N10-009 Practice Test 33 — 15 Questions

Question 1

A user reports slow network performance on their workstation. The technician checks the switch port and sees a high number of CRC errors. Which of the following is the MOST likely cause of this issue?

Accepted Answer

Duplex mismatch. CRC errors indicate data corruption at the data link layer, typically caused by collisions or electrical interference. A duplex mismatch occurs when one device operates at full duplex and the other at half duplex, leading to collisions on a full-duplex link that corrupt frames and generate CRC errors. This is the most common cause of CRC errors on a switch port.

Answer

A faulty cable

Answer

VLAN mismatch

Answer

Incorrect MTU setting

Question 2

A user's computer is unable to obtain a DHCP lease after connecting to a new switch port. The user's computer displays an IP address in the 169.254.x.x range. Other users on the same VLAN can obtain IP addresses successfully. The switch port is configured for 802.1X authentication. What is the most likely cause?

Accepted Answer

The user's computer has not authenticated via 802.1X and is placed in a restricted VLAN.. When 802.1X authentication is enabled on a switch port, the port initially operates in an unauthorized state, restricting traffic to only EAPoL (802.1X) frames. If the user's computer fails to authenticate (e.g., due to missing supplicant, incorrect credentials, or certificate issues), the switch can place the port into a restricted or guest VLAN that lacks a DHCP server or is isolated from the production network. The 169.254.x.x address (APIPA) indicates the client could not reach a DHCP server, which aligns with being placed in a VLAN without DHCP services.

Answer

The DHCP server has exhausted its address pool.

Answer

The switch port is in a blocked state due to a spanning tree loop.

Answer

The network cable is faulty.

Question 3

Which IPv6 address is reserved for loopback?

Accepted Answer

::1. The IPv6 loopback address is ::1 (equivalent to 127.0.0.1 in IPv4). It is used by a host to send traffic to itself without any physical network interface involvement, as defined in RFC 4291. This address is not routable and should never appear outside the host.

Answer

::

Answer

127.0.0.1

Answer

2000::/3

Question 4

A company is setting up a new branch office and needs to connect it to the main office over the internet using a secure VPN. The branch office has a dynamic public IP address. Which type of VPN should be configured?

Accepted Answer

Dynamic Multipoint VPN (DMVPN). C is correct because Dynamic Multipoint VPN (DMVPN) is designed to handle sites with dynamic public IP addresses, such as a branch office with a dynamically assigned IP. DMVPN uses mGRE (multipoint Generic Routing Encapsulation) and NHRP (Next Hop Resolution Protocol) to dynamically establish tunnels between spoke routers without requiring static IP configurations on each spoke, making it ideal for this scenario.

Answer

Site-to-site IPsec VPN with static IPs

Answer

Remote access VPN using SSL

Answer

Policy-based VPN

Question 5

Which of the following network devices operates primarily at Layer 2 of the OSI model and uses MAC addresses to forward data?

Accepted Answer

Switch. A switch operates primarily at Layer 2 (Data Link layer) of the OSI model, forwarding frames based on destination MAC addresses. It builds a MAC address table by learning source MAC addresses from incoming frames and uses this table to make forwarding decisions, reducing collision domains and improving network efficiency.

Answer

Hub

Answer

Router

Answer

Firewall

Question 6

A network engineer needs to segment a single physical switch into multiple broadcast domains to improve security and reduce traffic. Which technology should be implemented?

Accepted Answer

Virtual LAN (VLAN). A VLAN (Virtual LAN) segments a physical switch into multiple isolated broadcast domains at Layer 2. By assigning ports to different VLANs, broadcast traffic is confined to each VLAN, improving security and reducing unnecessary traffic. This directly meets the requirement without requiring additional hardware.

Answer

Spanning Tree Protocol (STP)

Answer

VLAN Trunking Protocol (VTP)

Answer

Access Control List (ACL)

Question 7

A user's laptop frequently disconnects from the Wi-Fi network when they move to the conference room. Other devices in the conference room maintain stable connections. The laptop shows a strong signal in the conference room. What is the most likely cause?

Accepted Answer

Laptop's wireless adapter driver is outdated or faulty. The laptop disconnects only when moving to the conference room, while other devices remain stable, ruling out environmental issues. A strong signal but frequent disconnects points to a client-side problem, most commonly an outdated or faulty wireless adapter driver that fails to handle roaming or power-save transitions properly.

Answer

AP channel is congested

Answer

Laptop is using the 5 GHz band while the AP uses 2.4 GHz

Answer

Interference from microwave ovens

Question 8

A network administrator needs to schedule a firmware upgrade for a critical router. Which document should be used to formally communicate the change, seek approval, and track the implementation?

Accepted Answer

A) Change management request. A change management request is the formal document used to communicate, seek approval, and track the implementation of a firmware upgrade on a critical router. This process ensures that the change is reviewed by stakeholders, risks are assessed, and a rollback plan is documented, which is essential for maintaining network stability and compliance with ITIL or organizational change control policies.

Answer

B) Network diagram

Answer

C) Service level agreement (SLA)

Answer

D) Baseline performance report

Question 9

A security analyst discovers that users on the network are receiving ARP replies that map the default gateway IP address to an unknown MAC address. This is causing intermittent connectivity issues. Which type of attack is occurring, and what security feature should be implemented to prevent it?

