N10-009 Network Operations — 20 Questions

Question 1

A network administrator needs to upgrade the firmware on a critical core router. The admin has downloaded the new firmware and verified its checksum. Which of the following should the admin do before proceeding with the installation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Back up the current router configuration. Before upgrading firmware on a critical core router, backing up the current configuration ensures that if the upgrade fails or causes unexpected behavior, the original operational state can be restored quickly. This is a standard best practice in network operations to minimize downtime and avoid manual reconfiguration of complex routing protocols, ACLs, and interface settings.

Answer

Change the management IP address

Answer

Disable all physical interfaces

Answer

Remove the old firmware image

Question 2

A network engineer plans to change the routing protocol configuration on a core router that will affect connectivity to all branches. According to change management best practices, which step should the engineer perform BEFORE implementing the change?

Accepted Answer

Create a backout plan to revert the change if necessary. Creating a backout plan is a critical step in change management because it provides a documented procedure to revert the router to its previous operational state if the new routing protocol configuration causes connectivity loss or instability. Without a backout plan, the engineer risks prolonged outages across all branches while troubleshooting or attempting to reconstruct the original configuration from memory or incomplete logs. This aligns with ITIL change management best practices, which prioritize risk mitigation and service continuity.

Answer

Notify all branch users of the upcoming change

Answer

Document the current router configuration

Answer

Schedule the change during a maintenance window

Question 3

A network administrator needs to update the firmware on a critical core switch. According to change management best practices, which step should be completed FIRST?

Accepted Answer

Test the firmware update in a lab environment. Before any change is applied to a production network device, the firmware update must first be validated in a controlled lab environment that mirrors the production configuration. This step ensures that the new firmware does not introduce compatibility issues with existing protocols (e.g., spanning-tree, VLAN configurations, or routing protocols like OSPF) and that the update process itself does not cause unexpected behavior. Skipping lab validation risks an outage that could have been prevented, making it the foundational step in change management.

Answer

Notify all users of a scheduled outage

Answer

Create a detailed rollback plan

Answer

Schedule the update during a maintenance window

Question 4

A network administrator is about to implement a QoS policy on a core router. According to change management best practices, which step should the administrator perform FIRST to ensure the policy can be reverted if it causes unexpected issues?

Accepted Answer

Back up the current configuration to an external TFTP or SCP server.. Under change management best practices, the first step before implementing any critical change is to create a reliable backup of the current configuration to an external server (e.g., TFTP, SCP, FTP). This provides the most robust form of reversibility, ensuring that if the QoS policy causes unexpected issues, the administrator can restore the original configuration exactly as it was, even in scenarios like router failure, internal configuration corruption, or accidental overwrites of the startup configuration. While saving the current running configuration to startup configuration (Option A) *before* making changes can provide a rollback point via reboot, it is less resilient than an external backup and does not protect against all failure modes, making it a less comprehensive 'first step' for ensuring reversibility according to best practices.

Answer

Save the running configuration to the startup configuration.

Answer

Test the QoS policy in a lab environment.

Answer

Schedule a maintenance window and notify the help desk.

Question 5

What is the default administrative distance for OSPF routes?

Accepted Answer

110. The default administrative distance for OSPF routes on a Cisco router is 110. Administrative distance is a trustworthiness metric used to select the best route when multiple routing protocols provide a route to the same destination; a lower value is preferred. OSPF's default AD of 110 is higher than that of static routes (1) and EIGRP (90/170), but lower than RIP (120) and IS-IS (115).

Answer

90

Answer

100

Answer

120

Question 6

A network administrator is configuring a new switch and needs to ensure that log messages are sent to a remote syslog server with a severity level of 'warning' (4) or higher. Which severity level should be set as the trap level on the switch?

Accepted Answer

4 (warning). Setting the trap level to 4 (warning) on a switch ensures that syslog messages with a severity of warning (4) and higher priority (i.e., emergency, alert, critical, error, and warning) are forwarded to the remote syslog server. The severity levels are defined in RFC 5424, where lower numbers indicate higher priority, so setting the trap level to 4 includes all messages from 0 through 4.

Answer

3 (error)

Answer

5 (notice)

Answer

7 (debug)

Question 7

A network engineer needs to update the firmware on dozens of access points located across multiple office floors. The APs are managed by a central wireless controller. Which protocol should the controller use to transfer the firmware file to each AP?

