N10-009 Practice Test 34 — 15 Questions

Question 1

A company is implementing network access control to ensure only authenticated users can connect to the wired network. Users must authenticate using their domain credentials before gaining full network access. Which standard should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

802.1X. 802.1X is the IEEE standard for port-based network access control (PNAC). It uses the Extensible Authentication Protocol (EAP) to authenticate devices attempting to connect to a wired or wireless LAN, requiring valid domain credentials before the switch port grants full network access.

Answer

802.3af

Answer

802.11i

Answer

802.1Q

Question 2

A network engineer is designing a wireless network for a large warehouse with many metal racks and heavy machinery that cause significant RF interference. The network must support a high density of IoT sensors and provide reliable connectivity. Which IEEE wireless standard should the engineer implement to best meet these requirements?

Accepted Answer

802.11ax (Wi-Fi 6). 802.11ax (Wi-Fi 6) is the correct choice because it introduces Orthogonal Frequency Division Multiple Access (OFDMA), which subdivides channels into smaller resource units (RUs) to serve multiple IoT sensors simultaneously, improving efficiency in dense, interference-heavy environments. Additionally, Wi-Fi 6 includes BSS Coloring, which reduces co-channel interference by allowing devices to ignore transmissions from overlapping basic service sets, and Target Wake Time (TWT), which schedules IoT sensor transmissions to conserve battery and reduce contention.

Answer

802.11ac (Wi-Fi 5)

Answer

802.11n (Wi-Fi 4)

Answer

802.11g (Wi-Fi 3)

Question 3

A network administrator needs to connect two switches to allow multiple VLANs to traverse the link. Which protocol should be used to tag frames with VLAN information?

Accepted Answer

802.1Q. 802.1Q is the IEEE standard for VLAN tagging, which inserts a 4-byte tag into the Ethernet frame header to identify the VLAN membership of the frame. This allows multiple VLANs to traverse a single trunk link between switches, enabling inter-switch VLAN communication without requiring separate physical links per VLAN.

Answer

STP (Spanning Tree Protocol)

Answer

VTP (VLAN Trunking Protocol)

Answer

LACP (Link Aggregation Control Protocol)

Question 4

A network administrator needs to implement a solution that allows for centralized management of user authentication, authorization, and accounting for network device access. The solution must support encryption of the entire authentication process. Which protocol should be selected?

Accepted Answer

TACACS+. TACACS+ is the correct choice because it separates authentication, authorization, and accounting (AAA) into distinct processes and encrypts the entire authentication payload, including the username, password, and all other traffic between the client and the server. This full-packet encryption ensures that credentials and session details are protected during transit, meeting the requirement for centralized management with encrypted authentication.

Answer

RADIUS

Answer

LDAP

Answer

Kerberos

Question 5

A company has just installed a new fiber optic connection between two buildings 2 km apart. The connection is using multimode fiber. However, the signal is too weak at the receiving end. What is the most likely cause?

Accepted Answer

Attenuation due to distance. Multimode fiber (MMF) is designed for shorter distances, typically up to 550 meters for 10 Gbps (OM3/OM4) and up to 2 km only for lower speeds like 100 Mbps or 1 Gbps using older OM1/OM2 fiber. At 2 km, the signal attenuation exceeds the power budget of the MMF link, causing a weak signal at the receiver. Single-mode fiber (SMF) would be required for reliable transmission over this distance.

Answer

Electromagnetic interference

Answer

Incorrect termination

Answer

Crosstalk

Question 6

A network switch that forwards frames based on MAC addresses operates at which layer of the OSI model?

Accepted Answer

Data Link. A network switch that forwards frames based on MAC addresses operates at Layer 2, the Data Link layer. This layer is responsible for node-to-node data transfer and error detection using MAC addresses, as defined by IEEE 802 standards. Switches build a MAC address table by learning source MAC addresses from incoming frames and use this table to make forwarding decisions.

Answer

Physical

Answer

Network

Answer

Transport

Question 7

A network engineer has configured an IPsec site-to-site VPN between two offices. The tunnel is established and shows as active. However, users at the branch office (10.0.1.0/24) cannot reach servers at the main office (192.168.1.0/24). Both routers have the correct VPN policies and firewall rules permitting IPsec traffic. What should the engineer check next?

Accepted Answer

B) That the routing tables on both routers include routes to the remote subnet. The tunnel being active means Phase 1 and Phase 2 of IPsec are established, but traffic still cannot flow because the routers lack routes to the remote subnets. Without a route for 10.0.1.0/24 on the main office router (or 192.168.1.0/24 on the branch router), packets will be dropped or sent out the wrong interface, even though the VPN policy and firewall rules are correct. The engineer must verify that static routes or a dynamic routing protocol (e.g., OSPF over the tunnel) are in place to direct traffic into the IPsec tunnel interface.

Answer

A) That the DNS server addresses are correctly configured

Answer

C) That the MTU size is set to 1500 on both ends

Answer

D) That the SSID is correctly configured on the access points

Question 8

A network engineer needs to implement a wireless network in a large open-plan office with high client density. The network must provide the fastest possible speeds and efficient handling of many simultaneous connections. Which IEEE 802.11 standard should be used?

