N10-009 Practice Test 26 — 15 Questions

Question 1

A user reports that they can browse to a website by typing its IP address (e.g., 93.184.216.34) but cannot access it by typing the domain name (e.g., www.example.com). The user's workstation receives IP configuration via DHCP. Which of the following is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The DNS server address is incorrect or unreachable.. The user can reach the website by IP address but not by domain name, which isolates the issue to name resolution. DNS translates domain names to IP addresses; if the DNS server address provided by DHCP is incorrect or unreachable, the workstation cannot resolve www.example.com to 93.184.216.34. This is the most likely cause because all other connectivity (default gateway, web server) is confirmed working by the successful IP-based access.

Answer

The default gateway is misconfigured.

Answer

The web server's SSL certificate is expired.

Answer

The workstation's hosts file has an incorrect entry.

Question 2

A security analyst discovers that an attacker is sending large numbers of incomplete TCP connection requests to a server, causing the server to run out of resources and stop responding to legitimate requests. Which type of attack is this, and which mitigation should be implemented?

Accepted Answer

SYN flood; enable TCP intercept or SYN cookies. This is a SYN flood attack, where the attacker sends a high volume of TCP SYN packets without completing the three-way handshake, exhausting the server's connection queue. Enabling TCP intercept (on Cisco devices) or SYN cookies (RFC 4987) allows the server to validate handshakes before allocating resources, mitigating the attack.

Answer

Ping flood; implement rate limiting

Answer

Smurf attack; disable IP-directed broadcasts

Answer

ARP poisoning; enable dynamic ARP inspection

Question 3

An organization's security policy requires that all remote access VPN connections use two-factor authentication and that the VPN clients are compliant with the latest patch levels before gaining network access. Which technology combination provides these capabilities?

Accepted Answer

VPN with RADIUS authentication and posture assessment. RADIUS authentication can enforce two-factor authentication (e.g., via token or OTP), and posture assessment (often via Network Access Control or a VPN posture plugin) checks the client's patch level before granting network access. This combination directly satisfies the policy requirements for both multi-factor authentication and endpoint compliance verification.

Answer

SSL VPN with client certificate authentication

Answer

IPsec VPN using preshared keys

Answer

NAC integrated with a reverse proxy

Question 4

A network technician needs to capture and analyze packets on a specific network segment to identify the source of a performance slowdown. Which tool is best suited for this task?

Accepted Answer

Protocol analyzer (e.g., Wireshark). A protocol analyzer like Wireshark is the correct tool because it captures and decodes packets at the data-link layer, allowing the technician to inspect frame headers, IP addresses, TCP/UDP ports, and payload contents on a specific network segment. This deep packet inspection is essential for identifying the root cause of performance slowdowns, such as excessive retransmissions, high latency, or application-layer issues. Unlike other tools, a protocol analyzer provides granular visibility into traffic patterns and protocol behavior.

Answer

Port scanner (e.g., Nmap)

Answer

Ping

Answer

Traceroute

Question 5

Which of the following best describes the primary difference between a hub and a switch?

Accepted Answer

A hub broadcasts all frames to all ports; a switch forwards frames only to the destination port. A hub operates at Layer 1 (physical layer) and simply repeats electrical signals out all ports, causing all connected devices to receive every frame. A switch operates at Layer 2 (data link layer) and uses the MAC address table to forward frames only to the specific port where the destination device resides, reducing unnecessary traffic and improving network efficiency.

Answer

A switch is faster than a hub because it operates at Layer 3

Answer

A hub can segment collision domains; a switch cannot

Answer

Both hubs and switches operate at the same OSI layer but use different frame types

Question 6

At which layer of the OSI model does logical addressing (e.g., IP addresses) and routing occur?

Accepted Answer

Network layer. The Network layer (Layer 3) of the OSI model is responsible for logical addressing, such as IPv4 and IPv6 addresses, and for routing packets between different networks. Routers operate at this layer, using routing tables and protocols like OSPF, BGP, or static routes to determine the best path for data. This layer provides end-to-end delivery and handles packet fragmentation and reassembly when necessary.

Answer

Data Link layer

Answer

Transport layer

Answer

Physical layer

Question 7

A security analyst is reviewing firewall logs and sees many incoming packets with a source IP address that matches the internal IP range of the company (10.0.0.0/8) arriving on the external interface. Which type of attack is likely being attempted?

Accepted Answer

IP spoofing attack. Packets arriving on the external interface with a source IP address from the internal 10.0.0.0/8 range indicate that the attacker is forging (spoofing) the source address to impersonate an internal host. This is a classic IP spoofing attack, often used to bypass access control lists or to launch further attacks that rely on trust relationships based on source IP.

Answer

Smurf attack

Answer

SYN flood

Answer

DNS amplification

Question 8

A network administrator wants to prevent unauthorized devices from connecting to the network by limiting the number of MAC addresses allowed on a switch port. Which security feature should be configured?

Accepted Answer

Port security. Port security is the correct feature because it directly restricts the number of unique MAC addresses that can be learned on a switch port, preventing unauthorized devices from connecting. When the configured limit is exceeded, the switch can take actions such as shutdown, restrict, or protect, effectively blocking the unauthorized device. This is a Layer 2 access control mechanism that operates on the switch port itself.

