N10-009 Network Troubleshooting Practice Test 4 — 15 Questions

Question 1

A network technician is troubleshooting an issue where Server A can ping Server B by IP address, but Server B cannot ping Server A. Both servers are in the same VLAN and subnet, connected to the same switch. The switch ports are configured identically, and there are no ACLs or firewalls between them. Which of the following is the MOST likely cause?

Accepted Answer

Server A's firewall is blocking incoming ICMP. Server A can ping Server B by IP address, meaning ICMP echo requests from Server A reach Server B and echo replies return successfully. However, Server B cannot ping Server A, which indicates that ICMP echo requests from Server B are not reaching Server A or their replies are blocked. Since both servers are in the same VLAN/subnet with no ACLs or firewalls between them, the most likely cause is that Server A's host-based firewall is blocking incoming ICMP (echo requests), preventing Server B's pings from being processed. This is a classic symptom of a one-way firewall rule that permits outbound ICMP but denies inbound ICMP.

Answer

Server B's firewall is blocking outgoing ICMP

Answer

The cable connecting Server A is faulty

Answer

There is a duplex mismatch on Server B's switch port

Question 2

A user reports that they cannot access the internet. The network technician checks the workstation's IP configuration and finds the IP address 169.254.15.77. What does this address indicate?

Accepted Answer

The DHCP server is unreachable.. The IP address 169.254.15.77 falls within the Automatic Private IP Addressing (APIPA) range (169.254.0.0/16, per RFC 3927). This address is automatically assigned by the operating system when a DHCP client fails to receive a lease from a DHCP server, indicating that the DHCP server is unreachable or not responding.

Answer

The workstation has a static IP address configured.

Answer

The DNS server is down.

Answer

The default gateway is misconfigured.

Question 3

A network administrator is troubleshooting an intermittent link between two switches connected by single-mode fiber. The interface log shows "Link up / Link down" events multiple times per hour. Which of the following is the most likely cause?

Accepted Answer

Dirty fiber connectors. Dirty fiber connectors cause intermittent signal loss by scattering or absorbing light, which leads to CRC errors and repeated link flaps as the optical transceiver struggles to maintain synchronization. This matches the 'Link up / Link down' pattern seen in the logs, especially on single-mode fiber where precise alignment is critical.

Answer

Incorrect VLAN configuration on the switch ports

Answer

Crossed fiber pairs

Answer

Duplex mismatch between the switches

Question 4

A user reports that they cannot access the internet. The technician is able to ping the default gateway successfully but unable to ping a public IP address (e.g., 8.8.8.8). Which of the following is the most likely cause?

Accepted Answer

The router's default route is missing or misconfigured. Successful ping to the default gateway confirms Layer 2 and Layer 3 connectivity within the local subnet, but failure to ping a public IP like 8.8.8.8 indicates that traffic cannot leave the local network. This is most commonly caused by a missing or misconfigured default route on the router, which prevents the router from forwarding packets destined for external networks to the next-hop ISP gateway.

Answer

Incorrect DNS server configuration

Answer

Duplicate IP address on the network

Answer

Faulty network interface card

Question 5

A network technician runs the command "traceroute 8.8.8.8" from a workstation. The output shows the first hop as the default gateway, the second hop as an internal router, and then a series of asterisks (* * *) before reaching the destination. What does the series of asterisks indicate?

Accepted Answer

The intermediate routers are not responding to ICMP time-exceeded messages. The series of asterisks indicates that intermediate routers beyond the second hop are not responding with ICMP Time-Exceeded messages when the TTL expires. Traceroute relies on these ICMP responses to identify each hop; if a router is configured to drop ICMP or not send the message, the output shows asterisks for that hop. The destination is still reachable, as the final hop succeeds, so the asterisks do not indicate unreachability.

Answer

The destination is unreachable

Answer

The TTL expired at the last hop

Answer

The connection is encrypted

Question 6

A user reports that they can connect to the internet by IP address but cannot access any websites by domain name. Which command-line tool should a technician use first to isolate the issue?

