N10-009 Practice Test 27 — 15 Questions

Question 1

A security analyst needs to deploy a device that can perform deep packet inspection and block specific application-layer attacks in real time. Which of the following devices is MOST appropriate for this purpose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Intrusion Prevention System (IPS). An Intrusion Prevention System (IPS) is designed to inspect traffic in real time, perform deep packet inspection (DPI) up to Layer 7, and automatically block malicious traffic, including application-layer attacks such as SQL injection or cross-site scripting. Unlike a passive IDS, an IPS sits inline and can drop or reset sessions based on signature or anomaly detection, making it the most appropriate device for this requirement.

Answer

Stateful firewall

Answer

Proxy server

Answer

VPN concentrator

Question 2

A user reports that they can access a website by its IP address but not by its domain name. Which of the following is most likely the issue?

Accepted Answer

A) DNS resolution failure. Accessing a website by IP address but not by domain name indicates that the client can reach the web server over the network, but the name-to-IP translation process is failing. This is a classic symptom of a DNS resolution failure, where the client cannot query or receive a valid A or AAAA record for the domain from its configured DNS server.

Answer

B) Incorrect default gateway

Answer

C) Duplicate IP address

Answer

D) Corrupted TCP/IP stack

Question 3

A user reports intermittent connectivity on a laptop that moves between floors. The signal strength fluctuates. Which tool would best help identify signal interference and dead zones?

Accepted Answer

Spectrum analyzer. A spectrum analyzer is the correct tool because it visualizes radio frequency (RF) energy across the 2.4 GHz and 5 GHz bands, allowing you to identify sources of interference (e.g., cordless phones, microwave ovens) and locate dead zones where signal strength drops below usable thresholds. Unlike other tools, it directly measures the RF environment rather than relying on logical-layer data.

Answer

Cable tester

Answer

Multimeter

Answer

Protocol analyzer

Question 4

A network administrator is reviewing syslog messages generated by a switch. The administrator wants to see only the most critical events, such as system failures. Which syslog severity level should be configured as the filter?

Accepted Answer

0 – Emergency. Syslog severity level 0 (Emergency) is the highest severity, indicating system-level failures that render the switch unusable. By filtering for level 0, the administrator ensures only the most critical events, such as kernel panics or hardware failures, are displayed, excluding all less severe messages.

Answer

1 – Alert

Answer

4 – Warning

Answer

7 – Debug

Question 5

A network administrator is concerned about DHCP security. To prevent rogue DHCP servers from offering incorrect IP addresses, the administrator enables DHCP snooping on the switches. Additionally, the administrator wants to prevent DHCP starvation attacks that exhaust the DHCP pool. Which feature should be enabled on the switch to specifically mitigate DHCP starvation?

Accepted Answer

Rate limiting on DHCP packets. Rate limiting on DHCP packets (option D) is the correct feature to mitigate DHCP starvation attacks. DHCP starvation works by flooding the network with fake DHCP discover messages, each using a different MAC address, to exhaust the DHCP server's address pool. By limiting the rate at which DHCP packets are accepted from a given interface, the switch can drop excessive requests before they reach the DHCP server, preventing pool exhaustion without blocking legitimate traffic.

Answer

Dynamic ARP Inspection (DAI)

Answer

IP Source Guard (IPSG)

Answer

Port Security

Question 6

A network switch that forwards frames based on MAC addresses operates at which layer of the OSI model?

Accepted Answer

Data Link. A network switch that forwards frames based on MAC addresses operates at Layer 2, the Data Link layer. This layer is responsible for node-to-node data transfer and error detection using MAC addresses, as defined by IEEE 802 standards. Switches build a MAC address table by learning source MAC addresses from incoming frames and use this table to make forwarding decisions.

Answer

Physical

Answer

Network

Answer

Transport

Question 7

A company is implementing 802.1X port-based authentication on its wired network to ensure only authorized devices can connect. Which of the following servers is required to authenticate users and devices?

Accepted Answer

A) RADIUS server. 802.1X port-based authentication relies on the Extensible Authentication Protocol (EAP) over LAN (EAPoL) between the supplicant (device) and the authenticator (switch), which then forwards authentication requests to a central authentication server. A RADIUS server is the required backend because it validates credentials (e.g., username/password or certificates) and returns an Accept/Reject decision to the switch, enabling or disabling the port. RADIUS is the standard protocol defined in IEEE 802.1X for this purpose, supporting EAP methods like PEAP, EAP-TLS, and EAP-FAST.

Answer

B) Syslog server

Answer

C) TACACS+ server

Answer

D) NTP server

Question 8

A company hosts a web server in a DMZ. The firewall has three interfaces: inside (corporate network), outside (Internet), and DMZ. Which firewall rule is necessary to allow external users to access the web server?

