N10-009 Practice Test 29 — 15 Questions

Question 1

A network security analyst notices that a switch's CPU utilization is spiking and that the switch is flooding unicast frames to all ports. The analyst suspects a MAC address table overflow attack. Which of the following security features should be configured on the switch's access ports to mitigate this type of attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Port security. Port security mitigates MAC address table overflow attacks by limiting the number of MAC addresses that can be learned on an access port. When the configured limit is exceeded, the switch can take action (e.g., shutdown or restrict) to prevent an attacker from flooding the CAM table with fake source MAC addresses, which would otherwise cause the switch to fail open and flood unicast frames out all ports.

Answer

BPDU guard

Answer

DHCP snooping

Answer

Dynamic ARP Inspection (DAI)

Question 2

A network technician is troubleshooting inter-VLAN routing. Hosts in VLAN 10 can communicate with hosts in VLAN 20, but cannot communicate with hosts in VLAN 30. All VLANs are configured on the same Layer 3 switch with SVIs. Which of the following should the technician verify FIRST?

Accepted Answer

The SVI for VLAN 30 is missing an IP address.. Since all VLANs are configured on the same Layer 3 switch with SVIs, inter-VLAN routing occurs internally. Hosts in VLAN 10 can reach VLAN 20, proving the Layer 3 switch is routing correctly for those VLANs. The failure to reach VLAN 30 most likely indicates that the SVI for VLAN 30 is missing an IP address, which prevents the switch from having a local interface to route traffic to that subnet.

Answer

VLAN 30 is not allowed on the trunk port to the switch.

Answer

The default gateway on hosts in VLAN 10 is incorrect.

Answer

The routing table does not have a route to VLAN 30.

Question 3

In the OSI model, which layer is responsible for establishing, managing, and terminating sessions between applications, as well as providing checkpoints and recovery?

Accepted Answer

Session layer. The Session layer (Layer 5) of the OSI model is explicitly responsible for establishing, managing, and terminating sessions between applications, as well as providing checkpointing and recovery mechanisms. This layer uses protocols like NetBIOS, RPC, and PPTP to coordinate dialog control, synchronization points, and session restoration after failures, ensuring that long-lived transactions can resume from a checkpoint rather than restarting entirely.

Answer

Transport layer

Answer

Network layer

Answer

Data link layer

Question 4

A technician installs a new wireless access point that requires 25 watts of power using Power over Ethernet (PoE). The existing switch only supports 802.3af (15.4W per port). What is the most likely result?

Accepted Answer

The access point will not power on.. The existing switch supports only 802.3af (PoE), which provides a maximum of 15.4 watts per port. The access point requires 25 watts, which exceeds the 802.3af power budget. Since the switch cannot deliver the required power, the access point will not power on. This is a strict power negotiation failure under IEEE 802.3 standards.

Answer

The access point will power on but may not transmit at full power.

Answer

The switch port will be damaged.

Answer

The access point will power on and function normally.

Question 5

A security administrator observes that an employee's workstation is sending large amounts of data to an external IP address on TCP port 443. The workstation is not supposed to initiate outbound connections, and there is no business need for it. What is the most likely cause?

Accepted Answer

The workstation is part of a botnet and is communicating with a command-and-control server. The workstation is sending large amounts of data to an external IP on TCP port 443, which is commonly used for HTTPS traffic. Since the workstation is not authorized to initiate outbound connections and has no business need for this traffic, the most likely cause is that it has been compromised and is part of a botnet, using HTTPS to communicate with a command-and-control (C2) server to evade detection by blending in with legitimate encrypted web traffic.

Answer

A legitimate software update is being downloaded

Answer

The workstation is acting as a VPN client connecting to a corporate VPN server

Answer

The workstation is hosting a web server that is being accessed externally

Question 6

A security engineer is configuring a firewall to protect an internal network. The requirement is that internal users can initiate connections to the internet, but external hosts should not be able to initiate connections to internal hosts unless the internal host first requested the connection. Which firewall technology should be used?

Accepted Answer

Stateful inspection. Stateful inspection (B) tracks the state of active connections by maintaining a state table that records source/destination IPs, ports, and sequence numbers. It allows return traffic for connections initiated from the internal network while blocking unsolicited inbound traffic, which directly matches the requirement that external hosts cannot initiate connections unless the internal host requested them first.

Answer

Stateless packet filtering

Answer

Application proxy

Answer

Packet filtering based on ACL only

Question 7

A network administrator is implementing a new wireless network that will use WPA2-Enterprise. Which of the following must be configured on the network to support this security method?

Accepted Answer

A RADIUS server. WPA2-Enterprise uses 802.1X authentication, which requires a RADIUS server to centralize authentication, authorization, and accounting (AAA). The RADIUS server validates user credentials (e.g., against Active Directory or LDAP) and distributes the Pairwise Master Key (PMK) to the access point, enabling per-user, per-session encryption keys. Without a RADIUS server, the enterprise authentication framework cannot function.