Accepted Answer

802.11ax. 802.11ax (Wi-Fi 6) is the correct choice because it introduces Orthogonal Frequency Division Multiple Access (OFDMA) and MU-MIMO (both uplink and downlink), which significantly improve spectral efficiency and capacity in high-density environments. It also supports 1024-QAM modulation for higher data rates, making it ideal for an open-plan office with many simultaneous connections.

Answer

802.11ac

Answer

802.11n

Answer

802.11r

Question 9

Match each network attack to its description.

Accepted Answer

Distributed Denial-of-Service (DDoS): Overwhelms a network or server with a flood of traffic from multiple sources. DDoS attacks flood systems with traffic, MitM attacks intercept communications, phishing tricks users into revealing info, and ransomware encrypts files for ransom.

Answer

Distributed Denial-of-Service (DDoS): Intercepts communication between two parties

Answer

Phishing: Malware that encrypts data for ransom

Question 10

Match each wireless standard to its maximum theoretical speed.

Accepted Answer

802.11b: Maximum speed of 11 Mbps. Common Wi-Fi standards: 802.11b (11 Mbps), 802.11g (54 Mbps), 802.11ac (1.3 Gbps). Note that 802.11a also runs at 54 Mbps, and 802.11n at up to 600 Mbps.

Answer

802.11a: Maximum speed of 11 Mbps

Answer

802.11n: Maximum speed of 54 Mbps

Question 11

A network technician is troubleshooting a user's inability to access a specific internal web application hosted on a server at 10.10.10.15:8080. The user can ping the server's IP address successfully, but the web browser displays 'connection refused'. The technician verifies that the web application service is running on the server. What is the most likely cause of the issue?

Accepted Answer

The server's firewall is blocking inbound connections to port 8080.. Since the user can ping the server (ICMP success) but receives 'connection refused' on port 8080, and the service is confirmed running, the most likely cause is that the server's firewall is blocking inbound TCP connections to port 8080. A firewall rule can permit ICMP echo requests while denying TCP SYN packets to specific ports, resulting in a successful ping but a TCP RST or no response at the application layer, which manifests as 'connection refused' in the browser.

Answer

The web application is listening on a different port than 8080.

Answer

The user's web browser is configured to use an incorrect proxy server.

Answer

The DNS resolution is failing for the server's hostname.

Question 12

A network administrator discovers that client workstations are receiving IP addresses from an unknown device, causing network connectivity issues. Which security feature should be configured on switches to prevent rogue DHCP servers from assigning IP addresses?

Accepted Answer

DHCP snooping. DHCP snooping is the correct security feature because it acts as a firewall between untrusted hosts and trusted DHCP servers. By configuring ports as trusted (where legitimate DHCP servers are connected) and untrusted (client-facing ports), the switch drops all DHCP server messages (OFFER, ACK, NAK) received on untrusted ports, effectively blocking rogue DHCP servers from assigning IP addresses.

Answer

Dynamic ARP Inspection

Answer

Port security

Answer

BPDU guard

Question 13

A security analyst observes that a workstation on the network is sending unsolicited ARP replies stating that the workstation's MAC address corresponds to the default gateway IP for all subnets. This behavior is causing other devices to send traffic destined for external networks to the workstation instead of the legitimate gateway. Which type of attack is being performed?

Accepted Answer

A: ARP spoofing. The workstation is sending unsolicited ARP replies that map the default gateway IP to its own MAC address. This poisons the ARP caches of other devices on the network, causing them to forward traffic destined for external networks to the attacker's workstation instead of the legitimate gateway. This is the classic behavior of an ARP spoofing (or ARP poisoning) attack, which exploits the lack of authentication in the ARP protocol (RFC 826).

Answer

B: DHCP starvation

Answer

C: DNS poisoning

Answer

D: MAC flooding

Question 14

A network engineer is designing an OSPF network for a large enterprise. To reduce the size of routing tables and limit the propagation of external routes, the engineer wants to use a special area that blocks Type 5 LSAs but still allows inter-area routes via a default route. Which type of OSPF area should be configured?

Accepted Answer

Stub area. A stub area blocks Type 5 LSAs (external routes) from entering the area, forcing the area border router (ABR) to inject a default route (0.0.0.0/0) for reaching external destinations. This reduces the routing table size while still allowing inter-area routes (Type 3 LSAs) to propagate, exactly matching the requirement.

Answer

Backbone area 0

Answer

Standard area

Answer

Totally stubby area

Question 15

A network administrator needs to identify which application protocols are consuming the most bandwidth on the company WAN link. Which of the following tools should the administrator use?

Accepted Answer

NetFlow analyzer. A NetFlow analyzer is the correct tool because it collects flow-level metadata (e.g., source/destination IPs, ports, protocol, and byte counts) from routers or switches, enabling the administrator to identify which application protocols (via port/protocol analysis) are consuming the most bandwidth over time. Unlike packet-level tools, NetFlow provides aggregated traffic statistics without storing full packet payloads, making it efficient for long-term WAN bandwidth monitoring.

Answer

Packet sniffer (e.g., tcpdump)

Answer

Port scanner (e.g., Nmap)

Answer

Bandwidth speed test