N10-009 Practice Questions 1 — 50 Questions

Question 1

A security analyst is reviewing firewall logs and sees many incoming packets with a source IP address that matches the internal IP range of the company (10.0.0.0/8) arriving on the external interface. Which type of attack is likely being attempted?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IP spoofing attack. Packets arriving on the external interface with a source IP address from the internal 10.0.0.0/8 range indicate that the attacker is forging (spoofing) the source address to impersonate an internal host. This is a classic IP spoofing attack, often used to bypass access control lists or to launch further attacks that rely on trust relationships based on source IP.

Answer

Smurf attack

Answer

SYN flood

Answer

DNS amplification

Question 2

A network technician runs the command "traceroute 8.8.8.8" from a workstation. The output shows the first hop as the default gateway, the second hop as an internal router, and then a series of asterisks (* * *) before reaching the destination. What does the series of asterisks indicate?

Accepted Answer

The intermediate routers are not responding to ICMP time-exceeded messages. The series of asterisks indicates that intermediate routers beyond the second hop are not responding with ICMP Time-Exceeded messages when the TTL expires. Traceroute relies on these ICMP responses to identify each hop; if a router is configured to drop ICMP or not send the message, the output shows asterisks for that hop. The destination is still reachable, as the final hop succeeds, so the asterisks do not indicate unreachability.

Answer

The destination is unreachable

Answer

The TTL expired at the last hop

Answer

The connection is encrypted

Question 3

A network engineer is designing a network and needs to ensure that broadcast traffic is contained within a single broadcast domain. Which of the following devices should be used to create these separate broadcast domains?

Accepted Answer

Router. A router operates at Layer 3 of the OSI model and does not forward broadcast frames by default, making it the correct device to segment a network into separate broadcast domains. Each interface on a router creates a distinct broadcast domain, ensuring that broadcast traffic is contained within that interface's subnet.

Answer

Hub

Answer

Bridge

Answer

Switch

Question 4

A user reports that they cannot access any network resources. The technician checks the IP configuration and sees that the workstation has an IP address of 169.254.1.5. What is the most likely cause?

Accepted Answer

The DHCP server is unavailable. The IP address 169.254.1.5 is an Automatic Private IP Addressing (APIPA) address (169.254.0.0/16 range), which Windows assigns when a DHCP client fails to receive a lease from a DHCP server. Since the workstation cannot obtain a valid IP configuration, it cannot communicate with any network resources, confirming that the DHCP server is unavailable.

Answer

The DNS server is down

Answer

The default gateway is incorrect

Answer

The subnet mask is mismatched

Question 5

A company wants to prevent unauthorized devices from connecting to the corporate network. The policy requires that only specific MAC addresses are permitted on switch ports. Which security feature should be implemented on the switches?

Accepted Answer

MAC filtering / Port security. MAC filtering, also known as port security, is the correct feature because it allows the switch to restrict access to a port based on the source MAC address of incoming frames. By configuring a list of allowed MAC addresses, the switch will drop traffic from any unauthorized device, directly enforcing the policy that only specific MAC addresses are permitted on switch ports.

Answer

802.1X authentication

Answer

VLAN hopping prevention

Answer

DHCP snooping

Question 6

A network administrator is connecting two switches and wants to increase the bandwidth between them while also providing redundancy in case one link fails. Which technology should be configured on the switch ports?

Accepted Answer

Link Aggregation Control Protocol (LACP). Link Aggregation Control Protocol (LACP) allows multiple physical links between two switches to be combined into a single logical link, increasing aggregate bandwidth and providing redundancy: if one physical link fails, traffic continues over the remaining links. This directly meets the requirement for both higher bandwidth and link-level fault tolerance.

Answer

Spanning Tree Protocol (STP)

Answer

VLAN trunking (802.1Q)

Answer

Power over Ethernet (PoE)

Question 7

An organization uses OSPF as its interior gateway protocol in a multi-area design. After a core router failure, the network takes a long time to reconverge. Which technology can be implemented to improve convergence speed?

Accepted Answer

Implement Bidirectional Forwarding Detection (BFD). BFD provides sub-second failure detection by sending rapid, lightweight hello packets independently of OSPF's own hello mechanism. When a core router fails, BFD detects the link down in milliseconds and immediately signals OSPF to trigger reconvergence, drastically reducing the time OSPF would otherwise spend waiting for its own dead timer to expire.

Answer

Use static routes instead of OSPF

Answer

Increase OSPF hello and dead timers

Answer

Configure all routers in a single OSPF area

Question 8

A network administrator needs to connect two switches located in separate buildings 150 meters apart. The connection must support 10 Gbps speeds. Which cabling type is most appropriate?

