N10-009 Practice Test 2 — 30 Questions

Question 1

After replacing a faulty network cable, a user reports that they can access local resources but not the internet. The technician verifies that the user's IP address is 192.168.1.100 with a subnet mask of 255.255.255.0 and a default gateway of 192.168.1.1. The technician can ping the default gateway successfully. Which of the following should the technician check NEXT?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A) DNS configuration. The user can access local resources and successfully ping the default gateway, which confirms that Layer 2 and Layer 3 connectivity to the local network is working. The inability to access the internet while local access works points to a name resolution failure, as the browser relies on DNS to translate domain names to IP addresses. Checking DNS configuration is the logical next step because a misconfigured or missing DNS server would prevent internet access even when IP connectivity is intact.

Answer

B) DHCP server

Answer

C) Router's firewall ACLs

Answer

D) Switch port VLAN assignment

Question 2

Users in VLAN 10 cannot obtain IP addresses from the DHCP server located in VLAN 20. The router interface for VLAN 10 has an ip helper-address 192.168.20.5 command configured, and users can ping the DHCP server IP (192.168.20.5) from the router. However, users receive APIPA addresses. What is the most likely cause?

Accepted Answer

The DHCP server does not have a scope configured for the 192.168.1.0/24 subnet (VLAN 10). The ip helper-address command on the router correctly forwards DHCPDISCOVER broadcasts from VLAN 10 to the DHCP server at 192.168.20.5. Since users can ping the server from the router, Layer 3 connectivity exists. However, the DHCP server must have a scope (or address pool) for the subnet of the requesting clients (192.168.1.0/24) to offer an IP address; without it, the server ignores the request, and clients fall back to APIPA (169.254.x.x).

Answer

The router's ip helper-address is configured on the wrong interface

Answer

The switch port connecting users is configured as a trunk instead of an access port

Answer

The router's ACL is blocking DHCP offers from the server

Question 3

A user reports that they cannot access the internet, but they can access local resources on the same subnet. The network administrator pings the default gateway and gets a response. Which tool should be used next to trace the path to an external website?

Accepted Answer

traceroute. B is correct because traceroute (tracert on Windows) is the appropriate tool to identify where packets are being dropped or delayed along the path from the local host to an external website. Since the user can access local resources and the default gateway responds to pings, the issue likely lies beyond the gateway, and traceroute will reveal the hop where connectivity fails.

Answer

netstat

Answer

nslookup

Answer

arp

Question 4

A security analyst observes that an internal server is sending a large volume of TCP SYN packets to various external IP addresses, but never completing the three-way handshake. This behavior is indicative of which type of attack?

Accepted Answer

SYN flood attack. A SYN flood attack occurs when an attacker sends a high volume of TCP SYN packets to a target but never completes the three-way handshake by sending the final ACK. This leaves the target's connection table half-open, consuming resources and potentially exhausting its ability to accept legitimate connections. The observed behavior—internal server sending many SYN packets without completing the handshake—matches the classic signature of a SYN flood, though typically the attacker spoofs the source IP to avoid response traffic.

Answer

Man-in-the-middle attack

Answer

DDoS amplification attack

Answer

Smurf attack

Question 5

A user reports that they can access the company's internal web server by IP address (10.10.10.100) but cannot access it by its hostname (intranet.company.com). The user's workstation is configured with the correct internal DNS server address. Which of the following should the technician do FIRST?

Accepted Answer

Check the DNS server's A record for intranet.company.com. The user can reach the server by IP but not by hostname, which indicates a DNS resolution problem. Since the workstation is configured with the correct internal DNS server, the most likely cause is a missing or incorrect A record for intranet.company.com on that DNS server. Checking the A record is the logical first step before other troubleshooting.

Answer

Review the firewall rules on the server

Answer

Run ipconfig /flushdns on the workstation

Answer

Verify the default gateway configuration

Question 6

A network technician notices that a switch port connected to a user's computer is showing a high number of CRC errors and late collisions. The link is operating at 100 Mbps, full duplex according to the switch. Which of the following is the most likely cause of these errors?

Accepted Answer

Duplex mismatch. CRC errors and late collisions in a full-duplex link are classic symptoms of a duplex mismatch. When one side is set to full duplex and the other to half duplex, the half-duplex side does not sense the carrier before transmitting, leading to collisions that are detected late in the frame. The switch reports full duplex, so the user's NIC is likely stuck at half duplex, causing these errors.

Answer

Cable length exceeds 100 meters

Answer

Faulty switch port

Answer

Electromagnetic interference

Question 7

A user reports that they can access the internet but cannot access the company's internal web application at https://intranet.company.local. The technician can ping the server's IP address (192.168.10.50) successfully from the user's workstation. However, when the technician runs 'nslookup intranet.company.local', it returns 'Non-existent domain'. What is the most likely cause?

