N10-009 Practice Test 34 — 15 Questions

Question 1

Match each network attack to its description.

Accepted Answer

Distributed Denial-of-Service (DDoS): Overwhelms a network or server with a flood of traffic from multiple sources. DDoS attacks flood systems with traffic, MitM attacks intercept communications, phishing tricks users into revealing info, and ransomware encrypts files for ransom.

Answer

Distributed Denial-of-Service (DDoS): Intercepts communication between two parties

Answer

Phishing: Malware that encrypts data for ransom

Question 2

A security analyst discovers that users on the network are receiving ARP replies that map the default gateway IP address to an unknown MAC address. This is causing intermittent connectivity issues. Which type of attack is occurring, and what security feature should be implemented to prevent it?

Accepted Answer

ARP poisoning; Dynamic ARP Inspection (DAI). This attack is ARP poisoning (also called ARP spoofing), where an attacker sends forged ARP replies to associate the default gateway's IP address with the attacker's MAC address. This allows the attacker to intercept, modify, or drop traffic intended for the gateway. Dynamic ARP Inspection (DAI) prevents this by validating ARP packets against a trusted DHCP snooping binding table, dropping any ARP reply that contains an IP-to-MAC mapping not present in the table.

Answer

MAC flooding; port security

Answer

DHCP starvation; DHCP snooping

Answer

DNS poisoning; DNSSEC

Question 3

Match each wireless standard to its maximum theoretical speed.

Accepted Answer

802.11b: Maximum speed of 11 Mbps. Common Wi-Fi standards: 802.11b (11 Mbps), 802.11g (54 Mbps), 802.11ac (1.3 Gbps). Note that 802.11a also runs at 54 Mbps, and 802.11n at up to 600 Mbps.

Answer

802.11a: Maximum speed of 11 Mbps

Answer

802.11n: Maximum speed of 54 Mbps

Question 4

A security analyst discovers that an attacker is sending large numbers of incomplete TCP connection requests to a server, causing the server to run out of resources and stop responding to legitimate requests. Which type of attack is this, and which mitigation should be implemented?

Accepted Answer

SYN flood; enable TCP intercept or SYN cookies. This is a SYN flood attack, where the attacker sends a high volume of TCP SYN packets without completing the three-way handshake, exhausting the server's connection queue. Enabling TCP intercept (on Cisco devices) or SYN cookies (RFC 4987) allows the server to validate handshakes before allocating resources, mitigating the attack.

Answer

Ping flood; implement rate limiting

Answer

Smurf attack; disable IP-directed broadcasts

Answer

ARP poisoning; enable dynamic ARP inspection

Question 5

A network technician is troubleshooting a user's inability to access a specific internal web application hosted on a server at 10.10.10.15:8080. The user can ping the server's IP address successfully, but the web browser displays 'connection refused'. The technician verifies that the web application service is running on the server. What is the most likely cause of the issue?

Accepted Answer

The server's firewall is blocking inbound connections to port 8080.. Since the user can ping the server (ICMP success) but receives 'connection refused' on port 8080, and the service is confirmed running, the most likely cause is that the server's firewall is blocking inbound TCP connections to port 8080. A firewall rule can permit ICMP echo requests while denying TCP SYN packets to specific ports, resulting in a successful ping but a TCP RST or no response at the application layer, which manifests as 'connection refused' in the browser.

Answer

The web application is listening on a different port than 8080.

Answer

The user's web browser is configured to use an incorrect proxy server.

Answer

The DNS resolution is failing for the server's hostname.

Question 6

A network administrator discovers that client workstations are receiving IP addresses from an unknown device, causing network connectivity issues. Which security feature should be configured on switches to prevent rogue DHCP servers from assigning IP addresses?

Accepted Answer

DHCP snooping. DHCP snooping is the correct security feature because it acts as a firewall between untrusted hosts and trusted DHCP servers. By configuring ports as trusted (where legitimate DHCP servers are connected) and untrusted (client-facing ports), the switch drops all DHCP server messages (OFFER, ACK, NAK) received on untrusted ports, effectively blocking rogue DHCP servers from assigning IP addresses.

Answer

Dynamic ARP Inspection

Answer

Port security

Answer

BPDU guard

Question 7

A security analyst observes that a workstation on the network is sending unsolicited ARP replies stating that the workstation's MAC address corresponds to the default gateway IP for all subnets. This behavior is causing other devices to send traffic destined for external networks to the workstation instead of the legitimate gateway. Which type of attack is being performed?

Accepted Answer

A: ARP spoofing. The workstation is sending unsolicited ARP replies that map the default gateway IP to its own MAC address. This poisons the ARP caches of other devices on the network, causing them to forward traffic destined for external networks to the attacker's workstation instead of the legitimate gateway. This is the classic behavior of an ARP spoofing (or ARP poisoning) attack, which exploits the lack of authentication in the ARP protocol (RFC 826).

