N10-009 Network Implementation Practice Test 3 — 15 Questions

Question 1

An organization uses OSPF as its interior gateway protocol in a multi-area design. After a core router failure, the network takes several seconds to reconverge. Which technology can be implemented to improve convergence speed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure BFD (Bidirectional Forwarding Detection). BFD provides sub-second failure detection times (as low as 50 ms) independent of the routing protocol, allowing OSPF to reconverge much faster than relying on its default dead timer intervals. By detecting link failures in milliseconds, BFD triggers OSPF to immediately recalculate routes, drastically reducing the convergence delay after a core router failure.

Answer

Implement LSA throttling

Answer

Enable OSPF fast hello timers

Answer

Convert all areas to stub areas

Question 2

A network administrator is configuring a new switch for management access via SSH. Which step must be performed FIRST?

Accepted Answer

Configure an IP address on the management VLAN.. Before SSH can function, the switch must have an IP address assigned to the management VLAN (typically VLAN 1 or a dedicated management VLAN) so that the switch is reachable over the network. Without this IP configuration, the switch cannot establish the TCP/IP connectivity required for SSH sessions, making it the foundational step that must be performed first.

Answer

Generate RSA key pair.

Answer

Configure a VTY password.

Answer

Enable SSH version 2.

Question 3

A switch port is configured as a trunk with native VLAN 99. When a frame tagged with VLAN 99 is received on the trunk, the switch displays an error. What is the most likely issue?

Accepted Answer

The remote switch is tagging frames on the native VLAN. The native VLAN is the VLAN that carries untagged traffic on an 802.1Q trunk. By design, frames belonging to the native VLAN should be sent untagged. When a switch receives a frame tagged with the native VLAN ID (VLAN 99), it indicates a mismatch in native VLAN configuration between the two ends of the trunk. The switch logs an error because it expects native VLAN frames to be untagged, but the remote switch is incorrectly tagging them.

Answer

The trunk is using 802.1Q encapsulation and the remote switch expects ISL

Answer

The remote switch is sending frames on VLAN 99 as untagged

Answer

The allowed VLAN list does not include VLAN 99

Question 4

A company wants to deploy a wireless network for employee devices using the highest security standard. The network will use a RADIUS server for authentication. Which authentication method should be configured?

Accepted Answer

802.1X/EAP. B is correct because 802.1X/EAP is the only option that provides enterprise-grade authentication using a RADIUS server. It requires each user to present unique credentials (e.g., username/password or certificate), which are verified by the RADIUS server before granting network access. This meets the requirement for the highest security standard in a corporate environment.

Answer

WPA3-SAE

Answer

WPA2-PSK

Answer

WEP with RADIUS

Question 5

A network administrator is configuring a new WAN link between two offices using MPLS. Which of the following is a characteristic of MPLS?

Accepted Answer

It uses label switching to forward packets. MPLS (Multiprotocol Label Switching) operates by attaching short, fixed-length labels to packets at the ingress router. These labels are used by intermediate routers (LSRs) to make forwarding decisions based on the label rather than the IP header, which enables faster switching and traffic engineering. This label-swapping mechanism is the defining characteristic of MPLS, distinguishing it from traditional IP routing.

Answer

It requires a dedicated point-to-point circuit

Answer

It operates at Layer 7 of the OSI model

Answer

It encrypts all data in transit

Question 6

A company is deploying a new wireless network for employee devices and wants to use the most secure encryption method currently available for WPA2/3. Which encryption standard should be used?

Accepted Answer

AES. AES (Advanced Encryption Standard) is the most secure encryption method available for WPA2 and WPA3. WPA2 mandates AES-CCMP, and WPA3 uses AES-GCMP, both of which are based on the AES block cipher, providing strong confidentiality and integrity. This makes AES the correct choice for the highest security in modern Wi-Fi deployments.

Answer

WEP

Answer

TKIP

Answer

DES

Question 7

A network administrator is creating a new VLAN 50 on a switch. After creating the VLAN, the administrator notices that the switch does not send VLAN information to other switches in the network. Which of the following is the most likely reason?

Accepted Answer

VTP mode is set to transparent.. When VTP mode is set to transparent, the switch does not originate or forward VTP advertisements, so VLAN changes made on it are not propagated to other switches. This explains why VLAN 50 was created locally but not shared with the rest of the network.

Answer

The trunk link is not configured.

Answer

The VLAN is not allowed on the trunk.

Answer

STP is blocking the VLAN.

Question 8

A network administrator is implementing a new wireless network that will use WPA2-Enterprise. Which of the following must be configured on the network to support this security method?

Accepted Answer

A RADIUS server. WPA2-Enterprise uses 802.1X authentication, which requires a RADIUS server to centralize authentication, authorization, and accounting (AAA). The RADIUS server validates user credentials (e.g., against Active Directory or LDAP) and distributes the Pairwise Master Key (PMK) to the access point, enabling per-user, per-session encryption keys. Without a RADIUS server, the enterprise authentication framework cannot function.

