N10-009 Practice Test 3 — 10 Questions

Question 1

A security analyst receives an alert that an internal user's workstation is sending a high volume of ARP requests for multiple IP addresses on the local subnet. The analyst suspects a man-in-the-middle attack. Which security mechanism is most effective at mitigating this type of attack on a switched network?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) is the correct answer because it validates ARP packets on a switched network, ensuring that only legitimate ARP replies are forwarded. In a man-in-the-middle attack, an attacker sends spoofed ARP replies to associate their MAC address with the IP address of a legitimate host. DAI intercepts all ARP packets and compares them against a trusted binding table (built by DHCP snooping), dropping any that are invalid, thus preventing ARP spoofing.

Answer

Port security

Answer

DHCP snooping

Answer

MAC address filtering

Question 2

A user reports that they cannot access the internet. The technician tests connectivity: pinging the default gateway succeeds, but pinging a public IP address like 8.8.8.8 fails. Firewall logs show outbound ICMP to 8.8.8.8 is permitted. What is the most likely cause?

Accepted Answer

Missing default route on the router. The user can ping the default gateway (local connectivity) but cannot ping a public IP like 8.8.8.8. This indicates that the workstation has a valid route to its local subnet, but the router lacks a default route (0.0.0.0/0) to forward traffic to the internet. Firewall logs confirm outbound ICMP is permitted, so the issue is at Layer 3 routing, not filtering.

Answer

Incorrect DNS configuration on the workstation

Answer

Duplicate IP address on the local network

Answer

Proxy server configuration is required

Question 3

A network administrator is investigating reports of slow network performance. Which tool should the administrator use to capture and analyze individual packets to identify the cause of the latency?

Accepted Answer

Packet analyzer. A packet analyzer captures and decodes individual packets, allowing the administrator to inspect frame-level details, identify retransmissions, TCP window scaling issues, or application-layer delays that cause latency. This granularity is essential for pinpointing the exact cause of slow performance.

Answer

Throughput tester

Answer

Spectrum analyzer

Answer

NetFlow analyzer

Question 4

A security analyst is reviewing logs and finds that a single MAC address is rapidly requesting IP addresses from a DHCP server, each time with a different client ID. The DHCP server is exhausting its address pool. Which type of attack is occurring?

Accepted Answer

DHCP starvation attack. A DHCP starvation attack occurs when an attacker sends numerous DHCP discover messages, each with a unique client ID (chaddr), to exhaust the DHCP server's address pool. This prevents legitimate clients from obtaining IP addresses, as the server believes all leases are assigned. The rapid requests with different client IDs from a single MAC address are a hallmark of this attack.

Answer

MAC flooding attack

Answer

ARP spoofing

Answer

DNS poisoning

Question 5

A user reports that they cannot connect to a file server on the same subnet. The technician checks the workstation's IP configuration: IP 192.168.1.10, subnet mask 255.255.255.0, default gateway 192.168.1.1. The workstation can ping the gateway but cannot ping the file server at 192.168.1.50. Which of the following is the most likely cause?

Accepted Answer

The file server is powered off or disconnected from the network. The workstation can ping the gateway (192.168.1.1) but not the file server (192.168.1.50) on the same subnet. Since both are on the same subnet, the default gateway is not needed for local traffic. The inability to ping the server suggests the server itself is not responding. The most likely causes are that the server is powered off, its network cable is disconnected, or it has a failed network interface. A firewall blocking ICMP would also prevent ping, but the question specifies that the correct answer is the server being powered off or disconnected (option C). Therefore, the most likely cause is that the file server is powered off or has a disconnected cable.

Answer

Incorrect subnet mask on the workstation

Answer

Incorrect default gateway on the workstation

Answer

A firewall on the workstation is blocking traffic to the server

Question 6

A network administrator wants to ensure all network devices have synchronized time for accurate log correlation and security event analysis. Which protocol should be implemented?

Accepted Answer

NTP. NTP (Network Time Protocol) is the correct choice because it is specifically designed to synchronize clocks across network devices using a hierarchical system of time sources, ensuring millisecond-level accuracy. Accurate time synchronization is critical for correlating logs and security events across multiple devices, as timestamps must match to reconstruct attack timelines or diagnose faults.

Answer

SNMP

Answer

FTP

Answer

HTTP

Question 7

A switch is connected to a network printer. The switch port is manually configured for 100 Mbps and full duplex. The printer is configured for auto-negotiation. The link is up, but there are many FCS errors on the switch port. What is the most likely cause?

Accepted Answer

Duplex mismatch. The most likely cause is a duplex mismatch. The switch port is manually set to full duplex, while the printer is using auto-negotiation. When one side is manually configured and the other is set to auto-negotiation, the auto-negotiating side fails to detect the manual setting and defaults to half duplex. This mismatch causes collisions and frame check sequence (FCS) errors on the full-duplex side, as the half-duplex side does not properly handle simultaneous transmission.

Answer

Bad Ethernet cable

Answer

Speed mismatch

Answer

Printer driver issues

Question 8

Which of the following uniquely identifies a hardware network interface on a device?

Accepted Answer

MAC address. A MAC (Media Access Control) address is a hardware-embedded, globally unique identifier assigned to a network interface controller (NIC) by the manufacturer. It operates at Layer 2 (Data Link Layer) of the OSI model and is used for local network communication, ensuring that no two devices on the same broadcast domain have the same MAC address.

Answer

IP address

Answer

Subnet mask

Answer

Default gateway

Question 9

A network administrator has configured a switch with four VLANs: VLAN 10, 20, 30, and 99 (native). The switch is connected to a router via an 802.1Q trunk link. The router has subinterfaces for VLANs 10, 20, and 30, each with an IP address. VLAN 99 is used for management and does not have a router subinterface. How many Layer 3 broadcast domains exist in this network?

Accepted Answer

3. A Layer 3 broadcast domain corresponds to a routed IP subnet. Without a router subinterface, VLAN 99 has no Layer 3 termination, so only VLANs 10, 20, and 30 (with subinterfaces) form separate broadcast domains. Thus, there are 3 Layer 3 broadcast domains.

Answer

1

Answer

2

Answer

4

Question 10

Which of the following is a characteristic of UDP?

Accepted Answer

Has lower overhead than TCP. UDP (User Datagram Protocol) is a connectionless transport-layer protocol that provides minimal overhead compared to TCP. It does not establish a connection before sending data, nor does it provide reliability, flow control, or error recovery, making it ideal for real-time applications like VoIP and streaming where speed is prioritized over guaranteed delivery.

Answer

Provides guaranteed delivery

Answer

Uses sequence numbers

Answer

Supports three-way handshake