N10-009 Practice Test 27 — 15 Questions

Question 1

A network administrator wants to prevent unauthorized DHCP servers from offering IP addresses to clients on a switch. Which security feature should be enabled?

Accepted Answer

DHCP snooping. DHCP snooping is the correct answer because it is a security feature specifically designed to filter untrusted DHCP messages on a switch. By configuring trusted and untrusted ports, DHCP snooping drops DHCP server responses (OFFER, ACK) received on untrusted ports, effectively preventing rogue DHCP servers from assigning IP addresses to clients.

Answer

BPDU guard

Answer

Dynamic ARP inspection

Answer

Port security

Question 2

A company is implementing a new wireless network for employees. The network must support seamless roaming between access points. Which protocol should be configured on the wireless controller?

Accepted Answer

802.11r. 802.11r, also known as Fast BSS Transition (FT), enables seamless roaming by allowing a client to authenticate and derive encryption keys with a new access point before or during the reassociation process, reducing the time-sensitive handshake overhead. This is essential for real-time applications like VoIP or video calls where roaming delays must be under 50 ms to avoid perceptible drops.

Answer

802.1X

Answer

802.11n

Answer

802.3af

Question 3

Match each cable type to its maximum segment length (Ethernet).

Accepted Answer

Cat5e: 100 meters. The correct matches are: Cat5e=100m, 10BASE2=185m, Multimode fiber=550m. Common confusions involve swapping lengths between copper and fiber types.

Answer

Cat6: 185 meters

Answer

10BASE5: 100 meters

Answer

Single-mode fiber: 550 meters

Question 4

A network security analyst notices high CPU utilization on the core switch and detects a large volume of ARP replies from a single IP address that claims to be the default gateway for all local subnets. Which type of attack is MOST likely occurring?

Accepted Answer

ARP poisoning. The attack described is ARP poisoning (also known as ARP spoofing), where an attacker sends forged ARP replies to associate their MAC address with the IP address of the default gateway. This causes all traffic destined for other subnets to be redirected to the attacker's machine, leading to high CPU utilization on the switch as it processes the flood of ARP packets and forwards the intercepted traffic.

Answer

DHCP starvation

Answer

MAC flooding

Answer

DNS amplification

Question 5

A network technician is analyzing a small office network topology. An 8-port switch has 7 workstations directly connected. The remaining switch port is connected to a 4-port hub, which has 4 workstations attached. All devices are configured on the same VLAN and IP subnet. How many collision domains and broadcast domains are present in this network?

Accepted Answer

8 collision domains, 1 broadcast domain. Switches create a separate collision domain per port, so the 8-port switch provides 8 collision domains. The hub connected to one switch port extends that single collision domain to all its attached devices, but does not create new ones. All devices are on the same VLAN and IP subnet, so there is only one broadcast domain. Therefore, the network has 8 collision domains and 1 broadcast domain.

Answer

11 collision domains, 1 broadcast domain

Answer

12 collision domains, 5 broadcast domains

Answer

8 collision domains, 5 broadcast domains

Question 6

A network technician is troubleshooting an issue where users on VLAN 20 can access internal servers and the default gateway but cannot reach any external websites. The router's ACL is configured to permit all outbound traffic. What is the most likely cause of this issue?

Accepted Answer

NAT is not configured or is misconfigured on the router. Since users can access internal servers and the default gateway, Layer 3 connectivity within the VLAN is working, and the router's ACL permits all outbound traffic. The inability to reach external websites while internal resources are reachable strongly indicates that Network Address Translation (NAT) is either not configured or misconfigured on the router. Without NAT, private IP addresses from VLAN 20 cannot be translated to a public IP, so return traffic from external web servers has no route back to the internal hosts.

Answer

The DNS server is unreachable from the VLAN

Answer

The DHCP server is not providing a default gateway

Answer

The switch port for the router is in the wrong VLAN

Question 7

A company wants to protect its internal network by placing web servers that need to be accessible from the internet in a separate network segment. Which security architecture best describes this setup?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a network segment that sits between the internal trusted network and the external untrusted internet. By placing web servers in the DMZ, the company ensures that external users can access the servers without directly exposing the internal network, as traffic must pass through a firewall that enforces strict access control policies. This architecture is specifically designed to isolate public-facing services from internal assets, reducing the attack surface.

Answer

Intranet

Answer

VPN

Answer

Extranet

Question 8

A network administrator has configured SNMPv3 on a router to send traps to a central management server. The administrator notices that no traps are being received. The management server is reachable via ping from the router. Which configuration step is most likely missing?

Accepted Answer

Configure SNMPv3 authentication and privacy credentials on both the router and the server. SNMPv3 requires authentication and encryption (privacy) to be configured on both the router and the management server. Without matching credentials, the server will reject or ignore the traps, even if the network path is reachable. This is the most likely missing step because SNMPv3 does not use community strings and relies on security models (authNoPriv, authPriv, or noAuthNoPriv) that must be consistent between endpoints.

