N10-009 Practice Test 3 — 30 Questions

Question 1

Two switches are connected via a trunk link configured with allowed VLANs 10, 20, and 30. Hosts on VLAN 20 can communicate across the trunk, but hosts on VLAN 30 cannot. Which of the following is the most likely cause?

Accepted Answer

D. Option D is correct because the most likely cause is that VLAN 30 is not allowed on the trunk link. Even though the trunk is configured with allowed VLANs 10, 20, and 30, if VLAN 30 is not present in the allowed VLAN list on one of the switch ports (e.g., due to a missing 'switchport trunk allowed vlan add 30' command or a pruning issue), frames from VLAN 30 will be dropped at the trunk. This explains why hosts on VLAN 20 can communicate while those on VLAN 30 cannot.

Answer

A

Answer

B

Answer

C

Question 2

A technician is troubleshooting a connectivity issue. The technician can successfully ping the IP address of a web server (10.10.10.10) from a client, but the client cannot access the web page. Firewall rules allow HTTP traffic. At which OSI layer is the issue most likely occurring?

Accepted Answer

Application layer (Layer 7). Since the client can successfully ping the web server's IP address (10.10.10.10), Layer 3 (Network) and Layer 4 (Transport) connectivity is verified, as ICMP operates at Layer 3 and uses IP. The failure to access the web page despite firewall rules allowing HTTP traffic points to an issue at Layer 7 (Application), such as a misconfigured web server (e.g., HTTP 404, incorrect document root), a missing or incorrect Host header in the HTTP request, or an application-layer proxy or authentication problem that prevents the HTTP transaction from completing.

Answer

Session layer (Layer 5)

Answer

Transport layer (Layer 4)

Answer

Network layer (Layer 3)

Question 3

A user reports that they can access internal resources such as file shares and printers by name, but they cannot access any external websites. The technician checks the IP configuration and finds the workstation has a valid IP address, subnet mask, default gateway, and DNS server addresses. The technician can successfully ping the default gateway and an external IP address like 8.8.8.8. Which of the following should the technician check NEXT?

Accepted Answer

Verify that the DNS server can resolve external domain names.. The user can access internal resources by name and can ping an external IP address (8.8.8.8), which confirms that IP routing, the default gateway, and basic network connectivity are working. The inability to access external websites by name, despite having DNS server addresses configured, points directly to a DNS resolution failure for external domains. Therefore, the next logical step is to verify that the configured DNS server can resolve external domain names, such as by using `nslookup` or `dig` to query a public domain like google.com.

Answer

Perform a traceroute to the external website to identify the point of failure.

Answer

Check the Windows Firewall on the workstation to ensure it is not blocking outbound HTTP traffic.

Answer

Renew the DHCP lease on the workstation.

Question 4

A network technician is troubleshooting a user's inability to connect to the network. The switch port is configured with port security with the default maximum of one MAC address. The user connects a computer and a VoIP phone to the port using the phone's built-in switch. Which of the following will MOST likely occur?

Accepted Answer

The port will go into errdisable state. With the default port security configuration, the switch port allows only one MAC address. When the VoIP phone connects, its own MAC address is learned first. The computer then connects through the phone's built-in switch, presenting a second MAC address, which violates the security policy. This triggers a security violation, and by default the port is placed into the errdisable state.

Answer

The phone will work but the computer will not

Answer

Both devices will work because the phone uses a different MAC

Answer

The switch will allow only the first learned MAC and block the second

Question 5

A network technician sees that the link light on a switch port is not lit, even though the cable is connected to an active device. The port has been tested with a known good cable. Which of the following should the technician do next?

Accepted Answer

Check if the port is administratively disabled. When a link light is off despite a known good cable and an active device, the most likely cause is that the switch port is administratively disabled (shutdown). This is a common Layer 1/2 issue where the interface is configured with the 'shutdown' command, preventing the port from negotiating a link. Checking the interface status with 'show interfaces status' or 'show interfaces [interface]' will confirm if the port is in an 'administratively down' state.