Answer

A pre-shared key

Answer

A certificate authority

Answer

A VPN concentrator

Question 9

A network administrator is setting up a new branch office that will connect to the main headquarters over the Internet. The connection must be encrypted and allow the branch to access internal resources as if they were directly connected. Which of the following VPN types is BEST suited for this site-to-site connection?

Accepted Answer

IPsec. IPsec is the correct choice because it is specifically designed for site-to-site VPNs, providing encryption and authentication at the IP layer to create a secure tunnel between two networks. This allows the branch office to access internal resources at headquarters as if they were directly connected, using a gateway-to-gateway model that encrypts all traffic between the sites.

Answer

SSL VPN

Answer

PPTP

Answer

L2TP

Question 10

A network administrator is configuring a router-on-a-stick to route between two VLANs (VLAN 10 and VLAN 20). The router has two subinterfaces: GigabitEthernet0/1.10 with encapsulation dot1Q 10 and IP 10.10.10.1/24, and GigabitEthernet0/1.20 with encapsulation dot1Q 20 and IP 10.10.20.1/24. The switch port connected to the router is configured as an access port in VLAN 10. Hosts in VLAN 10 can ping the router's VLAN 10 interface, but hosts in VLAN 20 cannot ping the router's VLAN 20 interface. What is the most likely cause?

Accepted Answer

The switch port connecting to the router should be configured as a trunk.. The router-on-a-stick design requires the switch port connecting to the router to be configured as a trunk port, not an access port. An access port only carries traffic for a single VLAN (VLAN 10 in this case), so frames from VLAN 20 are dropped at the switch port before reaching the router. Configuring the port as a trunk with allowed VLANs 10 and 20 would enable the router's subinterfaces to receive and forward traffic for both VLANs.

Answer

The router subinterface for VLAN 20 is not enabled.

Answer

The hosts in VLAN 20 do not have a default gateway configured.

Answer

The router's VLAN 20 subinterface has an incorrect IP address.

Question 11

A company has deployed a WPA2-Enterprise wireless network. Users report that they cannot authenticate. The RADIUS server logs show that authentication attempts are received but no responses are sent back to the wireless controller. The wireless controller and RADIUS server are on different subnets, separated by a firewall. Which of the following is the MOST likely cause?

Accepted Answer

The firewall is blocking RADIUS traffic on UDP ports 1812 and 1813.. The RADIUS server logs show authentication attempts are received but no responses are sent back, indicating the request reached the server but the reply is being dropped. Since the wireless controller and RADIUS server are on different subnets separated by a firewall, the most likely cause is that the firewall is blocking the return RADIUS traffic. RADIUS uses UDP ports 1812 for authentication and 1813 for accounting, and these must be open in both directions for successful communication.

Answer

The wireless clients do not support the correct EAP method.

Answer

The RADIUS server is not in the same broadcast domain as the wireless controller.

Answer

The SSID is not being broadcast.

Question 12

An organization needs to connect two buildings that are 2 km apart with a point-to-point wireless link. Which antenna type is BEST suited for this long-distance directional connection?

Accepted Answer

Parabolic dish antenna. A parabolic dish antenna is the best choice for a 2 km point-to-point wireless link because it provides a very narrow beamwidth and high gain, focusing the signal in a specific direction to maximize distance and minimize interference. This makes it ideal for long-distance, high-throughput links where precise alignment is possible.

Answer

Omni-directional antenna

Answer

Yagi antenna

Answer

Patch antenna

Question 13

A network engineer is designing a data center network and needs to ensure high availability for the core switches. Which technology allows multiple physical switches to be combined into a single logical switch to simplify management and improve redundancy?

Accepted Answer

Switch stacking. Switch stacking combines multiple physical switches into a single logical unit, sharing a common control plane and management interface. This simplifies configuration and provides redundancy because if one switch in the stack fails, the remaining switches continue forwarding traffic without requiring STP convergence.

Answer

Spanning Tree Protocol (STP)

Answer

EtherChannel

Answer

Virtual Router Redundancy Protocol (VRRP)

Question 14

A technician installs a new wireless access point that requires 25 watts of power using Power over Ethernet (PoE). The existing switch only supports 802.3af (15.4W per port). What is the most likely result?

Accepted Answer

The access point will not power on.. The existing switch supports only 802.3af (PoE), which provides a maximum of 15.4 watts per port. The access point requires 25 watts, which exceeds the 802.3af power budget. Since the switch cannot deliver the required power, the access point will not power on. This is a strict power negotiation failure under IEEE 802.3 standards.

Answer

The access point will power on but may not transmit at full power.

Answer

The switch port will be damaged.

Answer

The access point will power on and function normally.

Question 15

A network architect is designing a Software-Defined Networking (SDN) based network. Which of the following components is responsible for making centralized forwarding decisions and communicating those decisions to the physical switches using southbound APIs?

Accepted Answer

Control layer. In SDN architecture, the control layer (also known as the SDN controller) is the centralized entity responsible for making all forwarding decisions. It communicates these decisions to the physical switches via southbound APIs, such as OpenFlow, which program the flow tables in the data plane. This separation of the control plane from the data plane is the fundamental principle of SDN.

Answer

Application layer

Answer

Data plane

Answer

East-west interfaces