N10-009 Practice Test 30 — 15 Questions

Question 1

A network technician is troubleshooting a user's inability to access a specific internal web application hosted on a server at 10.10.10.15:8080. The user can ping the server's IP address successfully, but the web browser displays 'connection refused'. The technician verifies that the web application service is running on the server. What is the most likely cause of the issue?

Accepted Answer

The server's firewall is blocking inbound connections to port 8080.. Since the user can ping the server (ICMP success) but receives 'connection refused' on port 8080, and the service is confirmed running, the most likely cause is that the server's firewall is blocking inbound TCP connections to port 8080. A firewall rule can permit ICMP echo requests while denying TCP SYN packets to specific ports, resulting in a successful ping but a TCP RST or no response at the application layer, which manifests as 'connection refused' in the browser.

Answer

The web application is listening on a different port than 8080.

Answer

The user's web browser is configured to use an incorrect proxy server.

Answer

The DNS resolution is failing for the server's hostname.

Question 2

A network technician is explaining the concept of encapsulation to a junior technician. At which OSI layer does a packet get encapsulated with a source and destination IP address?

Accepted Answer

Layer 3. At Layer 3 (the Network layer), the packet is encapsulated with a source and destination IP address. This is defined by the Internet Protocol (IP), which handles logical addressing and routing across networks. The IP header is added to the payload from the upper layers, creating a packet that can be forwarded by routers.

Answer

Layer 2

Answer

Layer 4

Answer

Layer 1

Question 3

A security analyst discovers that an unauthorized device is sending forged ARP replies to poison the ARP caches of other devices on the network. Which security feature should be implemented on the switches to prevent this?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) validates ARP packets on a per-interface basis by intercepting all ARP requests and replies and verifying that they match entries in the DHCP snooping binding table. If an ARP reply contains a forged IP-to-MAC mapping, DAI drops the packet, preventing ARP cache poisoning. This directly stops the described attack where an unauthorized device sends forged ARP replies.

Answer

Port security

Answer

DHCP snooping

Answer

STP BPDU guard

Question 4

A security analyst is configuring a firewall to allow HTTPS traffic from the internet to an internal web server with a private IP address. The firewall must translate the destination IP address of incoming packets to the private server IP. Which type of NAT should be configured?

Accepted Answer

Destination NAT (DNAT). Destination NAT (DNAT) is used to translate the destination IP address of incoming packets from a public IP to a private IP, allowing external HTTPS traffic to reach an internal web server. This is exactly what the scenario requires: the firewall must rewrite the destination address of packets arriving from the internet to the private server IP. DNAT is commonly implemented using the 'ip nat inside source static' command in Cisco IOS, where the 'inside' keyword refers to the translation of destination addresses for inbound traffic.

Answer

Source NAT (SNAT)

Answer

Static NAT

Answer

Port Address Translation (PAT)

Question 5

A network technician is troubleshooting an issue where users on VLAN 20 can access internal servers and the default gateway but cannot reach any external websites. The router's ACL is configured to permit all outbound traffic. What is the most likely cause of this issue?

Accepted Answer

NAT is not configured or is misconfigured on the router. Since users can access internal servers and the default gateway, Layer 3 connectivity within the VLAN is working, and the router's ACL permits all outbound traffic. The inability to reach external websites while internal resources are reachable strongly indicates that Network Address Translation (NAT) is either not configured or misconfigured on the router. Without NAT, private IP addresses from VLAN 20 cannot be translated to a public IP, so return traffic from external web servers has no route back to the internal hosts.

Answer

The DNS server is unreachable from the VLAN

Answer

The DHCP server is not providing a default gateway

Answer

The switch port for the router is in the wrong VLAN

Question 6

A security administrator is configuring a wireless network to use WPA3-Enterprise. Which authentication server protocol is required for WPA3-Enterprise?

Accepted Answer

RADIUS. WPA3-Enterprise requires 802.1X/EAP authentication, which uses RADIUS as the backend authentication server protocol. RADIUS handles the exchange of EAP frames between the authenticator (access point) and the authentication server, enforcing per-user credentials and supporting the mandatory 192-bit security suite for WPA3-Enterprise. Without RADIUS, the 802.1X framework cannot operate, making it the only required protocol for this deployment.

Answer

LDAP

Answer

TACACS+

Answer

Kerberos

Question 7

A security engineer notices that the company's web server is receiving an overwhelming number of HTTP GET requests from thousands of different IP addresses around the world. The requests are for legitimate pages and are well-formed. The server is becoming unresponsive. Which type of attack is most likely occurring?

Accepted Answer

DDoS attack. The attack involves a high volume of legitimate HTTP GET requests from many distinct IP addresses, overwhelming the web server. This is a classic distributed denial-of-service (DDoS) attack, where multiple compromised systems (a botnet) coordinate to flood the target with traffic, exhausting server resources and causing unresponsiveness. The key indicators are the distributed source IPs and the use of application-layer (HTTP) requests, which distinguishes it from network-layer floods.

Answer

ARP spoofing

Answer

SYN flood

Answer

DNS amplification

Question 8

A technician is troubleshooting a connectivity issue. A client can successfully ping its default gateway but cannot ping a server located on a different subnet. The router's routing table shows a valid route to the server's network. What should the technician check NEXT?

Accepted Answer

The ACL applied to the router interface. Since the client can ping its default gateway but not a server on a different subnet, Layer 3 routing is working (the router has a valid route). The most likely cause is an ACL on the router interface that is blocking traffic to the server's network. ACLs filter traffic based on source/destination IP, protocol, or port, and can permit or deny packets even when a valid route exists.

