N10-009 Practice Test 30 — 15 Questions

Question 1

An IT security analyst is implementing a solution to detect malware on endpoints by monitoring system calls and file integrity. Which of the following types of controls is being deployed?

Accepted Answer

Host-based Intrusion Detection System (HIDS). A Host-based Intrusion Detection System (HIDS) monitors system calls, file integrity, and operating system logs directly on the endpoint. This matches the scenario because the analyst is deploying a solution that detects malware by observing low-level system behavior and verifying file integrity, which are core HIDS functions.

Answer

Network-based Intrusion Detection System (NIDS)

Answer

Firewall

Answer

Virtual Private Network (VPN)

Question 2

A network security administrator is configuring authentication for network devices and wants to use a protocol that supports separate encryption of the entire authentication packet. Which of the following protocols is designed to encrypt the entire authentication packet and is commonly used with AAA services?

Accepted Answer

TACACS+. TACACS+ is the correct answer because it encrypts the entire authentication packet, including the username, password, and all other fields, using a shared secret key. This full-packet encryption is a key differentiator from RADIUS, which only encrypts the password field. TACACS+ is commonly used with AAA services to provide separate authentication, authorization, and accounting processes.

Answer

RADIUS

Answer

LDAP

Answer

Kerberos

Question 3

Which of the following describes the purpose of a default gateway on a host in a TCP/IP network?

Accepted Answer

It forwards traffic from the local network to other networks. The default gateway is the router interface on the local subnet that a host uses to send packets destined for IP addresses outside its own network. When a host determines that the destination IP is not in its local subnet (via its subnet mask), it forwards the frame to the default gateway's MAC address, which then routes the packet toward the remote network. Without a default gateway, a host can only communicate with devices on the same local broadcast domain.

Answer

It translates domain names to IP addresses

Answer

It assigns IP addresses to devices on the network

Answer

It filters traffic to prevent unauthorized access

Question 4

A user reports that they cannot connect to a file server on the same subnet. The technician checks the IP configuration and sees an IP address of 169.254.5.10. What is the most likely cause?

Accepted Answer

The DHCP server is unreachable. The IP address 169.254.5.10 is an Automatic Private IP Addressing (APIPA) address from the 169.254.0.0/16 range, which Windows assigns when a DHCP client fails to obtain a lease from a DHCP server. Since the user is on the same subnet as the file server, a missing default gateway or DNS server would not prevent local connectivity, but the inability to reach the DHCP server indicates a broader network issue that also prevents the client from obtaining a valid IP address.

Answer

The default gateway is misconfigured

Answer

The DNS server is down

Answer

The file server is offline

Question 5

A network technician is troubleshooting an intermittent link between two switches connected via single-mode fiber. The interface logs show frequent 'link up / link down' events, sometimes several times per hour. The technician has verified that the SFPs are compatible and the fiber cable is within distance specifications. Which of the following is the most likely cause of the issue?

Accepted Answer

Dirty or contaminated fiber connectors. Intermittent link flaps on single-mode fiber, despite compatible SFPs and correct distance, are most often caused by dirty or contaminated fiber connectors. Even microscopic dust or oil on the end face can scatter light, causing signal loss that triggers the switch's optical receiver to lose sync and flap the link. This matches the symptom of frequent 'link up / link down' events without any configuration mismatch.

Answer

Electromagnetic interference (EMI) from nearby power cables

Answer

Mismatched VLAN configurations on the switches

Answer

Duplex mismatch between the two switch ports

Question 6

A user reports that they can connect to the internet by IP address but cannot access any websites by domain name. Which command-line tool should a technician use first to isolate the issue?

Accepted Answer

nslookup. The user can reach the internet by IP address but not by domain name, which indicates a DNS resolution failure. The `nslookup` command queries DNS servers directly to test name resolution, making it the correct first step to isolate whether the issue is with the DNS server, the client's DNS configuration, or a network path to the DNS server.

Answer

ping

Answer

tracert

Answer

netstat

Question 7

A network administrator wants to allow wireless clients to seamlessly roam between access points without re-authenticating to the RADIUS server for each transition. Which IEEE standard should be implemented?

Accepted Answer

802.11r. 802.11r, also known as Fast BSS Transition (FT), enables wireless clients to roam between access points without re-authenticating to the RADIUS server by using a cached Pairwise Master Key (PMK) and performing a faster, over-the-air or over-the-DS key exchange. This reduces the time required for roaming handoffs, which is critical for real-time applications like VoIP.

Answer

802.11k

Answer

802.11w

Answer

802.1X

Question 8

A network administrator wants to centrally monitor the status of all network devices and receive alerts when an interface goes down. Which protocol and feature combination should the administrator use?

Accepted Answer

SNMP with traps. SNMP traps provide unsolicited, asynchronous notifications from network devices to the management station when specific events occur, such as an interface going down. This allows the administrator to receive immediate alerts without continuously polling each device, making it the ideal protocol and feature combination for real-time status monitoring and alerting.

