N10-009 Practice Test 32 — 15 Questions

Question 1

An NOC technician receives an alert that latency on a critical WAN link has increased significantly. The technician needs to analyze the latency trend over the past week to identify patterns. Which approach is the most efficient for gathering this historical data?

Accepted Answer

Use SNMP polling with a suitable MIB to collect latency metrics at regular intervals. SNMP polling with a suitable MIB (e.g., IF-MIB for interface statistics or IP-MIB for performance metrics) allows the NOC to collect latency data at regular, configurable intervals over time. This historical data can be stored in a management system and analyzed for trends, making it the most efficient method for identifying patterns in WAN latency over a week. SNMP traps, by contrast, are event-driven and do not provide the continuous, periodic data needed for trend analysis.

Answer

Use SNMP traps to alert on each latency spike

Answer

Run a continuous ping test and manually log timestamps

Answer

Use traceroute to identify each hop and measure latency per hop

Question 2

A user reports that they cannot access the internet. The user's workstation has an IP address of 192.168.1.100/24, with a default gateway of 192.168.1.1. The user can ping the default gateway but cannot ping 8.8.8.8. Other users on the same subnet can ping 8.8.8.8. The technician checks the switch and sees the user's port is up. What should the technician check next?

Accepted Answer

Check the workstation's IP configuration for a misconfigured default gateway or DNS. Since the user can ping the default gateway (192.168.1.1) but not 8.8.8.8, while other users on the same subnet can reach 8.8.8.8, the issue is isolated to this workstation. The most likely cause is a misconfigured default gateway (e.g., wrong IP or subnet mask) or DNS settings, as the gateway is reachable but traffic is not being forwarded correctly. Option B directly addresses checking the workstation's IP configuration for these misconfigurations, which is the logical next step after verifying local connectivity.

Answer

Check the router's routing table for a route to the internet

Answer

Check the DNS server configuration on the workstation

Answer

Check the switch port for VLAN misconfiguration

Question 3

Two routers are configured with OSPF in the same area, but they do not form an adjacency. Router A shows OSPF state EXSTART, and Router B shows state EXSTART. Which of the following is the most likely cause?

Accepted Answer

The MTU is mismatched between the two routers. When OSPF routers are stuck in the EXSTART state, it indicates that they have progressed past the 2-Way and ExStart phases but are unable to exchange Database Description (DBD) packets. The most common cause is an MTU mismatch, because OSPF will not proceed to the Exchange state if a DBD packet exceeds the interface MTU of the neighbor. This causes the routers to continuously renegotiate the master/slave relationship without completing the exchange.

Answer

The OSPF Hello and Dead intervals are mismatched

Answer

The OSPF area IDs are different

Answer

The network type is misconfigured (e.g., one side is broadcast, the other is point-to-point)

Question 4

After replacing a faulty network cable, a user reports that they can access local resources but not the internet. The technician verifies that the user's IP address is 192.168.1.100 with a subnet mask of 255.255.255.0 and a default gateway of 192.168.1.1. The technician can ping the default gateway successfully. Which of the following should the technician check NEXT?

Accepted Answer

A) DNS configuration. The user can access local resources and successfully ping the default gateway, which confirms that Layer 2 and Layer 3 connectivity to the local network is working. The inability to access the internet while local access works points to a name resolution failure, as the browser relies on DNS to translate domain names to IP addresses. Checking DNS configuration is the logical next step because a misconfigured or missing DNS server would prevent internet access even when IP connectivity is intact.

Answer

B) DHCP server

Answer

C) Router's firewall ACLs

Answer

D) Switch port VLAN assignment

Question 5

A user's workstation shows an IP address of 169.254.15.7 with a subnet mask of 255.255.0.0. The user cannot access any network resources. Which of the following is the most likely cause?

Accepted Answer

The DHCP server is unreachable. The IP address 169.254.15.7 with a /16 subnet mask is an Automatic Private IP Addressing (APIPA) address, assigned by Windows when a DHCP client fails to obtain a lease. This indicates the workstation cannot reach a DHCP server, so the most likely cause is that the DHCP server is unreachable.

Answer

The DNS server is not responding

Answer

The subnet mask is incorrect

Answer

The default gateway is down

Question 6

An IT security analyst is implementing a solution to detect malware on endpoints by monitoring system calls and file integrity. Which of the following types of controls is being deployed?

Accepted Answer

Host-based Intrusion Detection System (HIDS). A Host-based Intrusion Detection System (HIDS) monitors system calls, file integrity, and operating system logs directly on the endpoint. This matches the scenario because the analyst is deploying a solution that detects malware by observing low-level system behavior and verifying file integrity, which are core HIDS functions.

Answer

Network-based Intrusion Detection System (NIDS)

Answer

Firewall

Answer

Virtual Private Network (VPN)

Question 7

An organization's security policy requires that all remote access VPN connections use two-factor authentication and that the VPN clients are compliant with the latest patch levels before gaining network access. Which technology combination provides these capabilities?

