N10-009 Network Troubleshooting — 20 Questions

Question 1

A user reports that they cannot access an internal web server at http://intranet.company.local but can access other internet websites. The technician runs ping intranet.company.local and receives replies successfully. Which tool should the technician use next to isolate the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

nslookup. The current explanation states that a successful `ping intranet.company.local` points to a name resolution failure. This is incorrect. If `ping intranet.company.local` receives replies successfully, it means the hostname *did* resolve to an IP address, and the server is reachable via ICMP. Therefore, name resolution is not the problem. The issue is more likely related to the web server service not running, a firewall blocking HTTP/HTTPS traffic to the server, or the hostname resolving to an *incorrect* IP address (though the explanation explicitly states 'failure' rather than 'incorrect resolution'). `nslookup` would only be the next step if the `ping` command failed to resolve the hostname or if the technician suspected an incorrect IP resolution despite successful ping.

Answer

tracert

Answer

netstat

Answer

ipconfig

Question 2

A technician is troubleshooting a failed ping to a specific website's IP address. The user can browse other websites without issue, and nslookup on the user's workstation returns the correct IP address for the website. Which of the following is the most likely cause?

Accepted Answer

The website server is blocking ICMP requests.. The most likely cause is that the website server is blocking ICMP echo request (ping) traffic. Many servers and firewalls block ICMP for security while still allowing HTTP/HTTPS traffic, so a failed ping does not mean the website is down. Because other websites are reachable and DNS resolved correctly, the default gateway, DNS, and subnet mask are unlikely to be the problem.

Answer

The default gateway is misconfigured.

Answer

The DNS server is not resolving the domain name.

Answer

The subnet mask is incorrect.

Question 3

A user reports that they can access a web server by its IP address (e.g., 10.10.10.50) but cannot access it by its domain name (e.g., server.example.com). The technician verifies that the DNS server is reachable and that the name resolves correctly from other workstations on the same subnet. Which of the following should the technician check NEXT?

Accepted Answer

Check the DNS cache on the user's workstation. The user's workstation can reach the web server by IP but not by domain name, while other workstations resolve the name correctly. This strongly suggests a local DNS resolution issue specific to that workstation, such as a corrupted or stale DNS cache. Flushing the DNS cache with `ipconfig /flushdns` is the logical next step before investigating broader network or firewall issues.

Answer

Verify the default gateway configuration

Answer

Renew the DHCP lease

Answer

Disable the Windows Firewall

Question 4

A technician is troubleshooting a user's inability to connect to a server. The technician runs 'tracert' from the user's workstation and sees that traffic stops at a particular router. The last hop shows a timeout. Which of the following is the most likely cause?

Accepted Answer

The next hop router is unreachable from that router.. The 'tracert' command relies on ICMP Time Exceeded messages from intermediate routers to map the path. When traffic stops at a particular router and the next hop shows a timeout, it indicates that the router cannot forward the packet to the next hop, meaning the next hop router is unreachable. This is the most direct cause because the traceroute fails to receive a response from the next hop, not because the destination is off or ICMP is blocked.

Answer

The destination server is powered off.

Answer

The router is blocking ICMP echo requests.

Answer

There is a routing loop.

Question 5

A network technician is troubleshooting a user's inability to connect to the network. The switch port is configured with port security with the default maximum of one MAC address. The user connects a computer and a VoIP phone to the port using the phone's built-in switch. Which of the following will MOST likely occur?

Accepted Answer

The port will go into errdisable state. With the default port security configuration, the switch port allows only one MAC address. When the VoIP phone connects, its own MAC address is learned first. The computer then connects through the phone's built-in switch, presenting a second MAC address, which violates the security policy. This triggers a security violation, and by default the port is placed into the errdisable state.

