N10-009 Practice Test 30 — 15 Questions

Question 1

A network monitoring system uses SNMP to poll interface statistics from switches every 5 minutes. This polling is causing high CPU utilization on the switches. Which of the following actions would BEST reduce the CPU load on the switches while still providing monitoring data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use SNMP traps instead of polling. SNMP traps are push-based notifications sent by the switch only when a significant event occurs (e.g., link up/down, threshold crossing), eliminating the need for the NMS to poll every 5 minutes. This reduces CPU load because the switch no longer processes periodic GET requests, which require CPU cycles to gather interface statistics from the MIB. Traps still provide monitoring data by alerting the NMS to changes, though they may not offer the same granularity as polling for all counters.

Answer

Increase the SNMP community string

Answer

Disable SNMP on unused interfaces

Answer

Change the SNMP version to v1

Question 2

Which of the following protocols is used to automatically assign IP addresses to devices on a network and also provides the subnet mask and default gateway?

Accepted Answer

DHCP. DHCP (Dynamic Host Configuration Protocol) is the correct answer because it is specifically designed to automatically assign IP addresses to devices on a network, along with essential configuration parameters such as the subnet mask and default gateway. When a DHCP client sends a discover message, the DHCP server responds with an offer that includes these details, allowing the client to fully participate in network communication without manual configuration.

Answer

DNS

Answer

ARP

Answer

ICMP

Question 3

A security analyst is investigating a user's complaint that their wireless connection keeps disconnecting. The analyst uses a wireless scanning tool and discovers two access points broadcasting the same SSID 'CorpNet' with different BSSIDs. One is the legitimate company AP on channel 1, and the other is on channel 11 with a strong signal and security set to 'Open'. Which of the following attacks is most likely occurring?

Accepted Answer

Evil twin. The presence of two access points broadcasting the same SSID 'CorpNet' with different BSSIDs, where the second AP is on channel 11 with a strong signal and security set to 'Open', is characteristic of an evil twin attack. The attacker sets up a fraudulent AP with the same SSID as the legitimate network but without encryption, tricking users into connecting to it and exposing their credentials or traffic. This differs from a rogue AP, which typically mimics the corporate network but may not necessarily use an open security setting or a different channel to lure victims.

Answer

War driving

Answer

Rogue access point

Answer

Bluesnarfing

Question 4

Which of the following is a characteristic of a Layer 2 network switch?

Accepted Answer

Uses MAC addresses to make forwarding decisions. A Layer 2 network switch operates at the Data Link layer of the OSI model and uses MAC addresses to make forwarding decisions. It examines the destination MAC address in an Ethernet frame and consults its MAC address table to determine the appropriate port to forward the frame, enabling efficient local area network communication.

Answer

Makes forwarding decisions based on IP addresses

Answer

Can route traffic between different VLANs without a router

Answer

Provides Network Address Translation (NAT)

Question 5

A network administrator needs to remotely manage multiple routers and switches. The management traffic must be encrypted. Which protocol should be used for the remote terminal sessions?

Accepted Answer

SSH. SSH (Secure Shell) encrypts all traffic, including authentication credentials and session data, making it the correct choice for securely managing routers and switches over a network. Telnet transmits everything in plaintext, while SNMP and HTTP lack the interactive encrypted terminal session required for remote CLI management.

Answer

Telnet

Answer

SNMP

Answer

HTTP

Question 6

A network device receives a frame and forwards it based on the destination MAC address. The device does not modify the frame and only floods unknown unicast frames. At which layer of the OSI model does this device operate?

Accepted Answer

Layer 2. This device operates at Layer 2 (Data Link Layer) because it forwards frames based on the destination MAC address, does not modify the frame, and floods unknown unicast frames. These behaviors are characteristic of a transparent bridge or switch, which uses a MAC address table to make forwarding decisions without examining IP addresses or modifying the frame. Layer 2 devices do not perform routing or alter the frame's content, distinguishing them from Layer 3 routers.

Answer

Layer 1

Answer

Layer 3

Answer

Layer 4

Question 7

Which of the following IPv6 addresses is a valid link-local address?

Accepted Answer

fe80::1. Link-local addresses in IPv6 always start with the prefix fe80::/10, and fe80::1 is a valid example. These addresses are automatically configured on interfaces for local link communication and are not routable beyond the local network segment.

Answer

2001:db8::1

Answer

ff02::1

Answer

10.0.0.1

Question 8

A network administrator wants to monitor network devices using SNMP. The security policy requires both authentication and encryption of SNMP packets. Which SNMP version and security level should be configured?