Answer

Replace the switch

Answer

Check the VLAN configuration

Answer

Check the speed/duplex settings

Question 6

A technician is troubleshooting intermittent wireless connectivity in a conference room. A site survey shows strong signal strength but many nearby access points are using channels that overlap with the channel used by the conference room AP. Which of the following is the most likely cause of the issue?

Accepted Answer

Adjacent channel interference from access points on overlapping channels.. The site survey shows strong signal strength but many nearby access points are using channels that overlap with the channel used by the conference room AP. This directly indicates adjacent-channel interference (ACI), where overlapping channels (e.g., channels 1, 2, 3, 4, and 5 all overlap with channel 1 in the 2.4 GHz band) cause contention and retransmissions, degrading performance even with strong signal. ACI is the most likely cause because the overlapping channels create co-existence issues without being on the exact same channel.

Answer

Multipath interference from reflective surfaces.

Answer

Co-channel interference from access points on the same channel.

Answer

Signal attenuation due to distance from the AP.

Question 7

A network technician is troubleshooting a workstation that is experiencing intermittent connectivity and slow file transfers. The technician has confirmed that the patch cable passes a cable tester, the switch port is not error-disabled, and the workstation's NIC is configured for autonegotiation. The switch port is also set to autonegotiate. Which of the following should the technician check next?

Accepted Answer

The duplex and speed settings on both ends. Option B is correct because intermittent connectivity and slow file transfers, despite a passing cable test and autonegotiation on both ends, strongly indicate a duplex mismatch. When both sides are set to autonegotiate but one side fails to negotiate correctly (e.g., due to a faulty NIC or switch port), they may fall back to half-duplex while the other remains full-duplex, causing collisions, CRC errors, and retransmissions. The technician should verify the actual negotiated duplex and speed on both the workstation NIC and the switch port using commands like 'show interfaces' or NIC driver properties.

Answer

The route table on the default gateway

Answer

The DNS server configuration

Answer

The MAC address filtering on the switch

Question 8

A network technician notices that a switch port connected to a user's computer is showing a high number of CRC errors and late collisions. The link is operating at 100 Mbps, full duplex according to the switch. Which of the following is the most likely cause of these errors?

Accepted Answer

Duplex mismatch. CRC errors and late collisions in a full-duplex link are classic symptoms of a duplex mismatch. When one side is set to full duplex and the other to half duplex, the half-duplex side does not sense the carrier before transmitting, leading to collisions that are detected late in the frame. The switch reports full duplex, so the user's NIC is likely stuck at half duplex, causing these errors.

Answer

Cable length exceeds 100 meters

Answer

Faulty switch port

Answer

Electromagnetic interference

Question 9

A security analyst notices that a web server is receiving a large number of ICMP echo reply packets from many different external hosts. The server did not send any echo requests. Which type of attack is most likely occurring?

Accepted Answer

Smurf attack. A Smurf attack exploits IP broadcast addressing and ICMP. The attacker sends a large number of ICMP echo request packets with a spoofed source IP (the victim's IP) to a network's broadcast address. All hosts on that network then send ICMP echo reply packets to the victim, overwhelming it with traffic. Since the server never sent any echo requests, the unsolicited flood of echo replies is the hallmark of a Smurf attack.

Answer

Ping flood

Answer

ICMP tunneling

Answer

Fraggle attack

Question 10

A new switch is installed in a remote wiring closet. It has been configured with a management IP address of 10.1.2.50/24. The switch is connected via a trunk to the distribution switch, and the management station (10.1.1.0/24) is on a different subnet. The switch cannot be pinged from the management station. The distribution switch has routing to the 10.1.2.0/24 subnet. What is the most likely cause?

