N10-009 Network Operations — Timed 20 Questions

Question 1

A network operations center uses SNMP to monitor device health. An administrator needs to retrieve the current CPU utilization from a router. Which SNMP operation is most appropriate?

Accepted Answer

GET. The SNMP GET operation is used by an NMS (Network Management System) to actively request a specific variable from a managed device, such as the current CPU utilization from a router's OID. This is a poll-based retrieval, making it the correct choice for an administrator who needs to read a single value on demand.

Answer

SET

Answer

TRAP

Answer

INFORM

Question 2

A network administrator needs to ensure that network device configurations are automatically backed up to a central server. Which protocol is commonly used for secure file transfer of configurations?

Accepted Answer

SFTP. SFTP (SSH File Transfer Protocol) is the correct choice because it provides encrypted, secure file transfers over an SSH session, making it ideal for backing up sensitive network device configurations to a central server. Unlike TFTP or FTP, SFTP ensures both authentication and data confidentiality, which is critical for network operations.

Answer

TFTP

Answer

FTP

Answer

HTTP

Question 3

An NOC technician observes that the CPU usage on a core switch has been consistently above 90% for the past hour. Which SNMP operation should the technician use to monitor the CPU load over time with minimal network overhead?

Accepted Answer

SNMP TRAP. D is correct because SNMP TRAP is an unsolicited notification sent from the agent (the switch) to the NMS, which allows the NOC to receive CPU load alerts only when a threshold is exceeded, minimizing network overhead by avoiding continuous polling. In this scenario, the technician wants to monitor CPU load over time with minimal overhead, and traps provide event-driven reporting rather than periodic requests, reducing bandwidth and processing load on both the switch and the network.

Answer

SNMP GET

Answer

SNMP GETNEXT

Answer

SNMP WALK

Question 4

A network administrator is preparing to upgrade the firmware on a critical router. Which document should the administrator consult to understand the steps required to minimize downtime and ensure a successful upgrade?

Accepted Answer

Change management plan. The change management plan documents the approved procedures, rollback steps, and communication protocols for performing maintenance on critical infrastructure. Consulting this plan ensures the administrator follows the organization's predefined steps to minimize downtime and mitigate risks during the firmware upgrade.

Answer

SLA

Answer

Network diagram

Answer

Baseline performance report

Question 5

An NOC technician receives an alert that latency on a critical WAN link has increased significantly. The technician needs to analyze the latency trend over the past week to identify patterns. Which approach is the most efficient for gathering this historical data?

Accepted Answer

Use SNMP polling with a suitable MIB to collect latency metrics at regular intervals. SNMP polling with a suitable MIB (e.g., IF-MIB for interface statistics or IP-MIB for performance metrics) allows the NOC to collect latency data at regular, configurable intervals over time. This historical data can be stored in a management system and analyzed for trends, making it the most efficient method for identifying patterns in WAN latency over a week. SNMP traps, by contrast, are event-driven and do not provide the continuous, periodic data needed for trend analysis.

Answer

Use SNMP traps to alert on each latency spike

Answer

Run a continuous ping test and manually log timestamps

Answer

Use traceroute to identify each hop and measure latency per hop

Question 6

A network administrator needs to upgrade the firmware on a critical core router. The admin has downloaded the new firmware and verified its checksum. Which of the following should the admin do before proceeding with the installation?

Accepted Answer

Back up the current router configuration. Before upgrading firmware on a critical core router, backing up the current configuration ensures that if the upgrade fails or causes unexpected behavior, the original operational state can be restored quickly. This is a standard best practice in network operations to minimize downtime and avoid manual reconfiguration of complex routing protocols, ACLs, and interface settings.

Answer

Change the management IP address

Answer

Disable all physical interfaces

Answer

Remove the old firmware image

Question 7

A network administrator wants to be alerted immediately when any interface on a core router goes down. The administrator has already configured SNMP community strings. Which additional configuration is necessary to receive these alerts?

Accepted Answer

A) Configure the router to send SNMP traps to the NMS. SNMP traps are unsolicited notifications sent from the managed device (the router) to the Network Management Station (NMS) when a specific event occurs, such as an interface going down. Since the administrator wants immediate alerts without polling, configuring the router to send SNMP traps to the NMS is the correct approach. The SNMP community strings are already set, so the missing piece is the trap destination and enabling trap generation for interface state changes.

