N10-009 Practice Test 2 — 30 Questions

Question 1

A network engineer is troubleshooting connectivity issues between two data center switches that are configured to support jumbo frames with an MTU of 9000. The link is a 10 Gigabit Ethernet fiber connection. Large file transfers fail, but small transfers succeed. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

C. The most likely cause is that an intermediate device (such as a router or another switch) along the Layer 2 path is not configured for jumbo frames and has a standard MTU of 1500. Since both end switches support an MTU of 9000, large frames are sent but are dropped when they reach the intermediate device that cannot handle them. Small frames (≤1500 bytes) pass through successfully because they fit within the standard MTU.

Answer

A

Answer

B

Answer

D

Question 2

A network administrator is configuring a new switch to carry traffic for multiple VLANs on a single link to a router. Which IEEE standard is used for VLAN tagging on Ethernet trunks?

Accepted Answer

802.1Q. 802.1Q is the IEEE standard that defines VLAN tagging on Ethernet trunks, inserting a 4-byte tag into the Ethernet frame to identify VLAN membership. This allows multiple VLANs to traverse a single link between a switch and a router, enabling inter-VLAN routing without separate physical interfaces.

Answer

802.3af

Answer

802.1D

Answer

802.11ac

Question 3

A user can access a website by its IP address (e.g., 203.0.113.5) but cannot access it by its domain name (example.com). Other users on the same subnet can access the website by domain name. Which of the following should the technician check FIRST?

Accepted Answer

Check the local hosts file. The issue is isolated to a single user who can reach the website by IP but not by domain name, while other users on the same subnet have no problem. This indicates a client-side DNS resolution problem. The first thing to check is the local hosts file (e.g., C:\Windows\System32\drivers\etc\hosts) for any incorrect or outdated entries that might be overriding DNS resolution. If the hosts file has an incorrect mapping for example.com, the browser will use that instead of querying the DNS server, causing the failure. Checking DNS server configuration is appropriate if the hosts file is clean.

Answer

Check the DNS server configuration on the network

Answer

Check the website's DNS records

Answer

Check the user's browser proxy settings

Question 4

A network engineer wants to segment a LAN into multiple broadcast domains without purchasing additional hardware. Which of the following technologies should be implemented?

Accepted Answer

VLANs. VLANs (Virtual Local Area Networks) allow a network engineer to logically segment a single physical LAN switch into multiple isolated broadcast domains without purchasing additional hardware. By assigning switch ports to different VLAN IDs, broadcast traffic is confined to ports within the same VLAN, effectively creating separate Layer 2 networks on the same switch infrastructure.

Answer

Subnetting

Answer

VPN

Answer

NAT

Question 5

A network engineer is reviewing RFC 1918 address ranges to plan a private IP addressing scheme. Which of the following IP addresses falls within the private address space for Class A?

Accepted Answer

10.10.10.1. RFC 1918 defines the Class A private address range as 10.0.0.0/8, which includes all addresses from 10.0.0.0 to 10.255.255.255. 10.10.10.1 falls within this range, making it a valid private IP address for internal network use.

Answer

172.16.0.1

Answer

192.168.1.1

Answer

172.32.0.1

Question 6

A network administrator needs to ensure high availability for a critical server that has two network interfaces connected to two different switches. Which configuration should be implemented to provide failover and load balancing at the network layer?

Accepted Answer

Link aggregation (LACP). Link Aggregation (LACP) allows multiple physical network interfaces to be combined into a single logical link, providing both failover and load balancing at Layer 2. In this scenario, the server's two NICs are connected to two different switches; LACP can be configured across the two switches (if they support Multi-chassis Link Aggregation) or the NICs can be set up in an active/standby team for failover. This satisfies the requirement for high availability and load balancing at the network layer (Layer 2/3 boundary). Virtual IP protocols like VRRP/HSRP are designed for gateway redundancy, not for server NIC failover.

Answer

Virtual IP (VRRP/HSRP)

Answer

Spanning Tree Protocol (STP)

Answer

Port mirroring

Question 7

A switch port is configured as a trunk with native VLAN 99. When a frame tagged with VLAN 99 is received on the trunk, the switch displays an error. What is the most likely issue?

Accepted Answer

The remote switch is tagging frames on the native VLAN. The native VLAN is the VLAN that carries untagged traffic on an 802.1Q trunk. By design, frames belonging to the native VLAN should be sent untagged. When a switch receives a frame tagged with the native VLAN ID (VLAN 99), it indicates a mismatch in native VLAN configuration between the two ends of the trunk. The switch logs an error because it expects native VLAN frames to be untagged, but the remote switch is incorrectly tagging them.

Answer

The trunk is using 802.1Q encapsulation and the remote switch expects ISL

Answer

The remote switch is sending frames on VLAN 99 as untagged

Answer

The allowed VLAN list does not include VLAN 99

Question 8

A network administrator has just connected a new access switch to the core switch via a trunk port. The administrator configured the trunk port on both switches with the same allowed VLAN list. However, hosts on VLAN 10 connected to the new access switch cannot communicate with hosts on VLAN 10 on the core switch. The trunk is operational and shows up/up. What is the most likely cause?

