N10-009 Practice Test 32 — 15 Questions

Question 1

A user's computer is unable to obtain a DHCP lease after connecting to a new switch port. The user's computer displays an IP address in the 169.254.x.x range. Other users on the same VLAN can obtain IP addresses successfully. The switch port is configured for 802.1X authentication. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user's computer has not authenticated via 802.1X and is placed in a restricted VLAN.. When 802.1X authentication is enabled on a switch port, the port initially operates in an unauthorized state, restricting traffic to only EAPoL (802.1X) frames. If the user's computer fails to authenticate (e.g., due to missing supplicant, incorrect credentials, or certificate issues), the switch can place the port into a restricted or guest VLAN that lacks a DHCP server or is isolated from the production network. The 169.254.x.x address (APIPA) indicates the client could not reach a DHCP server, which aligns with being placed in a VLAN without DHCP services.

Answer

The DHCP server has exhausted its address pool.

Answer

The switch port is in a blocked state due to a spanning tree loop.

Answer

The network cable is faulty.

Question 2

Which IPv6 address is reserved for loopback?

Accepted Answer

::1. The IPv6 loopback address is ::1 (equivalent to 127.0.0.1 in IPv4). It is used by a host to send traffic to itself without any physical network interface involvement, as defined in RFC 4291. This address is not routable and should never appear outside the host.

Answer

::

Answer

127.0.0.1

Answer

2000::/3

Question 3

A company is setting up a new branch office and needs to connect it to the main office over the internet using a secure VPN. The branch office has a dynamic public IP address. Which type of VPN should be configured?

Accepted Answer

Dynamic Multipoint VPN (DMVPN). C is correct because Dynamic Multipoint VPN (DMVPN) is designed to handle sites with dynamic public IP addresses, such as a branch office with a dynamically assigned IP. DMVPN uses mGRE (multipoint Generic Routing Encapsulation) and NHRP (Next Hop Resolution Protocol) to dynamically establish tunnels between spoke routers without requiring static IP configurations on each spoke, making it ideal for this scenario.

Answer

Site-to-site IPsec VPN with static IPs

Answer

Remote access VPN using SSL

Answer

Policy-based VPN

Question 4

Which of the following network devices operates primarily at Layer 2 of the OSI model and uses MAC addresses to forward data?

Accepted Answer

Switch. A switch operates primarily at Layer 2 (Data Link layer) of the OSI model, forwarding frames based on destination MAC addresses. It builds a MAC address table by learning source MAC addresses from incoming frames and uses this table to make forwarding decisions, reducing collision domains and improving network efficiency.

Answer

Hub

Answer

Router

Answer

Firewall

Question 5

A network engineer needs to segment a single physical switch into multiple broadcast domains to improve security and reduce traffic. Which technology should be implemented?

Accepted Answer

Virtual LAN (VLAN). A VLAN (Virtual LAN) segments a physical switch into multiple isolated broadcast domains at Layer 2. By assigning ports to different VLANs, broadcast traffic is confined to each VLAN, improving security and reducing unnecessary traffic. This directly meets the requirement without requiring additional hardware.

Answer

Spanning Tree Protocol (STP)

Answer

VLAN Trunking Protocol (VTP)

Answer

Access Control List (ACL)

Question 6

A user's laptop frequently disconnects from the Wi-Fi network when they move to the conference room. Other devices in the conference room maintain stable connections. The laptop shows a strong signal in the conference room. What is the most likely cause?

Accepted Answer

Laptop's wireless adapter driver is outdated or faulty. The laptop disconnects only when moving to the conference room, while other devices remain stable, ruling out environmental issues. A strong signal but frequent disconnects points to a client-side problem, most commonly an outdated or faulty wireless adapter driver that fails to handle roaming or power-save transitions properly.

Answer

AP channel is congested

Answer

Laptop is using the 5 GHz band while the AP uses 2.4 GHz

Answer

Interference from microwave ovens

Question 7

A network administrator needs to schedule a firmware upgrade for a critical router. Which document should be used to formally communicate the change, seek approval, and track the implementation?

Accepted Answer

A) Change management request. A change management request is the formal document used to communicate, seek approval, and track the implementation of a firmware upgrade on a critical router. This process ensures that the change is reviewed by stakeholders, risks are assessed, and a rollback plan is documented, which is essential for maintaining network stability and compliance with ITIL or organizational change control policies.

Answer

B) Network diagram

Answer

C) Service level agreement (SLA)

Answer

D) Baseline performance report

Question 8

A security analyst discovers that an unauthorized device is sending forged ARP replies, causing other devices to map the default gateway IP address to the attacker's MAC address. Which security feature should be implemented on the switches to prevent this attack?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) is the correct choice because it validates ARP packets on a per-port basis, ensuring that only legitimate ARP replies with correct IP-to-MAC bindings are forwarded. DAI uses a DHCP snooping binding table (or static ARP ACLs) to intercept and verify ARP packets, dropping forged replies that attempt to poison the ARP cache of other devices.

