N10-009 Network Troubleshooting Practice Question
A network technician is troubleshooting an issue where users on VLAN 20 can access internal servers and the default gateway but cannot reach any external websites. The router's ACL is configured to permit all outbound traffic. What is the most likely cause of this issue?
⚠ Common exam trap
CompTIA often tests the misconception that an ACL permitting all outbound traffic is sufficient for internet access, but without NAT, private IP addresses are not routable on the public internet, so the ACL alone cannot fix the issue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NAT is not configured or is misconfigured on the router
Since users can access internal servers and the default gateway, Layer 3 connectivity within the VLAN is working, and the router's ACL permits all outbound traffic. The inability to reach external websites while internal resources are reachable strongly indicates that Network Address Translation (NAT) is either not configured or misconfigured on the router. Without NAT, private IP addresses from VLAN 20 cannot be translated to a public IP, so return traffic from external web servers has no route back to the internal hosts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DNS server is unreachable from the VLAN
Why it's wrong here
DNS issues would affect name resolution, but the users can access internal resources by IP. Additionally, the problem is specifically with external websites, and if DNS were the root cause, they would likely be unable to resolve any hostnames, not just external ones.
When this WOULD be correct
A question where users cannot access any external resources (including internal servers by name) but can ping external IPs, or where the error message indicates 'server not found' while internal IP access works, would make DNS the correct answer.
- ✗
The DHCP server is not providing a default gateway
Why it's wrong here
A default gateway is absolutely essential for any device to send IP traffic to destinations located outside its immediate local subnet. If the DHCP server failed to provide a default gateway, or if it was misconfigured, users would be unable to reach *any* resources beyond their immediate local network segment, including internal servers residing on different subnets. Since the problem statement indicates users *can* access internal resources, this confirms that a default gateway is correctly assigned and functional for intra-network routing.
When this WOULD be correct
This would be correct if users could not reach any external or internal resources, and the question specified that clients receive an APIPA address or cannot ping the gateway, indicating DHCP failure to provide a default gateway.
- ✓
NAT is not configured or is misconfigured on the router
Why this is correct
NAT is required to translate private VLAN IPs to a public IP for internet access. Even if ACLs permit traffic, without proper NAT, packets will not be forwarded to the internet. This matches the symptom of being able to reach internal resources but not external ones.
- ✗
The switch port for the router is in the wrong VLAN
Why it's wrong here
If the switch port connecting the router were assigned to an incorrect VLAN, the router's interface would not be able to establish Layer 2 communication with devices residing in the intended VLAN. This misconfiguration would prevent users from successfully pinging their default gateway, as the router would be unreachable on the local subnet. The ability of users to ping the default gateway directly refutes this possibility, confirming proper Layer 2 VLAN assignment and connectivity between the hosts and their gateway.
When this WOULD be correct
A scenario where users on a VLAN cannot reach any external resources, including the default gateway, and internal servers are also unreachable. In that case, a misconfigured switch port (e.g., access port in wrong VLAN or trunk issue) could isolate the entire VLAN from the router.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓NAT is not configured or is misconfigured on the routerCorrect answer▾
Why this is correct
NAT is required to translate private VLAN IPs to a public IP for internet access. Even if ACLs permit traffic, without proper NAT, packets will not be forwarded to the internet. This matches the symptom of being able to reach internal resources but not external ones.
✗The DNS server is unreachable from the VLANWrong answer — click to see why▾
Why this is wrong here
The question states users can access internal servers and the default gateway, which indicates DNS resolution for internal names works and the gateway is reachable. External website access failure with a permissive ACL points to a NAT issue, not DNS.
★ When this WOULD be the correct answer
A question where users cannot access any external resources (including internal servers by name) but can ping external IPs, or where the error message indicates 'server not found' while internal IP access works, would make DNS the correct answer.
Why candidates choose this
Candidates often default to DNS as the cause of web browsing failures, overlooking that internal access works and the symptom pattern specifically points to NAT misconfiguration.
✗The DHCP server is not providing a default gatewayWrong answer — click to see why▾
Why this is wrong here
The question states users can access internal servers and the default gateway, so the DHCP server is providing a default gateway. The issue is external access, not gateway reachability.
★ When this WOULD be the correct answer
This would be correct if users could not reach any external or internal resources, and the question specified that clients receive an APIPA address or cannot ping the gateway, indicating DHCP failure to provide a default gateway.
Why candidates choose this
Candidates may confuse symptoms of missing default gateway (no external access) with the given scenario, overlooking that internal access and gateway reachability are already working.
✗The switch port for the router is in the wrong VLANWrong answer — click to see why▾
Why this is wrong here
The switch port for the router being in the wrong VLAN would prevent all traffic from that VLAN from reaching the router, but users can access internal servers and the default gateway, indicating the router is reachable. Thus, the issue is not at the switch port level.
★ When this WOULD be the correct answer
A scenario where users on a VLAN cannot reach any external resources, including the default gateway, and internal servers are also unreachable. In that case, a misconfigured switch port (e.g., access port in wrong VLAN or trunk issue) could isolate the entire VLAN from the router.
Why candidates choose this
Candidates may think that if the router's port is in the wrong VLAN, traffic cannot exit the VLAN, but the symptom of being able to reach the default gateway contradicts this, making the option tempting but incorrect.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Troubleshooting Methodology
Key term
Route
A route is a path that data takes through a network from one device or network to another, determined by routing protocols and configured rules.
Key term
NAT
NAT (Network Address Translation) is a method that allows multiple devices on a private network to share a single public IP address when accessing the internet.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.