Accepted Answer

A) VLAN 10 has not been created on the new access switch. The most likely cause is that VLAN 10 has not been created on the new access switch. Even though the trunk port is up/up and the allowed VLAN list matches, a switch will not forward traffic for a VLAN that does not exist in its local VLAN database. Without the VLAN being created, the switch drops all frames tagged with VLAN 10, preventing communication between hosts on that VLAN across the trunk.

Answer

B) Native VLAN mismatch on the trunk

Answer

C) Trunk encapsulation mismatch (ISL vs 802.1Q)

Answer

D) STP is blocking the VLAN 10 traffic on the trunk

Question 9

A network administrator is preparing to upgrade the firmware on a critical router. Which document should the administrator consult to understand the steps required to minimize downtime and ensure a successful upgrade?

Accepted Answer

Change management plan. The change management plan documents the approved procedures, rollback steps, and communication protocols for performing maintenance on critical infrastructure. Consulting this plan ensures the administrator follows the organization's predefined steps to minimize downtime and mitigate risks during the firmware upgrade.

Answer

SLA

Answer

Network diagram

Answer

Baseline performance report

Question 10

After replacing a faulty network cable, a user reports that they can access local resources but not the internet. The technician verifies that the user's IP address is 192.168.1.100 with a subnet mask of 255.255.255.0 and a default gateway of 192.168.1.1. The technician can ping the default gateway successfully. Which of the following should the technician check NEXT?

Accepted Answer

A) DNS configuration. The user can access local resources and successfully ping the default gateway, which confirms that Layer 2 and Layer 3 connectivity to the local network is working. The inability to access the internet while local access works points to a name resolution failure, as the browser relies on DNS to translate domain names to IP addresses. Checking DNS configuration is the logical next step because a misconfigured or missing DNS server would prevent internet access even when IP connectivity is intact.

Answer

B) DHCP server

Answer

C) Router's firewall ACLs

Answer

D) Switch port VLAN assignment

Question 11

Users in VLAN 10 cannot obtain IP addresses from the DHCP server located in VLAN 20. The router interface for VLAN 10 has an ip helper-address 192.168.20.5 command configured, and users can ping the DHCP server IP (192.168.20.5) from the router. However, users receive APIPA addresses. What is the most likely cause?

Accepted Answer

The DHCP server does not have a scope configured for the 192.168.1.0/24 subnet (VLAN 10). The ip helper-address command on the router correctly forwards DHCPDISCOVER broadcasts from VLAN 10 to the DHCP server at 192.168.20.5. Since users can ping the server from the router, Layer 3 connectivity exists. However, the DHCP server must have a scope (or address pool) for the subnet of the requesting clients (192.168.1.0/24) to offer an IP address; without it, the server ignores the request, and clients fall back to APIPA (169.254.x.x).

Answer

The router's ip helper-address is configured on the wrong interface

Answer

The switch port connecting users is configured as a trunk instead of an access port

Answer

The router's ACL is blocking DHCP offers from the server

Question 12

A user reports that they cannot access the internet, but they can access local resources on the same subnet. The network administrator pings the default gateway and gets a response. Which tool should be used next to trace the path to an external website?

Accepted Answer

traceroute. B is correct because traceroute (tracert on Windows) is the appropriate tool to identify where packets are being dropped or delayed along the path from the local host to an external website. Since the user can access local resources and the default gateway responds to pings, the issue likely lies beyond the gateway, and traceroute will reveal the hop where connectivity fails.

Answer

netstat

Answer

nslookup

Answer

arp

Question 13

A security analyst observes that an internal server is sending a large volume of TCP SYN packets to various external IP addresses, but never completing the three-way handshake. This behavior is indicative of which type of attack?

Accepted Answer

SYN flood attack. A SYN flood attack occurs when an attacker sends a high volume of TCP SYN packets to a target but never completes the three-way handshake by sending the final ACK. This leaves the target's connection table half-open, consuming resources and potentially exhausting its ability to accept legitimate connections. The observed behavior—internal server sending many SYN packets without completing the handshake—matches the classic signature of a SYN flood, though typically the attacker spoofs the source IP to avoid response traffic.

Answer

Man-in-the-middle attack

Answer

DDoS amplification attack

Answer

Smurf attack

Question 14

A user reports that they can access the company's internal web server by IP address (10.10.10.100) but cannot access it by its hostname (intranet.company.com). The user's workstation is configured with the correct internal DNS server address. Which of the following should the technician do FIRST?

Accepted Answer

Check the DNS server's A record for intranet.company.com. The user can reach the server by IP but not by hostname, which indicates a DNS resolution problem. Since the workstation is configured with the correct internal DNS server, the most likely cause is a missing or incorrect A record for intranet.company.com on that DNS server. Checking the A record is the logical first step before other troubleshooting.

