N10-009 Networking Concepts Practice Question
A network technician is explaining the process of resolving Layer 2 addresses to Layer 3 addresses on a local network. Which protocol is used by a host to determine the MAC address of another host given its IP address?
⚠ Common exam trap
Test-takers frequently confuse ARP with DNS because both involve 'resolution,' but DNS resolves names to IPs (Layer 3) while ARP resolves IPs to MACs (Layer 2), and Cisco tests this distinction by including DNS as a distractor in Layer 2 addressing questions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP
ARP (Address Resolution Protocol) is the correct answer because it is specifically designed to resolve a known Layer 3 (IP) address to an unknown Layer 2 (MAC) address on a local network. When a host needs to send a frame to another host, it first checks its ARP cache; if no entry exists, it broadcasts an ARP request containing the target IP, and the host with that IP responds with its MAC address. This process is defined in RFC 826 and operates at the data link layer, enabling direct communication within the same broadcast domain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS
Why it's wrong here
The Domain Name System (DNS) is a hierarchical and distributed naming system for computers, services, or any resource connected to the Internet or a private network. Its fundamental purpose is to translate human-readable domain names, such as 'www.example.com', into numerical IP addresses that computers use to identify each other. While essential for navigating the internet, DNS operates at the application layer and is distinct from resolving an IP address to a MAC address on a local network segment. It does not handle the physical address mapping required for local frame delivery.
When this WOULD be correct
DNS would be correct in a question like: 'Which protocol is used to resolve a fully qualified domain name (FQDN) to an IP address?'
- ✓
ARP
Why this is correct
The Address Resolution Protocol (ARP) is a crucial Layer 2 protocol that dynamically maps an IPv4 address to its corresponding hardware (MAC) address within the same local network segment. When a device needs to communicate with another device on the same subnet, it uses ARP to discover the destination's MAC address if it's not already known. This involves broadcasting an ARP request for the target IP, and the device with that IP responds with its MAC address, allowing for proper frame encapsulation and delivery. ARP is fundamental for enabling IP packets to traverse Ethernet networks.
- ✗
DHCP
Why it's wrong here
Dynamic Host Configuration Protocol (DHCP) is a network management protocol used to dynamically assign IP addresses and other network configuration parameters to devices connected to a network. Its primary function is to automate the configuration of network settings, such as subnet mask, default gateway, and DNS server addresses, to client devices. DHCP does not perform address resolution between IP and MAC addresses; instead, it provides the initial network identity to a host. This protocol simplifies network administration by centralizing IP address management.
When this WOULD be correct
A question asking which protocol automatically assigns IP addresses, subnet masks, default gateways, and DNS server addresses to hosts on a network would have DHCP as the correct answer.
- ✗
ICMP
Why it's wrong here
Internet Control Message Protocol (ICMP) operates at the network layer and is primarily used for error reporting and diagnostic functions within an IP network. It facilitates communication about network conditions, such as indicating that a requested service is unavailable or a host is unreachable. Common utilities like 'ping' and 'traceroute' rely on ICMP messages to test network connectivity and path. However, ICMP does not resolve logical IP addresses to physical MAC addresses; its role is strictly for control and informational messages.
When this WOULD be correct
A question asking which protocol is used to test reachability between hosts or to report network errors (e.g., 'Which protocol does ping use?') would have ICMP as the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓ARPCorrect answer▾
Why this is correct
The Address Resolution Protocol (ARP) is a crucial Layer 2 protocol that dynamically maps an IPv4 address to its corresponding hardware (MAC) address within the same local network segment. When a device needs to communicate with another device on the same subnet, it uses ARP to discover the destination's MAC address if it's not already known. This involves broadcasting an ARP request for the target IP, and the device with that IP responds with its MAC address, allowing for proper frame encapsulation and delivery. ARP is fundamental for enabling IP packets to traverse Ethernet networks.
✗DNSWrong answer — click to see why▾
Why this is wrong here
DNS resolves domain names to IP addresses, not MAC addresses. The question asks for the protocol that maps IP addresses (Layer 3) to MAC addresses (Layer 2), which is ARP.
★ When this WOULD be the correct answer
DNS would be correct in a question like: 'Which protocol is used to resolve a fully qualified domain name (FQDN) to an IP address?'
Why candidates choose this
Candidates may confuse 'address resolution' with DNS's name resolution, or think that DNS handles all types of address mapping on a network.
✗DHCPWrong answer — click to see why▾
Why this is wrong here
DHCP is used for dynamically assigning IP addresses and other network configuration parameters to hosts, not for resolving Layer 2 MAC addresses from Layer 3 IP addresses.
★ When this WOULD be the correct answer
A question asking which protocol automatically assigns IP addresses, subnet masks, default gateways, and DNS server addresses to hosts on a network would have DHCP as the correct answer.
Why candidates choose this
Candidates may confuse DHCP with ARP because both operate at the network layer and involve address assignment or resolution, leading them to think DHCP handles MAC-to-IP mapping.
✗ICMPWrong answer — click to see why▾
Why this is wrong here
ICMP is used for error reporting and diagnostics (e.g., ping), not for resolving Layer 2 addresses from Layer 3 addresses.
★ When this WOULD be the correct answer
A question asking which protocol is used to test reachability between hosts or to report network errors (e.g., 'Which protocol does ping use?') would have ICMP as the correct answer.
Why candidates choose this
Candidates may confuse ICMP's role in network troubleshooting with address resolution, or think that ICMP's use in ping involves MAC address discovery.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
OSI Model Reference
| Layer | Name | PDU | Key Protocols / Devices |
|---|---|---|---|
| 7 | Application | Data | HTTP, HTTPS, DNS, SMTP, FTP, SSH |
| 6 | Presentation | Data | TLS / SSL, JPEG, ASCII encoding |
| 5 | Session | Data | NetBIOS, RPC, SIP |
| 4 | Transport | Segment / Datagram | TCP, UDP |
| 3 | Network | Packet | IP, ICMP, OSPF — Routers |
| 2 | Data Link | Frame | Ethernet, Wi-Fi, PPP — Switches, Bridges |
| 1 | Physical | Bits | Cables, NICs, Hubs, Repeaters |
Go deeper
Related to this question
Learn chapter
Network Virtualization and VXLAN
Key term
ARP request
An ARP request is a network broadcast message sent by a device to discover the hardware (MAC) address of another device on the same local network given its IP address.
Key term
ARP
Address Resolution Protocol (ARP) is a network protocol used to map a device's IP address to its physical MAC address so data can be delivered correctly on a local network.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.