Answer

The phone will work but the computer will not

Answer

Both devices will work because the phone uses a different MAC

Answer

The switch will allow only the first learned MAC and block the second

Question 6

A user reports that their workstation cannot connect to the network. The technician checks the IP configuration and sees that the workstation has an IP address of 169.254.25.110. The DHCP server is operational and has available addresses. The switch port connected to the workstation shows a solid green link light. What should the technician check NEXT?

Accepted Answer

Check the switch port configuration for security features such as DHCP snooping or port security.. The workstation has an APIPA address (169.254.x.x), which indicates it failed to obtain a DHCP lease. Since the DHCP server is operational and has available addresses, the issue likely lies with the switch port configuration. Security features such as DHCP snooping or port security can block DHCP traffic or limit the number of MAC addresses, preventing the workstation from receiving a valid IP address. Checking the switch port configuration is the logical next step.

Answer

Check the DNS server configuration.

Answer

Replace the network cable between the wall jack and the workstation.

Answer

Verify the default gateway setting on the workstation.

Question 7

A technician is troubleshooting a user's inability to access the internet. The user can successfully ping the default gateway and internal servers, but cannot ping a public IP address such as 8.8.8.8. The technician checks the firewall logs and confirms that outbound ICMP traffic to 8.8.8.8 is permitted. Which of the following is the most likely cause of the issue?

Accepted Answer

Missing default route on the router. The user can ping the default gateway and internal servers, which confirms that Layer 2 and Layer 3 connectivity within the local network is working. However, the inability to ping a public IP (8.8.8.8) indicates that traffic is not being forwarded beyond the local subnet. A missing default route on the router means the router does not know where to send packets destined for external networks, so it drops them. Since outbound ICMP is permitted on the firewall, the issue is routing, not filtering.

Answer

Incorrect DNS server configuration on the workstation

Answer

Incorrect subnet mask on the workstation

Answer

Malware on the workstation is blocking ICMP traffic

Question 8

A network technician is troubleshooting a workstation that intermittently loses network connectivity. The link LED on the switch port is blinking slowly. The technician checks the cable and it appears fine. Which of the following is the most likely cause?

Accepted Answer

Duplex mismatch. Intermittent connectivity with a cable that appears physically fine is often caused by a duplex mismatch, where one side is configured for full duplex and the other for half duplex. This mismatch can cause collisions, CRC errors, and retransmissions, resulting in sporadic packet loss even though the link remains up. LED indicators vary by vendor and are not a reliable universal diagnostic; the connectivity pattern itself is the stronger clue.

Answer

Incorrect VLAN assignment

Answer

Bad cable

Answer

Spanning Tree blocking

Question 9

A technician is troubleshooting a connectivity issue. The technician can successfully ping the IP address of a web server (10.10.10.10) from a client, but the client cannot access the web page. Firewall rules allow HTTP traffic. At which OSI layer is the issue most likely occurring?

Accepted Answer

Application layer (Layer 7). Since the client can successfully ping the web server's IP address (10.10.10.10), Layer 3 (Network) connectivity is verified, as ICMP operates at Layer 3 and uses IP. While ping does not verify Layer 4 (Transport) connectivity, the explicit mention that firewall rules allow HTTP traffic suggests that Layer 4 connectivity for HTTP is not being blocked. Therefore, the failure to access the web page points to an issue at Layer 7 (Application), such as a misconfigured web server (e.g., HTTP 404, incorrect document root), a missing or incorrect Host header in the HTTP request, or an application-layer proxy or authentication problem that prevents the HTTP transaction from completing successfully after the TCP connection is established.

Answer

Session layer (Layer 5)

Answer

Transport layer (Layer 4)

Answer

Network layer (Layer 3)

Question 10

Users in a conference room frequently experience slow and dropping wireless connections. A site survey shows three other access points in the vicinity all using channel 6. Signal strength is adequate. What is the most likely cause?

Accepted Answer

Co-channel interference. All three nearby access points are operating on channel 6, which causes co-channel interference. Even with adequate signal strength, overlapping basic service sets (BSSs) on the same channel lead to contention, increased collisions, and reduced throughput due to the CSMA/CA mechanism in 802.11 networks. This results in slow and dropping connections for users in the conference room.

