N10-009 Network Implementation — 20 Questions

Question 1

A network engineer has established an IPsec VPN tunnel between a branch office (10.0.0.0/24) and the main office (192.168.10.0/24). The tunnel shows as up and active, but users at the branch office cannot ping the main office server at 192.168.10.10. The main office can ping the branch office gateway successfully. What is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incorrect static route on the branch router for the 192.168.10.0/24 network. The tunnel is up and active, and the main office can ping the branch office gateway, which confirms that Phase 1 and Phase 2 of IPsec are correctly negotiated and that the tunnel is passing traffic from the main office toward the branch. However, branch users cannot reach 192.168.10.10, indicating that return traffic from the branch is not being routed into the tunnel. The most likely cause is that the branch router lacks a static route for 192.168.10.0/24 pointing to the tunnel interface (or the IPsec virtual interface), so packets from the branch destined for the main office are sent out the wrong interface or dropped instead of being encrypted and forwarded through the VPN.

Answer

Mismatched encryption algorithms between the two VPN peers

Answer

Firewall on the main office server blocking ICMP

Answer

Incorrect IKE authentication settings

Question 2

A network administrator connects a new access switch to the core switch via a trunk port. Both switches have the same VLAN database, and the trunk is configured to allow all VLANs. However, hosts on VLAN 10 connected to the new access switch cannot communicate with hosts on VLAN 10 on the core switch. The administrator verifies that the access ports for VLAN 10 are correctly configured and that the trunk link status is up/up. Which of the following is the most likely cause?

Accepted Answer

The native VLAN on the trunk port is different on the two switches.. When the native VLAN (typically VLAN 1 by default) is mismatched on a trunk link, the switches will not properly tag frames for that VLAN. Since VLAN 10 is not the native VLAN, a native VLAN mismatch does not directly block VLAN 10 traffic; however, the scenario states that both switches have the same VLAN database and the trunk allows all VLANs, so the most likely cause is a native VLAN mismatch that can cause control plane issues or miscommunication. In practice, a native VLAN mismatch can lead to VLAN 10 hosts being unable to communicate because the switches may place the native VLAN frames into different VLANs, disrupting Layer 2 connectivity for all VLANs including VLAN 10.

Answer

The trunk port is in an err-disabled state.

Answer

The switchport mode is not set to trunk on one side.

Answer

The spanning-tree protocol is blocking VLAN 10 on the trunk.

Question 3

A network administrator is configuring a trunk port between two switches. Both switches have been set with native VLAN 99. However, traffic from some VLANs is not passing over the trunk. What should the administrator verify?

Accepted Answer

The allowed VLAN list on the trunk port.. The trunk port's allowed VLAN list explicitly controls which VLANs are permitted to traverse the link. Even when both switches agree on the native VLAN (99), if a particular VLAN is not included in the allowed list on either side, its traffic will be dropped. This is a common misconfiguration that prevents specific VLAN traffic from passing over the trunk.

Answer

The VLAN memberships on the access ports are correct.

Answer

The speed and duplex settings are identical.

Answer

The spanning tree protocol is disabled.

Question 4

A network administrator configures VLAN 10 (Sales) and VLAN 20 (Engineering) on a switch. The switch is connected to a router via a trunk interface for inter-VLAN routing. Users in VLAN 10 can reach the router and external networks, but users in VLAN 20 cannot communicate outside their VLAN. The router's subinterface for VLAN 20 is configured correctly with an IP address and encapsulation dot1Q 20. What is the MOST likely cause of the issue?

Accepted Answer

B: VLAN 20 is not allowed on the trunk. The router's subinterface for VLAN 20 is correctly configured, so the issue lies on the switch side. If VLAN 20 is not explicitly allowed on the trunk interface connecting the switch to the router, frames from VLAN 20 will be dropped by the switch, preventing inter-VLAN routing. The default trunk allowed VLAN list often includes only VLAN 1, so VLAN 20 must be explicitly added to the list of VLANs permitted on the trunk interface.

Answer

A: The switchport mode for VLAN 20 is set to access

Answer

C: The router needs to be rebooted to apply the subinterface configuration

Answer

D: The native VLAN on the trunk is misconfigured

Question 5

A network administrator configures a trunk link between two switches. The link is up, but no traffic from any VLAN is passed between the switches. The administrator verifies that the trunk port is configured correctly on both switches with 'switchport mode trunk' and allowed VLANs. Which of the following is the most likely cause?

