N10-009 Network Troubleshooting Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Mismatched encryption algorithms

  Why it's wrong here

  Mismatched encryption algorithms prevent the successful establishment of a VPN tunnel during the Internet Key Exchange (IKE) phases. If the two VPN endpoints cannot agree on a common set of cryptographic parameters, such as the encryption algorithm (e.g., AES-256 vs. 3DES) or hashing function (e.g., SHA-256 vs. MD5), the security association (SA) negotiation will fail. Since the problem implies that traffic is attempting to flow and being dropped by a firewall, the VPN tunnel must have already been established, making mismatched encryption algorithms an unlikely cause.

  When this WOULD be correct

  In a scenario where the VPN tunnel fails to establish or shows as down, mismatched encryption algorithms (e.g., AES vs. 3DES) are a common cause, especially when both sides have different security association proposals.

• ✓

  Asymmetric routing causing the stateful firewall to drop return traffic

  Why this is correct

  The stateful firewall expects to see both directions of a connection. If traffic from Branch A enters one firewall interface but the return traffic leaves via a different path, the firewall sees the return packet as unsolicited and drops it.

• ✗

  Incorrect DNS configuration

  Why it's wrong here

  Incorrect DNS configuration primarily affects name resolution, preventing devices from translating human-readable domain names into numerical IP addresses. If DNS were the issue, users would be unable to reach resources by hostname, but direct IP address communication would still function. Since the problem describes traffic being dropped by a firewall and implies that IP-based connectivity might be working (e.g., ping by IP to the gateway works), DNS is not the root cause of the firewall actively dropping packets that have a valid destination IP address.

  When this WOULD be correct

  A network technician is troubleshooting why users at a remote site cannot access internal servers by hostname, but can access them by IP address. The VPN tunnel is up and ping to the servers' IPs works. In this scenario, incorrect DNS configuration would be the likely cause.

• ✗

  MTU mismatch causing fragmentation issues

  Why it's wrong here

  An MTU (Maximum Transmission Unit) mismatch occurs when the largest packet size allowed on a network path varies, leading to fragmentation or dropping of larger packets if the 'Don't Fragment' bit is set. While MTU issues can cause packet loss, slow performance, or timeouts for specific applications, a stateful firewall typically drops traffic due to policy violations or a mismatch in its connection state table. The firewall would log a drop based on stateful inspection rules, not directly because of an MTU-related fragmentation problem, making this an indirect or unlikely cause for a firewall-specific drop.

  When this WOULD be correct

  In a scenario where users can establish a VPN connection but experience slow or intermittent access to applications, and large packets fail while small ones succeed, MTU mismatch would be the correct answer.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”