Answer

B) Perform an SNMP walk of the interface OIDs

Answer

C) Use SNMP get to retrieve interface status periodically

Answer

D) Configure SNMP set to change interface parameters

Question 8

A network administrator plans to make a configuration change on a core switch during a maintenance window. According to best practices, which document should the administrator prepare and have approved before making the change?

Accepted Answer

A) Change management request. A change management request is the correct document because it formalizes the proposed configuration change, including the scope, risk assessment, rollback plan, and approval chain. This ensures that all stakeholders review and authorize the change before implementation, reducing the risk of unintended network outages or security gaps. Best practices from ITIL and Cisco's own change management guidelines mandate this process for any production network device modification.

Answer

B) Network diagram

Answer

C) Incident report

Answer

D) Backup configuration

Question 9

A network administrator needs to collect traffic flow data from routers and switches to analyze bandwidth usage patterns. Which protocol should be implemented on the devices to export flow data to a collector?

Accepted Answer

NetFlow. NetFlow (or its standards-based equivalent, IPFIX) is the correct protocol because it is specifically designed to export traffic flow metadata—such as source/destination IPs, ports, and byte counts—from routers and switches to a collector for bandwidth usage analysis. SNMP can poll interface counters but does not provide per-flow granularity, making NetFlow the appropriate choice for detailed traffic pattern analysis.

Answer

SNMP

Answer

ICMP

Answer

LLDP

Question 10

An organization wants to centrally manage and monitor network devices from a single interface. The solution should support auto-discovery, configuration management, and performance monitoring. Which type of system should be deployed?

Accepted Answer

Network Management System (NMS). A Network Management System (NMS) is the correct choice because it provides a centralized interface for auto-discovery (e.g., via SNMP or CDP/LLDP), configuration management (e.g., using NETCONF or CLI scripting), and performance monitoring (e.g., polling SNMP MIBs or streaming telemetry). This directly matches the requirement for a single-pane-of-glass solution for network device lifecycle management.

Answer

AAA server

Answer

SIEM

Answer

DHCP server

Question 11

A network administrator needs to schedule a firmware upgrade for a critical router. Which document should be used to formally communicate the change, seek approval, and track the implementation?

Accepted Answer

A) Change management request. A change management request is the formal document used to communicate, seek approval, and track the implementation of a firmware upgrade on a critical router. This process ensures that the change is reviewed by stakeholders, risks are assessed, and a rollback plan is documented, which is essential for maintaining network stability and compliance with ITIL or organizational change control policies.

Answer

B) Network diagram

Answer

C) Service level agreement (SLA)

Answer

D) Baseline performance report

Question 12

An NOC technician observes that the average latency on a critical WAN link has risen sharply. To determine which applications are consuming the most bandwidth and contributing to the latency, which tool should the technician use?

Accepted Answer

A) NetFlow. NetFlow is the correct tool because it provides per-flow traffic analysis, allowing the technician to identify which applications (by protocol and port) are consuming the most bandwidth on the WAN link. Unlike simple bandwidth monitors, NetFlow exports detailed records of source/destination IPs, ports, and byte counts, enabling precise identification of bandwidth-hungry applications contributing to increased latency.

Answer

B) SNMP

Answer

C) Syslog

Answer

D) Ping

Question 13

A network administrator wants to be notified immediately when any interface on a core router goes down. The administrator has already configured SNMP community strings on the router. What additional configuration is necessary to receive these notifications?

Accepted Answer

Configure an SNMP trap receiver on the NMS and set the router to send traps to that receiver.. SNMP traps are unsolicited notifications sent from a managed device (the router) to a Network Management System (NMS) when a specific event occurs, such as an interface going down. Since the administrator already configured SNMP community strings (which provide authentication for SNMP messages), the missing piece is configuring the router to send traps to a specific trap receiver (the NMS) and ensuring the NMS is set up to listen for those traps. Without this trap receiver configuration, the router will not generate or forward the event-driven alerts.

Answer

Enable SNMP polling from the NMS at regular intervals.

Answer

Set up syslog to forward log messages to a centralized server.

Answer

Configure an access control list to allow the NMS to poll the router.