Accepted Answer

SNMPv3 with authPriv. SNMPv3 is the only version that supports both authentication and encryption. The security level 'authPriv' enables both authentication (via HMAC-MD5 or HMAC-SHA) and encryption (via CBC-DES or CFB128-AES), meeting the policy requirement. SNMPv1 and SNMPv2c use only plaintext community strings with no security, while 'authNoPriv' provides authentication without encryption.

Answer

SNMPv2c with a community string

Answer

SNMPv3 with authNoPriv

Answer

SNMPv1 with a community string

Question 9

A network engineer is designing a data center network and needs to ensure high availability for the core switches. Which technology allows multiple physical switches to be combined into a single logical switch to simplify management and improve redundancy?

Accepted Answer

Switch stacking. Switch stacking combines multiple physical switches into a single logical unit, sharing a common control plane and management interface. This simplifies configuration and provides redundancy because if one switch in the stack fails, the remaining switches continue forwarding traffic without requiring STP convergence.

Answer

Spanning Tree Protocol (STP)

Answer

EtherChannel

Answer

Virtual Router Redundancy Protocol (VRRP)

Question 10

A network technician is explaining the OSI model to a junior technician. The technician mentions that the Transport layer is responsible for end-to-end communication and data segmentation. Which protocol operates at the Transport layer?

Accepted Answer

TCP. TCP (Transmission Control Protocol) operates at Layer 4 (Transport) of the OSI model, providing reliable, connection-oriented end-to-end communication and data segmentation with sequencing and acknowledgment. It ensures data is delivered error-free and in order, directly fulfilling the described responsibilities.

Answer

IP

Answer

Ethernet

Answer

HTTP

Question 11

A network technician installs a new 802.3at (PoE+) access point in a warehouse. The AP is connected via a 200-foot Cat5e cable to a switch that only supports 802.3af (PoE). The AP powers on but experiences intermittent connectivity drops. What is the most likely cause?

Accepted Answer

The AP is not receiving enough power from the switch. The switch only supports 802.3af (PoE), which provides a maximum of 15.4 watts per port, while the 802.3at (PoE+) access point requires up to 25.5 watts to operate reliably. The AP powers on because it can negotiate 802.3af power, but under load (e.g., transmitting at higher power or using multiple radios), it draws more current than the switch can supply, causing voltage droop and intermittent resets or link drops. This is a classic power budget mismatch scenario.

Answer

The cable length exceeds the maximum allowed for PoE

Answer

Duplex mismatch between the AP and the switch

Answer

Radio frequency interference from warehouse equipment

Question 12

A network administrator is experiencing issues where unauthorized devices are offering IP addresses to clients, causing connectivity problems. Which security feature should be enabled on switches to prevent this?

Accepted Answer

DHCP Snooping. C is correct because DHCP Snooping is a security feature that filters untrusted DHCP messages on a per-port basis, preventing unauthorized DHCP servers from offering IP addresses to clients. By configuring trusted ports (typically uplinks to legitimate DHCP servers) and untrusted ports (access ports), the switch drops DHCPOFFER and DHCPACK messages received on untrusted ports, directly stopping rogue DHCP server attacks.

Answer

Dynamic ARP Inspection (DAI)

Answer

IP Source Guard

Answer

Port Security

Question 13

A network administrator needs to ensure that network device configurations are automatically backed up to a central server. Which protocol is commonly used for secure file transfer of configurations?

Accepted Answer

SFTP. SFTP (SSH File Transfer Protocol) is the correct choice because it provides encrypted, secure file transfers over an SSH session, making it ideal for backing up sensitive network device configurations to a central server. Unlike TFTP or FTP, SFTP ensures both authentication and data confidentiality, which is critical for network operations.

Answer

TFTP

Answer

FTP

Answer

HTTP

Question 14

Which of the following is a characteristic of UDP?

Accepted Answer

Has lower overhead than TCP. UDP (User Datagram Protocol) is a connectionless transport-layer protocol that provides minimal overhead compared to TCP. It does not establish a connection before sending data, nor does it provide reliability, flow control, or error recovery, making it ideal for real-time applications like VoIP and streaming where speed is prioritized over guaranteed delivery.

Answer

Provides guaranteed delivery

Answer

Uses sequence numbers

Answer

Supports three-way handshake

Question 15

At which OSI layer does a router primarily operate to make forwarding decisions based on IP addresses?

Accepted Answer

Layer 3 (Network). A router primarily operates at Layer 3 (Network) of the OSI model because it uses logical IP addresses (e.g., IPv4 or IPv6) to make forwarding decisions. The router examines the destination IP address in the packet header, performs a longest-prefix match against its routing table, and determines the next-hop interface. This layer is responsible for end-to-end delivery and path selection across multiple networks.

Answer

Layer 1 (Physical)

Answer

Layer 2 (Data Link)

Answer

Layer 4 (Transport)