Answer

The DNS resolution for the server

Answer

The ARP cache on the client

Answer

The duplex settings on the client NIC

Question 9

A security analyst is investigating a network anomaly. The analyst notices that the company's web server is receiving a large number of TCP SYN packets from random source IP addresses, all destined for port 80. The web server is responding with SYN-ACK packets, but the connections are never completed. This is causing the server's connection table to fill up, degrading performance for legitimate users. Which type of attack is being described?

Accepted Answer

SYN flood. The attack described is a SYN flood, a type of denial-of-service (DoS) attack that exploits the TCP three-way handshake. The attacker sends a high volume of TCP SYN packets with spoofed source IP addresses to the server's port 80. The server responds with SYN-ACK packets to each spoofed source and waits for the final ACK, which never arrives, causing the server's half-open connection table (backlog queue) to fill up and exhaust resources, degrading performance for legitimate users.

Answer

Ping of death

Answer

Smurf attack

Answer

DNS amplification

Question 10

A security analyst detects a large number of DNS queries for the same domain from multiple internal hosts. The responses contain large payloads. Which type of attack is likely occurring?

Accepted Answer

DNS amplification. DNS amplification is a type of reflection-based DDoS attack where an attacker sends a small query (e.g., ANY or DNSSEC-signed record request) with a spoofed source IP (the victim's address) to an open DNS resolver. The resolver responds with a large payload (often 50–100x larger than the query), flooding the victim's network. The scenario describes many internal hosts making queries to the same domain and receiving large responses, which matches the amplification effect from a compromised or misconfigured internal resolver.

Answer

DNS cache poisoning

Answer

DNS tunneling

Answer

DNS zone transfer

Question 11

A technician is troubleshooting a user's inability to reach a specific website. The user can reach other websites without issue. The technician runs nslookup on the user's workstation and receives the correct IP address for the website. However, a ping to that IP address fails. Which of the following is the most likely cause?

Accepted Answer

The website server is blocking ICMP requests.. Since nslookup returns the correct IP address, DNS resolution is working. The ping fails despite a valid IP, which indicates that the destination server is reachable at the network layer but is not responding to ICMP echo requests. Many web servers are configured to block ICMP to reduce attack surface or prevent reconnaissance, which is a common security practice.

Answer

The default gateway is misconfigured.

Answer

The DNS server is not resolving the domain name.

Answer

The subnet mask is incorrect.

Question 12

A security analyst is reviewing firewall logs and sees many incoming packets with a source IP address that matches the internal IP range of the company (10.0.0.0/8) arriving on the external interface. Which type of attack is likely being attempted?

Accepted Answer

IP spoofing attack. The correct answer is B because packets arriving on the external interface with a source IP address from the internal 10.0.0.0/8 range indicate that the attacker is forging (spoofing) the source address to impersonate an internal host. This is a classic IP spoofing attack, often used to bypass access control lists or to launch further attacks that rely on trust relationships based on source IP.

Answer

Smurf attack

Answer

SYN flood

Answer

DNS amplification

Question 13

A security analyst observes that an internal server is sending a large volume of TCP SYN packets to various external IP addresses, but never completing the three-way handshake. This behavior is indicative of which type of attack?

Accepted Answer

SYN flood attack. The correct answer is B. A SYN flood attack occurs when an attacker sends a high volume of TCP SYN packets to a target but never completes the three-way handshake by sending the final ACK. This leaves the target's connection table half-open, consuming resources and potentially exhausting its ability to accept legitimate connections. The observed behavior—internal server sending many SYN packets without completing the handshake—matches the classic signature of a SYN flood, though typically the attacker spoofs the source IP to avoid response traffic.

Answer

Man-in-the-middle attack

Answer

DDoS amplification attack

Answer

Smurf attack

Question 14

A user reports that they can access the company's intranet but not the internet. The technician checks the IP configuration and finds that the default gateway is set to 192.168.1.1, and the user can ping that IP. Which of the following is the most likely cause?

Accepted Answer

The router's NAT configuration is faulty.. Since the user can ping the default gateway (192.168.1.1) and access the intranet, Layer 3 connectivity to the local router is functional. The inability to reach the internet, despite having a valid gateway, points to a failure in the router's NAT (Network Address Translation) configuration. NAT is required to translate private RFC 1918 addresses (like 192.168.1.x) to a public IP for internet access; without it, packets are routed to the gateway but cannot be forwarded beyond the local network.

Answer

The DNS server address is incorrect.

Answer

The DHCP server is not providing a default gateway.

Answer

The user's workstation has a static IP address.

Question 15

A security analyst observes that a workstation on the network is sending unsolicited ARP replies stating that the workstation's MAC address corresponds to the default gateway IP for all subnets. This behavior is causing other devices to send traffic destined for external networks to the workstation instead of the legitimate gateway. Which type of attack is being performed?

Accepted Answer

A: ARP spoofing. The workstation is sending unsolicited ARP replies that map the default gateway IP to its own MAC address. This poisons the ARP caches of other devices on the network, causing them to forward traffic destined for external networks to the attacker's workstation instead of the legitimate gateway. This is the classic behavior of an ARP spoofing (or ARP poisoning) attack, which exploits the lack of authentication in the ARP protocol (RFC 826).

Answer

B: DHCP starvation

Answer

C: DNS poisoning

Answer

D: MAC flooding