Courseiva

CompTIA Network+ N10-009 (N10-009) — Questions 175

464 questions total · 7pages · All types, answers revealed

Page 1 of 7

Page 2
1
MCQeasy

Which attack technique involves an attacker intercepting and potentially modifying the communication between two parties without their knowledge?

A.Man-in-the-middle
B.Replay attack
C.Smurf attack
D.Phishing
AnswerA

A Man-in-the-Middle (MitM) attack positions the attacker transparently between two communicating parties, allowing them to intercept, read, and potentially modify all data exchanged without either party being aware. The attacker effectively spoofs the identities of both endpoints, making each believe they are communicating directly with the other. This enables real-time manipulation of the communication stream, making it a highly effective method for data theft or session hijacking.

Why this answer

A man-in-the-middle (MITM) attack is correct because it specifically involves an attacker secretly intercepting and potentially altering communications between two parties who believe they are directly communicating with each other. This is achieved by the attacker inserting themselves into the communication path, often by ARP spoofing, DNS spoofing, or rogue access points, allowing them to capture, decrypt, or modify packets in transit.

Exam trap

The trap here is that candidates often confuse a replay attack with a MITM attack because both involve capturing traffic, but a replay attack only retransmits captured data without real-time interception or modification of the ongoing session.

Why the other options are wrong

B

A replay attack involves capturing and retransmitting valid data, but it does not inherently intercept or modify live communication between two parties; the attacker typically does not position themselves in the middle of the ongoing session.

D

Phishing is a social engineering attack that tricks users into revealing sensitive information, not an attack that intercepts or modifies communication between two parties.

When would these options actually be correct?

B

A replay attack would be correct for a question like: 'Which attack involves capturing network traffic and retransmitting it to impersonate a legitimate user or gain unauthorized access?'

D

A question asking 'Which attack involves sending fraudulent emails to trick users into revealing credentials?' would have phishing as the correct answer.

Why candidates pick the wrong answer

B

Candidates may confuse replay attacks with man-in-the-middle because both involve intercepting data, but they overlook that replay attacks focus on reuse rather than real-time modification or interception of the communication channel.

D

Candidates may confuse phishing with man-in-the-middle because both involve deception, but phishing targets the user directly rather than the communication channel.

2
MCQmedium

A network operations center uses SNMP to monitor device health. An administrator needs to retrieve the current CPU utilization from a router. Which SNMP operation is most appropriate?

A.GET
B.SET
C.TRAP
D.INFORM
AnswerA

The GET operation is fundamental for network monitoring as it allows an SNMP manager to actively query an agent for the current value of a specific managed object. When a Network Operations Center (NOC) needs to check device health, such as CPU utilization or interface status, the manager sends a GET request to the device's SNMP agent. The agent then retrieves the requested data from its Management Information Base (MIB) and returns it in a GET-RESPONSE message, providing real-time insight into the device's operational state.

Why this answer

The SNMP GET operation is used by an NMS (Network Management System) to actively request a specific variable from a managed device, such as the current CPU utilization from a router's OID. This is a poll-based retrieval, making it the correct choice for an administrator who needs to read a single value on demand.

Exam trap

The trap here is confusing event-driven notifications (TRAP/INFORM) with on-demand data retrieval, leading candidates to select TRAP because they associate it with CPU alerts, but the question asks for retrieving current utilization, not waiting for an alert.

Why the other options are wrong

B

SET is used to modify configuration or write data to a device, not to retrieve information. The question asks for retrieving CPU utilization, which requires a read operation.

C

TRAP is an unsolicited message sent by an SNMP agent to the manager to notify an event, not a request to retrieve data. The question asks for retrieving current CPU utilization, which requires a GET request from the manager.

D

INFORM is used for acknowledged SNMP notifications between managers, not for retrieving data like CPU utilization from an agent.

When would these options actually be correct?

B

An administrator needs to change the SNMP community string on a router to enhance security. In this case, SET would be the correct operation to apply the change.

C

A question where the administrator needs to be notified automatically when CPU utilization exceeds a threshold, such as 'Which SNMP operation should be configured on the router to send an alert when CPU usage is high?'

D

A question asking which SNMP operation ensures reliable delivery of alerts between two NMS systems, where the receiver sends an acknowledgment back to the sender.

Why candidates pick the wrong answer

B

Candidates may confuse SNMP operations, thinking SET can be used to 'set up' monitoring or retrieve data, or they may not clearly distinguish between read and write operations.

C

Candidates may confuse TRAP with a method to obtain data because traps are commonly used for monitoring, but they are event-driven notifications, not on-demand retrieval.

D

Candidates may confuse INFORM with GET, thinking it involves a request-response exchange, but INFORM is for notifications, not data retrieval.

3
MCQmedium

A network security analyst notices high CPU utilization on the core switch and detects a large volume of ARP replies from a single IP address that claims to be the default gateway for all local subnets. Which type of attack is MOST likely occurring?

A.ARP poisoning
B.DHCP starvation
C.MAC flooding
D.DNS amplification
AnswerA

ARP poisoning involves an attacker sending unsolicited, forged ARP reply messages to devices on a local network. These replies falsely associate the attacker's MAC address with the IP address of a legitimate network device, such as the default gateway or another host. This manipulation redirects network traffic through the attacker's machine, enabling man-in-the-middle attacks, data interception, or session hijacking. The high volume of replies and claiming to be the gateway are strong indicators of this attack.

Why this answer

The attack described is ARP poisoning (also known as ARP spoofing), where an attacker sends forged ARP replies to associate their MAC address with the IP address of the default gateway. This causes all traffic destined for other subnets to be redirected to the attacker's machine, leading to high CPU utilization on the switch as it processes the flood of ARP packets and forwards the intercepted traffic.

Exam trap

The N10-009 exam often tests the distinction between ARP poisoning and MAC flooding by describing symptoms like 'high CPU utilization' and 'large volume of ARP replies,' which can mislead candidates into thinking MAC flooding is the answer because it also causes high CPU, but the key clue is the specific use of ARP replies targeting the default gateway IP.

Why the other options are wrong

B

DHCP starvation floods a DHCP server with fake requests to exhaust its IP address pool, causing denial of service. It does not involve ARP replies or claiming to be a default gateway.

C

MAC flooding overwhelms a switch's CAM table with fake MAC addresses, causing it to fail open and flood traffic to all ports. The question describes ARP replies from a single IP claiming to be the default gateway, which is characteristic of ARP poisoning, not MAC flooding.

D

DNS amplification attacks involve sending small queries with a spoofed source IP to open DNS servers, which then send large responses to the victim, causing bandwidth exhaustion. This does not involve ARP replies or high CPU on a switch.

When would these options actually be correct?

B

A network administrator notices clients failing to obtain IP addresses and the DHCP server logs show a high volume of DHCPDISCOVER messages from spoofed MAC addresses. This scenario indicates a DHCP starvation attack.

C

MAC flooding would be correct in a scenario where an attacker sends numerous frames with random source MAC addresses to a switch, aiming to overflow the CAM table and force the switch into hub mode, allowing the attacker to sniff traffic across VLANs.

D

A question describing a network under DDoS attack with high outbound traffic, where the attacker uses small DNS queries to generate large responses from misconfigured DNS servers, overwhelming the target's bandwidth.

Why candidates pick the wrong answer

B

Candidates may confuse DHCP starvation with ARP poisoning because both involve spoofing and can lead to man-in-the-middle attacks, but they target different protocols (DHCP vs. ARP).

C

Candidates may confuse MAC flooding with ARP poisoning because both involve sending spoofed frames to manipulate network behavior, and both can lead to traffic interception.

D

Candidates may confuse any attack involving spoofed IPs or high resource utilization with DNS amplification, without recognizing the specific ARP-based mechanism described.

4
MCQmedium

A network administrator is experiencing issues where unauthorized devices are offering IP addresses to clients, causing connectivity problems. Which security feature should be enabled on switches to prevent this?

A.Dynamic ARP Inspection (DAI)
B.IP Source Guard
C.DHCP Snooping
D.Port Security
AnswerC

DHCP Snooping allows only DHCP messages from trusted DHCP servers, blocking unauthorized DHCP offers.

Why this answer

C is correct because DHCP Snooping is a security feature that filters untrusted DHCP messages on a per-port basis, preventing unauthorized DHCP servers from offering IP addresses to clients. By configuring trusted ports (typically uplinks to legitimate DHCP servers) and untrusted ports (access ports), the switch drops DHCPOFFER and DHCPACK messages received on untrusted ports, directly stopping rogue DHCP server attacks.

Exam trap

The trap here is that candidates confuse the roles of DHCP Snooping, DAI, and IP Source Guard, often selecting DAI because they associate ARP with address assignment, but only DHCP Snooping directly filters unauthorized DHCP server messages.

Why the other options are wrong

A

Dynamic ARP Inspection (DAI) validates ARP packets to prevent man-in-the-middle attacks, but it does not prevent unauthorized DHCP servers from offering IP addresses. The issue described is rogue DHCP servers, which DHCP Snooping addresses.

B

IP Source Guard prevents IP spoofing by filtering traffic based on DHCP snooping bindings, but it does not prevent unauthorized DHCP servers from offering IP addresses.

D

Port Security limits the number of MAC addresses per port but does not prevent unauthorized DHCP servers from offering IP addresses.

When would these options actually be correct?

A

DAI would be correct in a scenario where the network is experiencing ARP spoofing attacks, where an attacker sends forged ARP replies to associate their MAC address with the IP address of a legitimate device, causing traffic interception.

B

A network administrator notices clients are receiving IP addresses from unknown sources and suspects IP spoofing attacks. Enabling IP Source Guard on access ports would block traffic from unauthorized IP addresses.

D

A question asking which feature prevents MAC flooding attacks or restricts device access based on MAC addresses on a switch port would make Port Security the correct answer.

Why candidates pick the wrong answer

A

Candidates may confuse DAI with DHCP Snooping because both are security features that rely on DHCP Snooping's binding database, and both protect against different types of attacks on the same layer.

B

Candidates may confuse IP Source Guard with DHCP Snooping because both rely on DHCP snooping bindings, but they address different threats: IP Source Guard filters IP traffic, while DHCP Snooping filters DHCP messages.

D

Candidates may confuse port-level security with DHCP protection, thinking that restricting MAC addresses also blocks rogue DHCP servers.

5
MCQmedium

Which of the following is a characteristic of UDP?

A.Provides guaranteed delivery
B.Uses sequence numbers
C.Supports three-way handshake
D.Has lower overhead than TCP
AnswerD

UDP has minimal header size and no connection establishment, resulting in lower overhead.

Why this answer

UDP (User Datagram Protocol) is a connectionless transport-layer protocol that provides minimal overhead compared to TCP. It does not establish a connection before sending data, nor does it provide reliability, flow control, or error recovery, making it ideal for real-time applications like VoIP and streaming where speed is prioritized over guaranteed delivery.

Exam trap

The trap here is that candidates often confuse UDP's lack of reliability with being 'unreliable' in a negative sense, but the exam tests that UDP's lower overhead is a deliberate design choice for performance-sensitive applications.

Why the other options are wrong

A

UDP is a connectionless protocol that does not provide guaranteed delivery; it offers no acknowledgments or retransmissions, unlike TCP which ensures reliable data transfer.

B

UDP is a connectionless protocol that does not use sequence numbers; sequence numbers are a feature of TCP for ordered delivery.

C

UDP is a connectionless protocol that does not establish a session, so it does not support a three-way handshake, which is a TCP mechanism.

When would these options actually be correct?

