N10-009 Practice Questions 2 — 50 Questions

Question 1

A user reports that they cannot access the internet. The technician verifies the workstation has IP address 192.168.1.10 with subnet mask 255.255.255.0 and default gateway 192.168.1.1. The user can ping the default gateway successfully. Other users on the same subnet can access the internet. Which command should the technician run on the workstation to further isolate the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

netstat -r. The user can ping the default gateway (192.168.1.1), indicating Layer 2 and basic Layer 3 connectivity to the local router. However, other users on the same subnet can access the internet, so the issue is likely with the workstation's routing table. The 'netstat -r' command displays the IP routing table, allowing the technician to check for a missing or incorrect default route (e.g., destination 0.0.0.0 with gateway 192.168.1.1). This isolates whether the workstation knows how to forward traffic beyond the local subnet.

Answer

ipconfig /all

Answer

tracert 8.8.8.8

Answer

nslookup google.com

Question 2

Which of the following best describes a broadcast domain?

Accepted Answer

All devices that can receive a broadcast frame from any other device in the network segment. A broadcast domain is defined as the set of all devices that can receive a broadcast frame (destination MAC FF:FF:FF:FF:FF:FF) sent by any other device within the same network segment. This boundary is typically enforced by Layer 3 devices like routers, which do not forward broadcast frames, whereas Layer 2 switches forward broadcasts out all ports except the receiving port within the same VLAN.

Answer

All devices connected to the same switch

Answer

All devices that share the same IP subnet

Answer

All devices that have the same MAC address prefix

Question 3

A user reports intermittent connectivity issues. The technician runs ping tests and notices that pings to the default gateway sometimes fail and sometimes succeed. While pinging, the technician observes that some replies have high latency. Which tool should the technician use to analyze the path and identify where packets are being delayed?

Accepted Answer

traceroute / tracert. Traceroute (tracert on Windows) is the correct tool because it sends packets with incrementing Time-to-Live (TTL) values to map the entire Layer 3 path from source to destination. By measuring the round-trip time (RTT) for each hop, it can pinpoint exactly which router or link is introducing high latency or packet loss, addressing the intermittent connectivity and delayed replies observed in the ping tests.

Answer

nslookup

Answer

ipconfig

Answer

arp

Question 4

A security analyst notices that the network has been flooded with packets that have the same source IP address as the company's internal DNS server. This is likely an example of which type of attack?

Accepted Answer

IP spoofing. IP spoofing is the correct answer because the attacker is forging the source IP address of packets to impersonate the company's internal DNS server. By flooding the network with packets that appear to originate from a trusted internal server, the attacker can bypass security controls, launch reflection attacks, or cause denial of service. This directly matches the scenario where the source IP is falsified to match a legitimate internal host.

Answer

Smurf attack

Answer

Man-in-the-middle

Answer

ARP poisoning

Question 5

A company is implementing a DMZ to host public-facing web and email servers. The DMZ network uses private IP addresses, and the internal network also uses private IP addresses. The company has only one public IP address assigned to the border router's external interface. Which of the following should be configured to allow internet users to access the DMZ servers?

Accepted Answer

Port forwarding to the private IP addresses of the servers.. Port forwarding (often configured as static NAT with a single public IP) allows the border router to forward incoming traffic on specific TCP/UDP ports (e.g., 80 for web, 25 for SMTP) to the private IP addresses of the DMZ servers. Since the company has only one public IP, this is the only way to direct external requests to the correct internal server without requiring multiple public IPs.

Answer

NAT with overload to translate multiple internal addresses to the single public IP.

Answer

Static NAT mapping each DMZ server to a unique public IP.

Answer

A VPN tunnel between the DMZ and the internal network.

Question 6

A network administrator is installing cable in a plenum space (an area used for air circulation, such as above a drop ceiling). Which cable type is required by most building codes for such an installation?

Accepted Answer

Plenum-rated cable. Plenum-rated cable is required by most building codes (e.g., NFPA 70, National Electrical Code) for installation in plenum spaces because it is constructed with fire-retardant materials, such as FEP or PFA, that produce minimal smoke and are self-extinguishing. This prevents toxic fumes and flames from spreading through air-handling areas, ensuring safety in case of a fire. Standard PVC-jacketed cable would release hazardous smoke and support flame propagation, making it illegal in plenum spaces.

Answer

PVC-jacketed cable

Answer

Riser-rated cable

Answer

Low Smoke Zero Halogen (LSZH) cable

Question 7

A user can ping the default gateway (192.168.1.1) but cannot ping the external IP address 8.8.8.8. Other users on the same subnet can ping 8.8.8.8 without issue. The user's IP configuration is correct: IP 192.168.1.10/24, default gateway 192.168.1.1, DNS 8.8.8.8. What is the most likely cause?

Accepted Answer

The computer's firewall is blocking outbound ICMP. The user can ping the default gateway (192.168.1.1) but not the external IP 8.8.8.8, while other users on the same subnet can ping 8.8.8.8 without issue. This isolates the problem to the user's specific host, not the network infrastructure. A local firewall on the user's computer blocking outbound ICMP (Internet Control Message Protocol) traffic would prevent ping to external IPs while still allowing local subnet communication, as ICMP is often restricted by default in some security policies.