Accepted Answer

Allow traffic from the outside interface to the DMZ interface on port 80. External users on the Internet (outside interface) need to reach the web server located in the DMZ. The firewall must permit inbound traffic from the outside zone to the DMZ zone on TCP port 80 (HTTP) to allow web requests while keeping the corporate network (inside) isolated from direct external access.

Answer

Allow traffic from the inside interface to the DMZ interface on port 80

Answer

Allow traffic from the outside interface to the inside interface on port 80

Answer

Deny all traffic by default and create no specific rules

Question 9

A network administrator needs to identify which devices are generating the most traffic on a WAN link. The administrator requires detailed flow data including source and destination IP addresses, ports, and protocols. Which technology should be deployed?

Accepted Answer

NetFlow. NetFlow is the correct technology because it provides detailed flow-level data, including source and destination IP addresses, ports, and protocols, which is exactly what the administrator needs to identify which devices are generating the most traffic on a WAN link. Unlike SNMP or Syslog, NetFlow exports metadata about network flows, allowing for granular traffic analysis and bandwidth usage per conversation.

Answer

SNMP polling

Answer

Syslog

Answer

ICMP

Question 10

A network administrator is troubleshooting a connectivity issue and suspects the problem is related to the physical cabling. At which layer of the OSI model should the administrator begin their investigation?

Accepted Answer

Physical layer. The Physical layer (Layer 1) is the correct starting point because the administrator suspects the problem is related to physical cabling. The Physical layer defines the electrical, mechanical, and procedural specifications for transmitting raw bits over a physical medium, such as copper or fiber optic cables. Troubleshooting at this layer involves checking for cable faults, signal degradation, or improper termination before moving up the OSI stack.

Answer

Transport layer

Answer

Data Link layer

Answer

Network layer

Question 11

A network administrator is configuring a trunk link between two switches. The link is up, but devices on VLAN 30 cannot communicate across the trunk. Devices on VLAN 10 and 20 can communicate. What should the administrator verify?

Accepted Answer

Verify that VLAN 30 is included in the allowed VLAN list on both switches. The trunk link is operational for VLANs 10 and 20 but not for VLAN 30, which indicates that VLAN 30 is likely not permitted on the trunk. By default, a trunk allows all VLANs, but if an administrator has manually configured an allowed VLAN list, VLAN 30 may have been omitted. Verifying that VLAN 30 is included in the allowed VLAN list on both switches will resolve the issue.

Answer

Ensure the native VLAN is the same on both switches

Answer

Check the trunk encapsulation type on both switches

Answer

Confirm that port security is not enabled on the trunk interfaces

Question 12

A network administrator needs to collect traffic flow data from routers and switches to analyze bandwidth usage patterns. Which protocol should be implemented on the devices to export flow data to a collector?

Accepted Answer

NetFlow. NetFlow (or its standards-based equivalent, IPFIX) is the correct protocol because it is specifically designed to export traffic flow metadata—such as source/destination IPs, ports, and byte counts—from routers and switches to a collector for bandwidth usage analysis. SNMP can poll interface counters but does not provide per-flow granularity, making NetFlow the appropriate choice for detailed traffic pattern analysis.

Answer

SNMP

Answer

ICMP

Answer

LLDP

Question 13

A small office has multiple devices that need internet access but the ISP provides only a single public IPv4 address. Which network address translation (NAT) technique is most appropriate to allow all internal hosts to share that one public address?

Accepted Answer

PAT (Port Address Translation). PAT (Port Address Translation), also known as NAT overload, is the correct choice because it allows multiple internal hosts to share a single public IPv4 address by mapping each unique internal IP:port combination to a different source port on the public address. This is the only NAT technique that provides many-to-one address translation, which is exactly what a small office with more devices than public IPs requires.

Answer

Static NAT

Answer

Dynamic NAT

Answer

IP masquerading

Question 14

A user reports that they cannot access a web server by its URL but can access it by IP address. A technician checks the DNS server and finds it is reachable. What is the most likely cause?

Accepted Answer

DNS resolution failure for that specific record. The user can access the web server by IP address but not by URL, which indicates that the name-to-IP resolution is failing. Since the DNS server is reachable, the issue is not with network connectivity to the DNS server but rather with the specific DNS record for that web server. This is a classic DNS resolution failure for that specific record, often due to a missing or incorrect A or AAAA record.

Answer

Incorrect default gateway

Answer

Firewall blocking port 80

Answer

IP conflict on the user's workstation

Question 15

A network administrator needs to be notified immediately when the CPU utilization on a core router exceeds 90%. Which SNMP mechanism should be configured on the router?

Accepted Answer

SNMP trap. B is correct because SNMP traps are unsolicited notifications sent from an SNMP agent (the router) to the manager when a predefined condition occurs, such as CPU utilization exceeding 90%. This allows immediate notification without waiting for the manager to poll, which is essential for urgent alerts.

Answer

SNMP get

Answer

SNMP walk

Answer

SNMP set