Accepted Answer

ARP poisoning; Dynamic ARP Inspection (DAI). This attack is ARP poisoning (also called ARP spoofing), where an attacker sends forged ARP replies to associate the default gateway's IP address with the attacker's MAC address. This allows the attacker to intercept, modify, or drop traffic intended for the gateway. Dynamic ARP Inspection (DAI) prevents this by validating ARP packets against a trusted DHCP snooping binding table, dropping any ARP reply that contains an IP-to-MAC mapping not present in the table.

Answer

MAC flooding; port security

Answer

DHCP starvation; DHCP snooping

Answer

DNS poisoning; DNSSEC

Question 10

A security analyst discovers that an unauthorized device is sending forged ARP replies, causing other devices to map the default gateway IP address to the attacker's MAC address. Which security feature should be implemented on the switches to prevent this attack?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) is the correct choice because it validates ARP packets on a per-port basis, ensuring that only legitimate ARP replies with correct IP-to-MAC bindings are forwarded. DAI uses a DHCP snooping binding table (or static ARP ACLs) to intercept and verify ARP packets, dropping forged replies that attempt to poison the ARP cache of other devices.

Answer

Port security

Answer

DHCP snooping

Answer

BPDU guard

Question 11

A network administrator adds a new server to VLAN 20. The switch port is configured as an access port in VLAN 20, and the server has a correct static IP address in that subnet. However, the server cannot communicate with other devices in the same VLAN. The VLAN exists on the switch and other devices in VLAN 20 are working. What is the most likely cause of this issue?

Accepted Answer

The switch port is configured as a trunk port instead of an access port. The scenario states the switch port is configured as an access port in VLAN 20, but the server cannot communicate with other devices in the same VLAN. If the port were actually configured as a trunk port, it would expect frames to be tagged with a VLAN ID. An untagged frame from the server would be placed into the native VLAN (typically VLAN 1), not VLAN 20, causing a mismatch. This explains why the server, despite having a correct static IP in VLAN 20's subnet, cannot reach other devices in VLAN 20.

Answer

VLAN 20 is not allowed on the trunk to the router

Answer

The server does not have a default gateway configured

Answer

The port is administratively down

Question 12

A network administrator wants to segment the network into multiple virtual LANs to reduce broadcast traffic. Which device is required to route traffic between these VLANs?

Accepted Answer

Router or Layer 3 switch. VLANs operate at Layer 2, isolating broadcast domains. To route traffic between different VLANs, a device that can forward packets based on Layer 3 IP addresses is required. A router or a Layer 3 switch (which performs hardware-based routing using ASICs) provides the necessary inter-VLAN routing functionality.

Answer

Layer 2 switch

Answer

Bridge

Answer

Hub

Question 13

An attacker is launching a DHCP starvation attack by sending a large number of DHCP discover messages with spoofed MAC addresses. This exhausts the DHCP pool and causes legitimate clients to fail to obtain IP addresses. Which security feature should be implemented on the switch to mitigate this attack?

Accepted Answer

DHCP snooping. DHCP snooping is the correct mitigation because it filters untrusted DHCP messages on access ports. By default, it only allows DHCP server responses (OFFER, ACK, etc.) on trusted ports (typically uplinks to the legitimate DHCP server) and drops them on untrusted ports, preventing a rogue or spoofed server from replying. Additionally, DHCP snooping builds a DHCP snooping binding table that tracks valid MAC-to-IP address mappings, which can be used to rate-limit DHCP discover messages and detect starvation attacks.

Answer

Port security

Answer

Dynamic ARP Inspection (DAI)

Answer

802.1X

Question 14

A security analyst has enabled DHCP snooping on all VLANs of the company's switches to mitigate the risk of rogue DHCP servers. After implementation, the analyst discovers that clients are still receiving IP addresses from an unauthorized DHCP server. The unauthorized server is connected to a switch port that is currently configured as a trusted port. What should the analyst do to stop the rogue DHCP server from offering addresses?

Accepted Answer

Change the port connecting the unauthorized server to an untrusted port.. DHCP snooping operates by designating switch ports as either trusted or untrusted. Trusted ports are allowed to send DHCP server messages (OFFER, ACK), while untrusted ports are blocked from sending such messages. Since the rogue server is connected to a trusted port, it can still offer IP addresses. Changing the port to untrusted will cause the switch to drop all DHCP server messages from that port, stopping the rogue server.

Answer

Enable Dynamic ARP Inspection on the VLAN.

Answer

Configure port security on the unauthorized server's port to limit MAC addresses.

Answer

Increase the rate limit on the unauthorized server's port.

Question 15

An organization needs to connect two buildings that are 2 km apart with a point-to-point wireless link. Which antenna type is BEST suited for this long-distance directional connection?

Accepted Answer

Parabolic dish antenna. A parabolic dish antenna is the best choice for a 2 km point-to-point wireless link because it provides a very narrow beamwidth and high gain, focusing the signal in a specific direction to maximize distance and minimize interference. This makes it ideal for long-distance, high-throughput links where precise alignment is possible.

Answer

Omni-directional antenna

Answer

Yagi antenna

Answer

Patch antenna