N10-009 Hard Questions — 25 Difficult Questions

Question 1

A security analyst is reviewing firewall logs and sees many incoming packets with a source IP address that matches the internal IP range of the company (10.0.0.0/8) arriving on the external interface. Which type of attack is likely being attempted?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IP spoofing attack. Packets arriving on the external interface with a source IP address from the internal 10.0.0.0/8 range indicate that the attacker is forging (spoofing) the source address to impersonate an internal host. This is a classic IP spoofing attack, often used to bypass access control lists or to launch further attacks that rely on trust relationships based on source IP.

Answer

Smurf attack

Answer

SYN flood

Answer

DNS amplification

Question 2

An organization uses OSPF as its interior gateway protocol in a multi-area design. After a core router failure, the network takes a long time to reconverge. Which technology can be implemented to improve convergence speed?

Accepted Answer

Implement Bidirectional Forwarding Detection (BFD). BFD provides sub-second failure detection by sending rapid, lightweight hello packets independently of OSPF's own hello mechanism. When a core router fails, BFD detects the link down in milliseconds and immediately signals OSPF to trigger reconvergence, drastically reducing the time OSPF would otherwise spend waiting for its own dead timer to expire.

Answer

Use static routes instead of OSPF

Answer

Increase OSPF hello and dead timers

Answer

Configure all routers in a single OSPF area

Question 3

An organization's security policy requires that all remote access VPN connections use two-factor authentication and that the VPN clients are compliant with the latest patch levels before gaining network access. Which technology combination provides these capabilities?

Accepted Answer

VPN with RADIUS authentication and posture assessment. RADIUS authentication can enforce two-factor authentication (e.g., via token or OTP), and posture assessment (often via Network Access Control or a VPN posture plugin) checks the client's patch level before granting network access. This combination directly satisfies the policy requirements for both multi-factor authentication and endpoint compliance verification.

Answer

SSL VPN with client certificate authentication

Answer

IPsec VPN using preshared keys

Answer

NAC integrated with a reverse proxy

Question 4

A security engineer is configuring a site-to-site VPN between two branch offices. The requirement is to encrypt all traffic between the two networks using IPsec. Which IPsec mode should be used to encrypt the entire IP packet including the original header?

Accepted Answer

Tunnel mode. Tunnel mode is the correct choice because it encrypts the entire original IP packet, including the original header, and then encapsulates it within a new IP header. This is required for site-to-site VPNs where the original source and destination IP addresses must be hidden or protected, and the new header is used for routing between the two VPN gateways.

Answer

Transport mode

Answer

AH only

Answer

ESP only

Question 5

A security analyst receives an alert that an internal user's workstation is sending a high volume of ARP requests for multiple IP addresses on the local subnet. The analyst suspects a man-in-the-middle attack. Which security mechanism is most effective at mitigating this type of attack on a switched network?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) is the correct answer because it validates ARP packets on a switched network, ensuring that only legitimate ARP replies are forwarded. In a man-in-the-middle attack, an attacker sends spoofed ARP replies to associate their MAC address with the IP address of a legitimate host. DAI intercepts all ARP packets and compares them against a trusted binding table (built by DHCP snooping), dropping any that are invalid, thus preventing ARP spoofing.

Answer

Port security

Answer

DHCP snooping

Answer

MAC address filtering

Question 6

A network administrator reviews firewall logs and sees thousands of SYN packets coming from various source IP addresses to a single internal web server. No ACK or RST packets are observed from these sources. Which type of attack is most likely occurring?

Accepted Answer

SYN flood attack. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target server without completing the handshake (no ACK or RST). This exhausts the server's connection table resources, preventing legitimate connections. The observed pattern of many SYN packets from various sources with no subsequent ACK or RST is the hallmark of a SYN flood.

Answer

DNS amplification attack

Answer

ARP spoofing attack

Answer

Man-in-the-middle attack

Question 7

A security analyst is reviewing logs and finds that a single MAC address is rapidly requesting IP addresses from a DHCP server, each time with a different client ID. The DHCP server is exhausting its address pool. Which type of attack is occurring?

Accepted Answer

DHCP starvation attack. A DHCP starvation attack occurs when an attacker sends numerous DHCP discover messages, each with a unique client ID (chaddr), to exhaust the DHCP server's address pool. This prevents legitimate clients from obtaining IP addresses, as the server believes all leases are assigned. The rapid requests with different client IDs from a single MAC address are a hallmark of this attack.

Answer

MAC flooding attack

Answer

ARP spoofing

Answer

DNS poisoning

Question 8

A network administrator has configured a switch with four VLANs: VLAN 10, 20, 30, and 99 (native). The switch is connected to a router via an 802.1Q trunk link. The router has subinterfaces for VLANs 10, 20, and 30, each with an IP address. VLAN 99 is used for management and does not have a router subinterface. How many Layer 3 broadcast domains exist in this network?

Accepted Answer

3. A Layer 3 broadcast domain corresponds to a routed IP subnet. Without a router subinterface, VLAN 99 has no Layer 3 termination, so only VLANs 10, 20, and 30 (with subinterfaces) form separate broadcast domains. Thus, there are 3 Layer 3 broadcast domains.

