N10-009 Timed Practice Test 1 — 10 Questions

Question 1

A security analyst is reviewing firewall logs and sees many incoming packets with a source IP address that matches the internal IP range of the company (10.0.0.0/8) arriving on the external interface. Which type of attack is likely being attempted?

10 minute time limit — choose an answer to begin.

Accepted Answer

IP spoofing attack. Packets arriving on the external interface with a source IP address from the internal 10.0.0.0/8 range indicate that the attacker is forging (spoofing) the source address to impersonate an internal host. This is a classic IP spoofing attack, often used to bypass access control lists or to launch further attacks that rely on trust relationships based on source IP.

Answer

Smurf attack

Answer

SYN flood

Answer

DNS amplification

Question 2

A network technician runs the command "traceroute 8.8.8.8" from a workstation. The output shows the first hop as the default gateway, the second hop as an internal router, and then a series of asterisks (* * *) before reaching the destination. What does the series of asterisks indicate?

Accepted Answer

The intermediate routers are not responding to ICMP time-exceeded messages. The series of asterisks indicates that intermediate routers beyond the second hop are not responding with ICMP Time-Exceeded messages when the TTL expires. Traceroute relies on these ICMP responses to identify each hop; if a router is configured to drop ICMP or not send the message, the output shows asterisks for that hop. The destination is still reachable, as the final hop succeeds, so the asterisks do not indicate unreachability.

Answer

The destination is unreachable

Answer

The TTL expired at the last hop

Answer

The connection is encrypted

Question 3

A network engineer is designing a network and needs to ensure that broadcast traffic is contained within a single broadcast domain. Which of the following devices should be used to create these separate broadcast domains?

Accepted Answer

Router. A router operates at Layer 3 of the OSI model and does not forward broadcast frames by default, making it the correct device to segment a network into separate broadcast domains. Each interface on a router creates a distinct broadcast domain, ensuring that broadcast traffic is contained within that interface's subnet.

Answer

Hub

Answer

Bridge

Answer

Switch

Question 4

A user reports that they cannot access any network resources. The technician checks the IP configuration and sees that the workstation has an IP address of 169.254.1.5. What is the most likely cause?

Accepted Answer

The DHCP server is unavailable. The IP address 169.254.1.5 is an Automatic Private IP Addressing (APIPA) address (169.254.0.0/16 range), which Windows assigns when a DHCP client fails to receive a lease from a DHCP server. Since the workstation cannot obtain a valid IP configuration, it cannot communicate with any network resources, confirming that the DHCP server is unavailable.

Answer

The DNS server is down

Answer

The default gateway is incorrect

Answer

The subnet mask is mismatched

Question 5

A company wants to prevent unauthorized devices from connecting to the corporate network. The policy requires that only specific MAC addresses are permitted on switch ports. Which security feature should be implemented on the switches?

Accepted Answer

MAC filtering / Port security. MAC filtering, also known as port security, is the correct feature because it allows the switch to restrict access to a port based on the source MAC address of incoming frames. By configuring a list of allowed MAC addresses, the switch will drop traffic from any unauthorized device, directly enforcing the policy that only specific MAC addresses are permitted on switch ports.

Answer

802.1X authentication

Answer

VLAN hopping prevention

Answer

DHCP snooping

Question 6

A network administrator is connecting two switches and wants to increase the bandwidth between them while also providing redundancy in case one link fails. Which technology should be configured on the switch ports?

Accepted Answer

Link Aggregation Control Protocol (LACP). Link Aggregation Control Protocol (LACP) allows multiple physical links between two switches to be combined into a single logical link, increasing aggregate bandwidth and providing redundancy: if one physical link fails, traffic continues over the remaining links. This directly meets the requirement for both higher bandwidth and link-level fault tolerance.

Answer

Spanning Tree Protocol (STP)

Answer

VLAN trunking (802.1Q)

Answer

Power over Ethernet (PoE)

Question 7

An organization uses OSPF as its interior gateway protocol in a multi-area design. After a core router failure, the network takes a long time to reconverge. Which technology can be implemented to improve convergence speed?

Accepted Answer

Implement Bidirectional Forwarding Detection (BFD). BFD provides sub-second failure detection by sending rapid, lightweight hello packets independently of OSPF's own hello mechanism. When a core router fails, BFD detects the link down in milliseconds and immediately signals OSPF to trigger reconvergence, drastically reducing the time OSPF would otherwise spend waiting for its own dead timer to expire.

Answer

Use static routes instead of OSPF

Answer

Increase OSPF hello and dead timers

Answer

Configure all routers in a single OSPF area

Question 8

A network administrator needs to connect two switches located in separate buildings 150 meters apart. The connection must support 10 Gbps speeds. Which cabling type is most appropriate?

Accepted Answer

Multi-mode fiber optic. Multi-mode fiber optic (MMF) is the most appropriate choice because it supports 10 Gbps speeds over distances up to 300 meters (using OM3 or OM4 fiber) with cost-effective transceivers (e.g., 10GBASE-SR). The 150-meter distance exceeds the 100-meter maximum for twisted-pair copper cabling (Cat6a or Cat7) at 10 Gbps, making fiber the only viable option among the choices.

Answer

Cat6a twisted pair

Answer

Cat7 twisted pair

Answer

Single-mode fiber optic

Question 9

A security analyst notices that a web server is receiving a large number of ICMP echo reply packets from many different external hosts. The server did not send any echo requests. Which type of attack is most likely occurring?

Accepted Answer

Smurf attack. A Smurf attack exploits IP broadcast addressing and ICMP. The attacker sends a large number of ICMP echo request packets with a spoofed source IP (the victim's IP) to a network's broadcast address. All hosts on that network then send ICMP echo reply packets to the victim, overwhelming it with traffic. Since the server never sent any echo requests, the unsolicited flood of echo replies is the hallmark of a Smurf attack.

Answer

Ping flood

Answer

ICMP tunneling

Answer

Fraggle attack

Question 10

A network administrator is preparing documentation for a new branch office. The administrator needs a diagram that shows the logical relationships between network devices and how VLANs are trunked over inter-switch links. Which type of document should be created?

Accepted Answer

Logical topology diagram. A logical topology diagram is the correct choice because it illustrates how devices communicate across the network, including VLAN assignments and trunk links (e.g., 802.1Q tagging) between switches. This diagram abstracts physical locations to show Layer 2 and Layer 3 relationships, such as which VLANs traverse which inter-switch links, making it ideal for documenting VLAN trunking and logical connectivity.

Answer

Network baseline

Answer

Wiring diagram

Answer

Physical topology diagram