Accepted Answer

The default gateway is not configured on the new switch.. The management station is on subnet 10.1.1.0/24, while the switch's management IP is 10.1.2.50/24. For the switch to reply to pings from a different subnet, it must have a default gateway configured so it knows where to send return traffic. Without a default gateway, the switch will only respond to traffic on its local subnet, making it unreachable from the management station.

Answer

The management VLAN is not allowed on the trunk.

Answer

The switch port to the distribution switch is in access mode.

Answer

The management IP is configured on the wrong VLAN.

Question 11

A security analyst notices that the DHCP server is responding to a large number of DHCP Discover messages from a single MAC address, but that client never sends a DHCP Request to complete the lease. This pattern repeats continuously. Which type of attack is most likely occurring?

Accepted Answer

DHCP starvation. Option C is correct because the described behavior—a single MAC address sending continuous DHCP Discover messages without completing the lease with a DHCP Request—is the hallmark of a DHCP starvation attack. The attacker exhausts the DHCP server's IP address pool by claiming all available leases, preventing legitimate clients from obtaining IP addresses. This attack targets the DHCP protocol's four-step DORA (Discover, Offer, Request, Acknowledge) process by never completing the handshake.

Answer

ARP poisoning

Answer

DNS amplification

Answer

Rogue DHCP server

Question 12

A user can ping the default gateway (192.168.1.1) but cannot access the internet (e.g., ping 8.8.8.8 fails). The user's IP is correctly configured as 192.168.1.10/24. What should the technician check next?

Accepted Answer

Check the router's default route configuration. Since the user can ping the default gateway (192.168.1.1), Layer 2 and Layer 3 connectivity within the local subnet is working, and the PC's IP configuration is correct. The failure to reach 8.8.8.8 indicates that the router does not have a valid path to external networks, which is typically provided by a default route (0.0.0.0/0). Checking the router's default route configuration is the logical next step because without it, the router cannot forward traffic destined for non-local networks.

Answer

Check the PC's DNS server settings

Answer

Verify the subnet mask on the PC

Answer

Examine the switch port VLAN assignment

Question 13

A security auditor is reviewing firewall logs and notices repeated login attempts from a single external IP address to the company's SSH server. Which type of attack is likely occurring?

Accepted Answer

Brute force attack. Repeated login attempts from a single external IP to an SSH server are characteristic of a brute force attack, where an attacker systematically tries many username/password combinations to gain unauthorized access. SSH (port 22) is a common target because it provides remote shell access, and automated tools like Hydra or Medusa can rapidly test credentials. The firewall logs show multiple failed authentication attempts from the same source, which is the hallmark of this attack type.

Answer

Man-in-the-middle attack

Answer

ARP poisoning

Answer

DDoS attack

Question 14

A user on VLAN 10 reports that they cannot access a file server on VLAN 20. The user can ping the default gateway (interface on the router) and other devices within VLAN 10. The router has an 'ip helper-address' for DHCP but no static routes or dynamic routing configured for inter-VLAN routing. The file server is correctly configured with an IP address in VLAN 20. What is the most likely cause of the communication failure?

Accepted Answer

The router does not have a route to the VLAN 20 subnet. The router has no route to the VLAN 20 subnet. Even though the router is directly connected to VLAN 20 via its subinterface, inter-VLAN routing requires the router to have a connected route in its routing table for that subnet. Without a route (either connected or static), the router cannot forward packets from VLAN 10 to VLAN 20. The 'ip helper-address' only forwards DHCP broadcasts, not general traffic.

Answer

The router is configured with an ACL that blocks traffic from VLAN 10 to VLAN 20

Answer

The switch port connecting the user to the network is configured with port security limiting MAC addresses

Answer

The file server has a firewall blocking ICMP ping requests

Question 15

An IPv6 address has the prefix 2001:db8::/32. Which of the following IP addresses belongs to the same prefix?