Accepted Answer

nslookup. The user can reach the internet by IP address but not by domain name, which indicates a DNS resolution failure. The `nslookup` command queries DNS servers directly to test name resolution, making it the correct first step to isolate whether the issue is with the DNS server, the client's DNS configuration, or a network path to the DNS server.

Answer

ping

Answer

tracert

Answer

netstat

Question 7

A technician is troubleshooting a user's inability to access the internet. The user can successfully ping the default gateway and internal servers, but cannot ping a public IP address such as 8.8.8.8. The technician checks the firewall logs and confirms that outbound ICMP traffic to 8.8.8.8 is permitted. Which of the following is the most likely cause of the issue?

Accepted Answer

Missing default route on the router. The user can ping the default gateway and internal servers, which confirms that Layer 2 and Layer 3 connectivity within the local network is working. However, the inability to ping a public IP (8.8.8.8) indicates that traffic is not being forwarded beyond the local subnet. A missing default route on the router means the router does not know where to send packets destined for external networks, so it drops them. Since outbound ICMP is permitted on the firewall, the issue is routing, not filtering.

Answer

Incorrect DNS server configuration on the workstation

Answer

Incorrect subnet mask on the workstation

Answer

Malware on the workstation is blocking ICMP traffic

Question 8

A network technician is troubleshooting an intermittent link between two switches connected via single-mode fiber. The interface logs show frequent 'link up / link down' events, sometimes several times per hour. The technician has verified that the SFPs are compatible and the fiber cable is within distance specifications. Which of the following is the most likely cause of the issue?

Accepted Answer

Dirty or contaminated fiber connectors. Intermittent link flaps on single-mode fiber, despite compatible SFPs and correct distance, are most often caused by dirty or contaminated fiber connectors. Even microscopic dust or oil on the end face can scatter light, causing signal loss that triggers the switch's optical receiver to lose sync and flap the link. This matches the symptom of frequent 'link up / link down' events without any configuration mismatch.

Answer

Electromagnetic interference (EMI) from nearby power cables

Answer

Mismatched VLAN configurations on the switches

Answer

Duplex mismatch between the two switch ports

Question 9

A user reports that they cannot access the internet. The technician tests connectivity: pinging the default gateway succeeds, but pinging a public IP address like 8.8.8.8 fails. Firewall logs show outbound ICMP to 8.8.8.8 is permitted. What is the most likely cause?

Accepted Answer

Missing default route on the router. The user can ping the default gateway (local connectivity) but cannot ping a public IP like 8.8.8.8. This indicates that the workstation has a valid route to its local subnet, but the router lacks a default route (0.0.0.0/0) to forward traffic to the internet. Firewall logs confirm outbound ICMP is permitted, so the issue is at Layer 3 routing, not filtering.

Answer

Incorrect DNS configuration on the workstation

Answer

Duplicate IP address on the local network

Answer

Proxy server configuration is required

Question 10

A user reports that they cannot access any network resources. The technician runs 'ipconfig' on the workstation and sees that the IP address is 169.254.23.45 with a subnet mask of 255.255.0.0. What is the most likely cause of this issue?

Accepted Answer

The DHCP server is unreachable or not functioning.. The IP address 169.254.23.45 with a subnet mask of 255.255.0.0 is an Automatic Private IP Addressing (APIPA) address, which is assigned by the operating system when a DHCP discovery attempt fails. This indicates that the workstation was unable to contact a DHCP server to obtain a valid IP configuration, making an unreachable or non-functioning DHCP server the most likely cause.

Answer

The workstation's network cable is unplugged.

Answer

The DNS server is not responding.

Answer

The workstation has been assigned a static IP address in the wrong subnet.

Question 11

A network technician is troubleshooting a user's inability to access a specific internal web application hosted on a server at 10.10.10.15:8080. The user can ping the server's IP address successfully, but the web browser displays 'connection refused'. The technician verifies that the web application service is running on the server. What is the most likely cause of the issue?

