N10-009 Network Implementation Practice Question
A new switch is installed in a remote wiring closet. It has been configured with a management IP address of 10.1.2.50/24. The switch is connected via a trunk to the distribution switch, and the management station (10.1.1.0/24) is on a different subnet. The switch cannot be pinged from the management station. The distribution switch has routing to the 10.1.2.0/24 subnet. What is the most likely cause?
⚠ Common exam trap
The N10-009 exam often tests the misconception that a management IP alone is sufficient for remote access, but candidates forget that a default gateway is mandatory for inter-subnet communication, especially when the management station and switch are on different subnets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The default gateway is not configured on the new switch.
The management station is on subnet 10.1.1.0/24, while the switch's management IP is 10.1.2.50/24. For the switch to reply to pings from a different subnet, it must have a default gateway configured so it knows where to send return traffic. Without a default gateway, the switch will only respond to traffic on its local subnet, making it unreachable from the management station.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The management VLAN is not allowed on the trunk.
Why it's wrong here
If the management VLAN is not explicitly allowed on the trunk link connecting the new switch to the distribution switch, no traffic for that VLAN can traverse the link. This means the switch would be completely unreachable for management purposes, even from devices within its *own* management subnet if those devices are on the other side of the trunk. The absence of the VLAN on the trunk would prevent any communication, not just cross-subnet routing.
When this WOULD be correct
This would be correct if the management station were on the same subnet as the switch's management IP (e.g., both in 10.1.2.0/24) and the trunk connected the switch to a distribution switch that does not have routing enabled for that VLAN. In that case, the management VLAN must be allowed on the trunk for the management station to reach the switch.
- ✓
The default gateway is not configured on the new switch.
Why this is correct
A switch's management interface, often a Switched Virtual Interface (SVI), requires a default gateway to route IP packets destined for networks outside its directly connected subnet. Without a configured default gateway, the switch can only communicate with devices within its own management VLAN and subnet. This specific issue explains why the switch is reachable locally but not from other subnets, as it lacks the necessary routing information to forward responses back to remote management stations.
- ✗
The switch port to the distribution switch is in access mode.
Why it's wrong here
Configuring the switch port to the distribution switch in access mode would severely restrict or completely break connectivity for multiple VLANs. An access port is designed to carry traffic for only a single, untagged VLAN, typically for an end device. If the management VLAN or other necessary VLANs are not the one configured on that access port, or if multiple VLANs need to traverse this uplink, the switch would experience widespread connectivity issues, potentially preventing any management access whatsoever.
When this WOULD be correct
This would be correct if the new switch were connected via an access port to the distribution switch, and the management station needed to reach it across different VLANs without routing. For example, if the distribution switch had no routing and the management VLAN was only on the access port.
- ✗
The management IP is configured on the wrong VLAN.
Why it's wrong here
If the management IP address were configured on the wrong VLAN, the switch would be unreachable from its intended management subnet entirely. The IP address would not correspond to the network segment where management traffic is expected, preventing any layer 3 communication. This scenario would result in a complete lack of management connectivity, not just an inability to reach it from *other* subnets.
When this WOULD be correct
In a scenario where the management station and switch are on the same subnet but ping fails, and the switch's management IP is assigned to a VLAN that is not the native VLAN or is blocked on the trunk, then the management VLAN being wrong would be the cause.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓The default gateway is not configured on the new switch.Correct answer▾
Why this is correct
A switch's management interface, often a Switched Virtual Interface (SVI), requires a default gateway to route IP packets destined for networks outside its directly connected subnet. Without a configured default gateway, the switch can only communicate with devices within its own management VLAN and subnet. This specific issue explains why the switch is reachable locally but not from other subnets, as it lacks the necessary routing information to forward responses back to remote management stations.
✗The management VLAN is not allowed on the trunk.Wrong answer — click to see why▾
Why this is wrong here
The management station is on a different subnet (10.1.1.0/24) than the switch (10.1.2.0/24), and the distribution switch has routing to the 10.1.2.0/24 subnet. Even if the management VLAN were not allowed on the trunk, the switch would still be reachable via its management IP if the default gateway were configured, because the distribution switch could route traffic to the switch's subnet. The issue is that the switch lacks a default gateway to return traffic to the management station's subnet.
★ When this WOULD be the correct answer
This would be correct if the management station were on the same subnet as the switch's management IP (e.g., both in 10.1.2.0/24) and the trunk connected the switch to a distribution switch that does not have routing enabled for that VLAN. In that case, the management VLAN must be allowed on the trunk for the management station to reach the switch.
Why candidates choose this
Candidates often confuse reachability issues with VLAN pruning or trunk misconfiguration, assuming that if a device is on a different VLAN, the VLAN must be explicitly allowed on the trunk. They overlook the role of routing and default gateway in inter-subnet communication.
✗The switch port to the distribution switch is in access mode.Wrong answer — click to see why▾
Why this is wrong here
The switch port to the distribution switch is a trunk, not an access port. Access mode would prevent VLAN trunking, but the question states a trunk is used, so this is not the issue.
★ When this WOULD be the correct answer
This would be correct if the new switch were connected via an access port to the distribution switch, and the management station needed to reach it across different VLANs without routing. For example, if the distribution switch had no routing and the management VLAN was only on the access port.
Why candidates choose this
Candidates may confuse port mode with VLAN membership, thinking that an access port might still allow management traffic if the VLAN matches, but they overlook that the trunk is explicitly mentioned and that routing is already in place.
✗The management IP is configured on the wrong VLAN.Wrong answer — click to see why▾
Why this is wrong here
The management IP is configured on the correct VLAN (likely VLAN 1 by default), and the trunk allows that VLAN; the issue is that the switch has no default gateway to reach the management station on a different subnet.
★ When this WOULD be the correct answer
In a scenario where the management station and switch are on the same subnet but ping fails, and the switch's management IP is assigned to a VLAN that is not the native VLAN or is blocked on the trunk, then the management VLAN being wrong would be the cause.
Why candidates choose this
Candidates may confuse VLAN misconfiguration with routing issues, assuming that if the management IP is on a different VLAN than expected, it would cause unreachability, even when the trunk and routing are properly set up.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Switch Port Modes: Access vs Trunk
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.