N10-009 Practice Test 8 — 10 Questions

Question 1

A security analyst notices that the DHCP server is responding to a large number of DHCP Discover messages from a single MAC address, but that client never sends a DHCP Request to complete the lease. This pattern repeats continuously. Which type of attack is most likely occurring?

Accepted Answer

DHCP starvation. Option C is correct because the described behavior—a single MAC address sending continuous DHCP Discover messages without completing the lease with a DHCP Request—is the hallmark of a DHCP starvation attack. The attacker exhausts the DHCP server's IP address pool by claiming all available leases, preventing legitimate clients from obtaining IP addresses. This attack targets the DHCP protocol's four-step DORA (Discover, Offer, Request, Acknowledge) process by never completing the handshake.

Answer

ARP poisoning

Answer

DNS amplification

Answer

Rogue DHCP server

Question 2

A user can ping the default gateway (192.168.1.1) but cannot access the internet (e.g., ping 8.8.8.8 fails). The user's IP is correctly configured as 192.168.1.10/24. What should the technician check next?

Accepted Answer

Check the router's default route configuration. Since the user can ping the default gateway (192.168.1.1), Layer 2 and Layer 3 connectivity within the local subnet is working, and the PC's IP configuration is correct. The failure to reach 8.8.8.8 indicates that the router does not have a valid path to external networks, which is typically provided by a default route (0.0.0.0/0). Checking the router's default route configuration is the logical next step because without it, the router cannot forward traffic destined for non-local networks.

Answer

Check the PC's DNS server settings

Answer

Verify the subnet mask on the PC

Answer

Examine the switch port VLAN assignment

Question 3

A security auditor is reviewing firewall logs and notices repeated login attempts from a single external IP address to the company's SSH server. Which type of attack is likely occurring?

Accepted Answer

Brute force attack. Repeated login attempts from a single external IP to an SSH server are characteristic of a brute force attack, where an attacker systematically tries many username/password combinations to gain unauthorized access. SSH (port 22) is a common target because it provides remote shell access, and automated tools like Hydra or Medusa can rapidly test credentials. The firewall logs show multiple failed authentication attempts from the same source, which is the hallmark of this attack type.

Answer

Man-in-the-middle attack

Answer

ARP poisoning

Answer

DDoS attack

Question 4

A user on VLAN 10 reports that they cannot access a file server on VLAN 20. The user can ping the default gateway (interface on the router) and other devices within VLAN 10. The router has an 'ip helper-address' for DHCP but no static routes or dynamic routing configured for inter-VLAN routing. The file server is correctly configured with an IP address in VLAN 20. What is the most likely cause of the communication failure?

Accepted Answer

The router does not have a route to the VLAN 20 subnet. The router has no route to the VLAN 20 subnet. Even though the router is directly connected to VLAN 20 via its subinterface, inter-VLAN routing requires the router to have a connected route in its routing table for that subnet. Without a route (either connected or static), the router cannot forward packets from VLAN 10 to VLAN 20. The 'ip helper-address' only forwards DHCP broadcasts, not general traffic.

Answer

The router is configured with an ACL that blocks traffic from VLAN 10 to VLAN 20

Answer

The switch port connecting the user to the network is configured with port security limiting MAC addresses

Answer

The file server has a firewall blocking ICMP ping requests

Question 5

An IPv6 address has the prefix 2001:db8::/32. Which of the following IP addresses belongs to the same prefix?

Accepted Answer

2001:db8:1::1. The prefix 2001:db8::/32 means the first 32 bits of the address must be 2001:0db8. Option A (2001:db8:1::1) expands to 2001:0db8:0001:0000:0000:0000:0000:0001, which matches the first 32 bits exactly, so it belongs to the same /32 prefix.

Answer

2001:db9::1

Answer

2001:db7::1

Answer

fe80::1

Question 6

A small office uses a wireless router that provides both wired and wireless connectivity. The router's LAN IP is 192.168.1.1. A new printer with a static IP of 192.168.1.50 cannot be reached from a laptop obtaining an IP via DHCP. The laptop's IP is 192.168.1.100. Which of the following is the most likely cause?

Accepted Answer

The subnet mask is incorrect. The laptop obtains an IP address via DHCP, which typically assigns a subnet mask of 255.255.255.0 for a /24 network. If the printer has a static IP of 192.168.1.50 but is configured with an incorrect subnet mask (e.g., 255.255.255.252), the printer may believe it is on a different subnet than the laptop (192.168.1.100). This prevents the laptop from reaching the printer because the printer will not respond to ARP requests or will send traffic to its default gateway instead of directly to the laptop.

Answer

The printer is on a different VLAN

Answer

The default gateway is misconfigured

Answer

The DHCP scope is exhausted

Question 7

A user reports that they cannot access the internet, but they can access local resources on the same subnet. The network administrator pings the default gateway and gets a response. Which tool should be used next to trace the path to an external website?

Accepted Answer

traceroute. B is correct because traceroute (tracert on Windows) is the appropriate tool to identify where packets are being dropped or delayed along the path from the local host to an external website. Since the user can access local resources and the default gateway responds to pings, the issue likely lies beyond the gateway, and traceroute will reveal the hop where connectivity fails.

Answer

netstat

Answer

nslookup

Answer

arp

Question 8

A user reports that they can access the internet but cannot connect to an internal file server at IP address 192.168.1.50. The technician successfully pings the file server's IP address from the user's workstation. The file server is on the same subnet as the user. What is the most likely cause of this issue?

Accepted Answer

The file server's firewall is blocking the file-sharing protocol while allowing ICMP.. The technician can ping the file server (ICMP success) but the user cannot connect to it using the file-sharing protocol (e.g., SMB on TCP/445). This indicates network-layer reachability is fine, but the application-layer service is blocked. The most likely cause is the file server's host-based firewall (e.g., Windows Defender Firewall) allowing ICMP Echo Requests while blocking inbound SMB traffic, which is a common misconfiguration.

Answer

The file server has an incorrect default gateway configured.

Answer

The user's workstation has an incorrect DNS server configured.

Answer

The user's workstation has a duplicate IP address assigned.

Question 9

A user reports that they cannot connect to a file server on the same subnet. The technician checks the IP configuration and sees an IP address of 169.254.5.10. What is the most likely cause?

Accepted Answer

The DHCP server is unreachable. The IP address 169.254.5.10 is an Automatic Private IP Addressing (APIPA) address from the 169.254.0.0/16 range, which Windows assigns when a DHCP client fails to obtain a lease from a DHCP server. Since the user is on the same subnet as the file server, a missing default gateway or DNS server would not prevent local connectivity, but the inability to reach the DHCP server indicates a broader network issue that also prevents the client from obtaining a valid IP address.

Answer

The default gateway is misconfigured

Answer

The DNS server is down

Answer

The file server is offline

Question 10

Which of the following best describes the purpose of the TCP three-way handshake?

Accepted Answer

To establish a reliable connection between two hosts. The TCP three-way handshake is the process by which two hosts synchronize sequence numbers and establish a reliable connection before data transfer begins. It involves the exchange of SYN, SYN-ACK, and ACK segments, ensuring both sides are ready to communicate and agree on initial sequence numbers (ISNs) as defined in RFC 793.

Answer

To terminate a connection gracefully

Answer

To resolve an IP address to a MAC address

Answer

To encrypt data between two devices