Accepted Answer

The trunk encapsulation is mismatched. A trunk link requires both ends to use the same encapsulation protocol, most commonly 802.1Q. If the encapsulation protocol configured on one switch does not match the protocol on the other switch (e.g., one uses 802.1Q and the other uses a different or proprietary encapsulation, or they fail to negotiate a common one), the frames will be dropped or misinterpreted. This prevents any VLAN traffic from passing, even if the link is up and the ports are configured for trunking mode and allowed VLANs. Mismatched encapsulation is a common oversight that stops all VLAN traffic while keeping the link up.

Answer

The native VLAN is different on each switch

Answer

VLAN 1 has been deleted on one of the switches

Answer

Spanning Tree Protocol is blocking the trunk link

Question 6

A network engineer is implementing VLANs for a company. The finance department's workstations are connected to switch ports configured as access ports in VLAN 20. The finance server is located in a different building and is connected to a second switch. The two switches are interconnected via a trunk link. What must be configured on the trunk link to allow finance workstations to communicate with the finance server?

Accepted Answer

Allow VLAN 20 on the trunk. A trunk link is designed to carry traffic for multiple VLANs between switches. For traffic belonging to a specific VLAN (like VLAN 20 in this case) to successfully traverse the trunk, that VLAN must be explicitly permitted or included in the list of allowed VLANs on the trunk link configuration on both switches. If VLAN 20 is not in the allowed list, its tagged frames will be dropped, preventing communication.

Answer

Set the native VLAN to 20 on both switches

Answer

Configure the trunk port as an access port in VLAN 20

Answer

Enable VLAN pruning for all VLANs on the trunk

Question 7

An organization wants to deploy Wi-Fi in a large, open office space. They need high throughput and the ability to support many simultaneous clients, but they are budget-constrained. Which IEEE wireless standard should they choose?

Accepted Answer

802.11ac (Wi-Fi 5). 802.11ac (Wi-Fi 5) is the best choice for this scenario because it offers high throughput (up to 1.3 Gbps in the 5 GHz band) and supports MU-MIMO (downlink) for handling multiple clients simultaneously, all at a lower cost than 802.11ax (Wi-Fi 6). Since the organization is budget-constrained, 802.11ac provides a good balance of performance and affordability for a dense open office environment.

Answer

802.11ax (Wi-Fi 6)

Answer

802.11n (Wi-Fi 4)

Answer

802.11b (Wi-Fi 1)

Question 8

A network technician needs to configure a trunk link between two switches so that only VLANs 10, 20, and 30 are allowed to traverse it. Which configuration approach will accomplish this?

Accepted Answer

Restrict the trunk to VLANs 10, 20, and 30 only.. To restrict which VLANs can traverse a trunk link, configure the list of allowed VLANs on the trunk port. By permitting only VLANs 10, 20, and 30, all other VLANs are pruned from the trunk. This is the standard method for limiting VLAN traffic on an IEEE 802.1Q trunk, regardless of vendor.

Answer

Set the port to trunk mode.

Answer

Assign the default native VLAN to the trunk.

Answer

Enable 802.1Q encapsulation on the link.

Question 9

A network administrator is configuring an IEEE 802.1Q trunk between two switches. Which of the following must match on both ends for the trunk to function correctly?

Accepted Answer

The native VLAN ID. For an IEEE 802.1Q trunk to function correctly, the native VLAN ID must match on both ends. The native VLAN is the VLAN that carries untagged traffic across the trunk; if the IDs differ, frames from one switch's native VLAN will be placed into a different VLAN on the other switch, causing traffic misrouting and potential layer 2 loops. This is a fundamental requirement of the 802.1Q standard, and mismatched native VLANs are a common source of trunk failures.

Answer

The trunk port speed and duplex

Answer

The encapsulation type

Answer

The allowed VLAN list

Question 10

A network engineer is configuring a trunk link between two switches to carry VLANs 10, 20, and 30. On Switch A, the port is configured with 'switchport mode trunk' and 'switchport nonegotiate'. On Switch B, the port is left at the default configuration. Which additional configuration is required on Switch B?

