N10-009 Network Implementation Practice Test 3 — 15 Questions

Question 1

A network administrator is creating a new VLAN 50 on a switch. After creating the VLAN, the administrator notices that the switch does not send VLAN information to other switches in the network. Which of the following is the most likely reason?

Accepted Answer

VTP mode is set to transparent.. When VTP mode is set to transparent, the switch does not originate or forward VTP advertisements, so VLAN changes made on it are not propagated to other switches. This explains why VLAN 50 was created locally but not shared with the rest of the network.

Answer

The trunk link is not configured.

Answer

The VLAN is not allowed on the trunk.

Answer

STP is blocking the VLAN.

Question 2

A network administrator is implementing a new wireless network that will use WPA2-Enterprise. Which of the following must be configured on the network to support this security method?

Accepted Answer

A RADIUS server. WPA2-Enterprise uses 802.1X authentication, which requires a RADIUS server to centralize authentication, authorization, and accounting (AAA). The RADIUS server validates user credentials (e.g., against Active Directory or LDAP) and distributes the Pairwise Master Key (PMK) to the access point, enabling per-user, per-session encryption keys. Without a RADIUS server, the enterprise authentication framework cannot function.

Answer

A pre-shared key

Answer

A certificate authority

Answer

A VPN concentrator

Question 3

A network administrator is setting up a new branch office that will connect to the main headquarters over the Internet. The connection must be encrypted and allow the branch to access internal resources as if they were directly connected. Which of the following VPN types is BEST suited for this site-to-site connection?

Accepted Answer

IPsec. IPsec is the correct choice because it is specifically designed for site-to-site VPNs, providing encryption and authentication at the IP layer to create a secure tunnel between two networks. This allows the branch office to access internal resources at headquarters as if they were directly connected, using a gateway-to-gateway model that encrypts all traffic between the sites.

Answer

SSL VPN

Answer

PPTP

Answer

L2TP

Question 4

A network administrator is configuring a router-on-a-stick to route between two VLANs (VLAN 10 and VLAN 20). The router has two subinterfaces: GigabitEthernet0/1.10 with encapsulation dot1Q 10 and IP 10.10.10.1/24, and GigabitEthernet0/1.20 with encapsulation dot1Q 20 and IP 10.10.20.1/24. The switch port connected to the router is configured as an access port in VLAN 10. Hosts in VLAN 10 can ping the router's VLAN 10 interface, but hosts in VLAN 20 cannot ping the router's VLAN 20 interface. What is the most likely cause?

Accepted Answer

The switch port connecting to the router should be configured as a trunk.. The router-on-a-stick design requires the switch port connecting to the router to be configured as a trunk port, not an access port. An access port only carries traffic for a single VLAN (VLAN 10 in this case), so frames from VLAN 20 are dropped at the switch port before reaching the router. Configuring the port as a trunk with allowed VLANs 10 and 20 would enable the router's subinterfaces to receive and forward traffic for both VLANs.

Answer

The router subinterface for VLAN 20 is not enabled.

Answer

The hosts in VLAN 20 do not have a default gateway configured.

Answer

The router's VLAN 20 subinterface has an incorrect IP address.

Question 5

A company has deployed a WPA2-Enterprise wireless network. Users report that they cannot authenticate. The RADIUS server logs show that authentication attempts are received but no responses are sent back to the wireless controller. The wireless controller and RADIUS server are on different subnets, separated by a firewall. Which of the following is the MOST likely cause?

Accepted Answer

The firewall is blocking RADIUS traffic on UDP ports 1812 and 1813.. The RADIUS server logs show authentication attempts are received but no responses are sent back, indicating the request reached the server but the reply is being dropped. Since the wireless controller and RADIUS server are on different subnets separated by a firewall, the most likely cause is that the firewall is blocking the return RADIUS traffic. RADIUS uses UDP ports 1812 for authentication and 1813 for accounting, and these must be open in both directions for successful communication.

Answer

The wireless clients do not support the correct EAP method.

Answer

The RADIUS server is not in the same broadcast domain as the wireless controller.

Answer

The SSID is not being broadcast.

Question 6

An organization needs to connect two buildings that are 2 km apart with a point-to-point wireless link. Which antenna type is BEST suited for this long-distance directional connection?

Accepted Answer

Parabolic dish antenna. A parabolic dish antenna is the best choice for a 2 km point-to-point wireless link because it provides a very narrow beamwidth and high gain, focusing the signal in a specific direction to maximize distance and minimize interference. This makes it ideal for long-distance, high-throughput links where precise alignment is possible.

Answer

Omni-directional antenna

Answer

Yagi antenna

Answer

Patch antenna

Question 7

A network engineer is designing a data center network and needs to ensure high availability for the core switches. Which technology allows multiple physical switches to be combined into a single logical switch to simplify management and improve redundancy?

Accepted Answer

Switch stacking. Switch stacking combines multiple physical switches into a single logical unit, sharing a common control plane and management interface. This simplifies configuration and provides redundancy because if one switch in the stack fails, the remaining switches continue forwarding traffic without requiring STP convergence.

Answer

Spanning Tree Protocol (STP)

Answer

EtherChannel

Answer

Virtual Router Redundancy Protocol (VRRP)

Question 8

A technician installs a new wireless access point that requires 25 watts of power using Power over Ethernet (PoE). The existing switch only supports 802.3af (15.4W per port). What is the most likely result?