A

In a question asking 'Which of the following is a characteristic of TCP?', 'Provides guaranteed delivery' would be correct because TCP uses acknowledgments and retransmissions to ensure data arrives intact.

B

In a question asking 'Which of the following is a characteristic of TCP?', option 'Uses sequence numbers' would be correct because TCP uses sequence numbers to ensure ordered data delivery.

C

In a question asking 'Which of the following is a characteristic of TCP?', option C would be correct because TCP uses a three-way handshake to establish a connection.

Why candidates pick the wrong answer

A

Candidates may confuse UDP with TCP, assuming all transport protocols provide reliability, or they may think 'best-effort' delivery implies some guarantee.

B

Candidates may confuse UDP with TCP, assuming all transport protocols use sequence numbers for reliability, or they may recall that UDP has a checksum but mistakenly think it includes sequence numbers.

C

Candidates may confuse UDP with TCP, as both are transport layer protocols, and mistakenly attribute TCP features like the three-way handshake to UDP.

6
MCQmedium

A network technician is analyzing a small office network topology. An 8-port switch has 7 workstations directly connected. The remaining switch port is connected to a 4-port hub, which has 4 workstations attached. All devices are configured on the same VLAN and IP subnet. How many collision domains and broadcast domains are present in this network?

A.8 collision domains, 1 broadcast domain
B.11 collision domains, 1 broadcast domain
C.12 collision domains, 5 broadcast domains
D.8 collision domains, 5 broadcast domains
AnswerA

Correct. Each switch port creates its own collision domain (8 total). The hub does not add separate collision domains; it connects all its ports into the collision domain of the switch port it is attached to. All devices are on the same VLAN, so there is one broadcast domain.

Why this answer

Switches create a separate collision domain per port, so the 8-port switch provides 8 collision domains. The hub connected to one switch port extends that single collision domain to all its attached devices, but does not create new ones. All devices are on the same VLAN and IP subnet, so there is only one broadcast domain.

Therefore, the network has 8 collision domains and 1 broadcast domain.

Exam trap

The N10-009 exam often tests the distinction between hubs (Layer 1 repeaters that extend collision domains) and switches (Layer 2 devices that segment collision domains), and the trap here is assuming that each hub port creates its own collision domain, leading to overcounting collision domains, or confusing collision domains with broadcast domains by thinking hubs or switches create multiple broadcast domains.

Why the other options are wrong

B

The hub creates a single collision domain for its 4 ports, not 4 separate ones. The switch has 8 collision domains (one per port), but the hub's segment adds only 1, totaling 9, not 11. The correct count is 8 collision domains (7 switch ports + 1 hub segment) and 1 broadcast domain.

C

A hub creates a single collision domain for all its ports, and a switch creates a separate collision domain per port. Here, the switch has 8 ports (7 workstations + 1 to hub), giving 8 collision domains. The hub adds 1 collision domain for its 4 workstations, but since it's connected to a switch port, that hub's collision domain is already counted within the switch port's collision domain.

So total collision domains = 8 (switch ports) = 8. Option C incorrectly counts 12 collision domains and 5 broadcast domains, but all devices are on the same VLAN and IP subnet, so there is only 1 broadcast domain.

D

A switch creates a separate collision domain per port, so the 8-port switch provides 8 collision domains. The hub creates a single collision domain for its 4 workstations, but that hub port on the switch is already counted as one collision domain. Thus total collision domains = 8 (switch ports) = 8, not 8 + 4 = 12.

Broadcast domain is one because all devices are on the same VLAN and IP subnet.

When would these options actually be correct?

B

If the question stated that each hub port was connected to a separate switch port (e.g., a 4-port hub connected to 4 different switch ports), then each hub port would be its own collision domain, giving 7 (switch workstations) + 4 (hub workstations) = 11 collision domains, all in one broadcast domain.

C

This option would be correct if the network had 5 separate VLANs (each with its own broadcast domain) and the switch ports were configured in access mode for different VLANs, with the hub connecting to a switch port in a trunk mode carrying multiple VLANs, and each hub port assigned to a different VLAN. Then collision domains would be 8 (switch ports) + 4 (hub ports) = 12, and broadcast domains would be 5 (one per VLAN).

D

This option would be correct if the question stated that the hub's 4 workstations are each directly connected to the switch (i.e., no hub), and the network had 5 VLANs (or 5 separate IP subnets). Then there would be 8 collision domains (one per switch port) and 5 broadcast domains (one per VLAN).

Why candidates pick the wrong answer

B

Candidates mistakenly count each hub port as a separate collision domain, forgetting that a hub operates as a single collision domain for all its ports. They also may incorrectly add the hub's 4 ports to the switch's 7 ports without considering the hub's shared nature.

C

Candidates often mistakenly count each hub port as a separate collision domain (adding 4 instead of 1) and think that a hub creates multiple broadcast domains, confusing collision and broadcast domain concepts.

D

Candidates often mistakenly count each hub-attached workstation as a separate collision domain, adding 4 to the switch's 8, and may also think that a hub creates multiple broadcast domains or confuse collision and broadcast domains.

7
MCQeasy

A network technician configures an 802.1Q trunk link between two switches. After the configuration, VLAN 20 traffic is not passing across the trunk, although VLAN 10 traffic works fine. The technician verifies that both switches have VLAN 20 created and that the trunk is up. What is the most likely cause?

A.The native VLAN is mismatched between the switches.
B.VLAN 20 is not included in the allowed VLAN list on the trunk.
C.The trunk port is set to dynamic desirable mode.
D.The encapsulation type is ISL instead of 802.1Q.
AnswerB

Trunk links, by default, permit all VLANs to traverse them. However, network administrators often configure an 'allowed VLAN list' to restrict which VLANs are permitted on a specific trunk port for security or traffic management purposes. If VLAN 20 is explicitly excluded or simply not included in this configured list on either end of the trunk, its traffic will be dropped, preventing communication for devices in that VLAN across the link.

Why this answer

The most likely cause is that VLAN 20 is not included in the allowed VLAN list on the trunk. By default, an 802.1Q trunk allows all VLANs, but if the allowed VLAN list has been manually configured or pruned, VLAN 20 may have been excluded. Since VLAN 10 works, the trunk is operational, and both switches have VLAN 20 created, the issue is specifically that the trunk is not permitting VLAN 20 traffic.

Exam trap

CompTIA often tests the misconception that a native VLAN mismatch is the default cause of VLAN-specific traffic failures, but the real issue is usually the allowed VLAN list being misconfigured or pruned.

Why the other options are wrong

A

A native VLAN mismatch would cause traffic on the native VLAN (typically VLAN 1) to fail, not specifically VLAN 20. Since VLAN 10 works, the native VLAN is likely correct.

C

In this scenario, VLAN 10 traffic works fine, indicating the trunk is operational. Dynamic desirable mode would not cause selective VLAN failure; it affects trunk negotiation, not per-VLAN traffic filtering.

D

The question states that the trunk is configured with 802.1Q, so ISL encapsulation is not in use. If ISL were the issue, the trunk would likely not form or would have problems with all VLANs, not just VLAN 20.

When would these options actually be correct?

A

If the question described that all VLAN traffic fails or only untagged traffic fails across the trunk, and both switches have the same VLANs configured, then a native VLAN mismatch would be the most likely cause.

C

A question where two switches fail to form a trunk link entirely, and one switch is set to dynamic desirable while the other is set to dynamic auto or access mode, preventing trunk establishment.

D

If the question described a scenario where two switches are configured with different trunk encapsulation types (e.g., one using ISL and the other 802.1Q), then the mismatch would prevent trunking and cause traffic issues across all VLANs.

Why candidates pick the wrong answer

A

Candidates often confuse native VLAN mismatch with general VLAN traffic issues, assuming any trunk problem is due to native VLAN mismatch without considering allowed VLAN lists.

C

Candidates may confuse dynamic trunking protocol (DTP) modes with VLAN traffic filtering, assuming that dynamic desirable mode could restrict specific VLANs, when it only controls trunk negotiation.

D

Candidates may confuse encapsulation mismatches with VLAN-specific issues, or they might think that ISL and 802.1Q incompatibility could selectively affect certain VLANs.

8
MCQmedium

A network technician is troubleshooting an issue where users on VLAN 20 can access internal servers and the default gateway but cannot reach any external websites. The router's ACL is configured to permit all outbound traffic. What is the most likely cause of this issue?

A.The DNS server is unreachable from the VLAN
B.The DHCP server is not providing a default gateway
C.NAT is not configured or is misconfigured on the router
D.The switch port for the router is in the wrong VLAN
AnswerC

NAT is required to translate private VLAN IPs to a public IP for internet access. Even if ACLs permit traffic, without proper NAT, packets will not be forwarded to the internet. This matches the symptom of being able to reach internal resources but not external ones.

Why this answer

Since users can access internal servers and the default gateway, Layer 3 connectivity within the VLAN is working, and the router's ACL permits all outbound traffic. The inability to reach external websites while internal resources are reachable strongly indicates that Network Address Translation (NAT) is either not configured or misconfigured on the router. Without NAT, private IP addresses from VLAN 20 cannot be translated to a public IP, so return traffic from external web servers has no route back to the internal hosts.

Exam trap

CompTIA often tests the misconception that an ACL permitting all outbound traffic is sufficient for internet access, but without NAT, private IP addresses are not routable on the public internet, so the ACL alone cannot fix the issue.

Why the other options are wrong

A

The question states users can access internal servers and the default gateway, which indicates DNS resolution for internal names works and the gateway is reachable. External website access failure with a permissive ACL points to a NAT issue, not DNS.

B

The question states users can access internal servers and the default gateway, so the DHCP server is providing a default gateway. The issue is external access, not gateway reachability.

D

The switch port for the router being in the wrong VLAN would prevent all traffic from that VLAN from reaching the router, but users can access internal servers and the default gateway, indicating the router is reachable. Thus, the issue is not at the switch port level.

When would these options actually be correct?

A

A question where users cannot access any external resources (including internal servers by name) but can ping external IPs, or where the error message indicates 'server not found' while internal IP access works, would make DNS the correct answer.

B

This would be correct if users could not reach any external or internal resources, and the question specified that clients receive an APIPA address or cannot ping the gateway, indicating DHCP failure to provide a default gateway.

D

A scenario where users on a VLAN cannot reach any external resources, including the default gateway, and internal servers are also unreachable. In that case, a misconfigured switch port (e.g., access port in wrong VLAN or trunk issue) could isolate the entire VLAN from the router.

Why candidates pick the wrong answer

A

Candidates often default to DNS as the cause of web browsing failures, overlooking that internal access works and the symptom pattern specifically points to NAT misconfiguration.

B

Candidates may confuse symptoms of missing default gateway (no external access) with the given scenario, overlooking that internal access and gateway reachability are already working.

D

Candidates may think that if the router's port is in the wrong VLAN, traffic cannot exit the VLAN, but the symptom of being able to reach the default gateway contradicts this, making the option tempting but incorrect.

9
MCQmedium

A company is deploying a wireless network that must support both 2.4 GHz and 5 GHz frequency bands. Which IEEE 802.11 standard supports both bands and is backward compatible with older devices?

A.A) 802.11b
B.B) 802.11g
C.C) 802.11n
D.D) 802.11ac
AnswerC

802.11n is the correct choice because it was the first widely adopted Wi-Fi standard to natively support operation in both the 2.4 GHz and 5 GHz frequency bands. This dual-band capability, combined with its use of Multiple-Input Multiple-Output (MIMO) technology, allows it to deliver significantly higher throughput and better range than its predecessors, fulfilling the requirement for both frequency bands.