Accepted Answer

VPN with RADIUS authentication and posture assessment. Option D is correct because RADIUS authentication can enforce two-factor authentication (e.g., via token or OTP), and posture assessment (often via Network Access Control or a VPN posture plugin) checks the client's patch level before granting network access. This combination directly satisfies the policy requirements for both multi-factor authentication and endpoint compliance verification.

Answer

SSL VPN with client certificate authentication

Answer

IPsec VPN using preshared keys

Answer

NAC integrated with a reverse proxy

Question 8

An organization uses a AAA server for network device authentication. The security team requires that all authentication traffic be fully encrypted and that authorization commands be logged per user. Which protocol is best suited for this requirement?

Accepted Answer

TACACS+. TACACS+ is the best choice because it encrypts the entire authentication packet (including username, password, and all other fields) and supports per-user command authorization logging. This meets the requirement for fully encrypted authentication traffic and detailed audit trails for each user's commands.

Answer

RADIUS with EAP-TLS

Answer

LDAP over SSL

Answer

Kerberos

Question 9

At which layer of the OSI model does a switch that uses MAC addresses to forward frames operate?

Accepted Answer

Layer 2. A switch that uses MAC addresses to forward frames operates at Layer 2 (Data Link layer) of the OSI model. Layer 2 is responsible for node-to-node data transfer and error detection, using MAC addresses as the addressing scheme. The switch builds a MAC address table by learning source MAC addresses from incoming frames and then forwards frames based on the destination MAC address, making forwarding decisions at this layer.

Answer

Layer 1

Answer

Layer 3

Answer

Layer 4

Question 10

An organization wants to deploy Wi-Fi in a large, open office space. They need high throughput and the ability to support many simultaneous clients, but they are budget-constrained. Which IEEE wireless standard should they choose?

Accepted Answer

802.11ax (Wi-Fi 6). 802.11ax (Wi-Fi 6) is the correct choice because it introduces Orthogonal Frequency Division Multiple Access (OFDMA) and MU-MIMO (both uplink and downlink), which significantly improve throughput and capacity in dense environments. It also operates in both 2.4 GHz and 5 GHz bands, providing backward compatibility and better spectrum utilization, all while maintaining cost-effectiveness for large-scale deployments.

Answer

802.11ac (Wi-Fi 5)

Answer

802.11n (Wi-Fi 4)

Answer

802.11b (Wi-Fi 1)

Question 11

In a network, a collision domain is a network segment where which of the following is true?

Accepted Answer

A: Only one device can transmit at a time to avoid data collisions. In a collision domain, only one device can transmit at a time because if two or more devices transmit simultaneously, their signals collide, corrupting the data. This is a fundamental characteristic of half-duplex Ethernet segments, such as those using hubs or legacy bus topologies, where the medium is shared and CSMA/CD (Carrier Sense Multiple Access with Collision Detection) is used to manage access.

Answer

B: All devices share the same IP subnet

Answer

C: Broadcast traffic is confined to that segment

Answer

D: MAC addresses are resolved to IP addresses

Question 12

At which layer of the OSI model does end-to-end communication and data segmentation occur?

Accepted Answer

Transport layer. The transport layer (Layer 4) is responsible for end-to-end communication between source and destination hosts, as well as data segmentation and reassembly. Protocols such as TCP and UDP operate at this layer, with TCP providing reliable, connection-oriented service by segmenting data into segments and managing flow control and error recovery.

Answer

Session layer

Answer

Network layer

Answer

Data link layer

Question 13

At which layer of the OSI model does logical addressing (e.g., IP addresses) and routing occur?

Accepted Answer

Network layer. The Network layer (Layer 3) of the OSI model is responsible for logical addressing, such as IPv4 and IPv6 addresses, and for routing packets between different networks. Routers operate at this layer, using routing tables and protocols like OSPF, BGP, or static routes to determine the best path for data. This layer provides end-to-end delivery and handles packet fragmentation and reassembly when necessary.

Answer

Data Link layer

Answer

Transport layer

Answer

Physical layer

Question 14

Users in a branch office report intermittent connectivity to the corporate data center. A technician runs a continuous ping from a workstation to the data center server and observes packet loss after the third hop. Which command should the technician run next to identify the specific router causing the issue?

Accepted Answer

tracert server_ip. The technician has already identified packet loss after the third hop using a continuous ping. The next logical step is to use `tracert` (or `traceroute` on Linux) to map the path and pinpoint which router (hop) is dropping packets. This command sends ICMP echo requests with incrementing TTL values, forcing each router along the path to reply with a Time Exceeded message, thereby revealing the specific hop where loss occurs.

Answer

ping -n 1000 server_ip

Answer

nslookup server_ip

Answer

ipconfig /all

Question 15

Which protocol is used to resolve a known IP address to a corresponding MAC address on a local network?

Accepted Answer

ARP. ARP (Address Resolution Protocol) is used to resolve a known IP address to its corresponding MAC address on a local network. When a host needs to send a frame to another host on the same subnet, it broadcasts an ARP request containing the target IP; the host with that IP responds with its MAC address, which is then cached for future use.

Answer

DNS

Answer

DHCP

Answer

ICMP