Answer

Incorrect encryption settings

Answer

Incorrect SSID configured

Answer

Low antenna gain on the access points

Question 11

Users at a remote branch office cannot access internet resources. The branch's edge router shows that the WAN interface is up. The default route is configured to point to next-hop 192.0.2.2, but the admin can successfully ping 192.0.2.1 from the router. What is the most likely cause?

Accepted Answer

The default route is missing or has an incorrect next-hop IP. The explanation states that the admin 'cannot reach 192.0.2.2 (the next-hop)', which is a critical piece of information not provided in the question stem. The stem only mentions successfully pinging 192.0.2.1. Without explicit confirmation that 192.0.2.2 is unreachable, the explanation's justification for the default route being the most likely cause is based on an unstated assumption. If 192.0.2.2 is reachable, other options like NAT configuration or firewall rules could be equally or more likely causes for internet access issues.

Answer

The router's WAN interface is configured with the wrong subnet mask

Answer

NAT is not configured on the router

Answer

A firewall on the router is blocking outbound traffic

Question 12

A user on VLAN 10 reports that they cannot access a file server on VLAN 20. The user can ping the default gateway (interface on the router) and other devices within VLAN 10. The router has an 'ip helper-address' for DHCP but no static routes or dynamic routing configured for inter-VLAN routing. The file server is correctly configured with an IP address in VLAN 20. What is the most likely cause of the communication failure?

Accepted Answer

The router does not have a route to the VLAN 20 subnet. The router has no route to the VLAN 20 subnet. For inter-VLAN routing to occur, the router must have a routing table entry for the destination VLAN. Since no static or dynamic routing is configured, the router relies on directly connected routes via its subinterfaces. If the subinterface for VLAN 20 is missing or misconfigured, the router will not have a connected route for that subnet and therefore cannot forward packets from VLAN 10 to VLAN 20. The 'ip helper-address' only forwards DHCP broadcasts, not general traffic.

Answer

The router is configured with an ACL that blocks traffic from VLAN 10 to VLAN 20

Answer

The switch port connecting the user to the network is configured with port security limiting MAC addresses

Answer

The file server has a firewall blocking ICMP ping requests

Question 13

Select the statements that correctly match each IEEE 802.3 standard to its description. (Select all that apply.)

Accepted Answer

802.3af: Provides up to 15.4W of power over Ethernet cables.. The correct matches: 802.3af is Power over Ethernet (15.4W), 802.3at is PoE+ (25.5W), 802.3ab is 1000BASE-T (twisted pair), and 802.3z is 1000BASE-X (fiber).

Answer

802.3ab: Gigabit Ethernet standard using fiber optic cabling.

Answer

802.3z: Gigabit Ethernet standard using twisted pair cabling.

Question 14

A user reports intermittent connectivity on a laptop that moves between floors. The signal strength fluctuates. Which tool would best help identify signal interference and dead zones?

Accepted Answer

Spectrum analyzer. A spectrum analyzer is the correct tool because it visualizes radio frequency (RF) energy across the 2.4 GHz and 5 GHz bands, allowing you to identify sources of interference (e.g., cordless phones, microwave ovens) and locate dead zones where signal strength drops below usable thresholds. Unlike other tools, it directly measures the RF environment rather than relying on logical-layer data.

Answer

Cable tester

Answer

Multimeter

Answer

Protocol analyzer

Question 15

A user reports that they cannot access the internet, but they can access local resources on the same subnet. The network administrator pings the default gateway and gets a response. Which tool should be used next to trace the path to an external website?

Accepted Answer

traceroute. B is correct because traceroute (tracert on Windows) is the appropriate tool to identify where packets are being dropped or delayed along the path from the local host to an external website. Since the user can access local resources and the default gateway responds to pings, the issue likely lies beyond the gateway, and traceroute will reveal the hop where connectivity fails.