Answer

The router is missing a default route to the internet

Answer

The DNS server is not resolving the hostname

Answer

The network cable is loose or faulty

Question 8

A network engineer is troubleshooting intermittent call drops on a VoIP deployment. The network uses separate VLANs for voice (VLAN 20) and data (VLAN 10). Switch ports connecting the IP phones are configured with the correct voice VLAN. Which of the following is the MOST likely cause to check NEXT?

Accepted Answer

Verify that QoS markings and queuing are configured on the switches and routers. Intermittent call drops on a VoIP deployment with separate voice and data VLANs most likely stem from insufficient or misconfigured QoS markings and queuing. Voice traffic is sensitive to latency, jitter, and packet loss, which occur when data traffic competes for bandwidth without proper prioritization. Verifying that switches and routers have consistent QoS policies (e.g., marking with DSCP EF for RTP and queuing with strict priority) is the logical next step after ensuring the voice VLAN is correctly assigned.

Answer

Check the DNS server for the phone's name resolution

Answer

Replace the patch cables from the phones to the switches

Answer

Increase the DHCP lease time for the phones

Question 9

Which of the following is the primary function of a subnet mask in IPv4 networking?

Accepted Answer

It determines the network portion of an IP address. The subnet mask's primary function is to distinguish the network portion from the host portion of an IPv4 address. By applying a bitwise AND operation between the IP address and the subnet mask, the network address is derived, which is essential for routing decisions. Without this separation, devices cannot determine whether a destination is local or requires forwarding through a router.

Answer

It identifies the default gateway for a subnet

Answer

It provides encryption for data in transit

Answer

It maps IP addresses to MAC addresses

Question 10

Users in a branch office report that file transfers to the data center are slow. A technician runs a traceroute and sees consistently high latency on hop 5. The technician then pings hop 5 and gets replies with varying response times. There are no errors reported on the interface. What is the most likely cause?

Accepted Answer

Interface congestion causing queuing delays.. High latency on hop 5 with varying response times and no interface errors indicates that the router at hop 5 is experiencing congestion, causing packets to be queued before transmission. This queuing delay results in increased and variable round-trip times (RTT), which is a classic symptom of interface congestion. The absence of errors rules out physical-layer issues, and the consistent latency on that specific hop points to a bottleneck at that router's egress interface.

Answer

Routing loop causing packets to be dropped.

Answer

DNS server misconfiguration causing lookup delays.

Answer

Firewall inspecting traffic and adding latency.

Question 11

A network administrator scheduled a change window to upgrade the firmware on a core switch. During the upgrade, the switch fails to boot properly. The administrator needs to restore the switch to its previous operational state. Which of the following should the administrator have done before the upgrade to facilitate a successful rollback?

Accepted Answer

Backed up the current configuration and firmware image.. Backing up both the current configuration and the firmware image ensures that the administrator can restore the switch to its exact previous operational state if the upgrade fails. Without a backup of the firmware image, the switch may not have a valid bootable image to revert to, even if the configuration is saved. This is a fundamental prerequisite for any firmware upgrade rollback plan.

Answer

Notified all users of the maintenance window.

Answer

Disconnected all redundant links.

Answer

Set the switch to boot from an alternative image.

Question 12

A network technician is troubleshooting an issue where Server A can ping Server B by IP address, but Server B cannot ping Server A. Both servers are in the same VLAN and subnet, connected to the same switch. The switch ports are configured identically, and there are no ACLs or firewalls between them. Which of the following is the MOST likely cause?

Accepted Answer

Server A's firewall is blocking incoming ICMP. Server A can ping Server B by IP address, meaning ICMP echo requests from Server A reach Server B and echo replies return successfully. However, Server B cannot ping Server A, which indicates that ICMP echo requests from Server B are not reaching Server A or their replies are blocked. Since both servers are in the same VLAN/subnet with no ACLs or firewalls between them, the most likely cause is that Server A's host-based firewall is blocking incoming ICMP (echo requests), preventing Server B's pings from being processed. This is a classic symptom of a one-way firewall rule that permits outbound ICMP but denies inbound ICMP.

Answer

Server B's firewall is blocking outgoing ICMP

Answer

The cable connecting Server A is faulty

Answer

There is a duplex mismatch on Server B's switch port

Question 13

A network engineer is configuring a Link Aggregation Group (LAG) between two switches. Switch A is set to LACP active mode. Which mode should be configured on Switch B to form the LAG?

Accepted Answer

Passive. LACP active mode initiates negotiation by sending LACP packets, while passive mode responds to those packets without initiating. Since Switch A is set to active, Switch B must be in passive mode to successfully form a Link Aggregation Group (LAG). This combination allows the two switches to exchange LACP frames and agree on the aggregation parameters.