Why this answer

802.11n (Wi-Fi 4) is the correct answer because it was the first standard to natively support both 2.4 GHz and 5 GHz bands simultaneously, using MIMO (Multiple Input Multiple Output) technology. It also maintains backward compatibility with older 802.11a/b/g devices through mandatory support for legacy modulation schemes (DSSS/CCK for 2.4 GHz and OFDM for 5 GHz).

Exam trap

The trap here is that candidates often confuse 802.11g (which is backward compatible with 802.11b but only 2.4 GHz) with a dual-band standard, or incorrectly assume 802.11ac supports 2.4 GHz because it is often marketed as 'dual-band' in consumer devices, but the IEEE 802.11ac-2013 amendment defines operation only in the 5 GHz band.

Why the other options are wrong

A

802.11b only operates in the 2.4 GHz band and does not support 5 GHz, so it cannot meet the requirement for dual-band support.

B

802.11g operates only on the 2.4 GHz band and does not support the 5 GHz band, so it cannot meet the requirement for dual-band support.

D

802.11ac operates only on the 5 GHz band and does not support 2.4 GHz, so it cannot meet the requirement of supporting both bands.

When would these options actually be correct?

A

If the question asked for a standard that supports only the 2.4 GHz band and provides the longest range among early Wi-Fi standards, 802.11b would be correct.

B

This option would be correct if the question asked for a standard that operates solely on the 2.4 GHz band and provides backward compatibility with 802.11b devices, without requiring 5 GHz support.

D

This option would be correct for a question asking which standard supports higher throughput on the 5 GHz band only, such as 'Which IEEE 802.11 standard supports up to 1.3 Gbps using 5 GHz and MU-MIMO?'

Why candidates pick the wrong answer

A

Candidates may confuse 802.11b as a legacy standard that is widely known and assume it supports both bands due to its prevalence in older devices.

B

Candidates may confuse 802.11g with 802.11n, as both are backward compatible with older devices, but 802.11g lacks the 5 GHz capability specified in the question.

D

Candidates may confuse 802.11ac as the latest standard and assume it supports both bands, or they may overlook the dual-band requirement and focus only on backward compatibility.

10
MCQmedium

A user reports that they cannot access the internet. The technician verifies the workstation has IP address 192.168.1.10 with subnet mask 255.255.255.0 and default gateway 192.168.1.1. The user can ping the default gateway successfully. Other users on the same subnet can access the internet. Which command should the technician run on the workstation to further isolate the issue?

A.ipconfig /all
B.netstat -r
C.tracert 8.8.8.8
D.nslookup google.com
AnswerB

The `netstat -r` command (or `route print` on Windows) displays the local routing table, which dictates how the workstation forwards network traffic. Since the user can ping the default gateway but not an external IP address (8.8.8.8), the issue points to a problem with how the workstation routes traffic destined for the internet. Verifying the presence and correctness of the default route (0.0.0.0/0) pointing to the gateway (192.168.1.1) is crucial, as its absence or misconfiguration would prevent the workstation from knowing where to send internet-bound packets.

Why this answer

The user can ping the default gateway (192.168.1.1), indicating Layer 2 and basic Layer 3 connectivity to the local router. However, other users on the same subnet can access the internet, so the issue is likely with the workstation's routing table. The 'netstat -r' command displays the IP routing table, allowing the technician to check for a missing or incorrect default route (e.g., destination 0.0.0.0 with gateway 192.168.1.1).

This isolates whether the workstation knows how to forward traffic beyond the local subnet.

Exam trap

The N10-009 exam often tests the misconception that 'ipconfig /all' is the first step for any connectivity issue, but here the technician already has the IP configuration, so the trap is to overlook that the routing table must be examined when local connectivity works but internet access fails.

Why the other options are wrong

A

The technician already knows the workstation's IP configuration (IP, subnet mask, gateway) from the initial verification, so running ipconfig /all would provide no new information to isolate the issue.

C

The user can ping the default gateway, indicating Layer 3 connectivity to the local network. Since other users on the same subnet can access the internet, the issue is likely DNS or routing beyond the gateway. tracert would show the path to 8.8.8.8, but the problem is more likely DNS resolution, not routing.

D

The user can ping the default gateway, indicating Layer 3 connectivity to the local network. The issue is likely DNS resolution, but the question states other users on the same subnet can access the internet, so DNS is probably working. The technician needs to check the routing table to see if the default route is missing or incorrect, which `netstat -r` does. `nslookup` tests DNS, which is not the immediate next step given the symptoms.

When would these options actually be correct?

A

When a user cannot access the internet and the technician needs to verify the workstation's IP address, subnet mask, default gateway, DNS servers, and DHCP lease details to check for misconfiguration or APIPA address.

C

A user cannot reach a specific external server, but can ping the default gateway. Running tracert to that server would identify where packets are being dropped or delayed, isolating a routing issue beyond the local network.

D

If the user could not access the internet but could ping the default gateway and other users had the same issue, or if the problem was specifically that domain names were not resolving while IP addresses worked, then `nslookup google.com` would be the correct command to diagnose DNS resolution.

Why candidates pick the wrong answer

A

Candidates often default to ipconfig /all as the first troubleshooting step for any network issue, overlooking that the necessary IP details are already known.

C

Candidates may think tracert is a standard first step for internet connectivity issues, but here the symptom (others can access internet) suggests a local configuration problem, not a routing failure.

D

Candidates often jump to DNS issues when internet access fails, especially if pinging the gateway works. `nslookup` is a common tool for testing DNS, making it a tempting choice without fully analyzing the scenario.

11
MCQmedium

A network administrator connects two switches with a trunk link that is configured to allow all VLANs. Workstations in VLAN 10 can communicate across the switches, but workstations in VLAN 20 cannot. Both VLANs are configured on the first switch. What is the most likely cause of the issue?

A.The native VLAN is mismatched on the two switches.
B.VLAN 20 is not created on the second switch.
C.The trunk uses ISL instead of 802.1Q.
D.The default gateway is missing for VLAN 20.
AnswerB

When a switch receives a frame on a trunk link tagged with a specific VLAN ID, it expects that VLAN to be locally defined in its VLAN database. If VLAN 20 is not created on the second switch, the switch lacks the necessary context to process frames belonging to that VLAN, effectively discarding them. This prevents any devices connected to the second switch from participating in VLAN 20, even if the trunk link is otherwise operational.

Why this answer

VLAN 20 is configured on the first switch but not on the second switch. Even though the trunk link allows all VLANs, the second switch must have VLAN 20 created in its VLAN database for traffic to be forwarded. Without the VLAN existing on the second switch, frames tagged for VLAN 20 are dropped at the receiving switch because there is no corresponding VLAN interface or forwarding table entry.

Exam trap

The N10-009 exam often tests the misconception that a trunk configured to 'allow all VLANs' automatically makes every VLAN functional across the link, when in fact each switch must have the VLAN defined in its local database for traffic to be processed.

Why the other options are wrong

A

A native VLAN mismatch would cause issues for untagged traffic on the trunk, but VLAN 20 is a tagged VLAN. Since VLAN 10 works, the trunk is functioning; the problem is specific to VLAN 20, which is likely not present on the second switch.

C

The trunk uses 802.1Q, not ISL, in modern networks. Even if ISL were used, it would affect all VLANs, not just VLAN 20, so it cannot explain why only VLAN 20 fails.

D

The issue is that VLAN 20 works on the first switch but not across the trunk, indicating the VLAN is missing on the second switch. A missing default gateway would prevent inter-VLAN routing but not affect Layer 2 communication within the same VLAN across switches.

When would these options actually be correct?

A

This would be correct if the question stated that all VLANs fail to communicate across the trunk, or if workstations in the native VLAN (e.g., VLAN 1) cannot communicate while other VLANs work. A native VLAN mismatch disrupts control traffic and untagged frames.

C

This would be correct if the question stated that the trunk is configured with ISL encapsulation and the switches do not support ISL, or if the question specified that ISL is incompatible with certain VLANs or switch models, causing connectivity issues for specific VLANs.

D

This option would be correct in a scenario where workstations in VLAN 20 cannot communicate with devices in other VLANs or the internet, but can communicate within VLAN 20 across switches. The question would specify that inter-VLAN routing is failing, and the default gateway is misconfigured or missing.

Why candidates pick the wrong answer

A

Candidates often confuse native VLAN mismatch symptoms with VLAN absence, as both can cause connectivity issues. They may assume trunk misconfiguration is the default cause without verifying VLAN existence on both switches.

C

Candidates may confuse trunking protocol mismatches as a cause for selective VLAN failure, not realizing that a protocol mismatch would affect all VLANs equally, not just one.

D

Candidates often confuse Layer 2 VLAN issues with Layer 3 routing problems. They may think that because VLAN 20 cannot communicate across switches, it must be a routing issue, especially if they have seen scenarios where a missing default gateway causes connectivity failures.

12
MCQmedium

A network administrator has configured SNMPv3 on a router to send traps to a central management server. The administrator notices that no traps are being received. The management server is reachable via ping from the router. Which configuration step is most likely missing?

A.Configure the SNMP community string on the router
B.Set the SNMP trap destination IP address on the router
C.Configure SNMPv3 authentication and privacy credentials on both the router and the server
D.Ensure the SNMP agent is enabled on the router
AnswerC

This is the correct answer because SNMPv3, unlike its predecessors, incorporates robust security features. For traps to be successfully sent by the router and subsequently accepted and processed by the management server, both devices must be configured with identical authentication protocols (e.g., MD5, SHA) and privacy protocols (e.g., DES, AES) along with their respective keys. Without this precise credential matching, the server will discard the encrypted traps due to authentication failure or inability to decrypt the payload, preventing any reception.

Why this answer

SNMPv3 requires authentication and encryption (privacy) to be configured on both the router and the management server. Without matching credentials, the server will reject or ignore the traps, even if the network path is reachable. This is the most likely missing step because SNMPv3 does not use community strings and relies on security models (authNoPriv, authPriv, or noAuthNoPriv) that must be consistent between endpoints.

Exam trap

CompTIA often tests the misconception that SNMPv3 still requires a community string or that simply setting a trap destination is sufficient, when in fact the security credentials must be explicitly configured and matched on both devices.

Why the other options are wrong

A

SNMPv3 does not use community strings; they are only for SNMPv1/v2c. The question specifies SNMPv3, so configuring a community string is irrelevant and will not resolve the trap delivery issue.

B

The trap destination IP address is a required step, but the question states that the management server is reachable via ping, implying the destination is already set. The issue is likely authentication mismatch, not missing destination.

D

The SNMP agent is enabled by default on most routers when SNMP is configured, and the question states that SNMPv3 has been configured, implying the agent is active. The issue is likely mismatched authentication and privacy settings, not a disabled agent.

When would these options actually be correct?

A

This would be correct in a question about SNMPv1 or v2c where traps are not being received, and the community string on the router does not match the server's expected community string.

B

This would be correct in a scenario where the administrator configured SNMPv2c traps but forgot to specify the trap receiver's IP address, and no traps are received despite the server being reachable.

D

In a scenario where a network administrator has configured SNMPv2c with a community string but no traps are received, and the management server is reachable, the missing step could be ensuring the SNMP agent is enabled (e.g., via 'snmp-server enable traps' command).

Why candidates pick the wrong answer

A

Candidates often confuse SNMPv3 with earlier versions and default to community string configuration, not realizing SNMPv3 uses usernames and authentication/privacy settings instead.

B

Candidates often assume that setting the trap destination is the most common missing step, overlooking that SNMPv3 requires matching credentials for communication.