Answer

1

Answer

2

Answer

4

Question 9

Users in VLAN 10 cannot obtain IP addresses from the DHCP server located in VLAN 20. The router interface for VLAN 10 has an ip helper-address 192.168.20.5 command configured, and users can ping the DHCP server IP (192.168.20.5) from the router. However, users receive APIPA addresses. What is the most likely cause?

Accepted Answer

The DHCP server does not have a scope configured for the 192.168.1.0/24 subnet (VLAN 10). The ip helper-address command on the router correctly forwards DHCPDISCOVER broadcasts from VLAN 10 to the DHCP server at 192.168.20.5. Since users can ping the server from the router, Layer 3 connectivity exists. However, the DHCP server must have a scope (or address pool) for the subnet of the requesting clients (192.168.1.0/24) to offer an IP address; without it, the server ignores the request, and clients fall back to APIPA (169.254.x.x).

Answer

The router's ip helper-address is configured on the wrong interface

Answer

The switch port connecting users is configured as a trunk instead of an access port

Answer

The router's ACL is blocking DHCP offers from the server

Question 10

A security analyst observes that an internal server is sending a large volume of TCP SYN packets to various external IP addresses, but never completing the three-way handshake. This behavior is indicative of which type of attack?

Accepted Answer

SYN flood attack. A SYN flood attack occurs when an attacker sends a high volume of TCP SYN packets to a target but never completes the three-way handshake by sending the final ACK. This leaves the target's connection table half-open, consuming resources and potentially exhausting its ability to accept legitimate connections. The observed behavior—internal server sending many SYN packets without completing the handshake—matches the classic signature of a SYN flood, though typically the attacker spoofs the source IP to avoid response traffic.

Answer

Man-in-the-middle attack

Answer

DDoS amplification attack

Answer

Smurf attack

Question 11

A company's public web server is experiencing a flood of TCP SYN packets from multiple external IP addresses. The server's connection table is full, causing new legitimate connections to be dropped. Which of the following mitigation techniques should be implemented to protect the server while still allowing legitimate traffic?

Accepted Answer

Implement SYN cookies on the server.. SYN cookies allow the server to avoid storing connection state in the TCP backlog until the three-way handshake completes. When the SYN flood fills the connection table, the server encodes the initial sequence number (ISN) with cryptographic information about the connection, enabling it to verify the ACK from a legitimate client without consuming table entries. This technique preserves resources for legitimate traffic while dropping spoofed or incomplete handshakes.

Answer

Increase the server's TCP connection backlog.

Answer

Enable bogon filtering on the perimeter firewall.

Answer

Deploy an intrusion prevention system (IPS) with signature detection.

Question 12

A network engineer is designing a new IPv6 addressing scheme. The company has been assigned a /48 prefix and needs to support up to 250 subnets. Which subnet size should be used to minimize waste while meeting the requirement?

Accepted Answer

/56. A /56 subnet provides 256 subnets (2^(56-48) = 2^8 = 256), which meets the requirement of up to 250 subnets with minimal waste. A /48 prefix is the site-level allocation, and using a /56 subnet mask leaves 8 bits for subnetting, offering exactly the needed capacity without over-allocating address space.

Answer

/52

Answer

/64

Answer

/60

Question 13

A network administrator configures a router to send syslog messages to a central log server. The administrator can ping the server from the router, but the server is not receiving any logs. What is the most likely cause?

Accepted Answer

UDP port 514 is blocked between the router and the server. Syslog messages are sent via UDP port 514 by default. Since the administrator can ping the server (ICMP works), but no logs arrive, the most likely cause is that a firewall or ACL is blocking UDP port 514 between the router and the server. This is a classic connectivity issue where Layer 3 reachability exists but the specific transport-layer port is filtered.

Answer

The syslog server is using the wrong protocol (TCP instead of UDP)

Answer

The syslog service on the server is not running

Answer

The router's clock is not synchronized with the server

Question 14

A network administrator is configuring a monitoring system to collect metrics from network devices. The administrator needs to ensure that the monitoring system can automatically discover the devices and obtain detailed information about their configuration and status, such as interface descriptions and software versions. Which protocol is best suited for this purpose?

Accepted Answer

SNMP. SNMP (Simple Network Management Protocol) is the correct choice because it is specifically designed for network management and monitoring. It allows a management system to automatically discover devices (via SNMP walks or queries to MIBs) and retrieve detailed configuration and status information, such as interface descriptions and software versions, by reading OIDs from the device's MIB. This matches the requirement for automatic discovery and detailed data collection.

Answer

LLDP

Answer

NetFlow

Answer

Syslog

Question 15

Two routers are configured with OSPF in the same area, but they do not form an adjacency. Router A shows OSPF state EXSTART, and Router B shows state EXSTART. Which of the following is the most likely cause?