Answer

netstat

Answer

nslookup

Answer

arp

Question 16

After replacing a faulty switch, several users in the same VLAN report that they cannot communicate with the server that is on a different subnet. The switch is connected to the router via a trunk port. Which command should the administrator run on the router to verify that the VLAN is allowed on the trunk?

Accepted Answer

show interfaces trunk. The `show interfaces trunk` command displays which VLANs are allowed on each trunk port. Since the switch is connected to the router via a trunk, this command verifies whether the VLAN of the affected users is permitted on that trunk. If the VLAN is missing from the allowed list, traffic to the server on a different subnet will be dropped at the router interface.

Answer

show vlan

Answer

show mac address-table

Answer

show ip route

Question 17

A user calls the help desk stating that they cannot access any network resources. The technician asks the user to run ipconfig and the output shows an IP address of 169.254.15.20 with a subnet mask of 255.255.0.0. Which of the following is the most likely cause?

Accepted Answer

The DHCP server is unreachable. The IP address 169.254.15.20 with a subnet mask of 255.255.0.0 is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when a DHCP client fails to receive a lease from a DHCP server. Since the user cannot access any network resources, the most likely cause is that the DHCP server is unreachable, preventing the client from obtaining a valid IP address, default gateway, and DNS server settings.

Answer

The DNS server is not responding

Answer

The default gateway is misconfigured

Answer

There is a duplicate IP address on the network

Question 18

A network technician is troubleshooting intermittent internet access for a single user. The user’s workstation can ping the default gateway consistently, but web pages fail to load intermittently. Which of the following should the technician check NEXT?

Accepted Answer

A) DNS server configuration. The user can ping the default gateway consistently, indicating Layer 3 connectivity to the local network is intact. However, intermittent web page failures suggest a name resolution issue, as DNS translates domain names to IP addresses. If the DNS server is misconfigured, unreachable, or returning stale records, the browser will fail to load pages even though basic IP connectivity works. Checking DNS server configuration is the logical next step because it directly addresses the symptom of name resolution failures.

Answer

B) DHCP lease time

Answer

C) Switch port speed and duplex settings

Answer

D) Firewall rules blocking ICMP

Question 19

A user at a branch office reports that they cannot connect to a file server at the main office. The branch office connects to the main office via a site-to-site VPN, and the VPN tunnel shows as active. The user can ping the main office's default gateway but not the file server. Which of the following should the technician check NEXT?

Accepted Answer

A) Check the routing tables on the branch router. The VPN tunnel is active and the user can ping the main office's default gateway, which confirms that Layer 3 connectivity exists across the tunnel. However, the file server is unreachable, indicating that the traffic destined for the file server's subnet is not being forwarded correctly. The next logical step is to check the routing tables on the branch router to ensure there is a specific route (or a default route) pointing to the VPN tunnel interface for the file server's network. Without this route, the branch router may be dropping the packets or sending them out the wrong interface.

Answer

B) Check the DNS resolution for the file server

Answer

C) Check the VPN encryption settings

Answer

D) Check the file server's antivirus software

Question 20

A network administrator is troubleshooting communication between two switches connected via a trunk port. The trunk link is up/up, but devices in VLAN 20 cannot communicate across the trunk. The administrator has verified that both switches have VLAN 20 created and that the access ports are configured correctly. Which command should the administrator run on each switch to verify the trunk's allowed VLAN list?

Accepted Answer

show interfaces trunk. The 'show interfaces trunk' command displays the trunking status, including the allowed VLAN list on the trunk port. Since the trunk link is up/up but VLAN 20 traffic fails, the most likely cause is that VLAN 20 is not included in the allowed VLAN list on one or both switches. This command directly shows which VLANs are permitted, pruned, or active on the trunk.

Answer

show vlan brief

Answer

show running-config interface

Answer

show mac address-table