot reach external websites. The technician checks the router's ACL and finds a rule that permits all outbound traffic. What is the most likely cause?

Accepted Answer

NAT configuration issue. The user can access internal servers and the default gateway, indicating Layer 3 connectivity within the local network. However, external websites are unreachable. Since the ACL permits all outbound traffic, the issue is not a blocked outbound rule. The most likely cause is a NAT configuration issue, such as missing or incorrect IP masquerading (PAT) on the router's outside interface, which prevents internal private IP addresses from being translated to a public IP address for internet access.

Answer

DNS resolution failure

Answer

Incorrect default gateway

Answer

Proxy server misconfiguration

Question 14

A network administrator needs to collect detailed data about network traffic flows, including source/destination IP addresses, ports, and protocols, to analyze bandwidth usage patterns. Which technology should be used?

Accepted Answer

NetFlow. NetFlow is the correct choice because it is specifically designed to collect detailed metadata about network traffic flows, including source and destination IP addresses, ports, protocols, and byte counts. This granular flow-level data enables administrators to analyze bandwidth usage patterns, identify top talkers, and perform capacity planning. Unlike SNMP, which provides aggregate interface statistics, NetFlow exports flow records that contain the exact fields needed for deep traffic analysis.

Answer

SNMP

Answer

Syslog

Answer

ICMP

Question 15

A network engineer needs to add a new switch to an existing network. The switch must be configured to support VLANs and trunking. The engineer connects the switch to the existing network via a trunk port. After configuration, the VLANs on the new switch are not receiving traffic from the core network. The core switch shows the trunk is up but no VLANs are allowed. What is the most likely cause?

Accepted Answer

The allowed VLAN list on the trunk does not include the desired VLANs. The core switch shows the trunk is up but no VLANs are allowed, which directly indicates that the allowed VLAN list on the trunk port does not include the desired VLANs. By default, a trunk port permits all VLANs, but if an administrator explicitly restricts the allowed VLAN list (e.g., with the 'switchport trunk allowed vlan' command), only those VLANs are forwarded. Since the new switch is not receiving traffic, the core switch's trunk likely has an empty or incorrect allowed VLAN list, preventing the desired VLAN traffic from crossing the trunk.

Answer

The native VLAN mismatch

Answer

The trunk encapsulation is not set to 802.1Q

Answer

The switch port mode is set to access