Answer

Port security

Answer

DHCP snooping

Answer

BPDU guard

Question 9

A network administrator adds a new server to VLAN 20. The switch port is configured as an access port in VLAN 20, and the server has a correct static IP address in that subnet. However, the server cannot communicate with other devices in the same VLAN. The VLAN exists on the switch and other devices in VLAN 20 are working. What is the most likely cause of this issue?

Accepted Answer

The switch port is configured as a trunk port instead of an access port. The scenario states the switch port is configured as an access port in VLAN 20, but the server cannot communicate with other devices in the same VLAN. If the port were actually configured as a trunk port, it would expect frames to be tagged with a VLAN ID. An untagged frame from the server would be placed into the native VLAN (typically VLAN 1), not VLAN 20, causing a mismatch. This explains why the server, despite having a correct static IP in VLAN 20's subnet, cannot reach other devices in VLAN 20.

Answer

VLAN 20 is not allowed on the trunk to the router

Answer

The server does not have a default gateway configured

Answer

The port is administratively down

Question 10

A network administrator wants to segment the network into multiple virtual LANs to reduce broadcast traffic. Which device is required to route traffic between these VLANs?

Accepted Answer

Router or Layer 3 switch. VLANs operate at Layer 2, isolating broadcast domains. To route traffic between different VLANs, a device that can forward packets based on Layer 3 IP addresses is required. A router or a Layer 3 switch (which performs hardware-based routing using ASICs) provides the necessary inter-VLAN routing functionality.

Answer

Layer 2 switch

Answer

Bridge

Answer

Hub

Question 11

An attacker is launching a DHCP starvation attack by sending a large number of DHCP discover messages with spoofed MAC addresses. This exhausts the DHCP pool and causes legitimate clients to fail to obtain IP addresses. Which security feature should be implemented on the switch to mitigate this attack?

Accepted Answer

DHCP snooping. DHCP snooping is the correct mitigation because it filters untrusted DHCP messages on access ports. By default, it only allows DHCP server responses (OFFER, ACK, etc.) on trusted ports (typically uplinks to the legitimate DHCP server) and drops them on untrusted ports, preventing a rogue or spoofed server from replying. Additionally, DHCP snooping builds a DHCP snooping binding table that tracks valid MAC-to-IP address mappings, which can be used to rate-limit DHCP discover messages and detect starvation attacks.

Answer

Port security

Answer

Dynamic ARP Inspection (DAI)

Answer

802.1X

Question 12

An organization needs to connect two buildings that are 2 km apart with a point-to-point wireless link. Which antenna type is BEST suited for this long-distance directional connection?

Accepted Answer

Parabolic dish antenna. A parabolic dish antenna is the best choice for a 2 km point-to-point wireless link because it provides a very narrow beamwidth and high gain, focusing the signal in a specific direction to maximize distance and minimize interference. This makes it ideal for long-distance, high-throughput links where precise alignment is possible.

Answer

Omni-directional antenna

Answer

Yagi antenna

Answer

Patch antenna

Question 13

A user reports that their workstation cannot connect to the network. The technician checks the IP configuration and sees that the workstation has an IP address of 169.254.25.110. The DHCP server is operational and has available addresses. The switch port connected to the workstation shows a solid green link light. What should the technician check NEXT?

Accepted Answer

Check the switch port configuration for security features such as DHCP snooping or port security.. The workstation has an APIPA address (169.254.x.x), which indicates it failed to obtain a DHCP lease. Since the DHCP server is operational and has available addresses, the issue likely lies with the switch port configuration. Security features such as DHCP snooping or port security can block DHCP traffic or limit the number of MAC addresses, preventing the workstation from receiving a valid IP address. Checking the switch port configuration is the logical next step.

Answer

Check the DNS server configuration.

Answer

Replace the network cable between the wall jack and the workstation.

Answer

Verify the default gateway setting on the workstation.

Question 14

Which of the following best describes the primary function of a subnet mask in IPv4 networking?

Accepted Answer

It identifies which part of an IP address is the network address and which part is the host address. The subnet mask is a 32-bit value that separates the IP address into network and host portions through a bitwise AND operation. This allows routers and hosts to determine whether a destination IP is on the same local network or requires forwarding to a default gateway. Without the subnet mask, a device cannot distinguish the network prefix from the host identifier, making routing impossible.

Answer

It dynamically assigns IP addresses to devices on the network

Answer

It encrypts data packets to ensure secure communication

Answer

It specifies the IP address of the router that forwards traffic to other networks

Question 15

An organization wants to deploy Wi-Fi in a large, open office space. They need high throughput and the ability to support many simultaneous clients, but they are budget-constrained. Which IEEE wireless standard should they choose?

Accepted Answer

802.11ac (Wi-Fi 5). 802.11ac (Wi-Fi 5) is the best choice for this scenario because it offers high throughput (up to 1.3 Gbps in the 5 GHz band) and supports MU-MIMO (downlink) for handling multiple clients simultaneously, all at a lower cost than 802.11ax (Wi-Fi 6). Since the organization is budget-constrained, 802.11ac provides a good balance of performance and affordability for a dense open office environment.

Answer

802.11ax (Wi-Fi 6)

Answer

802.11n (Wi-Fi 4)

Answer

802.11b (Wi-Fi 1)