Answer

B: DHCP starvation

Answer

C: DNS poisoning

Answer

D: MAC flooding

Question 8

A network engineer is designing an OSPF network for a large enterprise. To reduce the size of routing tables and limit the propagation of external routes, the engineer wants to use a special area that blocks Type 5 LSAs but still allows inter-area routes via a default route. Which type of OSPF area should be configured?

Accepted Answer

Stub area. A stub area blocks Type 5 LSAs (external routes) from entering the area, forcing the area border router (ABR) to inject a default route (0.0.0.0/0) for reaching external destinations. This reduces the routing table size while still allowing inter-area routes (Type 3 LSAs) to propagate, exactly matching the requirement.

Answer

Backbone area 0

Answer

Standard area

Answer

Totally stubby area

Question 9

A network administrator needs to identify which application protocols are consuming the most bandwidth on the company WAN link. Which of the following tools should the administrator use?

Accepted Answer

NetFlow analyzer. A NetFlow analyzer is the correct tool because it collects flow-level metadata (e.g., source/destination IPs, ports, protocol, and byte counts) from routers or switches, enabling the administrator to identify which application protocols (via port/protocol analysis) are consuming the most bandwidth over time. Unlike packet-level tools, NetFlow provides aggregated traffic statistics without storing full packet payloads, making it efficient for long-term WAN bandwidth monitoring.

Answer

Packet sniffer (e.g., tcpdump)

Answer

Port scanner (e.g., Nmap)

Answer

Bandwidth speed test

Question 10

A network administrator wants to collect and analyze logs from multiple network devices in a central location. Which of the following protocols should be used?

Accepted Answer

Syslog. Syslog is the correct protocol because it is specifically designed for centralized log collection and analysis from network devices. It uses UDP port 514 (or TCP 6514 for reliable delivery) to send event messages from routers, switches, and firewalls to a central syslog server, enabling administrators to aggregate and review logs for troubleshooting and security monitoring.

Answer

SNMP

Answer

SMTP

Answer

FTP

Question 11

Which of the following is a characteristic of UDP when compared to TCP?

Accepted Answer

C) UDP has lower overhead due to minimal header. UDP (User Datagram Protocol) has a minimal 8-byte header compared to TCP's 20-byte header, resulting in lower overhead and faster transmission. Unlike TCP, UDP does not provide reliability, flow control, or error recovery, making it ideal for real-time applications like VoIP or video streaming where speed is prioritized over guaranteed delivery.

Answer

A) UDP uses sequence numbers for ordering

Answer

B) UDP provides reliable data delivery

Answer

D) UDP requires a three-way handshake to establish a connection

Question 12

Which of the following network devices operates at Layer 1 of the OSI model and forwards all incoming electrical signals to all of its ports?

Accepted Answer

Hub. A hub operates at Layer 1 (Physical layer) of the OSI model and is a multiport repeater. It regenerates and forwards every incoming electrical signal out of all ports except the incoming port, regardless of the intended destination, because it has no intelligence to process MAC addresses or frames.

Answer

Router

Answer

Switch

Answer

Bridge

Question 13

An attacker sends ICMP echo request packets to the broadcast address of a network, with the source IP address spoofed to be the target's IP address. This causes all hosts on the network to send ICMP echo replies to the target, overwhelming it. Which type of attack is this?

Accepted Answer

Smurf attack. This is a classic Smurf attack, which exploits ICMP by sending echo request packets to the network's broadcast address with the source IP spoofed as the target. All hosts on the network receive the request and reply to the spoofed source, flooding the target with ICMP echo replies and consuming its bandwidth or resources.

Answer

Fraggle attack

Answer

Ping flood

Answer

ARP poisoning

Question 14

A network technician is troubleshooting an intermittent link between two switches connected via single-mode fiber. The interface logs show frequent 'link up / link down' events, sometimes several times per hour. The technician has verified that the SFPs are compatible and the fiber cable is within distance specifications. Which of the following is the most likely cause of the issue?

Accepted Answer

Dirty or contaminated fiber connectors. Intermittent link flaps on single-mode fiber, despite compatible SFPs and correct distance, are most often caused by dirty or contaminated fiber connectors. Even microscopic dust or oil on the end face can scatter light, causing signal loss that triggers the switch's optical receiver to lose sync and flap the link. This matches the symptom of frequent 'link up / link down' events without any configuration mismatch.

Answer

Electromagnetic interference (EMI) from nearby power cables

Answer

Mismatched VLAN configurations on the switches

Answer

Duplex mismatch between the two switch ports

Question 15

Which of the following uniquely identifies a hardware network interface on a device?

Accepted Answer

MAC address. A MAC (Media Access Control) address is a hardware-embedded, globally unique identifier assigned to a network interface controller (NIC) by the manufacturer. It operates at Layer 2 (Data Link Layer) of the OSI model and is used for local network communication, ensuring that no two devices on the same broadcast domain have the same MAC address.

Answer

IP address

Answer

Subnet mask

Answer

Default gateway