Answer

802.1X

Answer

DHCP snooping

Answer

Dynamic ARP inspection

Question 9

A router has two routes to the same destination network: one learned via OSPF with a metric of 10, and another learned via EIGRP with a composite metric of 3072. The default administrative distances are OSPF=110, EIGRP=90. Which route will be installed in the routing table?

Accepted Answer

The EIGRP route because it has a lower administrative distance. The EIGRP route is installed because administrative distance (AD) is the primary tiebreaker when multiple routing protocols provide routes to the same destination. EIGRP has a default AD of 90, which is lower than OSPF's AD of 110, so the router prefers the EIGRP route regardless of metric values. Metrics are only compared when routes come from the same protocol.

Answer

The OSPF route because it has a lower metric

Answer

Both routes will be installed for load balancing

Answer

The OSPF route because it is a link-state protocol

Question 10

An OSPF network uses a multi-access segment with four routers. All router interfaces have the default OSPF priority of 1. Which router becomes the Designated Router (DR)?

Accepted Answer

The router with the highest router ID. In an OSPF multi-access network, the Designated Router (DR) is elected based on the highest OSPF priority value, with a tie-breaking mechanism using the highest Router ID. Since all routers have the default priority of 1, the router with the highest Router ID wins the DR election. This ensures a stable topology for reducing LSA flooding and adjacency overhead.

Answer

The router with the lowest IP address on the segment

Answer

The router with the highest bandwidth on the connecting interface

Answer

The router with the oldest uptime

Question 11

A user reports intermittent inability to access websites. When the issue occurs, the user can ping external IP addresses (e.g., 8.8.8.8) but cannot ping domain names like google.com. The user's IP configuration shows a DNS server address of 8.8.8.8. What is the most likely cause?

Accepted Answer

The DNS server is reachable but not responding due to high load.. The user can ping external IP addresses (e.g., 8.8.8.8) but cannot resolve domain names like google.com, which indicates that IP connectivity is working but DNS resolution is failing. Since the DNS server address is 8.8.8.8 and the user can ping it, the server is reachable; however, intermittent failures suggest the server is overwhelmed and dropping or not responding to queries. This matches the symptom of a reachable but unresponsive DNS server due to high load, where ICMP (ping) succeeds but UDP/53 DNS queries time out.

Answer

The default gateway is down.

Answer

The corporate firewall is blocking UDP port 53.

Answer

The user's machine has a corrupted DNS cache.

Question 12

An IPv6 address has the prefix 2001:db8::/32. Which of the following IP addresses belongs to the same prefix?

Accepted Answer

2001:db8:1::1. The prefix 2001:db8::/32 means the first 32 bits of the address must be 2001:0db8. Option A (2001:db8:1::1) expands to 2001:0db8:0001:0000:0000:0000:0000:0001, which matches the first 32 bits exactly, so it belongs to the same /32 prefix.

Answer

2001:db9::1

Answer

2001:db7::1

Answer

fe80::1

Question 13

A security analyst is investigating a potential data exfiltration. The analyst notices that a server is sending DNS queries to an external IP address on TCP port 53, and the DNS responses are unusually large. The server is not a DNS server. Which technique is most likely being used?

Accepted Answer

DNS tunneling. DNS tunneling encodes non-DNS data (e.g., exfiltrated files) within DNS queries and responses, often using TCP port 53 to bypass firewalls. The unusually large responses are a hallmark of tunneled data being returned in DNS payloads, and the fact that the server is not a DNS server strongly indicates it is being used as a client for covert data transfer.

Answer

DNS amplification attack

Answer

DNS zone transfer

Answer

DNS cache poisoning

Question 14

A company has deployed a WPA2-Enterprise wireless network. Users report that they cannot authenticate. The RADIUS server logs show that authentication attempts are received but no responses are sent back to the wireless controller. The wireless controller and RADIUS server are on different subnets, separated by a firewall. Which of the following is the MOST likely cause?

Accepted Answer

The firewall is blocking RADIUS traffic on UDP ports 1812 and 1813.. The RADIUS server logs show authentication attempts are received but no responses are sent back, indicating the request reached the server but the reply is being dropped. Since the wireless controller and RADIUS server are on different subnets separated by a firewall, the most likely cause is that the firewall is blocking the return RADIUS traffic. RADIUS uses UDP ports 1812 for authentication and 1813 for accounting, and these must be open in both directions for successful communication.

Answer

The wireless clients do not support the correct EAP method.

Answer

The RADIUS server is not in the same broadcast domain as the wireless controller.

Answer

The SSID is not being broadcast.

Question 15

A network administrator needs to analyze bandwidth utilization and application traffic patterns on a WAN link. The administrator requires detailed flow-level data, including source/destination IP addresses, ports, and protocol. Which technology should be deployed?

Accepted Answer

NetFlow. NetFlow is the correct choice because it provides detailed flow-level data, including source/destination IP addresses, ports, and protocol information, which is essential for analyzing bandwidth utilization and application traffic patterns on a WAN link. Unlike simpler monitoring tools, NetFlow captures metadata about each network flow, allowing administrators to identify which applications and hosts are consuming bandwidth.

Answer

SNMP

Answer

Syslog

Answer

ICMP