N10-009 Practice Test 28 — 15 Questions

Question 1

A network technician is explaining the difference between connection-oriented and connectionless protocols to a junior technician. Which of the following protocols is connectionless at the transport layer?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

UDP. UDP (User Datagram Protocol) is the correct answer because it is a connectionless transport-layer protocol. It does not establish a session or guarantee delivery, instead sending datagrams independently without handshaking or acknowledgments, which makes it suitable for real-time applications like VoIP and streaming.

Answer

TCP

Answer

ICMP

Answer

ARP

Question 2

A network technician is explaining the process of resolving Layer 2 addresses to Layer 3 addresses on a local network. Which protocol is used by a host to determine the MAC address of another host given its IP address?

Accepted Answer

ARP. ARP (Address Resolution Protocol) is the correct answer because it is specifically designed to resolve a known Layer 3 (IP) address to an unknown Layer 2 (MAC) address on a local network. When a host needs to send a frame to another host, it first checks its ARP cache; if no entry exists, it broadcasts an ARP request containing the target IP, and the host with that IP responds with its MAC address. This process is defined in RFC 826 and operates at the data link layer, enabling direct communication within the same broadcast domain.

Answer

DNS

Answer

DHCP

Answer

ICMP

Question 3

A network engineer needs to deploy a new wireless network in a large office with many cubicles. The goal is to provide high throughput and support multiple simultaneous users. Which IEEE standard should be implemented?

Accepted Answer

802.11ac. 802.11ac (Wi-Fi 5) operates exclusively in the 5 GHz band, uses wider 80 MHz or 160 MHz channels, and supports MU-MIMO (Multi-User Multiple Input Multiple Output) to deliver high throughput and efficient handling of multiple simultaneous users in a dense office environment. This makes it the best choice among the options for a modern, high-capacity wireless deployment.

Answer

802.11n

Answer

802.11b

Answer

802.11g

Question 4

A network security analyst notices that a switch's CPU utilization is spiking and that the switch is flooding unicast frames to all ports. The analyst suspects a MAC address table overflow attack. Which of the following security features should be configured on the switch's access ports to mitigate this type of attack?

Accepted Answer

Port security. Port security mitigates MAC address table overflow attacks by limiting the number of MAC addresses that can be learned on an access port. When the configured limit is exceeded, the switch can take action (e.g., shutdown or restrict) to prevent an attacker from flooding the CAM table with fake source MAC addresses, which would otherwise cause the switch to fail open and flood unicast frames out all ports.

Answer

BPDU guard

Answer

DHCP snooping

Answer

Dynamic ARP Inspection (DAI)

Question 5

A network technician is troubleshooting inter-VLAN routing. Hosts in VLAN 10 can communicate with hosts in VLAN 20, but cannot communicate with hosts in VLAN 30. All VLANs are configured on the same Layer 3 switch with SVIs. Which of the following should the technician verify FIRST?

Accepted Answer

The SVI for VLAN 30 is missing an IP address.. Since all VLANs are configured on the same Layer 3 switch with SVIs, inter-VLAN routing occurs internally. Hosts in VLAN 10 can reach VLAN 20, proving the Layer 3 switch is routing correctly for those VLANs. The failure to reach VLAN 30 most likely indicates that the SVI for VLAN 30 is missing an IP address, which prevents the switch from having a local interface to route traffic to that subnet.

Answer

VLAN 30 is not allowed on the trunk port to the switch.

Answer

The default gateway on hosts in VLAN 10 is incorrect.

Answer

The routing table does not have a route to VLAN 30.

Question 6

In the OSI model, which layer is responsible for establishing, managing, and terminating sessions between applications, as well as providing checkpoints and recovery?

Accepted Answer

Session layer. The Session layer (Layer 5) of the OSI model is explicitly responsible for establishing, managing, and terminating sessions between applications, as well as providing checkpointing and recovery mechanisms. This layer uses protocols like NetBIOS, RPC, and PPTP to coordinate dialog control, synchronization points, and session restoration after failures, ensuring that long-lived transactions can resume from a checkpoint rather than restarting entirely.

Answer

Transport layer

Answer

Network layer

Answer

Data link layer

Question 7

A technician installs a new wireless access point that requires 25 watts of power using Power over Ethernet (PoE). The existing switch only supports 802.3af (15.4W per port). What is the most likely result?

Accepted Answer

The access point will not power on.. The existing switch supports only 802.3af (PoE), which provides a maximum of 15.4 watts per port. The access point requires 25 watts, which exceeds the 802.3af power budget. Since the switch cannot deliver the required power, the access point will not power on. This is a strict power negotiation failure under IEEE 802.3 standards.

Answer

The access point will power on but may not transmit at full power.

Answer

The switch port will be damaged.

Answer

The access point will power on and function normally.

Question 8

A security administrator observes that an employee's workstation is sending large amounts of data to an external IP address on TCP port 443. The workstation is not supposed to initiate outbound connections, and there is no business need for it. What is the most likely cause?