Question 14

A network administrator needs to schedule a firmware upgrade on a core switch during the next maintenance window. According to best practices, which document should the administrator create and have approved before making the change?

Accepted Answer

A change request form with a rollback plan and approval signatures.. Option C is correct because a change request form with a rollback plan and approval signatures ensures that the firmware upgrade follows the ITIL change management process, which is a best practice for network operations. This document provides a structured approach to assess risks, obtain authorization, and define steps to revert the switch to its previous state if the upgrade fails, minimizing downtime and impact on the network.

Answer

A network diagram showing the current topology.

Answer

An incident report detailing previous firmware issues.

Answer

A baseline performance report from the current firmware version.

Question 15

A network administrator needs to perform a critical firmware upgrade on a core switch during a maintenance window. Which of the following should the administrator do FIRST before making the change?

Accepted Answer

Test the firmware in a lab environment. Before making any change to a production device, the firmware should first be tested in a lab environment that mirrors the production setup. This validates compatibility with existing hardware, software features, and configurations, preventing unexpected behavior such as boot loops, protocol failures, or hardware incompatibility that could cause extended outages.

Answer

Notify all users of the planned outage

Answer

Create a backup of the current switch configuration

Answer

Submit a change request for approval

Question 16

A network administrator is creating a performance baseline for a new VoIP application. Which metric is most critical to monitor in order to ensure good voice quality for end users?

Accepted Answer

Latency. Latency is the most critical metric for VoIP voice quality because it directly impacts the conversational flow. High latency (above 150 ms one-way, per ITU-T G.114) causes noticeable delays that disrupt natural conversation, leading to user dissatisfaction. While jitter and bandwidth are important, latency is the primary factor that degrades the interactive experience.

Answer

Bandwidth utilization

Answer

Jitter

Answer

Packet loss

Question 17

A network administrator is creating a standard operating procedure for firmware upgrades. Which step should be performed FIRST according to best practices?

Accepted Answer

Test the firmware in a lab environment. According to best practices for firmware upgrades, the first step should always be to test the new firmware in a non-production lab environment that mirrors the production setup. This validates compatibility, identifies potential bugs, and ensures the upgrade process works without risking network downtime or data loss. Only after successful lab testing should you proceed to backup the current configuration and schedule the upgrade during a maintenance window.

Answer

Schedule the upgrade during a maintenance window

Answer

Back up the current configuration

Answer

Notify users of the planned outage

Question 18

An organization is implementing a network monitoring solution that uses SNMP. The administrator wants to receive traps from all devices but is concerned about the security of SNMPv1/v2c community strings. Which SNMP version should be used to provide authentication and encryption?

Accepted Answer

SNMPv3. SNMPv3 is the correct choice because it is the only version of SNMP that provides both authentication and encryption, addressing the security concerns with SNMPv1/v2c community strings. SNMPv3 supports user-based security models (USM) with features like message integrity, authentication, and encryption (e.g., using SHA/MD5 for auth and AES/DES for privacy). This ensures that traps are sent securely, preventing unauthorized access or tampering.

Answer

SNMPv1

Answer

SNMPv2c

Answer

SNMPv4

Question 19

A network administrator is preparing documentation for a new branch office. The administrator needs a diagram that shows the logical relationships between network devices and how VLANs are trunked over inter-switch links. Which type of document should be created?

Accepted Answer

Logical topology diagram. A logical topology diagram is the correct choice because it illustrates how devices communicate across the network, including VLAN assignments and trunk links (e.g., 802.1Q tagging) between switches. This diagram abstracts physical locations to show Layer 2 and Layer 3 relationships, such as which VLANs traverse which inter-switch links, making it ideal for documenting VLAN trunking and logical connectivity.

Answer

Network baseline

Answer

Wiring diagram

Answer

Physical topology diagram

Question 20

A network administrator needs to ensure that all changes to network devices are properly reviewed, approved, and tracked. Which process should the administrator implement?

Accepted Answer

Change management. Change management is the formal process for requesting, reviewing, approving, implementing, and documenting changes to network devices. It ensures that all modifications are authorized, tracked, and have a rollback plan, which directly meets the requirement for review, approval, and tracking.

Answer

Incident management

Answer

Problem management

Answer

Asset management