N10-009 Network Operations Practice Test 6 — 15 Questions

Question 1

A network administrator needs to analyze bandwidth utilization and application traffic patterns on a WAN link. The administrator requires detailed flow-level data, including source/destination IP addresses, ports, and protocol. Which technology should be deployed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NetFlow. NetFlow is the correct choice because it provides detailed flow-level data, including source/destination IP addresses, ports, and protocol information, which is essential for analyzing bandwidth utilization and application traffic patterns on a WAN link. Unlike simpler monitoring tools, NetFlow captures metadata about each network flow, allowing administrators to identify which applications and hosts are consuming bandwidth.

Answer

SNMP

Answer

Syslog

Answer

ICMP

Question 2

A network administrator needs to centrally collect and analyze log messages from multiple routers and switches. Which protocol should be used to forward these log messages to a central server?

Accepted Answer

Syslog. Syslog (B) is the correct protocol because it is specifically designed for centralized logging and event message collection from network devices. It uses UDP port 514 (or TCP 6514 for reliable delivery) to forward log messages from routers and switches to a central syslog server, enabling administrators to collect, analyze, and archive logs from multiple devices in a standardized format.

Answer

SNMP

Answer

SMTP

Answer

HTTP

Question 3

A network administrator needs to be notified immediately when a critical switch interface goes down. Which SNMP feature should be configured?

Accepted Answer

Traps. B is correct because SNMP traps are unsolicited messages sent from an SNMP agent to the network management system (NMS) to immediately notify the administrator of a critical event, such as a switch interface going down. Unlike polling, which requires the NMS to periodically request status information, traps provide real-time, event-driven alerts without delay, ensuring the administrator is notified as soon as the interface state changes.

Answer

Polling

Answer

Informs

Answer

Set

Question 4

A network administrator is reviewing syslog messages generated by a switch. The administrator wants to see only the most critical events, such as system failures. Which syslog severity level should be configured as the filter?

Accepted Answer

0 – Emergency. Syslog severity level 0 (Emergency) is the highest severity, indicating system-level failures that render the switch unusable. By filtering for level 0, the administrator ensures only the most critical events, such as kernel panics or hardware failures, are displayed, excluding all less severe messages.

Answer

1 – Alert

Answer

4 – Warning

Answer

7 – Debug

Question 5

A network engineer needs to securely transfer router configuration files to a central backup server. The backup server supports SCP and TFTP. Which protocol should the engineer use?

Accepted Answer

SCP. SCP (Secure Copy Protocol) is the correct choice because it encrypts both the authentication and the data transfer using SSH, ensuring confidentiality and integrity of the router configuration files during transit. TFTP, while simple and often used for network device backups, lacks any encryption or authentication, making it insecure for transferring sensitive configuration data over a network.

Answer

TFTP

Answer

HTTP

Answer

FTP

Question 6

A network administrator needs to be notified immediately when the CPU utilization on a core router exceeds 90%. Which SNMP mechanism should be configured on the router?

Accepted Answer

SNMP trap. B is correct because SNMP traps are unsolicited notifications sent from an SNMP agent (the router) to the manager when a predefined condition occurs, such as CPU utilization exceeding 90%. This allows immediate notification without waiting for the manager to poll, which is essential for urgent alerts.

Answer

SNMP get

Answer

SNMP walk

Answer

SNMP set

Question 7

A network administrator needs to identify which devices are generating the most traffic on a WAN link. The administrator requires detailed flow data including source and destination IP addresses, ports, and protocols. Which technology should be deployed?

Accepted Answer

NetFlow. NetFlow is the correct technology because it provides detailed flow-level data, including source and destination IP addresses, ports, and protocols, which is exactly what the administrator needs to identify which devices are generating the most traffic on a WAN link. Unlike SNMP or Syslog, NetFlow exports metadata about network flows, allowing for granular traffic analysis and bandwidth usage per conversation.

Answer

SNMP polling

Answer

Syslog

Answer

ICMP

Question 8

A network administrator wants to centrally monitor the status of all network devices and receive alerts when an interface goes down. Which protocol and feature combination should the administrator use?

Accepted Answer

SNMP with traps. SNMP traps provide unsolicited, asynchronous notifications from network devices to the management station when specific events occur, such as an interface going down. This allows the administrator to receive immediate alerts without continuously polling each device, making it the ideal protocol and feature combination for real-time status monitoring and alerting.