D

Candidates may think that enabling the SNMP agent is a separate, often overlooked step, especially when moving from SNMPv2c to SNMPv3, but in SNMPv3 configuration, the agent is typically enabled automatically when traps are configured.

13
MCQhard

A security analyst is investigating a potential breach. A network device shows logs indicating that it received packets with a source IP address belonging to the internal network range on its external (internet-facing) interface. This is a classic indication of which type of attack?

A.Denial-of-service (DoS) attack
B.IP spoofing
C.Man-in-the-middle (MITM) attack
D.ARP poisoning
AnswerB

IP spoofing involves an attacker deliberately altering the source IP address in packet headers to impersonate a legitimate or trusted host, often an internal network device. When a security analyst observes packets originating from an internal IP address on an external network interface (like a WAN port), it unequivocally indicates that an external entity is forging these source IPs. This technique is frequently used to bypass ingress filtering rules or to obscure the attacker's true identity, making it a definitive sign of a potential breach.

Why this answer

B is correct because receiving packets with a source IP address from the internal network range on an external (internet-facing) interface is a classic sign of IP spoofing. In IP spoofing, an attacker forges the source IP address in packet headers to impersonate a trusted internal host, often to bypass access controls or launch reflection attacks. This violates the expected behavior of ingress filtering, where external interfaces should never see internal source addresses.

Exam trap

The trap here is that candidates may confuse IP spoofing with a DoS attack because spoofing is often used in DDoS amplification, but the question's specific clue—internal source IP on an external interface—directly points to spoofing, not the volumetric nature of a DoS.

Why the other options are wrong

A

The logs show packets with an internal source IP arriving on the external interface, which is a sign of IP spoofing, not a DoS attack. DoS attacks focus on overwhelming resources, not on forging source addresses.

C

A man-in-the-middle attack involves intercepting and potentially altering communications between two parties, but the specific indicator of packets with an internal source IP on an external interface points to IP spoofing, not MITM.

D

ARP poisoning operates at Layer 2 and involves corrupting ARP caches within a local network segment, not receiving packets with internal source IPs on an external interface.

When would these options actually be correct?

A

A question describing a network device being overwhelmed with traffic from multiple sources, causing service disruption, would make DoS the correct answer. For example: 'A web server becomes unresponsive due to a flood of TCP SYN packets from many different IP addresses.'

C

A question describing an attacker intercepting traffic between a client and server, possibly using ARP spoofing or a rogue access point, and then modifying or eavesdropping on the communication would make MITM the correct answer.

D

A question describing an attacker sending forged ARP replies to associate their MAC address with the IP of a legitimate device, causing traffic to be misdirected, would make ARP poisoning the correct answer.

Why candidates pick the wrong answer

A

Candidates may associate any malicious traffic with DoS, especially when logs show unusual packets, without recognizing that the specific indicator (internal IP on external interface) points to spoofing rather than resource exhaustion.

C

Candidates may confuse IP spoofing with MITM because both involve deceptive IP addresses, but MITM focuses on interception and relay, not just falsifying the source address.

D

Candidates may confuse IP spoofing with ARP poisoning because both involve falsifying addresses, but ARP poisoning is specific to MAC-IP mapping on local networks, not the external interface scenario described.

14
MCQeasy

A user's workstation shows an IP address of 169.254.15.7 with a subnet mask of 255.255.0.0. The user cannot access any network resources. Which of the following is the most likely cause?

A.The DNS server is not responding
B.The DHCP server is unreachable
C.The subnet mask is incorrect
D.The default gateway is down
AnswerB

The IP address 169.254.15.7 is an Automatic Private IP Addressing (APIPA) address. This range (169.254.0.0/16) is automatically assigned by a client when it is configured to obtain an IP address via DHCP but fails to locate or communicate with a DHCP server on the network. Therefore, the workstation cannot obtain a valid IP configuration from the network's DHCP service, leading to this self-assigned address.

Why this answer

The IP address 169.254.15.7 with a /16 subnet mask is an Automatic Private IP Addressing (APIPA) address, assigned by Windows when a DHCP client fails to obtain a lease. This indicates the workstation cannot reach a DHCP server, so the most likely cause is that the DHCP server is unreachable.

Exam trap

The trap here is that candidates often confuse APIPA with a DNS or gateway issue, but APIPA specifically indicates DHCP failure, not a problem with higher-layer services or routing.

Why the other options are wrong

A

The IP address 169.254.15.7 is an Automatic Private IP Addressing (APIPA) address, which indicates that the workstation failed to obtain an IP from a DHCP server. A non-responsive DNS server would not cause the workstation to self-assign an APIPA address; it would still have a valid DHCP-assigned IP.

D

The IP address 169.254.15.7 is an Automatic Private IP Addressing (APIPA) address, which indicates the workstation failed to obtain an IP from a DHCP server. A down default gateway would not cause the workstation to self-assign an APIPA address; instead, the workstation would retain its DHCP-assigned IP but lose connectivity beyond the local subnet.

When would these options actually be correct?

A

In a scenario where a workstation has a valid static IP address but cannot resolve hostnames, and other network connectivity (e.g., ping to IP addresses) works, then a non-responsive DNS server would be the most likely cause.

D

A workstation has a static IP address (e.g., 192.168.1.10) and can communicate with other devices on the same subnet but cannot access the internet or remote networks. In this scenario, the most likely cause is that the default gateway is down or misconfigured.

Why candidates pick the wrong answer

A

Candidates often associate network resource access issues with DNS problems, overlooking that APIPA addresses are a clear indicator of DHCP failure rather than DNS failure.

D

Candidates often associate 'cannot access any network resources' with a gateway issue, overlooking that APIPA addresses result from DHCP failure, not gateway problems. The symptom of no connectivity to any resource (including local) should steer them away from a gateway-only cause.

15
MCQeasy

Which of the following is a characteristic of a Layer 2 broadcast domain?

A.Devices can communicate using MAC addresses alone.
B.All devices must be on the same IP subnet.
C.Broadcast frames are forwarded to all ports within the domain.
D.Routers are required to communicate between devices in the same domain.
AnswerC

The key characteristic of a broadcast domain is that a broadcast frame sent by any device is received by all other devices in that domain. Switches forward broadcasts to all ports in the same VLAN.

Why this answer

A Layer 2 broadcast domain consists of all devices that receive a broadcast frame sent by any device within that domain. Switches forward broadcast frames (destination MAC FF:FF:FF:FF:FF:FF) out all ports except the ingress port, ensuring every device in the same VLAN or collision-free segment sees the broadcast. This is why option C is correct.

Exam trap

The trap here is that candidates often confuse a broadcast domain with a collision domain, or incorrectly assume that being on the same IP subnet is a requirement for receiving broadcasts, when in fact Layer 2 broadcasts are forwarded regardless of IP addressing.

Why the other options are wrong

A

In a Layer 2 broadcast domain, devices communicate using MAC addresses, but this is not a defining characteristic of the domain itself; it's true for any Ethernet network. The question asks for a characteristic of the broadcast domain, which is that broadcast frames are forwarded to all ports.

B

A Layer 2 broadcast domain is defined by the reach of broadcast frames, not by IP subnetting. Devices on the same broadcast domain can be on different IP subnets; IP subnetting is a Layer 3 concept.

D

Routers operate at Layer 3 and are not required for communication within the same Layer 2 broadcast domain; switches or bridges handle Layer 2 forwarding.

When would these options actually be correct?

A

This option would be correct for a question like: 'Which of the following is true about communication within a single VLAN?' In that context, devices in the same VLAN can communicate using MAC addresses alone without needing Layer 3 routing.

B

This option would be correct for a question like: 'Which of the following is a characteristic of devices in the same IP subnet?' In that context, all devices must be on the same IP subnet to communicate without a router.

D

In a question asking about communication between different broadcast domains (i.e., different subnets), routers are required to forward traffic between them, making this statement correct.

Why candidates pick the wrong answer

A

Candidates may confuse a basic feature of Ethernet (MAC-based communication) with the specific property of a broadcast domain, or they may think that MAC-only communication is unique to broadcast domains.

B

Candidates often confuse broadcast domains with IP subnets because in typical network designs, a broadcast domain is often contained within a single subnet, leading to the mistaken belief that they are equivalent.

D

Candidates may confuse the role of routers in inter-domain communication with intra-domain communication, assuming routers are needed for any device-to-device communication.

16
MCQeasy

Which of the following best describes the primary difference between a hub and a switch?

A.A switch is faster than a hub because it operates at Layer 3
B.A hub broadcasts all frames to all ports; a switch forwards frames only to the destination port
C.A hub can segment collision domains; a switch cannot
D.Both hubs and switches operate at the same OSI layer but use different frame types
AnswerB

Hubs are Layer 1 devices that simply regenerate electrical signals received on one port and send them out all other ports, effectively creating a single collision domain where all connected devices see all traffic. In contrast, a switch operates at Layer 2, building a MAC address table by inspecting source MAC addresses of incoming frames. It then uses this table to intelligently forward frames only to the specific port where the destination MAC address is known to reside, significantly reducing unnecessary traffic on other ports.

Why this answer

A hub operates at Layer 1 (physical layer) and simply repeats electrical signals out all ports, causing all connected devices to receive every frame. A switch operates at Layer 2 (data link layer) and uses the MAC address table to forward frames only to the specific port where the destination device resides, reducing unnecessary traffic and improving network efficiency.

Exam trap

The trap here is that candidates often confuse the OSI layer of a switch (Layer 2) with a router (Layer 3) and incorrectly assume switches are faster because they operate at a higher layer, or they mistakenly think hubs can segment collision domains when in fact they expand them.

Why the other options are wrong

A

Switches operate at Layer 2 (data link layer), not Layer 3. While some switches can perform Layer 3 routing, the primary difference between a hub and a switch is not speed based on OSI layer; hubs operate at Layer 1 and switches at Layer 2.

C

A hub does not segment collision domains; it actually extends them. A switch segments collision domains by creating a separate collision domain per port.

D

Both hubs and switches operate at Layer 2 (Data Link layer) and use the same Ethernet frame types; the statement is factually incorrect.

When would these options actually be correct?

A

This option would be correct if the question asked: 'Which of the following best describes the primary difference between a Layer 3 switch and a router?' In that context, a Layer 3 switch can be faster than a router because it uses hardware-based switching at Layer 3.

C

If the question were 'Which of the following best describes the primary difference between a hub and a switch regarding collision domains?', then the correct answer would be that a switch segments collision domains while a hub does not.

D

If the question asked about the difference between a router and a switch, then 'operate at the same OSI layer but use different frame types' could be correct if comparing a Layer 3 router (using IP packets) with a Layer 2 switch (using Ethernet frames).

Why candidates pick the wrong answer

A

Candidates may confuse switches with routers or assume that 'switch' always implies Layer 3 capabilities, and they may think that operating at a higher layer inherently makes a device faster.

C

Candidates may confuse the concept of collision domains with broadcast domains, or mistakenly think that hubs provide segmentation because they are older devices that physically separate ports.

D

Candidates may confuse the OSI layers of hubs and switches, or think that switches use different frame types due to VLAN tagging, but standard Ethernet frames are identical for both devices.

17
MCQhard

A security engineer notices that the company's web server is receiving an overwhelming number of HTTP GET requests from thousands of different IP addresses around the world. The requests are for legitimate pages and are well-formed. The server is becoming unresponsive. Which type of attack is most likely occurring?

