N10-009 Practice Test 38 — 15 Questions

Question 1

A network administrator wants to prevent unauthorized devices from being plugged into switch ports. Only devices with specific MAC addresses should be allowed on each port. Which switch security feature should be enabled?

Accepted Answer

Port security. Port security is the correct feature because it allows the administrator to restrict which MAC addresses can communicate through a switch port. By configuring allowed MAC addresses (sticky or static), any device with an unknown MAC address attempting to send traffic will trigger a security violation (shutdown, restrict, or protect). This directly addresses the requirement to prevent unauthorized devices from being plugged into switch ports.

Answer

DHCP snooping

Answer

Dynamic ARP inspection

Answer

802.1X

Question 2

A network administrator wants to segment the network into multiple virtual LANs to reduce broadcast traffic. Which device is required to route traffic between these VLANs?

Accepted Answer

Router or Layer 3 switch. VLANs operate at Layer 2, isolating broadcast domains. To route traffic between different VLANs, a device that can forward packets based on Layer 3 IP addresses is required. A router or a Layer 3 switch (which performs hardware-based routing using ASICs) provides the necessary inter-VLAN routing functionality.

Answer

Layer 2 switch

Answer

Bridge

Answer

Hub

Question 3

A network engineer configures OSPF on two routers with a primary link (1 Gbps) and a backup link (100 Mbps). The engineer expects traffic to always use the primary link unless it fails, but the router is sending traffic over the backup link. What is the most likely cause?

Accepted Answer

B. OSPF uses cost to determine the best path, calculated as 10^8 / interface bandwidth. A 1 Gbps link has a cost of 1 (100,000,000 / 1,000,000,000), while a 100 Mbps link has a cost of 1 (100,000,000 / 100,000,000). Since both costs are equal, OSPF will load-balance traffic across both links instead of preferring the primary link, which is why traffic is seen on the backup link.

Answer

A

Answer

C

Answer

D

Question 4

A network administrator wants to prevent rogue DHCP servers from offering IP addresses to clients on the network. Which security feature should be enabled on the switches?

Accepted Answer

DHCP snooping. DHCP snooping is the correct security feature because it acts as a firewall between untrusted hosts and trusted DHCP servers. It validates DHCP messages by filtering out responses from unauthorized DHCP servers on untrusted ports, preventing rogue servers from offering IP addresses to clients. This is achieved by building and maintaining a DHCP snooping binding database that tracks valid IP-to-MAC address mappings.

Answer

Dynamic ARP Inspection (DAI)

Answer

Port Security

Answer

IP Source Guard

Question 5

A network engineer is configuring a trunk link between two switches to carry VLANs 10, 20, and 30. On Switch A, the port is configured with 'switchport mode trunk' and 'switchport nonegotiate'. On Switch B, the port is left at the default configuration. Which additional configuration is required on Switch B?

Accepted Answer

Manually set the port to trunk mode.. Switch B is left at default configuration, which on most Cisco switches means the port is in dynamic desirable or dynamic auto mode, relying on DTP to negotiate trunking. Since Switch A has 'switchport nonegotiate' configured, it will not send DTP frames, so Switch B will never receive a negotiation trigger and will remain in access mode. Therefore, the port on Switch B must be manually set to trunk mode with 'switchport mode trunk' to establish the trunk link.

Answer

Set the native VLAN to 1.

Answer

Enable DTP on Switch B.

Answer

Configure the allowed VLAN list.

Question 6

A network technician is explaining the function of a default gateway to a junior technician. Which of the following best describes the purpose of a default gateway?

Accepted Answer

It routes traffic from the local network to external networks.. The default gateway is a router or Layer 3 device that serves as the next-hop destination for packets destined to IP addresses outside the local subnet. When a host determines that the destination IP is not on the same network, it forwards the frame to the default gateway's MAC address, which then routes the packet toward the external network. This is defined in RFC 1122 and is essential for any host that needs to communicate beyond its directly connected segment.

Answer

It connects two different VLANs.

Answer

It provides DHCP services to the local network.

Answer

It translates private IP addresses to public IP addresses.

Question 7

A security auditor discovers that an unauthorized switch has been connected to an access port in the wiring closet. The rogue switch caused a network loop and disrupted connectivity. Which security feature, if enabled on the access port, would have prevented this by disabling the port when a BPDU is received?

Accepted Answer

BPDU guard. BPDU guard is the correct answer because it is specifically designed to protect against rogue switch connections on access ports. When enabled, if a port receives any Bridge Protocol Data Unit (BPDU), it immediately places the port into an errdisable state, effectively disabling it and preventing a potential network loop. This directly addresses the scenario where an unauthorized switch connected to an access port caused a loop.

Answer

Root guard

Answer

Loop guard

Answer

UDLD

Question 8

A security analyst discovers that users on the network are receiving ARP replies that map the default gateway IP address to an unknown MAC address. This is causing intermittent connectivity issues. Which type of attack is occurring, and what security feature should be implemented to prevent it?

Accepted Answer

ARP poisoning; Dynamic ARP Inspection (DAI). This attack is ARP poisoning (also called ARP spoofing), where an attacker sends forged ARP replies to associate the default gateway's IP address with the attacker's MAC address. This allows the attacker to intercept, modify, or drop traffic intended for the gateway. Dynamic ARP Inspection (DAI) prevents this by validating ARP packets against a trusted DHCP snooping binding table, dropping any ARP reply that contains an IP-to-MAC mapping not present in the table.