Answer

SNMP with polling

Answer

Syslog with severity levels

Answer

NetFlow with flow logs

Question 9

A network administrator needs to collect detailed data about network traffic flows, including source/destination IP addresses, ports, and protocols, to analyze bandwidth usage patterns. Which technology should be used?

Accepted Answer

NetFlow. NetFlow is the correct choice because it is specifically designed to collect detailed metadata about network traffic flows, including source and destination IP addresses, ports, protocols, and byte counts. This granular flow-level data enables administrators to analyze bandwidth usage patterns, identify top talkers, and perform capacity planning. Unlike SNMP, which provides aggregate interface statistics, NetFlow exports flow records that contain the exact fields needed for deep traffic analysis.

Answer

SNMP

Answer

Syslog

Answer

ICMP

Question 10

A network administrator needs to schedule a firmware update for several switches during a maintenance window. Which of the following documents should be updated immediately after the changes are complete?

Accepted Answer

Change management request. The change management request is the correct document to update immediately after completing the firmware update because it serves as the official record that the change was implemented, tested, and closed. This ensures audit compliance, rollback documentation, and approval tracking, which are critical in ITIL-based change management processes. Updating the network diagram or performance baseline may be done later as part of post-change verification, but the change management request must be updated first to formally close the change window.

Answer

Network diagram

Answer

Performance baseline

Answer

Service level agreement

Question 11

A network administrator wants to collect and analyze logs from multiple network devices in a central location. Which of the following protocols should be used?

Accepted Answer

Syslog. Syslog is the correct protocol because it is specifically designed for centralized log collection and analysis from network devices. It uses UDP port 514 (or TCP 6514 for reliable delivery) to send event messages from routers, switches, and firewalls to a central syslog server, enabling administrators to aggregate and review logs for troubleshooting and security monitoring.

Answer

SNMP

Answer

SMTP

Answer

FTP

Question 12

A network administrator wants to collect logs from multiple routers and switches to a central server for analysis. Which protocol should be configured on the devices to send logs to the server?

Accepted Answer

Syslog. Syslog (RFC 5424) is the standard protocol for sending event messages (logs) from network devices like routers and switches to a central log server. It uses UDP port 514 by default (or TCP 6514 for reliable delivery) and allows administrators to collect, store, and analyze system messages from multiple devices in one location.

Answer

SNMP

Answer

NetFlow

Answer

TFTP

Question 13

A network administrator configures a router to send syslog messages to a central log server. The administrator can ping the server from the router, but the server is not receiving any logs. What is the most likely cause?

Accepted Answer

UDP port 514 is blocked between the router and the server. Syslog messages are sent via UDP port 514 by default. Since the administrator can ping the server (ICMP works), but no logs arrive, the most likely cause is that a firewall or ACL is blocking UDP port 514 between the router and the server. This is a classic connectivity issue where Layer 3 reachability exists but the specific transport-layer port is filtered.

Answer

The syslog server is using the wrong protocol (TCP instead of UDP)

Answer

The syslog service on the server is not running

Answer

The router's clock is not synchronized with the server

Question 14

A network administrator has configured SNMPv3 on a router to send traps to a central management server. The administrator notices that no traps are being received. The management server is reachable via ping from the router. Which configuration step is most likely missing?

Accepted Answer

Configure SNMPv3 authentication and privacy credentials on both the router and the server. SNMPv3 requires authentication and encryption (privacy) to be configured on both the router and the management server. Without matching credentials, the server will reject or ignore the traps, even if the network path is reachable. This is the most likely missing step because SNMPv3 does not use community strings and relies on security models (authNoPriv, authPriv, or noAuthNoPriv) that must be consistent between endpoints.

Answer

Configure the SNMP community string on the router

Answer

Set the SNMP trap destination IP address on the router

Answer

Ensure the SNMP agent is enabled on the router

Question 15

A network administrator needs to maintain a record of all configuration changes made to network switches, including the date, time, and the administrator who made the change. Which document should be used for this purpose?

Accepted Answer

Change management log. A change management log is the correct document because it is specifically designed to record configuration changes, including the date, time, and the administrator responsible. This log provides an audit trail for network devices, ensuring compliance and facilitating troubleshooting by tracking who made what change and when.

Answer

Network topology diagram

Answer

Baseline configuration report

Answer

Incident report