Accepted Answer

The access point will not power on.. The existing switch supports only 802.3af (PoE), which provides a maximum of 15.4 watts per port. The access point requires 25 watts, which exceeds the 802.3af power budget. Since the switch cannot deliver the required power, the access point will not power on. This is a strict power negotiation failure under IEEE 802.3 standards.

Answer

The access point will power on but may not transmit at full power.

Answer

The switch port will be damaged.

Answer

The access point will power on and function normally.

Question 9

A network architect is designing a Software-Defined Networking (SDN) based network. Which of the following components is responsible for making centralized forwarding decisions and communicating those decisions to the physical switches using southbound APIs?

Accepted Answer

Control layer. In SDN architecture, the control layer (also known as the SDN controller) is the centralized entity responsible for making all forwarding decisions. It communicates these decisions to the physical switches via southbound APIs, such as OpenFlow, which program the flow tables in the data plane. This separation of the control plane from the data plane is the fundamental principle of SDN.

Answer

Application layer

Answer

Data plane

Answer

East-west interfaces

Question 10

A network administrator configures VLAN 10 (Sales) and VLAN 20 (Engineering) on a switch. The switch is connected to a router via a trunk interface for inter-VLAN routing. Users in VLAN 10 can reach the router and external networks, but users in VLAN 20 cannot communicate outside their VLAN. The router's subinterface for VLAN 20 is configured correctly with an IP address and encapsulation dot1Q 20. What is the MOST likely cause of the issue?

Accepted Answer

B: VLAN 20 is not allowed on the trunk. The router's subinterface for VLAN 20 is correctly configured, so the issue lies on the switch side. If VLAN 20 is not explicitly allowed on the trunk interface connecting the switch to the router, frames from VLAN 20 will be dropped by the switch, preventing inter-VLAN routing. The default trunk allowed VLAN list often includes only VLAN 1, so VLAN 20 must be added with the 'switchport trunk allowed vlan add 20' command.

Answer

A: The switchport mode for VLAN 20 is set to access

Answer

C: The router needs to be rebooted to apply the subinterface configuration

Answer

D: The native VLAN on the trunk is misconfigured

Question 11

A network administrator configures a trunk link between two switches. The link is up, but no traffic from any VLAN is passed between the switches. The administrator verifies that the trunk port is configured correctly on both switches with 'switchport mode trunk' and allowed VLANs. Which of the following is the most likely cause?

Accepted Answer

The trunk encapsulation is mismatched. Option D is correct because a trunk link requires both ends to use the same encapsulation protocol—either 802.1Q or ISL. If one switch is set to 'switchport trunk encapsulation dot1q' and the other uses 'isl' (or auto-negotiates to a different type), the frames will be dropped or misinterpreted, preventing any VLAN traffic from passing. The administrator verified 'switchport mode trunk' and allowed VLANs, but encapsulation mismatch is a common oversight that stops all VLAN traffic while keeping the link up.

Answer

The native VLAN is different on each switch

Answer

VLAN 1 has been deleted on one of the switches

Answer

Spanning Tree Protocol is blocking the trunk link

Question 12

A network engineer is implementing OSPF on a router. All directly connected neighbors are listed with state FULL, but routes from another area are not appearing in the routing table. Which of the following is the most likely cause?

Accepted Answer

The router has an ACL blocking inbound OSPF updates. Option B is correct because an ACL applied to the OSPF process or interface can filter inbound Type 3 LSAs (summary LSAs) from other areas. Even though neighbor adjacencies reach FULL state, the router will not install those inter-area routes into the routing table if the ACL blocks the LSA updates. This explains why directly connected neighbors are fine but routes from another area are missing.

Answer

The router is not configured with a router ID

Answer

The router is configured as an ABR but does not have a virtual-link configured

Answer

The link-state database is corrupted

Question 13

A network administrator is configuring Quality of Service (QoS) on a router to prioritize voice traffic. Which of the following fields should be used to mark packets for classification and prioritization?

Accepted Answer

DSCP. DSCP (Differentiated Services Code Point) is the correct field because it is a 6-bit value in the IP header used to mark packets for QoS classification and prioritization, as defined in RFC 2474. Voice traffic typically uses DSCP EF (Expedited Forwarding, value 46) to ensure low latency and jitter, making it the standard choice for QoS marking on routers.

Answer

Source IP address

Answer

Source port number

Answer

MAC address

Question 14

A network administrator is designing a Layer 2 network with redundant links between switches. Which protocol should be implemented to prevent loops in the network?

Accepted Answer

STP (Spanning Tree Protocol). STP (Spanning Tree Protocol) is the correct choice because it is specifically designed to prevent Layer 2 loops in networks with redundant links. It achieves this by placing redundant switch ports into a blocking state, creating a loop-free logical topology while maintaining physical redundancy for failover.

Answer

OSPF (Open Shortest Path First)

Answer

VRRP (Virtual Router Redundancy Protocol)

Answer

LACP (Link Aggregation Control Protocol)

Question 15

A network architect is implementing a Software-Defined Networking (SDN) solution. The SDN controller needs to communicate with the physical switches to install flow rules. Which type of API is used for this communication?

Accepted Answer

Southbound API. The Southbound API is the correct interface because it enables the SDN controller to communicate with the underlying physical or virtual network devices (switches, routers) to install flow rules, modify forwarding tables, and gather telemetry. This API typically uses protocols such as OpenFlow, NETCONF, or OVSDB to translate controller decisions into device-level actions, making it the essential southbound channel in an SDN architecture.

Answer

Northbound API

Answer

Eastbound API

Answer

Westbound API