N10-009 Practice Test 3 — 10 Questions

Question 1

Which layer of the OSI model is responsible for logical addressing and routing of packets between networks?

Accepted Answer

Network layer. The Network layer (Layer 3) is responsible for logical addressing (e.g., IPv4/IPv6 addresses) and routing packets between different networks by determining the best path using routing protocols such as OSPF, BGP, or static routes. Unlike the Data Link layer, which handles physical addressing (MAC) within a single network segment, the Network layer enables end-to-end delivery across multiple hops.

Answer

Data Link layer

Answer

Transport layer

Answer

Application layer

Question 2

A network administrator reviews firewall logs and sees thousands of SYN packets coming from various source IP addresses to a single internal web server. No ACK or RST packets are observed from these sources. Which type of attack is most likely occurring?

Accepted Answer

SYN flood attack. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target server without completing the handshake (no ACK or RST). This exhausts the server's connection table resources, preventing legitimate connections. The observed pattern of many SYN packets from various sources with no subsequent ACK or RST is the hallmark of a SYN flood.

Answer

DNS amplification attack

Answer

ARP spoofing attack

Answer

Man-in-the-middle attack

Question 3

A new switch is installed in a remote wiring closet. It has been configured with a management IP address of 10.1.2.50/24. The switch is connected via a trunk to the distribution switch, and the management station (10.1.1.0/24) is on a different subnet. The switch cannot be pinged from the management station. The distribution switch has routing to the 10.1.2.0/24 subnet. What is the most likely cause?

Accepted Answer

The default gateway is not configured on the new switch.. The management station is on subnet 10.1.1.0/24, while the switch's management IP is 10.1.2.50/24. For the switch to reply to pings from a different subnet, it must have a default gateway configured so it knows where to send return traffic. Without a default gateway, the switch will only respond to traffic on its local subnet, making it unreachable from the management station.

Answer

The management VLAN is not allowed on the trunk.

Answer

The switch port to the distribution switch is in access mode.

Answer

The management IP is configured on the wrong VLAN.

Question 4

A user reports that they cannot access the internet. The technician tests connectivity: pinging the default gateway succeeds, but pinging a public IP address like 8.8.8.8 fails. Firewall logs show outbound ICMP to 8.8.8.8 is permitted. What is the most likely cause?

Accepted Answer

Missing default route on the router. The user can ping the default gateway (local connectivity) but cannot ping a public IP like 8.8.8.8. This indicates that the workstation has a valid route to its local subnet, but the router lacks a default route (0.0.0.0/0) to forward traffic to the internet. Firewall logs confirm outbound ICMP is permitted, so the issue is at Layer 3 routing, not filtering.

Answer

Incorrect DNS configuration on the workstation

Answer

Duplicate IP address on the local network

Answer

Proxy server configuration is required

Question 5

A network administrator wants to ensure all network devices have synchronized time for accurate log correlation and security event analysis. Which protocol should be implemented?

Accepted Answer

NTP. NTP (Network Time Protocol) is the correct choice because it is specifically designed to synchronize clocks across network devices using a hierarchical system of time sources, ensuring millisecond-level accuracy. Accurate time synchronization is critical for correlating logs and security events across multiple devices, as timestamps must match to reconstruct attack timelines or diagnose faults.

Answer

SNMP

Answer

FTP

Answer

HTTP

Question 6

A user reports that they cannot connect to a file server on the same subnet. The technician checks the workstation's IP configuration: IP 192.168.1.10, subnet mask 255.255.255.0, default gateway 192.168.1.1. The workstation can ping the gateway but cannot ping the file server at 192.168.1.50. Which of the following is the most likely cause?

Accepted Answer

The file server is powered off or disconnected from the network. The workstation can ping the gateway (192.168.1.1) but not the file server (192.168.1.50) on the same subnet. Since both are on the same subnet, the default gateway is not needed for local traffic. The inability to ping the server suggests the server itself is not responding. The most likely causes are that the server is powered off, its network cable is disconnected, or it has a failed network interface. A firewall blocking ICMP would also prevent ping, but the question specifies that the correct answer is the server being powered off or disconnected (option C). Therefore, the most likely cause is that the file server is powered off or has a disconnected cable.

Answer

Incorrect subnet mask on the workstation

Answer

Incorrect default gateway on the workstation

Answer

A firewall on the workstation is blocking traffic to the server

Question 7

A network administrator is configuring a new switch to carry traffic for multiple VLANs on a single link to a router. Which IEEE standard is used for VLAN tagging on Ethernet trunks?

Accepted Answer

802.1Q. 802.1Q is the IEEE standard that defines VLAN tagging on Ethernet trunks, inserting a 4-byte tag into the Ethernet frame to identify VLAN membership. This allows multiple VLANs to traverse a single link between a switch and a router, enabling inter-VLAN routing without separate physical interfaces.

Answer

802.3af

Answer

802.1D

Answer

802.11ac

Question 8

A switch port is configured as a trunk with native VLAN 99. When a frame tagged with VLAN 99 is received on the trunk, the switch displays an error. What is the most likely issue?

Accepted Answer

The remote switch is tagging frames on the native VLAN. The native VLAN is the VLAN that carries untagged traffic on an 802.1Q trunk. By design, frames belonging to the native VLAN should be sent untagged. When a switch receives a frame tagged with the native VLAN ID (VLAN 99), it indicates a mismatch in native VLAN configuration between the two ends of the trunk. The switch logs an error because it expects native VLAN frames to be untagged, but the remote switch is incorrectly tagging them.

Answer

The trunk is using 802.1Q encapsulation and the remote switch expects ISL

Answer

The remote switch is sending frames on VLAN 99 as untagged

Answer

The allowed VLAN list does not include VLAN 99

Question 9

A network administrator has just connected a new access switch to the core switch via a trunk port. The administrator configured the trunk port on both switches with the same allowed VLAN list. However, hosts on VLAN 10 connected to the new access switch cannot communicate with hosts on VLAN 10 on the core switch. The trunk is operational and shows up/up. What is the most likely cause?

Accepted Answer

A) VLAN 10 has not been created on the new access switch. The most likely cause is that VLAN 10 has not been created on the new access switch. Even though the trunk port is up/up and the allowed VLAN list matches, a switch will not forward traffic for a VLAN that does not exist in its local VLAN database. Without the VLAN being created, the switch drops all frames tagged with VLAN 10, preventing communication between hosts on that VLAN across the trunk.

Answer

B) Native VLAN mismatch on the trunk

Answer

C) Trunk encapsulation mismatch (ISL vs 802.1Q)

Answer

D) STP is blocking the VLAN 10 traffic on the trunk

Question 10

A network administrator is preparing to upgrade the firmware on a critical router. Which document should the administrator consult to understand the steps required to minimize downtime and ensure a successful upgrade?

Accepted Answer

Change management plan. The change management plan documents the approved procedures, rollback steps, and communication protocols for performing maintenance on critical infrastructure. Consulting this plan ensures the administrator follows the organization's predefined steps to minimize downtime and mitigate risks during the firmware upgrade.

Answer

SLA

Answer

Network diagram

Answer

Baseline performance report