Accepted Answer

The workstation is part of a botnet and is communicating with a command-and-control server. The workstation is sending large amounts of data to an external IP on TCP port 443, which is commonly used for HTTPS traffic. Since the workstation is not authorized to initiate outbound connections and has no business need for this traffic, the most likely cause is that it has been compromised and is part of a botnet, using HTTPS to communicate with a command-and-control (C2) server to evade detection by blending in with legitimate encrypted web traffic.

Answer

A legitimate software update is being downloaded

Answer

The workstation is acting as a VPN client connecting to a corporate VPN server

Answer

The workstation is hosting a web server that is being accessed externally

Question 9

A security engineer is configuring a firewall to protect an internal network. The requirement is that internal users can initiate connections to the internet, but external hosts should not be able to initiate connections to internal hosts unless the internal host first requested the connection. Which firewall technology should be used?

Accepted Answer

Stateful inspection. Stateful inspection (B) tracks the state of active connections by maintaining a state table that records source/destination IPs, ports, and sequence numbers. It allows return traffic for connections initiated from the internal network while blocking unsolicited inbound traffic, which directly matches the requirement that external hosts cannot initiate connections unless the internal host requested them first.

Answer

Stateless packet filtering

Answer

Application proxy

Answer

Packet filtering based on ACL only

Question 10

A company is implementing network access control to ensure only authenticated users can connect to the wired network. Users must authenticate using their domain credentials before gaining full network access. Which standard should be implemented?

Accepted Answer

802.1X. 802.1X is the IEEE standard for port-based network access control (PNAC). It uses the Extensible Authentication Protocol (EAP) to authenticate devices attempting to connect to a wired or wireless LAN, requiring valid domain credentials before the switch port grants full network access.

Answer

802.3af

Answer

802.11i

Answer

802.1Q

Question 11

A network administrator is implementing a new wireless network that will use WPA2-Enterprise. Which of the following must be configured on the network to support this security method?

Accepted Answer

A RADIUS server. WPA2-Enterprise uses 802.1X authentication, which requires a RADIUS server to centralize authentication, authorization, and accounting (AAA). The RADIUS server validates user credentials (e.g., against Active Directory or LDAP) and distributes the Pairwise Master Key (PMK) to the access point, enabling per-user, per-session encryption keys. Without a RADIUS server, the enterprise authentication framework cannot function.

Answer

A pre-shared key

Answer

A certificate authority

Answer

A VPN concentrator

Question 12

A technician connects a user's workstation to a switch port. The cable passes a physical test, and the switch port LED is green, but the workstation cannot establish a network connection. What is the most likely cause?

Accepted Answer

Duplex mismatch between the workstation and the switch. A duplex mismatch occurs when one side of a link is set to full-duplex and the other to half-duplex, often due to a failed autonegotiation. Even though the cable passes a physical test and the switch port LED is green (indicating link at Layer 1), the mismatch causes excessive collisions and frame errors at Layer 2, preventing successful network communication. The workstation cannot establish a connection because the switch and NIC are not coordinating their transmission/reception timing correctly.

Answer

Incorrect VLAN assignment on the switch port

Answer

The workstation has a static IP address in the wrong subnet

Answer

A faulty cable

Question 13

A network monitoring system alerts that a specific router interface has been flapping (repeatedly going up and down) for the past hour. Which of the following is the MOST likely cause of this behavior?

Accepted Answer

Faulty transceiver. A faulty transceiver is the most likely cause of interface flapping because physical-layer issues, such as a failing SFP or GBIC, can cause intermittent loss of signal or link synchronization. The router's interface detects the loss of carrier and brings the link down, then re-establishes it when the signal returns, creating a repeated up/down cycle. This is a common hardware failure mode distinct from software or configuration problems.

Answer

High CPU utilization on the router

Answer

Incorrect SNMP community string

Answer

Routing protocol misconfiguration

Question 14

A network administrator is documenting the network topology. Which of the following tools is best suited for creating a diagram that shows the logical connections between network devices?

Accepted Answer

Microsoft Visio. Microsoft Visio is the correct tool because it is specifically designed for creating professional network topology diagrams, including logical connections between devices. Unlike general-purpose tools, Visio provides network-specific shapes, templates, and layering capabilities that accurately represent logical relationships such as VLANs, subnets, and routing paths.

Answer

Microsoft Excel

Answer

SNMP

Answer

Notepad

Question 15

A network administrator needs to maintain a record of all configuration changes made to network switches, including the date, time, and the administrator who made the change. Which document should be used for this purpose?

Accepted Answer

Change management log. A change management log is the correct document because it is specifically designed to record configuration changes, including the date, time, and the administrator responsible. This log provides an audit trail for network devices, ensuring compliance and facilitating troubleshooting by tracking who made what change and when.

Answer

Network topology diagram

Answer

Baseline configuration report

Answer

Incident report