Answer

A pre-shared key

Answer

A certificate authority

Answer

A VPN concentrator

Question 8

A technician connects a user's workstation to a switch port. The cable passes a physical test, and the switch port LED is green, but the workstation cannot establish a network connection. What is the most likely cause?

Accepted Answer

Duplex mismatch between the workstation and the switch. A duplex mismatch occurs when one side of a link is set to full-duplex and the other to half-duplex, often due to a failed autonegotiation. Even though the cable passes a physical test and the switch port LED is green (indicating link at Layer 1), the mismatch causes excessive collisions and frame errors at Layer 2, preventing successful network communication. The workstation cannot establish a connection because the switch and NIC are not coordinating their transmission/reception timing correctly.

Answer

Incorrect VLAN assignment on the switch port

Answer

The workstation has a static IP address in the wrong subnet

Answer

A faulty cable

Question 9

A network monitoring system alerts that a specific router interface has been flapping (repeatedly going up and down) for the past hour. Which of the following is the MOST likely cause of this behavior?

Accepted Answer

Faulty transceiver. A faulty transceiver is the most likely cause of interface flapping because physical-layer issues, such as a failing SFP or GBIC, can cause intermittent loss of signal or link synchronization. The router's interface detects the loss of carrier and brings the link down, then re-establishes it when the signal returns, creating a repeated up/down cycle. This is a common hardware failure mode distinct from software or configuration problems.

Answer

High CPU utilization on the router

Answer

Incorrect SNMP community string

Answer

Routing protocol misconfiguration

Question 10

A network administrator is documenting the network topology. Which of the following tools is best suited for creating a diagram that shows the logical connections between network devices?

Accepted Answer

Microsoft Visio. Microsoft Visio is the correct tool because it is specifically designed for creating professional network topology diagrams, including logical connections between devices. Unlike general-purpose tools, Visio provides network-specific shapes, templates, and layering capabilities that accurately represent logical relationships such as VLANs, subnets, and routing paths.

Answer

Microsoft Excel

Answer

SNMP

Answer

Notepad

Question 11

A network administrator needs to maintain a record of all configuration changes made to network switches, including the date, time, and the administrator who made the change. Which document should be used for this purpose?

Accepted Answer

Change management log. A change management log is the correct document because it is specifically designed to record configuration changes, including the date, time, and the administrator responsible. This log provides an audit trail for network devices, ensuring compliance and facilitating troubleshooting by tracking who made what change and when.

Answer

Network topology diagram

Answer

Baseline configuration report

Answer

Incident report

Question 12

A network engineer is installing a WLAN in a warehouse with many metal shelves and racks. During a site survey, the engineer notices significant signal degradation in certain areas. Which wireless propagation phenomenon is most likely causing the issue?

Accepted Answer

Reflection. In a warehouse with many metal shelves and racks, the primary cause of signal degradation is reflection. Metal surfaces act as RF reflectors, causing the wireless signal to bounce off them, which leads to multipath interference and dead zones where the signal cancels out or becomes too weak to be usable. This is a common issue in environments with high metal density, as the reflected waves interfere with the direct path signal.

Answer

Refraction

Answer

Diffraction

Answer

Absorption

Question 13

A network administrator plans to make a configuration change on a core switch during a maintenance window. According to best practices, which document should the administrator prepare and have approved before making the change?

Accepted Answer

A) Change management request. A change management request is the correct document because it formalizes the proposed configuration change, including the scope, risk assessment, rollback plan, and approval chain. This ensures that all stakeholders review and authorize the change before implementation, reducing the risk of unintended network outages or security gaps. Best practices from ITIL and Cisco's own change management guidelines mandate this process for any production network device modification.

Answer

B) Network diagram

Answer

C) Incident report

Answer

D) Backup configuration

Question 14

A user reports that they cannot access the internet. The technician is able to ping the default gateway successfully but unable to ping a public IP address (e.g., 8.8.8.8). Which of the following is the most likely cause?

Accepted Answer

The router's default route is missing or misconfigured. Successful ping to the default gateway confirms Layer 2 and Layer 3 connectivity within the local subnet, but failure to ping a public IP like 8.8.8.8 indicates that traffic cannot leave the local network. This is most commonly caused by a missing or misconfigured default route on the router, which prevents the router from forwarding packets destined for external networks to the next-hop ISP gateway.

Answer

Incorrect DNS server configuration

Answer

Duplicate IP address on the network

Answer

Faulty network interface card

Question 15

At which layer of the OSI model does end-to-end communication and data segmentation occur?

Accepted Answer

Transport layer. The transport layer (Layer 4) is responsible for end-to-end communication between source and destination hosts, as well as data segmentation and reassembly. Protocols such as TCP and UDP operate at this layer, with TCP providing reliable, connection-oriented service by segmenting data into segments and managing flow control and error recovery.

Answer

Session layer

Answer

Network layer

Answer

Data link layer