Accepted Answer

The MTU is mismatched between the two routers. When OSPF routers are stuck in the EXSTART state, it indicates that they have progressed past the 2-Way and ExStart phases but are unable to exchange Database Description (DBD) packets. The most common cause is an MTU mismatch, because OSPF will not proceed to the Exchange state if a DBD packet exceeds the interface MTU of the neighbor. This causes the routers to continuously renegotiate the master/slave relationship without completing the exchange.

Answer

The OSPF Hello and Dead intervals are mismatched

Answer

The OSPF area IDs are different

Answer

The network type is misconfigured (e.g., one side is broadcast, the other is point-to-point)

Question 16

A network engineer configures OSPF on two routers with a primary link (1 Gbps) and a backup link (100 Mbps). The engineer expects traffic to always use the primary link unless it fails, but the router is sending traffic over the backup link. What is the most likely cause?

Accepted Answer

The OSPF cost of the primary link is higher than the backup link.. OSPF determines the best path using cost, which is calculated as (reference bandwidth) / (interface bandwidth). By default, the reference bandwidth is 100 Mbps. For a 1 Gbps link, the cost is 0.1, which is rounded up to 1. For a 100 Mbps link, the cost is exactly 1. This would normally result in equal-cost paths and load balancing, not preferring the backup link. However, if the router is sending traffic over the backup link, it indicates that the primary link has a higher OSPF cost than the backup. This can happen if the bandwidth statement on the primary interface is misconfigured to a value that results in a higher OSPF cost (e.g., set to 50 Mbps, making its cost 2), or if a manual cost is set higher on the primary interface, or lower on the backup interface. Thus, the most likely cause is that the primary link’s OSPF cost is higher than expected, causing the router to prefer the backup link.

Answer

The backup link has a lower OSPF cost than the primary link.

Answer

The reference bandwidth is set to 1 Gbps on the primary router.

Answer

The bandwidth command is misconfigured on the backup interface.

Question 17

A network engineer is troubleshooting intermittent call drops on a VoIP deployment. The network uses separate VLANs for voice (VLAN 20) and data (VLAN 10). Switch ports connecting the IP phones are configured with the correct voice VLAN. Which of the following is the MOST likely cause to check NEXT?

Accepted Answer

Verify that QoS markings and queuing are configured on the switches and routers. Intermittent call drops on a VoIP deployment with separate voice and data VLANs most likely stem from insufficient or misconfigured QoS markings and queuing. Voice traffic is sensitive to latency, jitter, and packet loss, which occur when data traffic competes for bandwidth without proper prioritization. Verifying that switches and routers have consistent QoS policies (e.g., marking with DSCP EF for RTP and queuing with strict priority) is the logical next step after ensuring the voice VLAN is correctly assigned.

Answer

Check the DNS server for the phone's name resolution

Answer

Replace the patch cables from the phones to the switches

Answer

Increase the DHCP lease time for the phones

Question 18

A network administrator scheduled a change window to upgrade the firmware on a core switch. During the upgrade, the switch fails to boot properly. The administrator needs to restore the switch to its previous operational state. Which of the following should the administrator have done before the upgrade to facilitate a successful rollback?

Accepted Answer

Backed up the current configuration and firmware image.. Backing up both the current configuration and the firmware image ensures that the administrator can restore the switch to its exact previous operational state if the upgrade fails. Without a backup of the firmware image, the switch may not have a valid bootable image to revert to, even if the configuration is saved. This is a fundamental prerequisite for any firmware upgrade rollback plan.

Answer

Notified all users of the maintenance window.

Answer

Disconnected all redundant links.

Answer

Set the switch to boot from an alternative image.

Question 19

A network technician is troubleshooting an issue where Server A can ping Server B by IP address, but Server B cannot ping Server A. Both servers are in the same VLAN and subnet, connected to the same switch. The switch ports are configured identically, and there are no ACLs or firewalls between them. Which of the following is the MOST likely cause?

Accepted Answer

Server A's firewall is blocking incoming ICMP. Server A can ping Server B by IP address, meaning ICMP echo requests from Server A reach Server B and echo replies return successfully. However, Server B cannot ping Server A, which indicates that ICMP echo requests from Server B are not reaching Server A or their replies are blocked. Since both servers are in the same VLAN/subnet with no ACLs or firewalls between them, the most likely cause is that Server A's host-based firewall is blocking incoming ICMP (echo requests), preventing Server B's pings from being processed. This is a classic symptom of a one-way firewall rule that permits outbound ICMP but denies inbound ICMP.

Answer

Server B's firewall is blocking outgoing ICMP

Answer

The cable connecting Server A is faulty

Answer

There is a duplex mismatch on Server B's switch port

Question 20

A company is implementing 802.1X port-based authentication on its wired network to control access. The network uses Active Directory for user accounts. Which type of server must be deployed to authenticate clients connecting to the switch ports?

Accepted Answer

A RADIUS server. 802.1X port-based authentication requires a RADIUS server to act as the authentication server that validates client credentials against the identity store (Active Directory). The switch (authenticator) forwards EAP frames from the client (supplicant) to the RADIUS server, which checks the credentials and instructs the switch to grant or deny port access.

Answer

A DNS server

Answer

A DHCP server

Answer

A Kerberos server