N10-009 Practice Test 8 — 10 Questions

Question 1

A network technician is troubleshooting an issue where Server A can ping Server B by IP address, but Server B cannot ping Server A. Both servers are in the same VLAN and subnet, connected to the same switch. The switch ports are configured identically, and there are no ACLs or firewalls between them. Which of the following is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Server A's firewall is blocking incoming ICMP. Server A can ping Server B by IP address, meaning ICMP echo requests from Server A reach Server B and echo replies return successfully. However, Server B cannot ping Server A, which indicates that ICMP echo requests from Server B are not reaching Server A or their replies are blocked. Since both servers are in the same VLAN/subnet with no ACLs or firewalls between them, the most likely cause is that Server A's host-based firewall is blocking incoming ICMP (echo requests), preventing Server B's pings from being processed. This is a classic symptom of a one-way firewall rule that permits outbound ICMP but denies inbound ICMP.

Answer

Server B's firewall is blocking outgoing ICMP

Answer

The cable connecting Server A is faulty

Answer

There is a duplex mismatch on Server B's switch port

Question 2

A network engineer is configuring a Link Aggregation Group (LAG) between two switches. Switch A is set to LACP active mode. Which mode should be configured on Switch B to form the LAG?

Accepted Answer

Passive. LACP active mode initiates negotiation by sending LACP packets, while passive mode responds to those packets without initiating. Since Switch A is set to active, Switch B must be in passive mode to successfully form a Link Aggregation Group (LAG). This combination allows the two switches to exchange LACP frames and agree on the aggregation parameters.

Answer

On

Answer

Static

Answer

Auto

Question 3

A network administrator is configuring a syslog server to receive logs from network devices. The administrator wants to capture all messages with a severity level of 'critical' (2) and higher (more severe). What severity threshold should be set on the devices?

Accepted Answer

2 (critical). Syslog severity levels are numbered 0 (most severe) through 7 (least severe). When you set a severity threshold on a device, it captures messages at that level and all lower-numbered (more severe) levels. To capture 'critical' (2) and higher (i.e., levels 0, 1, and 2), you must set the threshold to 2. Option C is correct because level 2 includes itself and all more severe levels (0 and 1).

Answer

0 (emergency)

Answer

1 (alert)

Answer

3 (error)

Question 4

A user reports that they cannot access any network resources. The technician runs 'ipconfig' on the workstation and sees that the IP address is 169.254.23.45 with a subnet mask of 255.255.0.0. What is the most likely cause of this issue?

Accepted Answer

The DHCP server is unreachable or not functioning.. The IP address 169.254.23.45 with a subnet mask of 255.255.0.0 is an Automatic Private IP Addressing (APIPA) address, which is assigned by the operating system when a DHCP discovery attempt fails. This indicates that the workstation was unable to contact a DHCP server to obtain a valid IP configuration, making an unreachable or non-functioning DHCP server the most likely cause.

Answer

The workstation's network cable is unplugged.

Answer

The DNS server is not responding.

Answer

The workstation has been assigned a static IP address in the wrong subnet.

Question 5

A network administrator wants to be alerted immediately when any interface on a core router goes down. The administrator has already configured SNMP community strings. Which additional configuration is necessary to receive these alerts?

Accepted Answer

A) Configure the router to send SNMP traps to the NMS. SNMP traps are unsolicited notifications sent from the managed device (the router) to the Network Management Station (NMS) when a specific event occurs, such as an interface going down. Since the administrator wants immediate alerts without polling, configuring the router to send SNMP traps to the NMS is the correct approach. The SNMP community strings are already set, so the missing piece is the trap destination and enabling trap generation for interface state changes.

Answer

B) Perform an SNMP walk of the interface OIDs

Answer

C) Use SNMP get to retrieve interface status periodically

Answer

D) Configure SNMP set to change interface parameters

Question 6

A security engineer is configuring port security on a switch to prevent unauthorized devices from connecting. The requirement is that only the first device to connect to a port is allowed, and if a different device connects, the port should be disabled. Which port security violation mode should be configured?

Accepted Answer

Shutdown. The 'shutdown' violation mode disables the port entirely when a violation occurs, which meets the requirement that the port be disabled if a different device connects. This is the only mode that physically err-disables the port, preventing any further traffic until manually re-enabled.

Answer

Protect

Answer

Restrict

Answer

Sticky

Question 7

A security auditor discovers that an unauthorized switch has been connected to an access port in the wiring closet. The rogue switch caused a network loop and disrupted connectivity. Which security feature, if enabled on the access port, would have prevented this by disabling the port when a BPDU is received?

Accepted Answer

BPDU guard. BPDU guard is the correct answer because it is specifically designed to protect against rogue switch connections on access ports. When enabled, if a port receives any Bridge Protocol Data Unit (BPDU), it immediately places the port into an errdisable state, effectively disabling it and preventing a potential network loop. This directly addresses the scenario where an unauthorized switch connected to an access port caused a loop.

Answer

Root guard

Answer

Loop guard

Answer

UDLD

Question 8

A network engineer needs to create subnets for four departments, each requiring at least 50 host addresses. The available network is 192.168.1.0/24. Which subnet mask should be used to satisfy the requirements while minimizing wasted addresses?

Accepted Answer

/26 (255.255.255.192). A /26 subnet mask (255.255.255.192) provides 62 usable host addresses per subnet (2^(32-26) - 2 = 62), which meets the requirement of at least 50 hosts per department. With a /24 network, you can create exactly four /26 subnets (192.168.1.0/26, 192.168.1.64/26, 192.168.1.128/26, 192.168.1.192/26), perfectly matching the four departments while minimizing wasted addresses.

Answer

/25 (255.255.255.128)

Answer

/27 (255.255.255.224)

Answer

/24 (255.255.255.0)

Question 9

A workstation with IP address 10.0.1.5/24 needs to communicate with a server at 10.0.2.10/24. The workstation's default gateway is configured as 10.0.1.1. Which of the following will the workstation do with the IP packets destined for the server?

Accepted Answer

Send the packets to the default gateway.. The workstation's IP address (10.0.1.5/24) and the server's IP address (10.0.2.10/24) are on different subnets (10.0.1.0/24 vs. 10.0.2.0/24). When a host determines that the destination is not on the same local network, it will not attempt direct delivery via ARP. Instead, it forwards the IP packet to its configured default gateway (10.0.1.1), which then routes the packet toward the server's subnet.

Answer

Send the packets directly to the server using ARP.

Answer

Send the packets to the DNS server for resolution.

Answer

Drop the packets because the server is on a different network.

Question 10

Users in a warehouse report that their wireless tablets lose connectivity when moving near large metal racks. The signal strength remains high but throughput drops significantly. What is the most likely cause?

Accepted Answer

Multipath interference. When wireless signals reflect off large metal surfaces, multiple copies of the signal arrive at the receiver at slightly different times, causing multipath interference. This phase cancellation effect corrupts the signal, forcing the 802.11 MAC layer to retransmit frames, which drastically reduces throughput even though the received signal strength indicator (RSSI) remains high. The metal racks in the warehouse act as reflective surfaces, creating a classic multipath environment.

Answer

Signal attenuation

Answer

Co-channel interference

Answer

Insufficient DHCP scope