Accepted Answer

TFTP. TFTP (Trivial File Transfer Protocol). Wireless LAN controllers (WLCs) use TFTP to push firmware images to lightweight access points (APs) because TFTP is lightweight, connectionless, and requires minimal memory and processing overhead on the AP. This makes it ideal for the simple, one-way file transfer of a firmware binary during the AP boot or upgrade process, where the AP acts as a TFTP client and the controller as the server.

Answer

FTP

Answer

HTTP

Answer

SNMP

Question 8

A network administrator needs to generate a report of all MAC addresses learned on each switch port to assist with inventory management. Which switch feature should be examined?

Accepted Answer

MAC address table. A switch maintains a MAC address table (CAM table) that dynamically records source MAC addresses and the ports on which they were learned. This is the correct source for per-port MAC address inventory. The running configuration contains static settings, not learned addresses. IP interface configuration shows Layer 3 addressing, not MAC-to-port mappings. VLAN configuration shows VLAN memberships, not learned MAC addresses.

Answer

Running configuration

Answer

IP interface configuration

Answer

VLAN configuration

Question 9

A network administrator wants to evaluate the current bandwidth utilization on a core switch to determine if an upgrade is needed. The administrator needs to understand typical usage patterns. Which of the following should the administrator perform first?

Accepted Answer

Collect performance data over a period of time.. To evaluate bandwidth utilization and determine if an upgrade is needed, the administrator must first establish a baseline of typical usage patterns. This is done by collecting performance data over a period of time (e.g., using SNMP to poll interface counters or NetFlow/sFlow to capture traffic flows) to identify peak loads, average utilization, and trends. Without this historical data, any decision to upgrade or implement QoS would be based on guesswork rather than evidence.

Answer

Implement QoS policies to prioritize traffic.

Answer

Upgrade the switch to a higher capacity model.

Answer

Enable SNMP traps for link down events.

Question 10

Drag and drop the steps to install a new network cable and terminate it with an RJ45 connector (T568B standard) into the correct order.

Accepted Answer

Strip the cable jacket, Untwist and arrange wires in T568B order, Trim wires to length, Insert wires into RJ45 connector, Crimp the connector, Test the cable. The correct order for terminating an RJ45 connector with T568B wiring is: strip the cable jacket, untwist and arrange wires in the T568B order (white-orange, orange, white-green, blue, white-blue, green, white-brown, brown), trim the wires to an even length, insert them into the RJ45 connector, crimp the connector, and test for continuity. Common mistakes include trimming before arranging, or inserting before trimming.

Answer

Strip the cable jacket, Trim wires to length, Untwist and arrange wires in T568B order, Insert wires into RJ45 connector, Crimp the connector, Test the cable

Answer

Strip the cable jacket, Untwist and arrange wires in T568B order, Insert wires into RJ45 connector, Trim wires to length, Crimp the connector, Test the cable

Answer

Untwist and arrange wires in T568B order, Strip the cable jacket, Trim wires to length, Insert wires into RJ45 connector, Crimp the connector, Test the cable

Question 11

Select all statements that correctly match each network command to its primary function.

Accepted Answer

ping: Tests connectivity to a remote host.. Correct matches: ping verifies connectivity, traceroute maps the network path, nslookup resolves DNS names, ipconfig shows network configuration. Common confusions include confusing ping with nslookup or traceroute with ping.

Answer

ping: Resolves domain names to IP addresses.

Answer

traceroute: Tests connectivity by sending ICMP echo requests.

Question 12

A network operations center uses SNMP to monitor device health. An administrator needs to retrieve the current CPU utilization from a router. Which SNMP operation is most appropriate?

Accepted Answer

GET. The SNMP GET operation is used by an NMS (Network Management System) to actively request a specific variable from a managed device, such as the current CPU utilization from a router's OID. This is a poll-based retrieval, making it the correct choice for an administrator who needs to read a single value on demand.

Answer

SET

Answer

TRAP

Answer

INFORM

Question 13

A network administrator needs to ensure that network device configurations are automatically backed up to a central server. Which protocol is commonly used for secure file transfer of configurations?

Accepted Answer

SFTP. SFTP (SSH File Transfer Protocol) is the correct choice because it provides encrypted, secure file transfers over an SSH session, making it ideal for backing up sensitive network device configurations to a central server. Unlike TFTP or FTP, SFTP ensures both authentication and data confidentiality, which is critical for network operations.

Answer

TFTP

Answer

FTP

Answer

HTTP

Question 14

An NOC technician observes that the CPU usage on a core switch has been consistently above 90% for the past hour. Which SNMP operation should the technician use to monitor the CPU load over time with minimal network overhead?