A.ARP spoofing
B.SYN flood
C.DDoS attack
D.DNS amplification
AnswerC

A Distributed Denial-of-Service (DDoS) attack is precisely characterized by an overwhelming volume of traffic, often comprising legitimate-looking requests, originating from numerous compromised or controlled sources. These requests are designed to consume the target web server's resources, such as CPU, memory, network bandwidth, or connection capacity, rendering it unavailable to legitimate users. The distributed nature makes it challenging to block by simply filtering a single source IP address, as the attack traffic appears to come from many different, seemingly valid clients.

Why this answer

The attack involves a high volume of legitimate HTTP GET requests from many distinct IP addresses, overwhelming the web server. This is a classic distributed denial-of-service (DDoS) attack, where multiple compromised systems (a botnet) coordinate to flood the target with traffic, exhausting server resources and causing unresponsiveness. The key indicators are the distributed source IPs and the use of application-layer (HTTP) requests, which distinguishes it from network-layer floods.

Exam trap

The trap here is that candidates confuse a SYN flood (a TCP-level attack) with a DDoS attack that uses complete HTTP requests, but the question explicitly states the requests are 'well-formed' and for 'legitimate pages,' ruling out incomplete handshake attacks.

Why the other options are wrong

A

ARP spoofing operates at Layer 2 and targets local network communications, not a web server receiving HTTP requests from thousands of global IP addresses.

B

A SYN flood targets the TCP handshake by sending many SYN packets without completing the handshake, but this question specifies HTTP GET requests, which are application-layer and fully formed, not incomplete TCP connections.

D

DNS amplification attacks use reflection off open DNS resolvers to flood a target with amplified responses, not direct HTTP GET requests from many IPs. The question describes well-formed HTTP requests from diverse IPs, which is a classic DDoS, not a DNS-based attack.

When would these options actually be correct?

A

A question describing a scenario where an attacker on the same subnet intercepts traffic between a client and server by sending forged ARP messages, causing the server to receive unexpected traffic or become unresponsive.

B

A SYN flood would be correct if the question described a server overwhelmed by a high volume of incomplete TCP connection requests (SYN packets) from spoofed IPs, causing the connection table to fill and legitimate connections to be refused.

D

A question describing a server receiving a high volume of large DNS response packets from many different IPs, where the attacker spoofs the victim's IP as the source of small DNS queries to open resolvers, would make DNS amplification the correct answer.

Why candidates pick the wrong answer

A

Candidates may confuse any network-based attack with ARP spoofing, or mistakenly think that overwhelming a server can be achieved via ARP manipulation.

B

Candidates often confuse any network-based denial-of-service attack with a SYN flood because SYN floods are a common DoS technique, but they overlook that the attack here uses complete HTTP requests, not half-open TCP connections.

D

Candidates may confuse any large-scale distributed attack with DNS amplification because both involve many sources, but they overlook that DNS amplification relies on UDP reflection and amplified responses, not direct HTTP requests.

18
MCQmedium

A router has two routes to the same destination network: one learned via OSPF with a metric of 10, and another learned via EIGRP with a composite metric of 3072. The default administrative distances are OSPF=110, EIGRP=90. Which route will be installed in the routing table?

A.The OSPF route because it has a lower metric
B.The EIGRP route because it has a lower administrative distance
C.Both routes will be installed for load balancing
D.The OSPF route because it is a link-state protocol
AnswerB

When a router learns multiple routes to the same destination from different routing protocols, it employs administrative distance (AD) as the primary criterion for path selection. EIGRP has a default AD of 90, which is lower than OSPF's default AD of 110. Since a lower administrative distance indicates a more trustworthy source, the router will always prefer the EIGRP-learned route, irrespective of the metric values calculated by each protocol.

Why this answer

The EIGRP route is installed because administrative distance (AD) is the primary tiebreaker when multiple routing protocols provide routes to the same destination. EIGRP has a default AD of 90, which is lower than OSPF's AD of 110, so the router prefers the EIGRP route regardless of metric values. Metrics are only compared when routes come from the same protocol.

Exam trap

The trap here is that candidates often confuse metric with administrative distance, mistakenly thinking a lower OSPF metric (10) beats a higher EIGRP metric (3072), when in fact the router first compares AD values (90 vs 110) and selects the EIGRP route.

Why the other options are wrong

A

When comparing routes from different routing protocols, the router uses administrative distance (AD) first, not metric. OSPF has AD 110, EIGRP has AD 90, so EIGRP is preferred regardless of metric values.

C

Routers install only the route with the lowest administrative distance (AD) when multiple routes to the same destination exist from different routing protocols. Here, EIGRP has AD 90 vs OSPF's 110, so only the EIGRP route is installed; load balancing requires equal AD and equal metric.

D

OSPF being a link-state protocol does not automatically make its route preferred; route selection is based on administrative distance, not protocol type. Here, EIGRP has a lower AD (90 vs 110), so it wins regardless of OSPF's link-state nature.

When would these options actually be correct?

A

If both routes were learned via the same routing protocol (e.g., both OSPF), then the route with the lower metric would be installed. For example, two OSPF routes to the same destination with metrics 10 and 20.

C

If both routes had the same administrative distance (e.g., both from OSPF) and equal metrics, or if both were from protocols with equal AD (e.g., two EIGRP routes with equal composite metrics), then both routes would be installed for load balancing.

D

This option would be correct if the question asked which routing protocol is more scalable or converges faster in a large network, where link-state protocols like OSPF are generally superior to distance-vector protocols like EIGRP.

Why candidates pick the wrong answer

A

Candidates often confuse metric and administrative distance, assuming the lower metric always wins, but metric only applies within the same protocol.

C

Candidates may think that multiple routes to the same network always result in load balancing, ignoring the role of administrative distance in selecting which routing protocol's route is preferred.

D

Candidates may incorrectly assume that link-state protocols are always preferred over distance-vector protocols, or they confuse protocol characteristics with route selection criteria.

19
MCQhard

An IPv6 address has the prefix 2001:db8::/32. Which of the following IP addresses belongs to the same prefix?

A.2001:db8:1::1
B.2001:db9::1
C.2001:db7::1
D.fe80::1
AnswerA

This address, 2001:db8:1::1, precisely matches the 2001:db8 portion of the given /32 prefix in its first two hextets. The prefix 2001:db8::/32 dictates that any address beginning with 2001:db8 belongs to this network. Since the first 32 bits of 2001:db8:1::1 are indeed 2001:0db8, it is correctly identified as being within the specified network range, making it a valid address for this prefix.

Why this answer

The prefix 2001:db8::/32 means the first 32 bits of the address must be 2001:0db8. Option A (2001:db8:1::1) expands to 2001:0db8:0001:0000:0000:0000:0000:0001, which matches the first 32 bits exactly, so it belongs to the same /32 prefix.

Exam trap

The N10-009 exam often tests the misconception that the double-colon (::) compresses the prefix itself, leading candidates to incorrectly assume that 2001:db8::/32 matches any address starting with 2001:db8, even if the second hextet is altered (e.g., 2001:db9 or 2001:db7).

Why the other options are wrong

B

The prefix 2001:db8::/32 includes addresses where the first 32 bits are 2001:0db8. Option B, 2001:db9::1, has the third quartet as 0db9, which differs in the 33rd bit, so it is not within the /32 prefix.

C

The prefix 2001:db8::/32 includes addresses where the first 32 bits are 2001:0db8. Option C (2001:db7::1) has the third hextet as db7, which differs from db8 in the 33rd bit, so it does not match the /32 prefix.

D

The prefix 2001:db8::/32 specifies that the first 32 bits must be 2001:0db8. Option D (fe80::1) starts with fe80, which is a link-local address prefix, not matching the required prefix.

When would these options actually be correct?

B

If the question specified a prefix of 2001:db8::/28, then 2001:db9::1 would be within the same prefix because the first 28 bits (2001:0db) match, and the next nibble (8 vs 9) is part of the host portion.

C

If the question specified a prefix of 2001:db7::/32, then 2001:db7::1 would be a correct address belonging to that prefix.

D

In a question asking for a link-local IPv6 address, fe80::1 would be correct. For example, 'Which of the following is a valid link-local unicast address?'

Why candidates pick the wrong answer

B

Candidates may mistakenly think that only the first two quartets (2001:db8) define the prefix, ignoring that the /32 prefix includes the entire third quartet, so any change in the third quartet (like db9) is outside the prefix.

C

Candidates may confuse the prefix length and think that only the first two hextets matter, or they may misread db7 as db8 due to visual similarity.

D

Candidates may confuse different IPv6 address types (global unicast vs. link-local) or misremember the prefix ranges, thinking fe80 falls within the 2001::/16 range.

20
MCQeasy

A network technician is explaining the process of resolving Layer 2 addresses to Layer 3 addresses on a local network. Which protocol is used by a host to determine the MAC address of another host given its IP address?

A.DNS
B.ARP
C.DHCP
D.ICMP
AnswerB

The Address Resolution Protocol (ARP) is a crucial Layer 2 protocol that dynamically maps an IPv4 address to its corresponding hardware (MAC) address within the same local network segment. When a device needs to communicate with another device on the same subnet, it uses ARP to discover the destination's MAC address if it's not already known. This involves broadcasting an ARP request for the target IP, and the device with that IP responds with its MAC address, allowing for proper frame encapsulation and delivery. ARP is fundamental for enabling IP packets to traverse Ethernet networks.

Why this answer

ARP (Address Resolution Protocol) is the correct answer because it is specifically designed to resolve a known Layer 3 (IP) address to an unknown Layer 2 (MAC) address on a local network. When a host needs to send a frame to another host, it first checks its ARP cache; if no entry exists, it broadcasts an ARP request containing the target IP, and the host with that IP responds with its MAC address. This process is defined in RFC 826 and operates at the data link layer, enabling direct communication within the same broadcast domain.

Exam trap

The trap here is that candidates often confuse ARP with DNS because both involve 'resolution,' but DNS resolves names to IPs (Layer 3) while ARP resolves IPs to MACs (Layer 2), and Cisco tests this distinction by including DNS as a distractor in Layer 2 addressing questions.

Why the other options are wrong

A

DNS resolves domain names to IP addresses, not MAC addresses. The question asks for the protocol that maps IP addresses (Layer 3) to MAC addresses (Layer 2), which is ARP.

C

DHCP is used for dynamically assigning IP addresses and other network configuration parameters to hosts, not for resolving Layer 2 MAC addresses from Layer 3 IP addresses.

D

ICMP is used for error reporting and diagnostics (e.g., ping), not for resolving Layer 2 addresses from Layer 3 addresses.

When would these options actually be correct?

A

DNS would be correct in a question like: 'Which protocol is used to resolve a fully qualified domain name (FQDN) to an IP address?'

C

A question asking which protocol automatically assigns IP addresses, subnet masks, default gateways, and DNS server addresses to hosts on a network would have DHCP as the correct answer.

D

A question asking which protocol is used to test reachability between hosts or to report network errors (e.g., 'Which protocol does ping use?') would have ICMP as the correct answer.

Why candidates pick the wrong answer

A

Candidates may confuse 'address resolution' with DNS's name resolution, or think that DNS handles all types of address mapping on a network.

C

Candidates may confuse DHCP with ARP because both operate at the network layer and involve address assignment or resolution, leading them to think DHCP handles MAC-to-IP mapping.

D

Candidates may confuse ICMP's role in network troubleshooting with address resolution, or think that ICMP's use in ping involves MAC address discovery.

21
MCQeasy

A network engineer is troubleshooting a communication issue between two hosts. The engineer determines that the data is being segmented at the source and reassembled at the destination, but the segments are arriving out of order. Which OSI layer is responsible for sequencing the segments?

