N10-009 Practice Test 28 — 15 Questions

Question 1

A network administrator is concerned about DHCP security. To prevent rogue DHCP servers from offering incorrect IP addresses, the administrator enables DHCP snooping on the switches. Additionally, the administrator wants to prevent DHCP starvation attacks that exhaust the DHCP pool. Which feature should be enabled on the switch to specifically mitigate DHCP starvation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Rate limiting on DHCP packets. Rate limiting on DHCP packets (option D) is the correct feature to mitigate DHCP starvation attacks. DHCP starvation works by flooding the network with fake DHCP discover messages, each using a different MAC address, to exhaust the DHCP server's address pool. By limiting the rate at which DHCP packets are accepted from a given interface, the switch can drop excessive requests before they reach the DHCP server, preventing pool exhaustion without blocking legitimate traffic.

Answer

Dynamic ARP Inspection (DAI)

Answer

IP Source Guard (IPSG)

Answer

Port Security

Question 2

A company is implementing 802.1X port-based authentication on its wired network to ensure only authorized devices can connect. Which of the following servers is required to authenticate users and devices?

Accepted Answer

A) RADIUS server. 802.1X port-based authentication relies on the Extensible Authentication Protocol (EAP) over LAN (EAPoL) between the supplicant (device) and the authenticator (switch), which then forwards authentication requests to a central authentication server. A RADIUS server is the required backend because it validates credentials (e.g., username/password or certificates) and returns an Accept/Reject decision to the switch, enabling or disabling the port. RADIUS is the standard protocol defined in IEEE 802.1X for this purpose, supporting EAP methods like PEAP, EAP-TLS, and EAP-FAST.

Answer

B) Syslog server

Answer

C) TACACS+ server

Answer

D) NTP server

Question 3

A security analyst discovers that an unauthorized device is sending forged ARP replies to poison the ARP caches of other devices on the network. Which security feature should be implemented on the switches to prevent this?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) validates ARP packets on a per-interface basis by intercepting all ARP requests and replies and verifying that they match entries in the DHCP snooping binding table. If an ARP reply contains a forged IP-to-MAC mapping, DAI drops the packet, preventing ARP cache poisoning. This directly stops the described attack where an unauthorized device sends forged ARP replies.

Answer

Port security

Answer

DHCP snooping

Answer

STP BPDU guard

Question 4

A company hosts a web server in a DMZ. The firewall has three interfaces: inside (corporate network), outside (Internet), and DMZ. Which firewall rule is necessary to allow external users to access the web server?

Accepted Answer

Allow traffic from the outside interface to the DMZ interface on port 80. External users on the Internet (outside interface) need to reach the web server located in the DMZ. The firewall must permit inbound traffic from the outside zone to the DMZ zone on TCP port 80 (HTTP) to allow web requests while keeping the corporate network (inside) isolated from direct external access.

Answer

Allow traffic from the inside interface to the DMZ interface on port 80

Answer

Allow traffic from the outside interface to the inside interface on port 80

Answer

Deny all traffic by default and create no specific rules

Question 5

A network administrator needs to identify which devices are generating the most traffic on a WAN link. The administrator requires detailed flow data including source and destination IP addresses, ports, and protocols. Which technology should be deployed?

Accepted Answer

NetFlow. NetFlow is the correct technology because it provides detailed flow-level data, including source and destination IP addresses, ports, and protocols, which is exactly what the administrator needs to identify which devices are generating the most traffic on a WAN link. Unlike SNMP or Syslog, NetFlow exports metadata about network flows, allowing for granular traffic analysis and bandwidth usage per conversation.

Answer

SNMP polling

Answer

Syslog

Answer

ICMP

Question 6

A network administrator is troubleshooting a connectivity issue and suspects the problem is related to the physical cabling. At which layer of the OSI model should the administrator begin their investigation?

Accepted Answer

Physical layer. The Physical layer (Layer 1) is the correct starting point because the administrator suspects the problem is related to physical cabling. The Physical layer defines the electrical, mechanical, and procedural specifications for transmitting raw bits over a physical medium, such as copper or fiber optic cables. Troubleshooting at this layer involves checking for cable faults, signal degradation, or improper termination before moving up the OSI stack.

Answer

Transport layer

Answer

Data Link layer

Answer

Network layer

Question 7

A network administrator is configuring a trunk link between two switches. The link is up, but devices on VLAN 30 cannot communicate across the trunk. Devices on VLAN 10 and 20 can communicate. What should the administrator verify?

Accepted Answer

Verify that VLAN 30 is included in the allowed VLAN list on both switches. The trunk link is operational for VLANs 10 and 20 but not for VLAN 30, which indicates that VLAN 30 is likely not permitted on the trunk. By default, a trunk allows all VLANs, but if an administrator has manually configured an allowed VLAN list, VLAN 30 may have been omitted. Verifying that VLAN 30 is included in the allowed VLAN list on both switches will resolve the issue.