Answer

MAC flooding; port security

Answer

DHCP starvation; DHCP snooping

Answer

DNS poisoning; DNSSEC

Question 9

A user reports that they can access the company's intranet website by IP address but not by its hostname (intranet.company.local). A technician checks the DNS server and finds that the A record exists and returns the correct IP. However, the user's browser still cannot resolve the hostname. Which of the following is the most likely cause?

Accepted Answer

The DNS cache on the user's workstation is corrupt.. The user can access the intranet by IP but not by hostname, which indicates that name resolution is failing. Since the DNS server has the correct A record, the issue is likely on the client side. A corrupt DNS cache on the workstation can cause the browser to use stale or invalid cached data, preventing successful resolution even though the authoritative DNS server returns the correct IP. Flushing the DNS cache with `ipconfig /flushdns` would resolve this.

Answer

The web server's certificate is expired.

Answer

The default gateway is misconfigured.

Answer

The file server is overloaded.

Question 10

A user reports that they can access internal websites but cannot access any external websites. Other users in the same subnet can access external sites. The user's IP configuration shows a correct IP, subnet mask, and default gateway. What is the most likely cause?

Accepted Answer

The proxy server settings are incorrect.. The user can access internal websites but not external ones, while other users in the same subnet have no issues. This points to a client-specific configuration problem rather than a network-wide issue. Incorrect proxy server settings on the user's machine can prevent external HTTP/HTTPS traffic from being routed correctly, even though internal traffic (which may bypass the proxy) works fine.

Answer

The DNS server is not reachable.

Answer

The default gateway is misconfigured.

Answer

The web browser has a corrupted cache.

Question 11

An attacker is launching a DHCP starvation attack by sending a large number of DHCP discover messages with spoofed MAC addresses. This exhausts the DHCP pool and causes legitimate clients to fail to obtain IP addresses. Which security feature should be implemented on the switch to mitigate this attack?

Accepted Answer

DHCP snooping. DHCP snooping is the correct mitigation because it filters untrusted DHCP messages on access ports. By default, it only allows DHCP server responses (OFFER, ACK, etc.) on trusted ports (typically uplinks to the legitimate DHCP server) and drops them on untrusted ports, preventing a rogue or spoofed server from replying. Additionally, DHCP snooping builds a DHCP snooping binding table that tracks valid MAC-to-IP address mappings, which can be used to rate-limit DHCP discover messages and detect starvation attacks.

Answer

Port security

Answer

Dynamic ARP Inspection (DAI)

Answer

802.1X

Question 12

An attacker sends ICMP echo request packets to the broadcast address of a network, with the source IP address spoofed to be the target's IP address. This causes all hosts on the network to send ICMP echo replies to the target, overwhelming it. Which type of attack is this?

Accepted Answer

Smurf attack. This is a classic Smurf attack, which exploits ICMP by sending echo request packets to the network's broadcast address with the source IP spoofed as the target. All hosts on the network receive the request and reply to the spoofed source, flooding the target with ICMP echo replies and consuming its bandwidth or resources.

Answer

Fraggle attack

Answer

Ping flood

Answer

ARP poisoning

Question 13

Users in a department report that the network is extremely slow. A technician checks the access switch and notices that a single port shows a high number of CRC errors and runts. The link LED is solid green. Which of the following is the most likely cause of the issue?

Accepted Answer

Duplex mismatch between the switch port and the connected device. A duplex mismatch occurs when one device operates at full duplex and the other at half duplex. The full-duplex side does not perform Carrier Sense Multiple Access with Collision Detection (CSMA/CD), so it transmits without checking for collisions. The half-duplex side detects collisions, causing late collisions that manifest as CRC errors and runts on the switch port. The solid green link LED indicates Layer 1 connectivity is intact, ruling out a physical cable fault.

Answer

Faulty network cable

Answer

Broadcast storm

Answer

VLAN misconfiguration

Question 14

Which SNMPv3 security level provides both authentication and encryption?

Accepted Answer

authPriv. Option C (authPriv) is correct because SNMPv3 defines three security levels: noAuthNoPriv, authNoPriv, and authPriv. The authPriv level provides both authentication (using HMAC-MD5 or HMAC-SHA) and encryption (using CBC-DES or AES) to ensure data integrity, origin verification, and confidentiality. This is the highest security level defined in RFC 3414.

Answer

noAuthNoPriv

Answer

authNoPriv

Answer

noAuthPriv

Question 15

A security analyst has enabled DHCP snooping on all VLANs of the company's switches to mitigate the risk of rogue DHCP servers. After implementation, the analyst discovers that clients are still receiving IP addresses from an unauthorized DHCP server. The unauthorized server is connected to a switch port that is currently configured as a trusted port. What should the analyst do to stop the rogue DHCP server from offering addresses?

Accepted Answer

Change the port connecting the unauthorized server to an untrusted port.. DHCP snooping operates by designating switch ports as either trusted or untrusted. Trusted ports are allowed to send DHCP server messages (OFFER, ACK), while untrusted ports are blocked from sending such messages. Since the rogue server is connected to a trusted port, it can still offer IP addresses. Changing the port to untrusted will cause the switch to drop all DHCP server messages from that port, stopping the rogue server.

Answer

Enable Dynamic ARP Inspection on the VLAN.

Answer

Configure port security on the unauthorized server's port to limit MAC addresses.

Answer

Increase the rate limit on the unauthorized server's port.