Accepted Answer

2001:db8:1::1. The prefix 2001:db8::/32 means the first 32 bits of the address must be 2001:0db8. Option A (2001:db8:1::1) expands to 2001:0db8:0001:0000:0000:0000:0000:0001, which matches the first 32 bits exactly, so it belongs to the same /32 prefix.

Answer

2001:db9::1

Answer

2001:db7::1

Answer

fe80::1

Question 16

A small office uses a wireless router that provides both wired and wireless connectivity. The router's LAN IP is 192.168.1.1. A new printer with a static IP of 192.168.1.50 cannot be reached from a laptop obtaining an IP via DHCP. The laptop's IP is 192.168.1.100. Which of the following is the most likely cause?

Accepted Answer

The subnet mask is incorrect. The laptop obtains an IP address via DHCP, which typically assigns a subnet mask of 255.255.255.0 for a /24 network. If the printer has a static IP of 192.168.1.50 but is configured with an incorrect subnet mask (e.g., 255.255.255.252), the printer may believe it is on a different subnet than the laptop (192.168.1.100). This prevents the laptop from reaching the printer because the printer will not respond to ARP requests or will send traffic to its default gateway instead of directly to the laptop.

Answer

The printer is on a different VLAN

Answer

The default gateway is misconfigured

Answer

The DHCP scope is exhausted

Question 17

A user reports that they cannot access the internet, but they can access local resources on the same subnet. The network administrator pings the default gateway and gets a response. Which tool should be used next to trace the path to an external website?

Accepted Answer

traceroute. B is correct because traceroute (tracert on Windows) is the appropriate tool to identify where packets are being dropped or delayed along the path from the local host to an external website. Since the user can access local resources and the default gateway responds to pings, the issue likely lies beyond the gateway, and traceroute will reveal the hop where connectivity fails.

Answer

netstat

Answer

nslookup

Answer

arp

Question 18

A user reports that they can access the internet but cannot connect to an internal file server at IP address 192.168.1.50. The technician successfully pings the file server's IP address from the user's workstation. The file server is on the same subnet as the user. What is the most likely cause of this issue?

Accepted Answer

The file server's firewall is blocking the file-sharing protocol while allowing ICMP.. The technician can ping the file server (ICMP success) but the user cannot connect to it using the file-sharing protocol (e.g., SMB on TCP/445). This indicates network-layer reachability is fine, but the application-layer service is blocked. The most likely cause is the file server's host-based firewall (e.g., Windows Defender Firewall) allowing ICMP Echo Requests while blocking inbound SMB traffic, which is a common misconfiguration.

Answer

The file server has an incorrect default gateway configured.

Answer

The user's workstation has an incorrect DNS server configured.

Answer

The user's workstation has a duplicate IP address assigned.

Question 19

A user reports that they cannot connect to a file server on the same subnet. The technician checks the IP configuration and sees an IP address of 169.254.5.10. What is the most likely cause?

Accepted Answer

The DHCP server is unreachable. The IP address 169.254.5.10 is an Automatic Private IP Addressing (APIPA) address from the 169.254.0.0/16 range, which Windows assigns when a DHCP client fails to obtain a lease from a DHCP server. Since the user is on the same subnet as the file server, a missing default gateway or DNS server would not prevent local connectivity, but the inability to reach the DHCP server indicates a broader network issue that also prevents the client from obtaining a valid IP address.

Answer

The default gateway is misconfigured

Answer

The DNS server is down

Answer

The file server is offline

Question 20

Which of the following best describes the purpose of the TCP three-way handshake?

Accepted Answer

To establish a reliable connection between two hosts. The TCP three-way handshake is the process by which two hosts synchronize sequence numbers and establish a reliable connection before data transfer begins. It involves the exchange of SYN, SYN-ACK, and ACK segments, ensuring both sides are ready to communicate and agree on initial sequence numbers (ISNs) as defined in RFC 793.

Answer

To terminate a connection gracefully

Answer

To resolve an IP address to a MAC address

Answer

To encrypt data between two devices