Answer

SNMP with polling

Answer

Syslog with severity levels

Answer

NetFlow with flow logs

Question 9

A network administrator needs to schedule a firmware upgrade for a critical switch during a maintenance window. After the upgrade is completed and verified, which document should the administrator update to reflect the new firmware version?

Accepted Answer

Configuration baseline document. The configuration baseline document records the approved configuration of a network device, including firmware versions. After a firmware upgrade is verified, updating this document ensures that the baseline reflects the current, known-good state for change management and troubleshooting. The administrator must update the baseline to maintain configuration consistency and audit compliance.

Answer

Incident response plan

Answer

Network topology diagram

Answer

Change request form

Question 10

A network administrator needs to schedule a firmware update for several switches during a maintenance window. Which of the following documents should be updated immediately after the changes are complete?

Accepted Answer

Change management request. The change management request is the correct document to update immediately after completing the firmware update because it serves as the official record that the change was implemented, tested, and closed. This ensures audit compliance, rollback documentation, and approval tracking, which are critical in ITIL-based change management processes. Updating the network diagram or performance baseline may be done later as part of post-change verification, but the change management request must be updated first to formally close the change window.

Answer

Network diagram

Answer

Performance baseline

Answer

Service level agreement

Question 11

A network administrator wants to centrally monitor the bandwidth utilization on a router's serial interface over time. The monitoring tool needs to periodically poll the router for current interface counters. Which protocol should be used for this polling?

Accepted Answer

SNMP. SNMP (Simple Network Management Protocol) is the correct choice because it is specifically designed for polling network devices to retrieve operational statistics such as interface counters (e.g., ifInOctets, ifOutOctets) from a Management Information Base (MIB). The network administrator can configure an SNMP manager to periodically poll the router's serial interface OIDs, enabling centralized bandwidth utilization monitoring over time.

Answer

Syslog

Answer

NetFlow

Answer

ICMP

Question 12

A network monitoring system uses SNMP to poll interface statistics from switches every 5 minutes. This polling is causing high CPU utilization on the switches. Which of the following actions would BEST reduce the CPU load on the switches while still providing monitoring data?

Accepted Answer

Use SNMP traps instead of polling. SNMP traps are push-based notifications sent by the switch only when a significant event occurs (e.g., link up/down, threshold crossing), eliminating the need for the NMS to poll every 5 minutes. This reduces CPU load because the switch no longer processes periodic GET requests, which require CPU cycles to gather interface statistics from the MIB. Traps still provide monitoring data by alerting the NMS to changes, though they may not offer the same granularity as polling for all counters.

Answer

Increase the SNMP community string

Answer

Disable SNMP on unused interfaces

Answer

Change the SNMP version to v1

Question 13

A company wants to implement network access control that requires users to authenticate before gaining access to the network. The NAC solution uses a policy that checks for antivirus updates and OS patches. Which component enforces the policy?

Accepted Answer

Authenticator. The Authenticator (typically a switch or wireless access point) is the component that enforces the NAC policy by controlling access to the network port or SSID. It receives the authentication result from the Authentication Server and applies the policy (e.g., placing the endpoint in a quarantine VLAN if antivirus or OS patch checks fail). This enforcement is defined in IEEE 802.1X, where the Authenticator acts as the gatekeeper between the Supplicant and the network.

Answer

Supplicant

Answer

Authentication server

Answer

Policy server

Question 14

A security analyst is investigating a user's complaint that their wireless connection keeps disconnecting. The analyst uses a wireless scanning tool and discovers two access points broadcasting the same SSID 'CorpNet' with different BSSIDs. One is the legitimate company AP on channel 1, and the other is on channel 11 with a strong signal and security set to 'Open'. Which of the following attacks is most likely occurring?

Accepted Answer

Evil twin. The presence of two access points broadcasting the same SSID 'CorpNet' with different BSSIDs, where the second AP is on channel 11 with a strong signal and security set to 'Open', is characteristic of an evil twin attack. The attacker sets up a fraudulent AP with the same SSID as the legitimate network but without encryption, tricking users into connecting to it and exposing their credentials or traffic. This differs from a rogue AP, which typically mimics the corporate network but may not necessarily use an open security setting or a different channel to lure victims.

Answer

War driving

Answer

Rogue access point

Answer

Bluesnarfing

Question 15

Which of the following is a characteristic of a Layer 2 network switch?

Accepted Answer

Uses MAC addresses to make forwarding decisions. A Layer 2 network switch operates at the Data Link layer of the OSI model and uses MAC addresses to make forwarding decisions. It examines the destination MAC address in an Ethernet frame and consults its MAC address table to determine the appropriate port to forward the frame, enabling efficient local area network communication.

Answer

Makes forwarding decisions based on IP addresses

Answer

Can route traffic between different VLANs without a router

Answer

Provides Network Address Translation (NAT)