A.A) Physical layer
B.B) Data Link layer
C.C) Network layer
D.D) Transport layer
AnswerD

The Transport layer, notably through protocols like TCP, is directly responsible for segmenting application data into smaller units, assigning unique sequence numbers to each segment. This crucial sequencing allows the receiving host to correctly reassemble the data stream in its original order, even if segments arrive out of sequence due to network conditions. It also facilitates reliable delivery, acknowledging received segments and requesting retransmission of any missing ones, ensuring data integrity from source to destination.

Why this answer

The Transport layer (Layer 4) is responsible for end-to-end communication, including segmentation, reassembly, and sequencing of data segments. Protocols like TCP use sequence numbers to order segments correctly at the destination, even if they arrive out of order. This ensures the upper layers receive a complete, ordered data stream.

Exam trap

CompTIA often tests the misconception that the Network layer (Layer 3) handles sequencing because it deals with packet fragmentation and reassembly, but fragmentation is based on MTU size, not sequence numbers for ordering; sequencing is strictly a Transport layer function.

Why the other options are wrong

A

The Physical layer (Layer 1) handles raw bit transmission over a physical medium and does not perform any sequencing or reassembly of data segments.

B

The Data Link layer handles node-to-node delivery and framing, not end-to-end segment sequencing. Sequencing of segments is a Transport layer function (e.g., TCP sequence numbers).

C

The Network layer (Layer 3) handles routing and logical addressing, but not segmentation or sequencing of data segments. Sequencing is a function of the Transport layer (Layer 4), which manages end-to-end communication and reassembly.

When would these options actually be correct?

A

A question asking which layer defines the electrical, mechanical, and procedural specifications for activating, maintaining, and deactivating the physical link between end systems.

B

A question about which layer adds a header with MAC addresses for local delivery or performs error detection on a frame would make the Data Link layer correct.

C

A question asking which layer is responsible for routing packets between different networks, such as 'Which OSI layer uses IP addresses to determine the best path for data?' would have the Network layer as the correct answer.

Why candidates pick the wrong answer

A

Candidates may confuse the physical transmission of bits with the process of data ordering, or they might think that physical layer issues (like signal interference) could cause out-of-order delivery.

B

Candidates may confuse the Data Link layer's role in ordering frames (e.g., in some protocols like HDLC) with the Transport layer's segment sequencing, or think that any 'sequencing' must happen at a lower layer.

C

Candidates may confuse the Network layer's role in packet fragmentation with the Transport layer's segmentation and sequencing, or mistakenly think that 'sequencing' relates to packet order in routing.

22
MCQeasy

A user reports that they cannot access the internet. The technician is able to ping the default gateway successfully but unable to ping a public IP address (e.g., 8.8.8.8). Which of the following is the most likely cause?

A.Incorrect DNS server configuration
B.The router's default route is missing or misconfigured
C.Duplicate IP address on the network
D.Faulty network interface card
AnswerB

The router's default route (0.0.0.0/0) is crucial for forwarding packets to destinations not explicitly listed in its routing table, which typically includes the entire internet. If this route is missing or misconfigured on the router, traffic destined for external networks will be dropped because the router has no instruction on where to send it. The ability to ping the gateway confirms local network connectivity, but the lack of internet access points directly to the router's inability to forward traffic beyond the local subnet.

Why this answer

Successful ping to the default gateway confirms Layer 2 and Layer 3 connectivity within the local subnet, but failure to ping a public IP like 8.8.8.8 indicates that traffic cannot leave the local network. This is most commonly caused by a missing or misconfigured default route on the router, which prevents the router from forwarding packets destined for external networks to the next-hop ISP gateway.

Exam trap

The trap here is that candidates often confuse DNS resolution with IP connectivity and incorrectly choose 'Incorrect DNS server configuration' when the question explicitly states a public IP address is being pinged, not a hostname.

Why the other options are wrong

A

The user can ping the default gateway but not a public IP like 8.8.8.8, indicating IP routing works locally but fails beyond the local network. DNS is not involved because the test uses an IP address, not a hostname.

C

The user can ping the default gateway but not a public IP, indicating layer 3 routing failure. A duplicate IP address would cause intermittent connectivity or inability to ping the gateway, not a specific failure to reach external IPs.

D

A faulty NIC would prevent successful pings to the default gateway, but the technician can ping the gateway, indicating the NIC is working.

When would these options actually be correct?

A

In a scenario where a user reports 'cannot access the internet' and the technician can ping 8.8.8.8 but cannot browse by name (e.g., www.google.com), incorrect DNS server configuration would be the likely cause.

C

A user reports intermittent connectivity and IP conflicts. The technician finds two devices with the same IP via ARP table. The correct answer would be 'Duplicate IP address on the network'.

D

A user cannot access any network resources, and the technician cannot ping the default gateway or any other device. The NIC driver shows errors in Device Manager.

Why candidates pick the wrong answer

A

Candidates often associate internet access problems with DNS, but the question explicitly tests with a public IP address, bypassing DNS. They may overlook that DNS is only needed for name resolution, not IP connectivity.

C

Candidates may confuse symptoms of DNS failure (which affects name resolution, not IP pings) with IP conflicts, or assume any connectivity issue could be caused by duplicate addresses.

D

Candidates may associate internet access issues with hardware failure, overlooking that successful gateway pings rule out a faulty NIC.

23
MCQhard

A network administrator is configuring BGP between two autonomous systems. Which BGP attribute is primarily used to influence inbound traffic to a particular AS?

A.AS_PATH
B.Next Hop
C.Local Preference
D.MED (Multi-Exit Discriminator)
AnswerD

The Multi-Exit Discriminator (MED) is a BGP attribute exchanged between autonomous systems (ASes) to influence how a neighboring AS routes traffic into the advertising AS. When an AS has multiple entry points to a peer AS, the MED value, which is essentially a metric, allows the advertising AS to suggest which entry point is preferred for inbound traffic. A lower MED value indicates a more preferred path, guiding the external AS's routing decisions for traffic destined for the advertising AS.

Why this answer

The Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic from a neighboring AS when multiple entry points exist. A lower MED value is preferred, allowing an AS to advertise to its neighbor which path should be used to reach it, thereby influencing traffic entering the local AS.

Exam trap

The trap here is confusing MED with Local Preference: candidates often pick Local Preference because it is a well-known attribute for path selection, but it influences outbound traffic from the local AS, not inbound traffic from a neighboring AS.

Why the other options are wrong

A

AS_PATH is used for loop prevention and path selection, but it primarily influences outbound traffic by affecting how routes are advertised, not inbound traffic to a particular AS.

B

The Next Hop attribute specifies the IP address of the next router to reach a destination, but it does not influence inbound traffic decisions; it is used for routing path selection, not traffic engineering into an AS.

C

Local Preference is used to influence outbound traffic from an AS, not inbound traffic. It is a well-known discretionary attribute that is exchanged within an AS to affect the exit path for routes learned from EBGP peers.

When would these options actually be correct?

A

A question asking 'Which BGP attribute is used to prevent routing loops and influence path selection by prepending AS numbers?' would make AS_PATH correct.

B

In a BGP question asking which attribute is used to determine the next router for forwarding packets toward a destination network, Next Hop would be the correct answer.

C

A network administrator wants to ensure that traffic from within the AS leaves via a specific EBGP peer when multiple paths exist to the same destination. In this case, Local Preference is the correct attribute to set a higher value on the preferred path.

Why candidates pick the wrong answer

A

Candidates may confuse AS_PATH with MED because both can influence path selection, but AS_PATH affects outbound traffic while MED affects inbound traffic.

B

Candidates may confuse Next Hop with a tool for traffic control because it is a mandatory BGP attribute involved in path selection, but they overlook that it does not affect inbound traffic preference.

C

Candidates may confuse Local Preference with MED because both are used for path selection, but they operate in opposite directions: Local Preference influences outbound traffic, while MED influences inbound traffic.

24
MCQmedium

A user reports that they cannot connect to a file server on the same subnet. The technician checks the workstation's IP configuration: IP 192.168.1.10, subnet mask 255.255.255.0, default gateway 192.168.1.1. The workstation can ping the gateway but cannot ping the file server at 192.168.1.50. Which of the following is the most likely cause?

A.Incorrect subnet mask on the workstation
B.Incorrect default gateway on the workstation
C.The file server is powered off or disconnected from the network
D.A firewall on the workstation is blocking traffic to the server
AnswerC

The server being powered off or having its network cable disconnected would cause all traffic to fail, matching the symptoms.

Why this answer

The workstation can ping the gateway (192.168.1.1) but not the file server (192.168.1.50) on the same subnet. Since both are on the same subnet, the default gateway is not needed for local traffic. The inability to ping the server suggests the server itself is not responding.

The most likely causes are that the server is powered off, its network cable is disconnected, or it has a failed network interface. A firewall blocking ICMP would also prevent ping, but the question specifies that the correct answer is the server being powered off or disconnected (option C). Therefore, the most likely cause is that the file server is powered off or has a disconnected cable.

Exam trap

The trap here is that candidates assume a failed ping means a network connectivity issue, but CompTIA often tests that a host firewall can block ICMP while allowing other traffic, so a ping failure does not necessarily indicate a broken path.

Why the other options are wrong

A

Option A is not defined, but if it were a common distractor like 'incorrect subnet mask,' the subnet mask 255.255.255.0 is correct for the given IPs on the same subnet, so it would not cause connectivity issues between them.

B

The workstation can ping the gateway (192.168.1.1) but not the file server (192.168.1.50) on the same subnet. Since both are on the same subnet, the default gateway is not needed for local communication; the issue is likely with the file server itself or a local firewall, not the gateway.

D

Option D is not provided in the question, so it cannot be evaluated. The correct answer is C, which is undefined in the given context.

When would these options actually be correct?

A

If the question described a scenario where the workstation's subnet mask was mismatched (e.g., 255.255.255.0 vs 255.255.0.0) and the file server was on a different subnet, then an incorrect subnet mask would be the correct answer.

B

In a scenario where a workstation cannot reach any external networks (e.g., internet) but can ping local devices, the default gateway being misconfigured or down would be the correct answer. For example, if the workstation had IP 192.168.1.10/24 and could ping 192.168.1.50 but not 8.8.8.8, a wrong default gateway would be the cause.

D

In a scenario where the workstation has an APIPA address (169.254.x.x) due to DHCP failure, and the question asks for the most likely cause, 'DHCP server unavailable' would be correct.

Why candidates pick the wrong answer

A

Candidates may incorrectly assume that any connectivity problem is due to subnet mask misconfiguration, especially when they see IPs in the same range but overlook that the mask is actually correct.

B

Candidates may assume that since the gateway is reachable, it must be correct, and then incorrectly attribute the problem to the gateway when the real issue is local connectivity. They might also confuse the role of the gateway in local vs. remote communication.

D

Candidates might choose an undefined option out of confusion or misreading, especially if they expect a specific answer like 'firewall blocking' or 'incorrect subnet mask'.

25
MCQeasy

A network administrator is configuring IP addresses for a new subnet. The network address is 192.168.1.0 with a subnet mask of 255.255.255.240. How many usable host addresses are available on this subnet?

A.14
B.16
C.30
D.62
AnswerA

A /28 subnet mask (255.255.255.240) designates 4 bits for the host portion of the IP address (32 total bits - 28 network bits = 4 host bits). This allows for 2^4 = 16 total IP addresses within the subnet. However, two addresses are reserved: one for the network address itself and one for the broadcast address. Subtracting these two reserved addresses leaves 14 usable IP addresses for hosts and other network devices.