Accepted Answer

The client's DNS server does not have a record for the internal domain.. The user can access the internet and ping the server's IP address, which confirms Layer 3 connectivity and that the web server is reachable. However, 'nslookup intranet.company.local' returns 'Non-existent domain', indicating that the DNS server used by the client does not have an A or CNAME record for that internal hostname. Since the browser relies on DNS resolution to translate the FQDN to an IP address, the failure to resolve the name prevents the web application from loading, even though the server itself is online and reachable.

Answer

The web server is not running on port 443.

Answer

A firewall is blocking traffic to the internal web server.

Answer

The hostname is misspelled in the browser.

Question 8

A network administrator connects two switches with a trunk link that is configured to allow all VLANs. Workstations in VLAN 10 can communicate across the switches, but workstations in VLAN 20 cannot. Both VLANs are configured on the first switch. What is the most likely cause of the issue?

Accepted Answer

VLAN 20 is not created on the second switch.. VLAN 20 is configured on the first switch but not on the second switch. Even though the trunk link allows all VLANs, the second switch must have VLAN 20 created in its VLAN database for traffic to be forwarded. Without the VLAN existing on the second switch, frames tagged for VLAN 20 are dropped at the receiving switch because there is no corresponding VLAN interface or forwarding table entry.

Answer

The native VLAN is mismatched on the two switches.

Answer

The trunk uses ISL instead of 802.1Q.

Answer

The default gateway is missing for VLAN 20.

Question 9

A company's public web server is experiencing a flood of TCP SYN packets from multiple external IP addresses. The server's connection table is full, causing new legitimate connections to be dropped. Which of the following mitigation techniques should be implemented to protect the server while still allowing legitimate traffic?

Accepted Answer

Implement SYN cookies on the server.. SYN cookies allow the server to avoid storing connection state in the TCP backlog until the three-way handshake completes. When the SYN flood fills the connection table, the server encodes the initial sequence number (ISN) with cryptographic information about the connection, enabling it to verify the ACK from a legitimate client without consuming table entries. This technique preserves resources for legitimate traffic while dropping spoofed or incomplete handshakes.

Answer

Increase the server's TCP connection backlog.

Answer

Enable bogon filtering on the perimeter firewall.

Answer

Deploy an intrusion prevention system (IPS) with signature detection.

Question 10

A network technician is installing a new wireless access point in a warehouse. The AP requires PoE+ (802.3at) for full operation. The technician connects the AP using a Cat5e cable run of 200 feet to a switch that only supports 802.3af (PoE). The AP powers on but has intermittent connectivity issues. What is the most likely cause?

Accepted Answer

The switch does not support the required PoE standard. The switch only supports 802.3af (PoE), which provides up to 15.4W per port, while the AP requires 802.3at (PoE+) for full operation, which supplies up to 30W. Although the AP powers on, it may not receive sufficient power to operate all radios or features, leading to intermittent connectivity issues. The cable length of 200 feet is within the 100-meter (328-foot) limit for Cat5e, so length is not the problem.

Answer

The cable length exceeds the maximum for PoE

Answer

The AP is experiencing interference from metal racks

Answer

The AP is configured with the wrong SSID

Question 11

A network engineer is designing a new IPv6 addressing scheme. The company has been assigned a /48 prefix and needs to support up to 250 subnets. Which subnet size should be used to minimize waste while meeting the requirement?

Accepted Answer

/56. A /56 subnet provides 256 subnets (2^(56-48) = 2^8 = 256), which meets the requirement of up to 250 subnets with minimal waste. A /48 prefix is the site-level allocation, and using a /56 subnet mask leaves 8 bits for subnetting, offering exactly the needed capacity without over-allocating address space.

Answer

/52

Answer

/64

Answer

/60

Question 12

A network administrator configures a router to send syslog messages to a central log server. The administrator can ping the server from the router, but the server is not receiving any logs. What is the most likely cause?

Accepted Answer

UDP port 514 is blocked between the router and the server. Syslog messages are sent via UDP port 514 by default. Since the administrator can ping the server (ICMP works), but no logs arrive, the most likely cause is that a firewall or ACL is blocking UDP port 514 between the router and the server. This is a classic connectivity issue where Layer 3 reachability exists but the specific transport-layer port is filtered.

Answer

The syslog server is using the wrong protocol (TCP instead of UDP)

Answer

The syslog service on the server is not running

Answer

The router's clock is not synchronized with the server

Question 13

A network administrator is designing a small office network with 40 workstations. The design must ensure that a single cable failure only affects the connected workstation. Which logical topology should the administrator implement?