Accepted Answer

SNMP TRAP. D is correct because SNMP TRAP is an unsolicited notification sent from the agent (the switch) to the NMS, which allows the NOC to receive CPU load alerts only when a threshold is exceeded, minimizing network overhead by avoiding continuous polling. In this scenario, the technician wants to monitor CPU load over time with minimal overhead, and traps provide event-driven reporting rather than periodic requests, reducing bandwidth and processing load on both the switch and the network.

Answer

SNMP GET

Answer

SNMP GETNEXT

Answer

SNMP WALK

Question 15

A network administrator is preparing to upgrade the firmware on a critical router. Which document should the administrator consult to understand the steps required to minimize downtime and ensure a successful upgrade?

Accepted Answer

Change management plan. The change management plan documents the approved procedures, rollback steps, and communication protocols for performing maintenance on critical infrastructure. Consulting this plan ensures the administrator follows the organization's predefined steps to minimize downtime and mitigate risks during the firmware upgrade.

Answer

SLA

Answer

Network diagram

Answer

Baseline performance report

Question 16

An NOC technician receives an alert that latency on a critical WAN link has increased significantly. The technician needs to analyze the latency trend over the past week to identify patterns. Which approach is the most efficient for gathering this historical data?

Accepted Answer

Use SNMP polling with a suitable MIB to collect latency metrics at regular intervals. SNMP polling with a suitable MIB (e.g., IF-MIB for interface statistics or IP-MIB for performance metrics) allows the NOC to collect latency data at regular, configurable intervals over time. This historical data can be stored in a management system and analyzed for trends, making it the most efficient method for identifying patterns in WAN latency over a week. SNMP traps, by contrast, are event-driven and do not provide the continuous, periodic data needed for trend analysis.

Answer

Use SNMP traps to alert on each latency spike

Answer

Run a continuous ping test and manually log timestamps

Answer

Use traceroute to identify each hop and measure latency per hop

Question 17

A network administrator wants to be alerted immediately when any interface on a core router goes down. The administrator has already configured SNMP community strings. Which additional configuration is necessary to receive these alerts?

Accepted Answer

A) Configure the router to send SNMP traps to the NMS. SNMP traps are unsolicited notifications sent from the managed device (the router) to the Network Management Station (NMS) when a specific event occurs, such as an interface going down. Since the administrator wants immediate alerts without polling, configuring the router to send SNMP traps to the NMS is the correct approach. The SNMP community strings are already set, so the missing piece is the trap destination and enabling trap generation for interface state changes.

Answer

B) Perform an SNMP walk of the interface OIDs

Answer

C) Use SNMP get to retrieve interface status periodically

Answer

D) Configure SNMP set to change interface parameters

Question 18

A network administrator plans to make a configuration change on a core switch during a maintenance window. According to best practices, which document should the administrator prepare and have approved before making the change?

Accepted Answer

A) Change management request. A change management request is the correct document because it formalizes the proposed configuration change, including the scope, risk assessment, rollback plan, and approval chain. This ensures that all stakeholders review and authorize the change before implementation, reducing the risk of unintended network outages or security gaps. Best practices from ITIL and Cisco's own change management guidelines mandate this process for any production network device modification.

Answer

B) Network diagram

Answer

C) Incident report

Answer

D) Backup configuration

Question 19

A network administrator needs to collect traffic flow data from routers and switches to analyze bandwidth usage patterns. Which protocol should be implemented on the devices to export flow data to a collector?

Accepted Answer

NetFlow. NetFlow (or its standards-based equivalent, IPFIX) is the correct protocol because it is specifically designed to export traffic flow metadata—such as source/destination IPs, ports, and byte counts—from routers and switches to a collector for bandwidth usage analysis. SNMP can poll interface counters but does not provide per-flow granularity, making NetFlow the appropriate choice for detailed traffic pattern analysis.

Answer

SNMP

Answer

ICMP

Answer

LLDP

Question 20

An organization wants to centrally manage and monitor network devices from a single interface. The solution should support auto-discovery, configuration management, and performance monitoring. Which type of system should be deployed?

Accepted Answer

Network Management System (NMS). A Network Management System (NMS) is the correct choice because it provides a centralized interface for auto-discovery (e.g., via SNMP or CDP/LLDP), configuration management (e.g., using NETCONF or CLI scripting), and performance monitoring (e.g., polling SNMP MIBs or streaming telemetry). This directly matches the requirement for a single-pane-of-glass solution for network device lifecycle management.

Answer

AAA server

Answer

SIEM

Answer

DHCP server