Why this answer

The subnet mask 255.255.255.240 (or /28) provides 16 total addresses per subnet. The network address (192.168.1.0) and the broadcast address (192.168.1.15) are reserved, leaving 16 - 2 = 14 usable host addresses. This is calculated as 2^(32-28) - 2 = 2^4 - 2 = 16 - 2 = 14.

Exam trap

The trap here is that candidates often forget to subtract the network and broadcast addresses, selecting the total number of addresses (16) instead of the usable host count (14).

Why the other options are wrong

B

The subnet mask 255.255.255.240 (/28) provides 16 total addresses per subnet, but the network address and broadcast address are reserved, leaving only 14 usable host addresses.

C

A /28 subnet (255.255.255.240) provides 16 total addresses, but the network and broadcast addresses are reserved, leaving 14 usable hosts. Option C (30) corresponds to a /27 subnet (255.255.255.224), not /28.

D

A /28 subnet (255.255.255.240) provides 16 total addresses, but 2 are reserved for network and broadcast, leaving 14 usable. Option D (62) corresponds to a /26 subnet (255.255.255.192), which is not the mask in this question.

When would these options actually be correct?

B

If the question asked for the total number of addresses in the subnet (including network and broadcast), then 16 would be correct. For example: 'How many IP addresses are in a subnet with mask 255.255.255.240?'

C

This option would be correct if the subnet mask were 255.255.255.224 (/27), which provides 32 total addresses and 30 usable hosts. For example, a question asking for usable hosts on 192.168.1.0/27 would have answer 30.

D

If the subnet mask were 255.255.255.192 (/26) instead of 255.255.255.240, the network would have 64 total addresses, yielding 62 usable hosts. This would be the correct answer for a question with that mask.

Why candidates pick the wrong answer

B

Candidates often forget to subtract the network and broadcast addresses, mistakenly counting all 16 addresses as usable.

C

Candidates often confuse the number of total addresses (32) with usable addresses, forgetting to subtract 2 for network and broadcast. They may also misapply the formula 2^(32 - prefix) - 2, mistakenly using 2^5 = 32 instead of 2^4 = 16.

D

Candidates may mistakenly calculate 2^(32-26) = 64 and forget to subtract 2, or confuse the mask with a /26, which is a common subnet size.

26
MCQeasy

A company wants to ensure that only authorized employee computers can connect to the wired network. Each computer must be authenticated before it is granted access to the network. Which technology is designed to provide this port-based authentication?

A.802.1X
B.WPA2
C.MAC filtering
D.VPN
AnswerA

802.1X is a port-based Network Access Control (NAC) protocol that provides authentication for devices attempting to connect to a network, whether wired or wireless. It acts as a gatekeeper, requiring devices to successfully authenticate with an authentication server (like RADIUS) using credentials or certificates *before* granting any network access. This ensures only authorized employee computers can connect by validating their identity at the network edge.

Why this answer

802.1X is the IEEE standard for port-based Network Access Control (NAC). It uses the Extensible Authentication Protocol (EAP) over LAN (EAPoL) to authenticate a device at the switch port before granting full network access. Only after successful authentication does the switch open the port, ensuring that unauthorized computers cannot connect.

Exam trap

CompTIA often tests the distinction between authentication (802.1X) and access control methods (MAC filtering), where candidates mistakenly choose MAC filtering because they think it 'authenticates' devices, but it only identifies by MAC address without verifying identity or credentials.

Why the other options are wrong

B

WPA2 is a wireless security protocol for Wi-Fi networks, not for port-based authentication on wired networks. The question specifically asks about wired network access control.

C

MAC filtering authenticates based on MAC address, not user or device credentials, and does not provide port-based authentication as defined by 802.1X. It can be bypassed by MAC spoofing.

D

VPN provides encrypted remote access over an untrusted network, not port-based authentication for wired LAN access. It does not control access at the switch port level.

When would these options actually be correct?

B

A question asking 'Which technology provides encryption and authentication for wireless networks?' would make WPA2 the correct answer, as it secures Wi-Fi communications.

C

A question asking for a simple, low-security method to restrict network access to known devices based on hardware addresses, without requiring authentication credentials or a RADIUS server.

D

A question asks: 'Which technology allows remote employees to securely access the corporate network over the internet?' In that context, VPN is the correct answer.

Why candidates pick the wrong answer

B

Candidates may confuse WPA2 with 802.1X because both involve authentication, but WPA2 is wireless-specific and does not perform port-based access control on wired switches.

C

Candidates confuse MAC filtering with port security because both involve controlling access at the switch port level, but MAC filtering lacks the authentication mechanism required by the question.

D

Candidates may confuse network access control with remote access security, thinking VPN authenticates users before granting network access.

27
MCQeasy

A network administrator needs to maintain a record of all configuration changes made to network switches, including the date, time, and the administrator who made the change. Which document should be used for this purpose?

A.Network topology diagram
B.Baseline configuration report
C.Change management log
D.Incident report
AnswerC

A change management log is a critical document specifically designed to systematically track all modifications made to network infrastructure, configurations, and services. It provides a chronological record detailing who initiated the change, the exact timestamp of its implementation, a comprehensive description of what was altered, and often includes the reason for the change and any necessary rollback procedures. This log is indispensable for auditing, troubleshooting, ensuring accountability, and maintaining network stability.

Why this answer

A change management log is the correct document because it is specifically designed to record configuration changes, including the date, time, and the administrator responsible. This log provides an audit trail for network devices, ensuring compliance and facilitating troubleshooting by tracking who made what change and when.

Exam trap

The trap here is that candidates confuse a baseline configuration report with a change log, thinking it records changes, when in fact a baseline is a snapshot of a known good state, not a running history of modifications.

Why the other options are wrong

A

A network topology diagram shows the physical or logical layout of devices and connections, not a record of configuration changes with timestamps and administrator details.

B

A baseline configuration report documents the initial or standard configuration of network devices, not a historical record of changes with dates and administrators.

D

An incident report documents unplanned events or security breaches, not routine configuration changes. The question asks for a record of all configuration changes, which is the purpose of a change management log.

When would these options actually be correct?

A

When a question asks for a document that visually represents the arrangement of network devices and their interconnections, such as 'Which document should be used to understand the physical layout of the network?'

B

When an exam question asks for a document that captures the standard or expected configuration of network devices for comparison purposes, such as verifying compliance or detecting unauthorized changes.

D

An incident report would be correct if the question asked: 'Which document should be used to record details of a security breach or network outage, including the date, time, and administrator who responded?'

Why candidates pick the wrong answer

A

Candidates may confuse documentation of changes with documentation of the network structure, thinking that a topology diagram would include change history.

B

Candidates may confuse 'baseline' with a log of changes, thinking it records deviations from the baseline, but it is a snapshot, not a change history.

D

Candidates may confuse incident reports with change logs because both involve recording dates, times, and personnel, but incident reports are for reactive events, not proactive changes.

28
MCQhard

A user at a branch office reports that they cannot connect to a file server at the main office. The branch office connects to the main office via a site-to-site VPN, and the VPN tunnel shows as active. The user can ping the main office's default gateway but not the file server. Which of the following should the technician check NEXT?

A.A) Check the routing tables on the branch router
B.B) Check the DNS resolution for the file server
C.C) Check the VPN encryption settings
D.D) Check the file server's antivirus software
AnswerA

Correct. The branch router may not have a route to the file server's subnet, or the main office router may not have a route back to the branch subnet. Verifying routing tables on both ends is essential.

Why this answer

The VPN tunnel is active and the user can ping the main office's default gateway, which confirms that Layer 3 connectivity exists across the tunnel. However, the file server is unreachable, indicating that the traffic destined for the file server's subnet is not being forwarded correctly. The next logical step is to check the routing tables on the branch router to ensure there is a specific route (or a default route) pointing to the VPN tunnel interface for the file server's network.

Without this route, the branch router may be dropping the packets or sending them out the wrong interface.

Exam trap

The N10-009 exam often tests the misconception that a 'tunnel up' status guarantees end-to-end connectivity, but the trap here is that routing misconfiguration can allow the tunnel to be established while specific subnets remain unreachable.

Why the other options are wrong

B

The user can ping the main office's default gateway, indicating the VPN tunnel is working and routing is functional at the network layer. DNS resolution is not the issue because connectivity to the file server fails at the IP level, not due to name resolution.

C

The VPN tunnel is active and the user can ping the main office's default gateway, indicating the VPN is established and encryption settings are likely correct. The issue is connectivity to a specific server beyond the gateway, pointing to routing or firewall rules rather than encryption.

D

The file server's antivirus software is unlikely to cause connectivity issues from a remote branch office when the VPN tunnel is active and the user can ping the main office's default gateway. The problem is more likely related to routing or network segmentation within the main office.

When would these options actually be correct?

B

A user can connect to a server by IP address but not by hostname. The technician should check DNS resolution to ensure the hostname resolves correctly.

C

A technician finds that a site-to-site VPN tunnel is down or intermittently dropping, and the logs show encryption mismatches (e.g., AES vs. 3DES, or incorrect pre-shared keys). In that case, checking VPN encryption settings would be the next step to resolve the tunnel failure.

D

A technician would check the file server's antivirus software if users at the main office report they cannot connect to the file server locally, and other network connectivity is working. The antivirus might be blocking file-sharing ports or quarantining the server's network service.

Why candidates pick the wrong answer

B

Candidates often assume that connectivity issues are due to DNS, especially when users refer to servers by name, but here the problem persists at the IP layer (ping fails).

C

Candidates may assume that any VPN issue involves encryption settings, especially when the problem is connectivity across a VPN. They overlook that an active tunnel with successful pings to the gateway implies encryption is working.

D

Candidates may think antivirus software could block network traffic, but in this scenario the issue is specific to remote access via VPN, making routing or firewall rules more relevant.

29
MCQmedium

A user can ping the default gateway (192.168.1.1) but cannot ping the external IP address 8.8.8.8. Other users on the same subnet can ping 8.8.8.8 without issue. The user's IP configuration is correct: IP 192.168.1.10/24, default gateway 192.168.1.1, DNS 8.8.8.8. What is the most likely cause?

A.The computer's firewall is blocking outbound ICMP
B.The router is missing a default route to the internet
C.The DNS server is not resolving the hostname
D.The network cable is loose or faulty
AnswerA

If a user can successfully ping the default gateway (an internal network device) but fails to ping an external IP address like 8.8.8.8, it strongly suggests a local issue on the user's machine. Many operating system firewalls, by default or through custom configuration, are set to block outbound Internet Control Message Protocol (ICMP) echo requests to external destinations, while still permitting internal network communication. This selective blocking prevents external pings from leaving the host, even if the network path to the gateway is clear.

Why this answer

The user can ping the default gateway (192.168.1.1) but not the external IP 8.8.8.8, while other users on the same subnet can ping 8.8.8.8 without issue. This isolates the problem to the user's specific host, not the network infrastructure. A local firewall on the user's computer blocking outbound ICMP (Internet Control Message Protocol) traffic would prevent ping to external IPs while still allowing local subnet communication, as ICMP is often restricted by default in some security policies.

Exam trap

The trap here is that candidates often assume a routing or DNS issue when the problem is host-specific, but the key clue is that other users on the same subnet succeed, pointing to a local host configuration or firewall problem rather than a network-wide fault.

Why the other options are wrong

B

Other users on the same subnet can ping 8.8.8.8, which proves the router has a default route to the internet. The issue is isolated to this user's computer.