Accepted Answer

Manually set the port to trunk mode.. Switch B is left at default configuration, which on most Cisco switches means the port is in dynamic desirable or dynamic auto mode, relying on DTP to negotiate trunking. Since Switch A has 'switchport nonegotiate' configured, it will not send DTP frames, so Switch B will never receive a negotiation trigger and will remain in access mode. Therefore, the port on Switch B must be manually set to trunk mode with 'switchport mode trunk' to establish the trunk link.

Answer

Set the native VLAN to 1.

Answer

Enable DTP on Switch B.

Answer

Configure the allowed VLAN list.

Question 11

A network engineer needs to segment a single physical switch into multiple broadcast domains to improve security and reduce traffic. Which technology should be implemented?

Accepted Answer

Virtual LAN (VLAN). A VLAN (Virtual LAN) segments a physical switch into multiple isolated broadcast domains at Layer 2. By assigning ports to different VLANs, broadcast traffic is confined to each VLAN, improving security and reducing unnecessary traffic. This directly meets the requirement without requiring additional hardware.

Answer

Spanning Tree Protocol (STP)

Answer

VLAN Trunking Protocol (VTP)

Answer

Access Control List (ACL)

Question 12

A router receives a packet destined for 10.0.0.15. It has the following routes in the routing table: 10.0.0.0/8 via 192.168.1.1, 10.0.0.0/16 via 192.168.2.1, 0.0.0.0/0 via 192.168.3.1. Which route will be used?

Accepted Answer

10.0.0.0/16 via 192.168.2.1. The router will use the route 10.0.0.0/16 via 192.168.2.1 because it has the longest prefix match (16 bits) for the destination 10.0.0.15. The /16 route is more specific than the /8 route and the default route, so it is preferred regardless of administrative distance or metric.

Answer

Default route (0.0.0.0/0)

Answer

10.0.0.0/8 via 192.168.1.1

Answer

None; the packet is dropped

Question 13

A company has just installed a new fiber optic connection between two buildings 2 km apart. The connection is using multimode fiber. However, the signal is too weak at the receiving end. What is the most likely cause?

Accepted Answer

Attenuation due to distance. Multimode fiber (MMF) is designed for shorter distances, typically up to 550 meters for 10 Gbps (OM3/OM4) and up to 2 km only for lower speeds like 100 Mbps or 1 Gbps using older OM1/OM2 fiber. At 2 km, the signal attenuation exceeds the power budget of the MMF link, causing a weak signal at the receiver. Single-mode fiber (SMF) would be required for reliable transmission over this distance.

Answer

Electromagnetic interference

Answer

Incorrect termination

Answer

Crosstalk

Question 14

A small office uses a wireless router that provides both wired and wireless connectivity. The router's LAN IP is 192.168.1.1. A new printer with a static IP of 192.168.1.50 cannot be reached from a laptop obtaining an IP via DHCP. The laptop's IP is 192.168.1.100. Which of the following is the most likely cause?

Accepted Answer

The subnet mask is incorrect. The laptop obtains an IP address via DHCP, which typically assigns a subnet mask of 255.255.255.0 for a /24 network. If the printer has a static IP of 192.168.1.50 but is configured with an incorrect subnet mask (e.g., 255.255.255.252), the printer may believe it is on a different subnet than the laptop (192.168.1.100). This prevents the laptop from reaching the printer because the printer will not respond to ARP requests or will send traffic to its default gateway instead of directly to the laptop.

Answer

The printer is on a different VLAN

Answer

The default gateway is misconfigured

Answer

The DHCP scope is exhausted

Question 15

A network administrator adds a new server to VLAN 20. The switch port is configured as an access port in VLAN 20, and the server has a correct static IP address in that subnet. However, the server cannot communicate with other devices in the same VLAN. The VLAN exists on the switch and other devices in VLAN 20 are working. What is the most likely cause of this issue?

Accepted Answer

The switch port is configured as a trunk port instead of an access port. The scenario states the switch port is configured as an access port in VLAN 20, but the server cannot communicate with other devices in the same VLAN. If the port were actually configured as a trunk port, it would expect frames to be tagged with a VLAN ID. An untagged frame from the server would be placed into the native VLAN (typically VLAN 1), not VLAN 20, causing a mismatch. This explains why the server, despite having a correct static IP in VLAN 20's subnet, cannot reach other devices in VLAN 20.

