N10-009 Network Troubleshooting Practice Question
A user's computer obtains an IP address from DHCP, can ping the default gateway, but cannot access any external websites. The technician runs 'tracert 8.8.8.8' from the user's computer. The first hop shows the default gateway with low latency, but the second hop shows a timeout. What is the most likely cause?
⚠ Common exam trap
Many candidates confuse a DNS resolution failure with a routing failure, but the traceroute to an IP address bypasses DNS entirely, so the timeout at the second hop isolates the issue to the router's default route rather than DNS or the local firewall.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The router's default route pointing to the ISP is missing or incorrectly configured.
The traceroute shows that the user's computer can reach the default gateway (first hop) but times out at the second hop, which is the ISP's router. This indicates that the local router does not have a valid default route pointing to the ISP, so it cannot forward traffic beyond the local subnet. Without a correct default route, packets destined for external networks (like 8.8.8.8) are dropped, even though the user's computer can ping the gateway and obtain an IP via DHCP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user's computer firewall is blocking outbound web traffic.
Why it's wrong here
If the firewall were blocking web traffic, the traceroute would still likely show the first hop, but the subsequent hops might fail due to the firewall dropping the ICMP packets? However, the traceroute uses ICMP or UDP which may be blocked by different rules. The pattern of first hop success and second hop timeout points to a routing issue beyond the gateway.
When this WOULD be correct
A user cannot access external websites but can ping internal IPs and the default gateway. Tracert shows the first hop succeeds but subsequent hops time out, and the firewall logs show outbound HTTP/HTTPS traffic being dropped. In that case, the local firewall blocking outbound web traffic would be correct.
- ✗
The DNS server is not resolving domain names.
Why it's wrong here
DNS resolution is a service that translates human-readable domain names into IP addresses. However, `traceroute` can be performed directly to an IP address, bypassing the need for DNS. If the problem were solely a DNS server issue, a `traceroute` to a known external IP address would still succeed, demonstrating network connectivity, even if accessing websites by name failed. The failure to reach beyond the first hop with an IP address target points to a routing problem, not a name resolution issue.
When this WOULD be correct
In a scenario where a user can obtain an IP address from DHCP, ping the default gateway, but cannot access external websites by name, and 'nslookup' fails to resolve domain names while pinging external IP addresses succeeds, then the DNS server being unreachable or misconfigured would be the correct answer.
- ✓
The router's default route pointing to the ISP is missing or incorrectly configured.
Why this is correct
When a traceroute successfully reaches the first hop (the local router) but fails at subsequent hops, it indicates the local router received the packet but cannot forward it further towards the destination. This scenario strongly suggests that the router lacks a proper default route (0.0.0.0/0) configured to point to the next-hop router at the Internet Service Provider (ISP). Without this critical route, the router doesn't know where to send traffic destined for external networks, causing packets to be dropped or timed out beyond the local network.
- ✗
The ISP's DNS server is unreachable.
Why it's wrong here
Similar to general DNS issues, the unreachability of the ISP's specific DNS server does not prevent `traceroute` from functioning when an IP address is provided as the target. `Traceroute` operates at the network layer, sending ICMP or UDP packets directly to IP addresses to map the path. A failure at the second hop, indicating packets are not leaving the local network, signifies a fundamental routing problem on the local gateway, entirely independent of any DNS server's operational status or reachability.
When this WOULD be correct
In a scenario where a user can access external websites by IP address (e.g., pinging 8.8.8.8 works) but cannot resolve domain names, and the DNS server is configured on the ISP's side, then an unreachable ISP DNS server would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓The router's default route pointing to the ISP is missing or incorrectly configured.Correct answer▾
Why this is correct
When a traceroute successfully reaches the first hop (the local router) but fails at subsequent hops, it indicates the local router received the packet but cannot forward it further towards the destination. This scenario strongly suggests that the router lacks a proper default route (0.0.0.0/0) configured to point to the next-hop router at the Internet Service Provider (ISP). Without this critical route, the router doesn't know where to send traffic destined for external networks, causing packets to be dropped or timed out beyond the local network.
✗The user's computer firewall is blocking outbound web traffic.Wrong answer — click to see why▾
Why this is wrong here
The user can ping the default gateway and tracert shows the first hop succeeds, indicating outbound traffic is not blocked by the local firewall. The issue is beyond the gateway, at the second hop, which points to a routing problem.
★ When this WOULD be the correct answer
A user cannot access external websites but can ping internal IPs and the default gateway. Tracert shows the first hop succeeds but subsequent hops time out, and the firewall logs show outbound HTTP/HTTPS traffic being dropped. In that case, the local firewall blocking outbound web traffic would be correct.
Why candidates choose this
Candidates may assume that inability to access websites is always due to firewall rules, overlooking that the tracert result localizes the problem to the router's upstream routing, not the local host.
✗The DNS server is not resolving domain names.Wrong answer — click to see why▾
Why this is wrong here
The user can ping the default gateway and tracert shows the first hop succeeds, indicating local network connectivity is fine. DNS issues would prevent name resolution, but the question states the user cannot access external websites, and tracert to an IP address (8.8.8.8) shows a timeout at the second hop, which points to a routing problem beyond the gateway, not DNS.
★ When this WOULD be the correct answer
In a scenario where a user can obtain an IP address from DHCP, ping the default gateway, but cannot access external websites by name, and 'nslookup' fails to resolve domain names while pinging external IP addresses succeeds, then the DNS server being unreachable or misconfigured would be the correct answer.
Why candidates choose this
Candidates often confuse inability to access websites with DNS failure, especially when they see that pinging an IP works but browsing fails. They may overlook the tracert output showing a routing issue at the second hop, which clearly indicates the problem is beyond DNS.
✗The ISP's DNS server is unreachable.Wrong answer — click to see why▾
Why this is wrong here
The user can ping the default gateway, and tracert shows the first hop (gateway) succeeds, indicating local connectivity is fine. The second hop timeout suggests the issue is beyond the gateway, likely a missing or incorrect default route on the router, not the ISP's DNS server being unreachable.
★ When this WOULD be the correct answer
In a scenario where a user can access external websites by IP address (e.g., pinging 8.8.8.8 works) but cannot resolve domain names, and the DNS server is configured on the ISP's side, then an unreachable ISP DNS server would be the correct answer.
Why candidates choose this
Candidates often confuse DNS resolution issues with routing problems, and since external websites are unreachable, they may incorrectly attribute it to DNS, especially when the ISP provides DNS services.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
CLI Tools: ping, tracert, nslookup, netstat
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
Key term
Latency
Latency is the time delay between a request being sent over a network and the response being received, often measured in milliseconds.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.