Answer

Review the firewall rules on the server

Answer

Run ipconfig /flushdns on the workstation

Answer

Verify the default gateway configuration

Question 15

A network technician notices that a switch port connected to a user's computer is showing a high number of CRC errors and late collisions. The link is operating at 100 Mbps, full duplex according to the switch. Which of the following is the most likely cause of these errors?

Accepted Answer

Duplex mismatch. CRC errors and late collisions in a full-duplex link are classic symptoms of a duplex mismatch. When one side is set to full duplex and the other to half duplex, the half-duplex side does not sense the carrier before transmitting, leading to collisions that are detected late in the frame. The switch reports full duplex, so the user's NIC is likely stuck at half duplex, causing these errors.

Answer

Cable length exceeds 100 meters

Answer

Faulty switch port

Answer

Electromagnetic interference

Question 16

A user reports that they can access the internet but cannot access the company's internal web application at https://intranet.company.local. The technician can ping the server's IP address (192.168.10.50) successfully from the user's workstation. However, when the technician runs 'nslookup intranet.company.local', it returns 'Non-existent domain'. What is the most likely cause?

Accepted Answer

The client's DNS server does not have a record for the internal domain.. The user can access the internet and ping the server's IP address, which confirms Layer 3 connectivity and that the web server is reachable. However, 'nslookup intranet.company.local' returns 'Non-existent domain', indicating that the DNS server used by the client does not have an A or CNAME record for that internal hostname. Since the browser relies on DNS resolution to translate the FQDN to an IP address, the failure to resolve the name prevents the web application from loading, even though the server itself is online and reachable.

Answer

The web server is not running on port 443.

Answer

A firewall is blocking traffic to the internal web server.

Answer

The hostname is misspelled in the browser.

Question 17

A network administrator connects two switches with a trunk link that is configured to allow all VLANs. Workstations in VLAN 10 can communicate across the switches, but workstations in VLAN 20 cannot. Both VLANs are configured on the first switch. What is the most likely cause of the issue?

Accepted Answer

VLAN 20 is not created on the second switch.. VLAN 20 is configured on the first switch but not on the second switch. Even though the trunk link allows all VLANs, the second switch must have VLAN 20 created in its VLAN database for traffic to be forwarded. Without the VLAN existing on the second switch, frames tagged for VLAN 20 are dropped at the receiving switch because there is no corresponding VLAN interface or forwarding table entry.

Answer

The native VLAN is mismatched on the two switches.

Answer

The trunk uses ISL instead of 802.1Q.

Answer

The default gateway is missing for VLAN 20.

Question 18

A company's public web server is experiencing a flood of TCP SYN packets from multiple external IP addresses. The server's connection table is full, causing new legitimate connections to be dropped. Which of the following mitigation techniques should be implemented to protect the server while still allowing legitimate traffic?

Accepted Answer

Implement SYN cookies on the server.. SYN cookies allow the server to avoid storing connection state in the TCP backlog until the three-way handshake completes. When the SYN flood fills the connection table, the server encodes the initial sequence number (ISN) with cryptographic information about the connection, enabling it to verify the ACK from a legitimate client without consuming table entries. This technique preserves resources for legitimate traffic while dropping spoofed or incomplete handshakes.

Answer

Increase the server's TCP connection backlog.

Answer

Enable bogon filtering on the perimeter firewall.

Answer

Deploy an intrusion prevention system (IPS) with signature detection.

Question 19

A network technician is installing a new wireless access point in a warehouse. The AP requires PoE+ (802.3at) for full operation. The technician connects the AP using a Cat5e cable run of 200 feet to a switch that only supports 802.3af (PoE). The AP powers on but has intermittent connectivity issues. What is the most likely cause?

Accepted Answer

The switch does not support the required PoE standard. The switch only supports 802.3af (PoE), which provides up to 15.4W per port, while the AP requires 802.3at (PoE+) for full operation, which supplies up to 30W. Although the AP powers on, it may not receive sufficient power to operate all radios or features, leading to intermittent connectivity issues. The cable length of 200 feet is within the 100-meter (328-foot) limit for Cat5e, so length is not the problem.

Answer

The cable length exceeds the maximum for PoE

Answer

The AP is experiencing interference from metal racks

Answer

The AP is configured with the wrong SSID

Question 20

A network engineer is designing a new IPv6 addressing scheme. The company has been assigned a /48 prefix and needs to support up to 250 subnets. Which subnet size should be used to minimize waste while meeting the requirement?

Accepted Answer

/56. A /56 subnet provides 256 subnets (2^(56-48) = 2^8 = 256), which meets the requirement of up to 250 subnets with minimal waste. A /48 prefix is the site-level allocation, and using a /56 subnet mask leaves 8 bits for subnetting, offering exactly the needed capacity without over-allocating address space.

Answer

/52

Answer

/64

Answer

/60