Answer

Ensure the native VLAN is the same on both switches

Answer

Check the trunk encapsulation type on both switches

Answer

Confirm that port security is not enabled on the trunk interfaces

Question 8

A network administrator needs to collect traffic flow data from routers and switches to analyze bandwidth usage patterns. Which protocol should be implemented on the devices to export flow data to a collector?

Accepted Answer

NetFlow. NetFlow (or its standards-based equivalent, IPFIX) is the correct protocol because it is specifically designed to export traffic flow metadata—such as source/destination IPs, ports, and byte counts—from routers and switches to a collector for bandwidth usage analysis. SNMP can poll interface counters but does not provide per-flow granularity, making NetFlow the appropriate choice for detailed traffic pattern analysis.

Answer

SNMP

Answer

ICMP

Answer

LLDP

Question 9

A small office has multiple devices that need internet access but the ISP provides only a single public IPv4 address. Which network address translation (NAT) technique is most appropriate to allow all internal hosts to share that one public address?

Accepted Answer

PAT (Port Address Translation). PAT (Port Address Translation), also known as NAT overload, is the correct choice because it allows multiple internal hosts to share a single public IPv4 address by mapping each unique internal IP:port combination to a different source port on the public address. This is the only NAT technique that provides many-to-one address translation, which is exactly what a small office with more devices than public IPs requires.

Answer

Static NAT

Answer

Dynamic NAT

Answer

IP masquerading

Question 10

A user reports that they cannot access a web server by its URL but can access it by IP address. A technician checks the DNS server and finds it is reachable. What is the most likely cause?

Accepted Answer

DNS resolution failure for that specific record. The user can access the web server by IP address but not by URL, which indicates that the name-to-IP resolution is failing. Since the DNS server is reachable, the issue is not with network connectivity to the DNS server but rather with the specific DNS record for that web server. This is a classic DNS resolution failure for that specific record, often due to a missing or incorrect A or AAAA record.

Answer

Incorrect default gateway

Answer

Firewall blocking port 80

Answer

IP conflict on the user's workstation

Question 11

A network administrator needs to be notified immediately when the CPU utilization on a core router exceeds 90%. Which SNMP mechanism should be configured on the router?

Accepted Answer

SNMP trap. B is correct because SNMP traps are unsolicited notifications sent from an SNMP agent (the router) to the manager when a predefined condition occurs, such as CPU utilization exceeding 90%. This allows immediate notification without waiting for the manager to poll, which is essential for urgent alerts.

Answer

SNMP get

Answer

SNMP walk

Answer

SNMP set

Question 12

A network technician is explaining the difference between connection-oriented and connectionless protocols to a junior technician. Which of the following protocols is connectionless at the transport layer?

Accepted Answer

UDP. UDP (User Datagram Protocol) is the correct answer because it is a connectionless transport-layer protocol. It does not establish a session or guarantee delivery, instead sending datagrams independently without handshaking or acknowledgments, which makes it suitable for real-time applications like VoIP and streaming.

Answer

TCP

Answer

ICMP

Answer

ARP

Question 13

A network administrator needs to ensure that only authorized devices can connect to the wired network. Each user must authenticate using their domain credentials. Which of the following should be implemented?

Accepted Answer

802.1X with EAP-TLS. 802.1X with EAP-TLS is correct because it provides port-based network access control that requires each user to authenticate using their domain credentials (via a RADIUS server) before the switch port is opened for traffic. EAP-TLS uses mutual authentication with digital certificates, ensuring only authorized devices and users gain access to the wired network.

Answer

MAC filtering

Answer

WPA2-PSK

Answer

Port security

Question 14

A network technician is explaining the process of resolving Layer 2 addresses to Layer 3 addresses on a local network. Which protocol is used by a host to determine the MAC address of another host given its IP address?

Accepted Answer

ARP. ARP (Address Resolution Protocol) is the correct answer because it is specifically designed to resolve a known Layer 3 (IP) address to an unknown Layer 2 (MAC) address on a local network. When a host needs to send a frame to another host, it first checks its ARP cache; if no entry exists, it broadcasts an ARP request containing the target IP, and the host with that IP responds with its MAC address. This process is defined in RFC 826 and operates at the data link layer, enabling direct communication within the same broadcast domain.

Answer

DNS

Answer

DHCP

Answer

ICMP

Question 15

A network engineer needs to deploy a new wireless network in a large office with many cubicles. The goal is to provide high throughput and support multiple simultaneous users. Which IEEE standard should be implemented?

Accepted Answer

802.11ac. 802.11ac (Wi-Fi 5) operates exclusively in the 5 GHz band, uses wider 80 MHz or 160 MHz channels, and supports MU-MIMO (Multi-User Multiple Input Multiple Output) to deliver high throughput and efficient handling of multiple simultaneous users in a dense office environment. This makes it the best choice among the options for a modern, high-capacity wireless deployment.

Answer

802.11n

Answer

802.11b

Answer

802.11g