Accepted Answer

Star. A star topology connects each workstation directly to a central switch or hub, so a cable failure only affects the single connected workstation, not the rest of the network. This meets the requirement for fault isolation at the workstation level, which is the core design goal in a small office with 40 devices.

Answer

Ring

Answer

Bus

Answer

Mesh

Question 14

A network administrator is configuring Quality of Service (QoS) on a router to prioritize voice traffic. Which of the following fields should be used to mark packets for classification and prioritization?

Accepted Answer

DSCP. DSCP (Differentiated Services Code Point) is the correct field because it is a 6-bit value in the IP header used to mark packets for QoS classification and prioritization, as defined in RFC 2474. Voice traffic typically uses DSCP EF (Expedited Forwarding, value 46) to ensure low latency and jitter, making it the standard choice for QoS marking on routers.

Answer

Source IP address

Answer

Source port number

Answer

MAC address

Question 15

A network administrator is configuring a monitoring system to collect metrics from network devices. The administrator needs to ensure that the monitoring system can automatically discover the devices and obtain detailed information about their configuration and status, such as interface descriptions and software versions. Which protocol is best suited for this purpose?

Accepted Answer

SNMP. SNMP (Simple Network Management Protocol) is the correct choice because it is specifically designed for network management and monitoring. It allows a management system to automatically discover devices (via SNMP walks or queries to MIBs) and retrieve detailed configuration and status information, such as interface descriptions and software versions, by reading OIDs from the device's MIB. This matches the requirement for automatic discovery and detailed data collection.

Answer

LLDP

Answer

NetFlow

Answer

Syslog

Question 16

A network administrator wants to prevent unauthorized devices from being plugged into switch ports. Only devices with specific MAC addresses should be allowed on each port. Which switch security feature should be enabled?

Accepted Answer

Port security. Port security is the correct feature because it allows the administrator to restrict which MAC addresses can communicate through a switch port. By configuring allowed MAC addresses (sticky or static), any device with an unknown MAC address attempting to send traffic will trigger a security violation (shutdown, restrict, or protect). This directly addresses the requirement to prevent unauthorized devices from being plugged into switch ports.

Answer

DHCP snooping

Answer

Dynamic ARP inspection

Answer

802.1X

Question 17

Two routers are configured with OSPF in the same area, but they do not form an adjacency. Router A shows OSPF state EXSTART, and Router B shows state EXSTART. Which of the following is the most likely cause?

Accepted Answer

The MTU is mismatched between the two routers. When OSPF routers are stuck in the EXSTART state, it indicates that they have progressed past the 2-Way and ExStart phases but are unable to exchange Database Description (DBD) packets. The most common cause is an MTU mismatch, because OSPF will not proceed to the Exchange state if a DBD packet exceeds the interface MTU of the neighbor. This causes the routers to continuously renegotiate the master/slave relationship without completing the exchange.

Answer

The OSPF Hello and Dead intervals are mismatched

Answer

The OSPF area IDs are different

Answer

The network type is misconfigured (e.g., one side is broadcast, the other is point-to-point)

Question 18

A network administrator needs to power IP phones and wireless access points through the Ethernet cable. Which standard should be supported?

Accepted Answer

802.3af. The 802.3af standard, also known as Power over Ethernet (PoE), delivers up to 15.4 watts of DC power over twisted-pair Ethernet cabling. This allows devices like IP phones and wireless access points to receive both data and power through a single Ethernet cable, eliminating the need for separate power supplies.

Answer

802.11ac

Answer

802.1X

Answer

802.3ab

Question 19

A network administrator wants to prevent rogue DHCP servers from offering IP addresses to clients on the network. Which security feature should be enabled on the switches?

Accepted Answer

DHCP snooping. DHCP snooping is the correct security feature because it acts as a firewall between untrusted hosts and trusted DHCP servers. It validates DHCP messages by filtering out responses from unauthorized DHCP servers on untrusted ports, preventing rogue servers from offering IP addresses to clients. This is achieved by building and maintaining a DHCP snooping binding database that tracks valid IP-to-MAC address mappings.

Answer

Dynamic ARP Inspection (DAI)

Answer

Port Security

Answer

IP Source Guard

Question 20

A security administrator discovers that an attacker has intercepted data between two legitimate hosts by redirecting traffic through a rogue device. Which type of attack is this?

Accepted Answer

Man-in-the-middle. This is a classic man-in-the-middle (MITM) attack, where the attacker intercepts and potentially alters communication between two legitimate hosts by inserting a rogue device into the data path. The key characteristic is the redirection of traffic through the attacker's device, which allows them to capture, inspect, or modify packets in transit.

Answer

ARP poisoning

Answer

DNS poisoning

Answer

Replay attack