Accepted Answer

The server's firewall is blocking inbound connections to port 8080.. Since the user can ping the server (ICMP success) but receives 'connection refused' on port 8080, and the service is confirmed running, the most likely cause is that the server's firewall is blocking inbound TCP connections to port 8080. A firewall rule can permit ICMP echo requests while denying TCP SYN packets to specific ports, resulting in a successful ping but a TCP RST or no response at the application layer, which manifests as 'connection refused' in the browser.

Answer

The web application is listening on a different port than 8080.

Answer

The user's web browser is configured to use an incorrect proxy server.

Answer

The DNS resolution is failing for the server's hostname.

Question 12

A network technician is troubleshooting a workstation that intermittently loses network connectivity. The link LED on the switch port is blinking slowly. The technician checks the cable and it appears fine. Which of the following is the most likely cause?

Accepted Answer

Duplex mismatch. A slow-blinking link LED on a switch port typically indicates a duplex mismatch, where one device is set to full duplex and the other to half duplex. This causes frame collisions and CRC errors, leading to intermittent connectivity even though the cable appears fine. The symptom of intermittent loss with a physically good cable is classic for duplex mismatch, as the port is still electrically connected but suffers from excessive retransmissions.

Answer

Incorrect VLAN assignment

Answer

Bad cable

Answer

Spanning Tree blocking

Question 13

A network technician is troubleshooting connectivity between two branch offices connected by a site-to-site VPN. The VPN tunnel shows as active and up. Users at Branch A can ping the VPN gateway IP at Branch B successfully, but they cannot access any servers behind the firewall at Branch B. The firewall at Branch B is stateful and its logs show that traffic from Branch A is being dropped. What is the most likely cause?

Accepted Answer

Asymmetric routing causing the stateful firewall to drop return traffic. The VPN tunnel is active and Branch A can ping the VPN gateway IP at Branch B, confirming that the tunnel itself and Layer 3 connectivity are functional. However, a stateful firewall tracks connection states based on source/destination IP and port; if traffic from Branch A enters the firewall on one interface but return traffic exits via a different path (asymmetric routing), the firewall sees the return packets as not belonging to any established session and drops them. This matches the log showing traffic being dropped despite the tunnel being up.

Answer

Mismatched encryption algorithms

Answer

Incorrect DNS configuration

Answer

MTU mismatch causing fragmentation issues

Question 14

A user reports intermittent inability to access websites. When the issue occurs, the user can ping external IP addresses (e.g., 8.8.8.8) but cannot ping domain names like google.com. The user's IP configuration shows a DNS server address of 8.8.8.8. What is the most likely cause?

Accepted Answer

The DNS server is reachable but not responding due to high load.. The user can ping external IP addresses (e.g., 8.8.8.8) but cannot resolve domain names like google.com, which indicates that IP connectivity is working but DNS resolution is failing. Since the DNS server address is 8.8.8.8 and the user can ping it, the server is reachable; however, intermittent failures suggest the server is overwhelmed and dropping or not responding to queries. This matches the symptom of a reachable but unresponsive DNS server due to high load, where ICMP (ping) succeeds but UDP/53 DNS queries time out.

Answer

The default gateway is down.

Answer

The corporate firewall is blocking UDP port 53.

Answer

The user's machine has a corrupted DNS cache.

Question 15

A technician is troubleshooting a connectivity issue. The technician can successfully ping the IP address of a web server (10.10.10.10) from a client, but the client cannot access the web page. Firewall rules allow HTTP traffic. At which OSI layer is the issue most likely occurring?

Accepted Answer

Application layer (Layer 7). Since the client can successfully ping the web server's IP address (10.10.10.10), Layer 3 (Network) and Layer 4 (Transport) connectivity is verified, as ICMP operates at Layer 3 and uses IP. The failure to access the web page despite firewall rules allowing HTTP traffic points to an issue at Layer 7 (Application), such as a misconfigured web server (e.g., HTTP 404, incorrect document root), a missing or incorrect Host header in the HTTP request, or an application-layer proxy or authentication problem that prevents the HTTP transaction from completing.

Answer

Session layer (Layer 5)

Answer

Transport layer (Layer 4)

Answer

Network layer (Layer 3)