Accepted Answer

Multi-mode fiber optic. Multi-mode fiber optic (MMF) is the most appropriate choice because it supports 10 Gbps speeds over distances up to 300 meters (using OM3 or OM4 fiber) with cost-effective transceivers (e.g., 10GBASE-SR). The 150-meter distance exceeds the 100-meter maximum for twisted-pair copper cabling (Cat6a or Cat7) at 10 Gbps, making fiber the only viable option among the choices.

Answer

Cat6a twisted pair

Answer

Cat7 twisted pair

Answer

Single-mode fiber optic

Question 9

A security analyst notices that a web server is receiving a large number of ICMP echo reply packets from many different external hosts. The server did not send any echo requests. Which type of attack is most likely occurring?

Accepted Answer

Smurf attack. A Smurf attack exploits IP broadcast addressing and ICMP. The attacker sends a large number of ICMP echo request packets with a spoofed source IP (the victim's IP) to a network's broadcast address. All hosts on that network then send ICMP echo reply packets to the victim, overwhelming it with traffic. Since the server never sent any echo requests, the unsolicited flood of echo replies is the hallmark of a Smurf attack.

Answer

Ping flood

Answer

ICMP tunneling

Answer

Fraggle attack

Question 10

A network administrator is preparing documentation for a new branch office. The administrator needs a diagram that shows the logical relationships between network devices and how VLANs are trunked over inter-switch links. Which type of document should be created?

Accepted Answer

Logical topology diagram. A logical topology diagram is the correct choice because it illustrates how devices communicate across the network, including VLAN assignments and trunk links (e.g., 802.1Q tagging) between switches. This diagram abstracts physical locations to show Layer 2 and Layer 3 relationships, such as which VLANs traverse which inter-switch links, making it ideal for documenting VLAN trunking and logical connectivity.

Answer

Network baseline

Answer

Wiring diagram

Answer

Physical topology diagram

Question 11

A network technician is configuring a small office network with two subnets: 10.0.1.0/24 and 10.0.2.0/24. Each subnet has its own switch, and both switches are connected to a router with interfaces 10.0.1.1 and 10.0.2.1. Hosts on subnet A can ping the router's interface in their subnet but cannot ping hosts on subnet B. Which of the following is the most likely cause?

Accepted Answer

IP routing is disabled on the router.. The hosts on subnet A can ping their default gateway (10.0.1.1) but cannot reach hosts on subnet B, which indicates that the router is not forwarding packets between the two directly connected subnets. This behavior is characteristic of a router with IP routing disabled, as the router will not perform inter-VLAN or inter-subnet forwarding unless the 'ip routing' command is enabled globally. Without IP routing, the router acts as a host and will only respond to traffic destined for its own interfaces, dropping any packets that require forwarding to another subnet.

Answer

The router is not configured with a routing protocol.

Answer

The hosts in subnet A have the wrong default gateway.

Answer

The switch in subnet A is blocking ICMP traffic.

Question 12

A network engineer is implementing OSPF on a router. All directly connected neighbors are listed with state FULL, but routes from another area are not appearing in the routing table. Which of the following is the most likely cause?

Accepted Answer

The router has an ACL blocking inbound OSPF updates. An ACL applied to the OSPF process or interface can filter inbound Type 3 LSAs (summary LSAs) from other areas. Even though neighbor adjacencies reach FULL state, the router will not install those inter-area routes into the routing table if the ACL blocks the LSA updates. This explains why directly connected neighbors are fine but routes from another area are missing.

Answer

The router is not configured with a router ID

Answer

The router is configured as an ABR but does not have a virtual-link configured

Answer

The link-state database is corrupted

Question 13

A company wants to increase the bandwidth between two switches without upgrading the existing 1 Gbps copper links. Both switches support 802.3ad. Which technology should be implemented?

Accepted Answer

Link aggregation (LACP). Link aggregation using LACP (802.3ad) allows multiple 1 Gbps copper links to be combined into a single logical link, increasing bandwidth between the two switches without upgrading the physical interfaces. Since both switches support 802.3ad, they can negotiate and manage the aggregated link dynamically, providing both increased throughput and link redundancy.

Answer

VLAN trunking

Answer

Port mirroring

Answer

StackWise

Question 14

Drag and drop the steps to configure a firewall rule allowing inbound HTTPS traffic to a web server into the correct order.