Answer

VLAN 20 is not allowed on the trunk to the router

Answer

The server does not have a default gateway configured

Answer

The port is administratively down

Question 16

A network administrator has just connected a new access switch to the core switch via a trunk port. The administrator configured the trunk port on both switches with the same allowed VLAN list. However, hosts on VLAN 10 connected to the new access switch cannot communicate with hosts on VLAN 10 on the core switch. The trunk is operational and shows up/up. What is the most likely cause?

Accepted Answer

A) VLAN 10 has not been created on the new access switch. The most likely cause is that VLAN 10 has not been created on the new access switch. Even though the trunk port is up/up and the allowed VLAN list matches, a switch will not forward traffic for a VLAN that does not exist in its local VLAN database. Without the VLAN being created, the switch drops all frames tagged with VLAN 10, preventing communication between hosts on that VLAN across the trunk.

Answer

B) Native VLAN mismatch on the trunk

Answer

C) Trunk encapsulation mismatch (ISL vs 802.1Q)

Answer

D) STP is blocking the VLAN 10 traffic on the trunk

Question 17

A company is deploying a new wireless network in a warehouse. The network administrator needs to ensure that clients can seamlessly roam between access points without losing connectivity. Which of the following should be configured?

Accepted Answer

A) Same SSID and security settings on all APs. Configuring the same SSID and security settings on all access points (APs) is essential for seamless roaming because clients use the SSID to identify the network and the security credentials to authenticate. When a client moves between APs, it can re-associate without needing to re-authenticate or discover a new network, provided the SSID and security parameters (e.g., PSK or 802.1X configuration) are identical. This ensures a smooth handoff and maintains connectivity during roaming.

Answer

B) Different channels per AP to reduce interference

Answer

C) WPA2-Enterprise with RADIUS authentication

Answer

D) Mesh topology for AP interconnection

Question 18

A company is setting up a new branch office and needs to connect it to the main office over the internet using a secure VPN. The branch office has a dynamic public IP address. Which type of VPN should be configured?

Accepted Answer

Dynamic Multipoint VPN (DMVPN). C is correct because Dynamic Multipoint VPN (DMVPN) is designed to handle sites with dynamic public IP addresses, such as a branch office with a dynamically assigned IP. DMVPN uses mGRE (multipoint Generic Routing Encapsulation) and NHRP (Next Hop Resolution Protocol) to dynamically establish tunnels between spoke routers without requiring static IP configurations on each spoke, making it ideal for this scenario.

Answer

Site-to-site IPsec VPN with static IPs

Answer

Remote access VPN using SSL

Answer

Policy-based VPN

Question 19

A company is implementing a wireless network and needs to support high-density client environments with minimal interference. Which IEEE 802.11 standard operates in the 5 GHz band and provides the highest throughput among the options?

Accepted Answer

802.11ac. 802.11ac (Wi-Fi 5) operates exclusively in the 5 GHz band and supports up to 8 spatial streams, 256-QAM modulation, and channel bonding up to 160 MHz, yielding theoretical throughput exceeding 6.9 Gbps. This makes it the highest-throughput option among the listed standards for high-density environments with minimal interference, as the 5 GHz band offers more non-overlapping channels and less co-channel contention than 2.4 GHz.

Answer

802.11n

Answer

802.11g

Answer

802.11b

Question 20

A company is deploying a wireless network that must support both 2.4 GHz and 5 GHz frequency bands. Which IEEE 802.11 standard supports both bands and is backward compatible with older devices?

Accepted Answer

C) 802.11n. 802.11n (Wi-Fi 4) is the correct answer because it was the first standard to natively support both 2.4 GHz and 5 GHz bands simultaneously, using MIMO (Multiple Input Multiple Output) technology. It also maintains backward compatibility with older 802.11a/b/g devices through mandatory support for legacy modulation schemes (DSSS/CCK for 2.4 GHz and OFDM for 5 GHz).

Answer

A) 802.11b

Answer

B) 802.11g

Answer

D) 802.11ac