Answer

Configure the SNMP community string on the router

Answer

Set the SNMP trap destination IP address on the router

Answer

Ensure the SNMP agent is enabled on the router

Question 9

A user reports they can access internal servers and the default gateway but cannot reach external websites. The technician checks the router's ACL and finds a rule that permits all outbound traffic. What is the most likely cause?

Accepted Answer

NAT configuration issue. The user can access internal servers and the default gateway, indicating Layer 3 connectivity within the local network. However, external websites are unreachable. Since the ACL permits all outbound traffic, the issue is not a blocked outbound rule. The most likely cause is a NAT configuration issue, such as missing or incorrect IP masquerading (PAT) on the router's outside interface, which prevents internal private IP addresses from being translated to a public IP address for internet access.

Answer

DNS resolution failure

Answer

Incorrect default gateway

Answer

Proxy server misconfiguration

Question 10

A network administrator needs to collect detailed data about network traffic flows, including source/destination IP addresses, ports, and protocols, to analyze bandwidth usage patterns. Which technology should be used?

Accepted Answer

NetFlow. NetFlow is the correct choice because it is specifically designed to collect detailed metadata about network traffic flows, including source and destination IP addresses, ports, protocols, and byte counts. This granular flow-level data enables administrators to analyze bandwidth usage patterns, identify top talkers, and perform capacity planning. Unlike SNMP, which provides aggregate interface statistics, NetFlow exports flow records that contain the exact fields needed for deep traffic analysis.

Answer

SNMP

Answer

Syslog

Answer

ICMP

Question 11

A network engineer needs to add a new switch to an existing network. The switch must be configured to support VLANs and trunking. The engineer connects the switch to the existing network via a trunk port. After configuration, the VLANs on the new switch are not receiving traffic from the core network. The core switch shows the trunk is up but no VLANs are allowed. What is the most likely cause?

Accepted Answer

The allowed VLAN list on the trunk does not include the desired VLANs. The core switch shows the trunk is up but no VLANs are allowed, which directly indicates that the allowed VLAN list on the trunk port does not include the desired VLANs. By default, a trunk port permits all VLANs, but if an administrator explicitly restricts the allowed VLAN list (e.g., with the 'switchport trunk allowed vlan' command), only those VLANs are forwarded. Since the new switch is not receiving traffic, the core switch's trunk likely has an empty or incorrect allowed VLAN list, preventing the desired VLAN traffic from crossing the trunk.

Answer

The native VLAN mismatch

Answer

The trunk encapsulation is not set to 802.1Q

Answer

The switch port mode is set to access

Question 12

A security analyst needs to deploy a device that can perform deep packet inspection and block specific application-layer attacks in real time. Which of the following devices is MOST appropriate for this purpose?

Accepted Answer

Intrusion Prevention System (IPS). An Intrusion Prevention System (IPS) is designed to inspect traffic in real time, perform deep packet inspection (DPI) up to Layer 7, and automatically block malicious traffic, including application-layer attacks such as SQL injection or cross-site scripting. Unlike a passive IDS, an IPS sits inline and can drop or reset sessions based on signature or anomaly detection, making it the most appropriate device for this requirement.

Answer

Stateful firewall

Answer

Proxy server

Answer

VPN concentrator

Question 13

A user reports that they can access a website by its IP address but not by its domain name. Which of the following is most likely the issue?

Accepted Answer

A) DNS resolution failure. Accessing a website by IP address but not by domain name indicates that the client can reach the web server over the network, but the name-to-IP translation process is failing. This is a classic symptom of a DNS resolution failure, where the client cannot query or receive a valid A or AAAA record for the domain from its configured DNS server.

Answer

B) Incorrect default gateway

Answer

C) Duplicate IP address

Answer

D) Corrupted TCP/IP stack

Question 14

A user reports intermittent connectivity on a laptop that moves between floors. The signal strength fluctuates. Which tool would best help identify signal interference and dead zones?

Accepted Answer

Spectrum analyzer. A spectrum analyzer is the correct tool because it visualizes radio frequency (RF) energy across the 2.4 GHz and 5 GHz bands, allowing you to identify sources of interference (e.g., cordless phones, microwave ovens) and locate dead zones where signal strength drops below usable thresholds. Unlike other tools, it directly measures the RF environment rather than relying on logical-layer data.

Answer

Cable tester

Answer

Multimeter

Answer

Protocol analyzer

Question 15

A network administrator is reviewing syslog messages generated by a switch. The administrator wants to see only the most critical events, such as system failures. Which syslog severity level should be configured as the filter?

Accepted Answer

0 – Emergency. Syslog severity level 0 (Emergency) is the highest severity, indicating system-level failures that render the switch unusable. By filtering for level 0, the administrator ensures only the most critical events, such as kernel panics or hardware failures, are displayed, excluding all less severe messages.

Answer

1 – Alert

Answer

4 – Warning

Answer

7 – Debug