Accepted Answer

Define rule name & description, then specify protocol and port (TCP/443), then specify source and destination addresses, then set action to allow and apply the rule.. The correct sequence for configuring a firewall rule to allow inbound HTTPS traffic is to start with a descriptive rule name, then specify the protocol (TCP) and port (443) to identify the service, then define the source and destination IP addresses, and finally set the action to allow and apply the rule. This order follows logical firewall policy design: identification, service definition, addressing, and enforcement. Common mistakes include placing the protocol/port after addressing or delaying the rule name, which can lead to disorganized or incorrect firewall configurations.

Answer

Specify protocol and port (TCP/443), then define rule name & description, then specify source and destination addresses, then set action to allow and apply the rule.

Answer

Specify source and destination addresses, then specify protocol and port (TCP/443), then define rule name & description, then set action to allow and apply the rule.

Answer

Define rule name & description, then specify source and destination addresses, then specify protocol and port (TCP/443), then set action to allow and apply the rule.

Question 15

An organization's security policy requires that all remote access VPN connections use two-factor authentication and that the VPN clients are compliant with the latest patch levels before gaining network access. Which technology combination provides these capabilities?

Accepted Answer

VPN with RADIUS authentication and posture assessment. RADIUS authentication can enforce two-factor authentication (e.g., via token or OTP), and posture assessment (often via Network Access Control or a VPN posture plugin) checks the client's patch level before granting network access. This combination directly satisfies the policy requirements for both multi-factor authentication and endpoint compliance verification.

Answer

SSL VPN with client certificate authentication

Answer

IPsec VPN using preshared keys

Answer

NAC integrated with a reverse proxy

Question 16

A network engineer is reviewing RFC 1918 address ranges to plan a private IP addressing scheme. Which of the following IP addresses falls within the private address space for Class A?

Accepted Answer

10.10.10.1. RFC 1918 defines the Class A private address range as 10.0.0.0/8, which includes all addresses from 10.0.0.0 to 10.255.255.255. 10.10.10.1 falls within this range, making it a valid private IP address for internal network use.

Answer

172.16.0.1

Answer

192.168.1.1

Answer

172.32.0.1

Question 17

A security engineer is configuring a site-to-site VPN between two branch offices. The requirement is to encrypt all traffic between the two networks using IPsec. Which IPsec mode should be used to encrypt the entire IP packet including the original header?

Accepted Answer

Tunnel mode. Tunnel mode is the correct choice because it encrypts the entire original IP packet, including the original header, and then encapsulates it within a new IP header. This is required for site-to-site VPNs where the original source and destination IP addresses must be hidden or protected, and the new header is used for routing between the two VPN gateways.

Answer

Transport mode

Answer

AH only

Answer

ESP only

Question 18

A network technician is analyzing a small office network topology. An 8-port switch has 7 workstations directly connected. The remaining switch port is connected to a 4-port hub, which has 4 workstations attached. All devices are configured on the same VLAN and IP subnet. How many collision domains and broadcast domains are present in this network?

Accepted Answer

8 collision domains, 1 broadcast domain. Switches create a separate collision domain per port, so the 8-port switch provides 8 collision domains. The hub connected to one switch port extends that single collision domain to all its attached devices, but does not create new ones. All devices are on the same VLAN and IP subnet, so there is only one broadcast domain. Therefore, the network has 8 collision domains and 1 broadcast domain.

Answer

11 collision domains, 1 broadcast domain

Answer

12 collision domains, 5 broadcast domains

Answer

8 collision domains, 5 broadcast domains

Question 19

A security analyst receives an alert that an internal user's workstation is sending a high volume of ARP requests for multiple IP addresses on the local subnet. The analyst suspects a man-in-the-middle attack. Which security mechanism is most effective at mitigating this type of attack on a switched network?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) is the correct answer because it validates ARP packets on a switched network, ensuring that only legitimate ARP replies are forwarded. In a man-in-the-middle attack, an attacker sends spoofed ARP replies to associate their MAC address with the IP address of a legitimate host. DAI intercepts all ARP packets and compares them against a trusted binding table (built by DHCP snooping), dropping any that are invalid, thus preventing ARP spoofing.

Answer

Port security

Answer

DHCP snooping

Answer

MAC address filtering

Question 20

A security auditor recommends implementing a solution that authenticates users and devices before granting network access, regardless of the physical port they connect to. Which technology should be deployed?

Accepted Answer

802.1X. 802.1X is the correct technology because it provides port-based network access control (PNAC) that authenticates users and devices before granting network access, regardless of the physical port they connect to. It uses the Extensible Authentication Protocol (EAP) over LAN (EAPoL) to communicate with a RADIUS server, ensuring that only authenticated endpoints are allowed on the network. This meets the auditor's requirement for authentication at the port level, independent of the switch port used.

Answer

Port security

Answer

VLAN hopping

Answer

DHCP snooping