N10-009 Network Troubleshooting Practice Question
A user's computer is unable to obtain a DHCP lease after connecting to a new switch port. The user's computer displays an IP address in the 169.254.x.x range. Other users on the same VLAN can obtain IP addresses successfully. The switch port is configured for 802.1X authentication. What is the most likely cause?
⚠ Common exam trap
The N10-009 exam often tests the misconception that a 169.254.x.x address always indicates a DHCP server problem, but the trap here is that the issue is actually an 802.1X authentication failure placing the port into a restricted VLAN without DHCP, not a global DHCP exhaustion or spanning-tree issue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user's computer has not authenticated via 802.1X and is placed in a restricted VLAN.
When 802.1X authentication is enabled on a switch port, the port initially operates in an unauthorized state, restricting traffic to only EAPoL (802.1X) frames. If the user's computer fails to authenticate (e.g., due to missing supplicant, incorrect credentials, or certificate issues), the switch can place the port into a restricted or guest VLAN that lacks a DHCP server or is isolated from the production network. The 169.254.x.x address (APIPA) indicates the client could not reach a DHCP server, which aligns with being placed in a VLAN without DHCP services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DHCP server has exhausted its address pool.
Why it's wrong here
If the DHCP server had genuinely exhausted its address pool, it would be unable to offer IP addresses to *any* new client requesting a lease on that specific VLAN or scope. This would manifest as multiple users or devices on the same network segment failing to obtain DHCP leases, not just an isolated incident with one user's computer. The problem would be widespread across the subnet, indicating a server-side resource limitation rather than a client-specific issue.
When this WOULD be correct
This option would be correct in a scenario where multiple users on the same VLAN are unable to obtain DHCP leases, and the DHCP server logs indicate no available addresses. The question would specify that all users are affected.
- ✗
The switch port is in a blocked state due to a spanning tree loop.
Why it's wrong here
A spanning tree protocol (STP) blocked state is a normal operational state to prevent network loops, not necessarily indicative of an active loop. If a switch port were blocked by STP, no traffic, including DHCP requests, would pass through it, effectively making the link appear completely non-functional for all protocols. However, a user's computer typically wouldn't even attempt DHCP if the physical link was entirely non-functional due to a blocked port. Furthermore, if an active loop *were* occurring, it would cause network-wide broadcast storms and severe performance degradation, affecting far more than just one user's DHCP process.
- ✓
The user's computer has not authenticated via 802.1X and is placed in a restricted VLAN.
Why this is correct
With 802.1X, unauthenticated devices are often placed in a restricted VLAN that may not include the DHCP server or have limited access. This explains why the computer gets an APIPA address while other devices on the same physical port (if authenticated) work normally.
- ✗
The network cable is faulty.
Why it's wrong here
A faulty network cable would typically result in a complete loss of link connectivity, indicated by no link lights on the network interface card (NIC) or switch port, or severe packet loss and errors. If the computer is able to attempt DHCP, it implies that a physical layer connection has been established and basic communication is possible, even if the DHCP request isn't successful. While a *partially* faulty cable could cause intermittent issues, a complete inability to obtain a DHCP lease without other symptoms like link flapping or no link suggests a higher-layer problem.
When this WOULD be correct
In a scenario where a user's computer shows 'Network cable unplugged' or intermittent disconnects, and other devices on the same port also fail, a faulty cable would be the likely cause.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓The user's computer has not authenticated via 802.1X and is placed in a restricted VLAN.Correct answer▾
Why this is correct
With 802.1X, unauthenticated devices are often placed in a restricted VLAN that may not include the DHCP server or have limited access. This explains why the computer gets an APIPA address while other devices on the same physical port (if authenticated) work normally.
✗The DHCP server has exhausted its address pool.Wrong answer — click to see why▾
Why this is wrong here
The DHCP server address pool exhaustion would affect all users on the VLAN, not just one user. Since other users can obtain IP addresses, the pool is not exhausted.
★ When this WOULD be the correct answer
This option would be correct in a scenario where multiple users on the same VLAN are unable to obtain DHCP leases, and the DHCP server logs indicate no available addresses. The question would specify that all users are affected.
Why candidates choose this
Candidates may confuse a local connectivity issue with a global DHCP server problem, or they may not consider that 169.254.x.x addresses indicate a local failure rather than server exhaustion.
✗The network cable is faulty.Wrong answer — click to see why▾
Why this is wrong here
A faulty network cable would typically cause a complete lack of connectivity or link drops, not a specific 169.254.x.x address. The user can still communicate on the local link (APIPA), indicating the cable is functional at layer 1/2.
★ When this WOULD be the correct answer
In a scenario where a user's computer shows 'Network cable unplugged' or intermittent disconnects, and other devices on the same port also fail, a faulty cable would be the likely cause.
Why candidates choose this
Candidates may default to physical layer issues when troubleshooting connectivity problems, overlooking the more specific indicator of APIPA addressing which points to DHCP failure rather than cable faults.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Troubleshoot: Network Connectivity
Key term
802.1X
802.1X is a network access control standard that authenticates devices before they are allowed to connect to a wired or wireless network.
Key term
APIPA
APIPA is a Windows feature that automatically assigns a private IP address (169.254.x.x) to a device when a DHCP server is unavailable, allowing limited local network communication.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.