N10-009 Network Troubleshooting Practice Question
A user at a branch office reports that they cannot connect to a file server at the main office. The branch office connects to the main office via a site-to-site VPN, and the VPN tunnel shows as active. The user can ping the main office's default gateway but not the file server. Which of the following should the technician check NEXT?
⚠ Common exam trap
The N10-009 exam often tests the misconception that a 'tunnel up' status guarantees end-to-end connectivity, but the trap here is that routing misconfiguration can allow the tunnel to be established while specific subnets remain unreachable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A) Check the routing tables on the branch router
The VPN tunnel is active and the user can ping the main office's default gateway, which confirms that Layer 3 connectivity exists across the tunnel. However, the file server is unreachable, indicating that the traffic destined for the file server's subnet is not being forwarded correctly. The next logical step is to check the routing tables on the branch router to ensure there is a specific route (or a default route) pointing to the VPN tunnel interface for the file server's network. Without this route, the branch router may be dropping the packets or sending them out the wrong interface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A) Check the routing tables on the branch router
Why this is correct
Correct. The branch router may not have a route to the file server's subnet, or the main office router may not have a route back to the branch subnet. Verifying routing tables on both ends is essential.
- ✗
B) Check the DNS resolution for the file server
Why it's wrong here
Checking DNS resolution for the file server is incorrect because the user can ping the remote gateway, confirming basic IP-level connectivity through the VPN. If the user is attempting to connect to the file server using its IP address, DNS is not involved in the process. Even if connecting by hostname, a DNS failure would typically manifest as a 'host not found' error, whereas a 'cannot connect' message often points to a deeper network layer problem like routing after successful name resolution.
When this WOULD be correct
A user can connect to a server by IP address but not by hostname. The technician should check DNS resolution to ensure the hostname resolves correctly.
- ✗
C) Check the VPN encryption settings
Why it's wrong here
Checking VPN encryption settings is incorrect because the user can successfully ping the remote gateway, indicating the VPN tunnel is established and operational at a fundamental level. Mismatched encryption algorithms, authentication methods, or pre-shared keys would typically prevent the tunnel from forming or passing any traffic whatsoever. Since basic connectivity through the tunnel exists, the issue is likely not with the VPN's foundational security parameters.
When this WOULD be correct
A technician finds that a site-to-site VPN tunnel is down or intermittently dropping, and the logs show encryption mismatches (e.g., AES vs. 3DES, or incorrect pre-shared keys). In that case, checking VPN encryption settings would be the next step to resolve the tunnel failure.
- ✗
D) Check the file server's antivirus software
Why it's wrong here
Incorrect. Antivirus software on the file server could block certain traffic, but it would not cause a 'cannot connect' issue at the network level if routing is correct. It is less likely to be the first step.
When this WOULD be correct
A technician would check the file server's antivirus software if users at the main office report they cannot connect to the file server locally, and other network connectivity is working. The antivirus might be blocking file-sharing ports or quarantining the server's network service.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓A) Check the routing tables on the branch routerCorrect answer▾
Why this is correct
Correct. The branch router may not have a route to the file server's subnet, or the main office router may not have a route back to the branch subnet. Verifying routing tables on both ends is essential.
✗B) Check the DNS resolution for the file serverWrong answer — click to see why▾
Why this is wrong here
The user can ping the main office's default gateway, indicating the VPN tunnel is working and routing is functional at the network layer. DNS resolution is not the issue because connectivity to the file server fails at the IP level, not due to name resolution.
★ When this WOULD be the correct answer
A user can connect to a server by IP address but not by hostname. The technician should check DNS resolution to ensure the hostname resolves correctly.
Why candidates choose this
Candidates often assume that connectivity issues are due to DNS, especially when users refer to servers by name, but here the problem persists at the IP layer (ping fails).
✗C) Check the VPN encryption settingsWrong answer — click to see why▾
Why this is wrong here
The VPN tunnel is active and the user can ping the main office's default gateway, indicating the VPN is established and encryption settings are likely correct. The issue is connectivity to a specific server beyond the gateway, pointing to routing or firewall rules rather than encryption.
★ When this WOULD be the correct answer
A technician finds that a site-to-site VPN tunnel is down or intermittently dropping, and the logs show encryption mismatches (e.g., AES vs. 3DES, or incorrect pre-shared keys). In that case, checking VPN encryption settings would be the next step to resolve the tunnel failure.
Why candidates choose this
Candidates may assume that any VPN issue involves encryption settings, especially when the problem is connectivity across a VPN. They overlook that an active tunnel with successful pings to the gateway implies encryption is working.
✗D) Check the file server's antivirus softwareWrong answer — click to see why▾
Why this is wrong here
The file server's antivirus software is unlikely to cause connectivity issues from a remote branch office when the VPN tunnel is active and the user can ping the main office's default gateway. The problem is more likely related to routing or network segmentation within the main office.
★ When this WOULD be the correct answer
A technician would check the file server's antivirus software if users at the main office report they cannot connect to the file server locally, and other network connectivity is working. The antivirus might be blocking file-sharing ports or quarantining the server's network service.
Why candidates choose this
Candidates may think antivirus software could block network traffic, but in this scenario the issue is specific to remote access via VPN, making routing or firewall rules more relevant.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Troubleshoot: Cable and Physical Layer
Key term
Route
A route is a path that data takes through a network from one device or network to another, determined by routing protocols and configured rules.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.