Answer

On

Answer

Static

Answer

Auto

Question 14

A network administrator is configuring a syslog server to receive logs from network devices. The administrator wants to capture all messages with a severity level of 'critical' (2) and higher (more severe). What severity threshold should be set on the devices?

Accepted Answer

2 (critical). Syslog severity levels are numbered 0 (most severe) through 7 (least severe). When you set a severity threshold on a device, it captures messages at that level and all lower-numbered (more severe) levels. To capture 'critical' (2) and higher (i.e., levels 0, 1, and 2), you must set the threshold to 2. Option C is correct because level 2 includes itself and all more severe levels (0 and 1).

Answer

0 (emergency)

Answer

1 (alert)

Answer

3 (error)

Question 15

A user reports that they cannot access any network resources. The technician runs 'ipconfig' on the workstation and sees that the IP address is 169.254.23.45 with a subnet mask of 255.255.0.0. What is the most likely cause of this issue?

Accepted Answer

The DHCP server is unreachable or not functioning.. The IP address 169.254.23.45 with a subnet mask of 255.255.0.0 is an Automatic Private IP Addressing (APIPA) address, which is assigned by the operating system when a DHCP discovery attempt fails. This indicates that the workstation was unable to contact a DHCP server to obtain a valid IP configuration, making an unreachable or non-functioning DHCP server the most likely cause.

Answer

The workstation's network cable is unplugged.

Answer

The DNS server is not responding.

Answer

The workstation has been assigned a static IP address in the wrong subnet.

Question 16

A network administrator wants to be alerted immediately when any interface on a core router goes down. The administrator has already configured SNMP community strings. Which additional configuration is necessary to receive these alerts?

Accepted Answer

A) Configure the router to send SNMP traps to the NMS. SNMP traps are unsolicited notifications sent from the managed device (the router) to the Network Management Station (NMS) when a specific event occurs, such as an interface going down. Since the administrator wants immediate alerts without polling, configuring the router to send SNMP traps to the NMS is the correct approach. The SNMP community strings are already set, so the missing piece is the trap destination and enabling trap generation for interface state changes.

Answer

B) Perform an SNMP walk of the interface OIDs

Answer

C) Use SNMP get to retrieve interface status periodically

Answer

D) Configure SNMP set to change interface parameters

Question 17

A security engineer is configuring port security on a switch to prevent unauthorized devices from connecting. The requirement is that only the first device to connect to a port is allowed, and if a different device connects, the port should be disabled. Which port security violation mode should be configured?

Accepted Answer

Shutdown. The 'shutdown' violation mode disables the port entirely when a violation occurs, which meets the requirement that the port be disabled if a different device connects. This is the only mode that physically err-disables the port, preventing any further traffic until manually re-enabled.

Answer

Protect

Answer

Restrict

Answer

Sticky

Question 18

A security auditor discovers that an unauthorized switch has been connected to an access port in the wiring closet. The rogue switch caused a network loop and disrupted connectivity. Which security feature, if enabled on the access port, would have prevented this by disabling the port when a BPDU is received?

Accepted Answer

BPDU guard. BPDU guard is the correct answer because it is specifically designed to protect against rogue switch connections on access ports. When enabled, if a port receives any Bridge Protocol Data Unit (BPDU), it immediately places the port into an errdisable state, effectively disabling it and preventing a potential network loop. This directly addresses the scenario where an unauthorized switch connected to an access port caused a loop.

Answer

Root guard

Answer

Loop guard

Answer

UDLD

Question 19

A network engineer needs to create subnets for four departments, each requiring at least 50 host addresses. The available network is 192.168.1.0/24. Which subnet mask should be used to satisfy the requirements while minimizing wasted addresses?

Accepted Answer

/26 (255.255.255.192). A /26 subnet mask (255.255.255.192) provides 62 usable host addresses per subnet (2^(32-26) - 2 = 62), which meets the requirement of at least 50 hosts per department. With a /24 network, you can create exactly four /26 subnets (192.168.1.0/26, 192.168.1.64/26, 192.168.1.128/26, 192.168.1.192/26), perfectly matching the four departments while minimizing wasted addresses.

Answer

/25 (255.255.255.128)

Answer

/27 (255.255.255.224)

Answer

/24 (255.255.255.0)

Question 20

A workstation with IP address 10.0.1.5/24 needs to communicate with a server at 10.0.2.10/24. The workstation's default gateway is configured as 10.0.1.1. Which of the following will the workstation do with the IP packets destined for the server?

Accepted Answer

Send the packets to the default gateway.. The workstation's IP address (10.0.1.5/24) and the server's IP address (10.0.2.10/24) are on different subnets (10.0.1.0/24 vs. 10.0.2.0/24). When a host determines that the destination is not on the same local network, it will not attempt direct delivery via ARP. Instead, it forwards the IP packet to its configured default gateway (10.0.1.1), which then routes the packet toward the server's subnet.

Answer

Send the packets directly to the server using ARP.

Answer

Send the packets to the DNS server for resolution.

Answer

Drop the packets because the server is on a different network.