C

The user can ping the default gateway but not 8.8.8.8, and DNS is not involved in ICMP ping to an IP address. DNS resolution is only needed when pinging a hostname, not an IP.

D

The user can ping the default gateway, indicating the network cable is functional. A loose or faulty cable would prevent all network communication, including pinging the gateway.

When would these options actually be correct?

B

If the question stated that no users on the subnet can ping external IPs, and the router's routing table shows no default route, then a missing default route would be the likely cause.

C

In a scenario where a user cannot ping a hostname (e.g., www.google.com) but can ping its IP address (e.g., 8.8.8.8), and other users can ping the hostname, the most likely cause is DNS server misconfiguration or failure.

D

In a scenario where a user cannot ping any IP address (neither gateway nor external), and link lights are off or intermittent, a loose or faulty network cable would be the likely cause.

Why candidates pick the wrong answer

B

Candidates may assume that any inability to reach the internet is due to a router misconfiguration, overlooking that the problem is isolated to a single host.

C

Candidates often confuse DNS with general internet connectivity issues, assuming that if you can't reach an external IP, DNS must be the problem, even though the ping command uses an IP address directly.

D

Candidates may associate connectivity issues with physical layer problems, overlooking that successful gateway ping rules out cable faults.

30
MCQeasy

A network technician is explaining the role of a network switch to a new employee. Which of the following best describes the primary function of a switch in a local area network?

A.It forwards data based on IP addresses.
B.It forwards data based on MAC addresses.
C.It connects different networks and performs routing.
D.It amplifies and repeats the signal to all ports.
AnswerB

A network switch, operating at Layer 2 of the OSI model, intelligently forwards data frames based on the destination Media Access Control (MAC) address found in the frame header. The switch dynamically learns the MAC addresses of connected devices by inspecting incoming frames and populates its MAC address table, also known as a CAM table. When a frame arrives, the switch consults this table to send the frame only to the specific port where the destination MAC address is known to reside. This intelligent forwarding significantly reduces unnecessary network traffic and segments collision domains, improving overall network performance.

Why this answer

A network switch operates at Layer 2 of the OSI model and uses MAC addresses to make forwarding decisions. When a frame arrives, the switch examines the destination MAC address, looks it up in its MAC address table, and forwards the frame only to the port associated with that address, reducing collision domains and improving network efficiency.

Exam trap

The N10-009 exam often tests the distinction between Layer 2 switching (MAC addresses) and Layer 3 routing (IP addresses), and the trap here is that candidates confuse the switch's forwarding decision with that of a router, especially when dealing with multilayer switches that can perform both functions.

Why the other options are wrong

A

Switches operate at Layer 2 and forward frames based on MAC addresses, not IP addresses. IP address-based forwarding is the function of a router (Layer 3).

C

A switch operates at Layer 2 and forwards frames based on MAC addresses, not IP addresses. Connecting different networks and performing routing is the function of a router, not a switch.

D

A switch does not amplify and repeat signals to all ports; that describes a hub. Switches forward frames only to the specific port based on MAC addresses.

When would these options actually be correct?

A

This option would be correct if the question asked about the primary function of a router or a Layer 3 switch in a network, where forwarding decisions are made based on IP addresses.

C

This option would be correct for a question like: 'Which device connects different networks and makes forwarding decisions based on IP addresses?' In that context, describing a router's function would be accurate.

D

In a question about the function of a hub or repeater, such as 'Which device regenerates and broadcasts signals to all ports?'

Why candidates pick the wrong answer

A

Candidates may confuse the roles of switches and routers, especially since many modern switches support Layer 3 routing, leading them to think IP forwarding is a primary switch function.

C

Candidates may confuse the roles of switches and routers, especially when thinking about network segmentation or inter-VLAN routing, which involves both devices.

D

Candidates may confuse switches with hubs, especially if they recall that switches 'repeat' signals but forget they do so selectively.

31
MCQhard

A security analyst is investigating a potential data exfiltration. The analyst notices that a server is sending DNS queries to an external IP address on TCP port 53, and the DNS responses are unusually large. The server is not a DNS server. Which technique is most likely being used?

A.DNS amplification attack
B.DNS tunneling
C.DNS zone transfer
D.DNS cache poisoning
AnswerB

DNS tunneling leverages the DNS protocol to exfiltrate data or establish command-and-control channels by encoding arbitrary data within DNS queries and responses. Attackers often embed data in subdomain names of queries or within resource record fields of responses, making it appear as legitimate DNS traffic. Indicators include unusually large DNS response sizes, frequent queries to uncommon domains, or the unexpected use of TCP port 53 for data transfer, which is typically reserved for zone transfers.

Why this answer

DNS tunneling encodes non-DNS data (e.g., exfiltrated files) within DNS queries and responses, often using TCP port 53 to bypass firewalls. The unusually large responses are a hallmark of tunneled data being returned in DNS payloads, and the fact that the server is not a DNS server strongly indicates it is being used as a client for covert data transfer.

Exam trap

CompTIA often tests the distinction between DNS amplification (a DDoS attack using UDP reflection) and DNS tunneling (a covert channel using TCP or UDP for data exfiltration), and the trap here is that candidates see 'large responses' and immediately think amplification, ignoring the TCP port 53 and non-DNS server context.

Why the other options are wrong

A

A DNS amplification attack uses UDP, not TCP, and involves sending small queries that generate large responses to a victim, not to an external IP from a server. The server here is the source, not the target.

C

DNS zone transfer is used to replicate DNS databases between authoritative servers, not for data exfiltration. The scenario involves a non-DNS server sending queries to an external IP, which is characteristic of tunneling, not zone transfer.

D

DNS cache poisoning involves corrupting a DNS resolver's cache with false records, not exfiltrating data via large DNS responses. The scenario describes data exfiltration, not cache manipulation.

When would these options actually be correct?

A

A DNS amplification attack would be correct if the question described a server sending small DNS queries to open resolvers with a spoofed source IP (the victim), resulting in large responses flooding the victim.

C

A question describing a secondary DNS server failing to synchronize with a primary server, with large zone data transfers occurring over TCP port 53, would make DNS zone transfer the correct answer.

D

A question describing a user being redirected to a malicious site after a DNS resolver returns incorrect IP addresses, with no mention of data exfiltration or large responses, would make DNS cache poisoning correct.

Why candidates pick the wrong answer

A

Candidates may confuse 'unusually large DNS responses' with amplification, but they overlook the TCP port 53 and the server initiating queries to an external IP, which points to tunneling instead.

C

Candidates may confuse large DNS responses with zone transfers, or think that any unusual DNS traffic on TCP port 53 indicates a zone transfer, overlooking the data exfiltration context.

D

Candidates may confuse DNS cache poisoning with DNS tunneling because both involve DNS abuse, but cache poisoning focuses on redirection, not data exfiltration via response size.

32
MCQeasy

Which of the following network topologies provides the highest level of redundancy and fault tolerance?

A.Star
B.Bus
C.Ring
D.Mesh
AnswerD

A full mesh topology provides the highest level of redundancy by connecting every device directly to every other device in the network. This creates numerous distinct and independent paths for data transmission, ensuring that if any single link or node fails, traffic can automatically reroute through alternative connections. This design effectively eliminates single points of failure, making it exceptionally fault-tolerant and reliable for critical infrastructure.

Why this answer

A mesh topology provides the highest level of redundancy and fault tolerance because every node has a dedicated point-to-point connection to every other node. This means that if any single link or node fails, traffic can be immediately rerouted through multiple alternative paths without any single point of failure. In a full mesh, the number of links is n(n-1)/2, ensuring maximum path diversity and resilience.

Exam trap

The N10-009 exam often tests the misconception that a ring topology (especially a dual-ring like FDDI) offers the highest fault tolerance, but candidates must remember that a full mesh provides more redundant paths and no single point of failure, whereas even a dual ring can be disrupted by multiple simultaneous failures.

Why the other options are wrong

A

A star topology uses a central switch or hub; if that central device fails, the entire network goes down, so it does not provide the highest level of redundancy and fault tolerance compared to a mesh topology.

B

A bus topology uses a single backbone cable; if the cable fails, the entire network goes down, offering no redundancy or fault tolerance.

C

In a ring topology, each device is connected to exactly two neighbors, forming a single path for data. A break in the ring or a device failure disrupts the entire network, offering minimal fault tolerance compared to mesh.

When would these options actually be correct?

A

A star topology would be correct if the question asked for the topology that is easiest to manage and troubleshoot, or the most cost-effective for a small network with a single point of failure acceptable.

B

In a question asking for the most cost-effective topology for a small, temporary network with minimal devices and low reliability requirements, bus topology would be correct due to its simple cabling and low cost.

C

A question asking 'Which topology uses a token passing mechanism to prevent collisions?' would have ring as correct, as token ring networks rely on this method to control data transmission.

Why candidates pick the wrong answer

A

Candidates often think star is highly redundant because it isolates each device's failure, but they overlook the single point of failure at the central device.

B

Candidates may confuse 'simplicity' with 'reliability', assuming fewer components mean fewer failure points, but in a bus, the single cable is a critical single point of failure.

C

Candidates may think that because ring topologies can use dual rings for redundancy, they offer high fault tolerance, but standard single-ring topologies do not; the dual-ring variant is less common and not implied.

33
MCQmedium

A user reports that their laptop is connected to the corporate Wi-Fi network but cannot access the internet. Other users in the same area are able to access the internet without issues. The laptop shows a valid IP address of 192.168.1.25/24 and the default gateway is 192.168.1.1. Which of the following should the technician check NEXT?

A.DNS server configuration on the laptop
B.DHCP server lease exhaustion
C.Access point channel utilization
D.Switch port status on the distribution switch
AnswerA

A misconfigured DNS server address on the laptop prevents it from translating human-readable domain names into numerical IP addresses, which are necessary for network communication. Even if the laptop has a valid IP address and physical connectivity to the Wi-Fi network, it cannot locate external resources like websites or internal servers by name. This specific issue often manifests as "no internet access" despite being connected, affecting only the device with the incorrect DNS settings while other network functions might remain operational.

Why this answer

Since the laptop has a valid IP address (192.168.1.25/24) and default gateway (192.168.1.1), and other users can access the internet, the issue is isolated to this laptop. A common cause is incorrect or missing DNS server configuration, which prevents domain name resolution even though IP-level connectivity exists. The technician should verify the DNS server addresses in the laptop's IPv4 settings or run 'nslookup' to confirm resolution.

Exam trap

The trap here is that candidates assume a valid IP address and gateway mean full internet connectivity, overlooking that DNS misconfiguration is a classic isolated symptom where other users work fine.

Why the other options are wrong

B

The laptop has a valid IP address (192.168.1.25/24) and other users can access the internet, so DHCP lease exhaustion is unlikely. The issue is isolated to one device, pointing to a client-side problem like DNS.

C

The issue is isolated to a single laptop with a valid IP and gateway, so channel utilization affecting all users is not the cause.

D

The issue is isolated to one laptop with a valid IP and gateway, so the switch port on the distribution switch is unlikely to be the cause; a port problem would affect multiple users or cause complete connectivity loss.

When would these options actually be correct?

B

A technician finds that multiple users in the same area cannot obtain IP addresses or receive APIPA addresses. The DHCP server logs show no available leases. In this scenario, DHCP server lease exhaustion is the correct next check.

C

When multiple users in the same area report slow or intermittent connectivity, and the technician suspects RF interference or congestion on the access point's channel.

D

A technician would check switch port status on the distribution switch when multiple users in the same area cannot access the network or internet, and the access point shows no issues, suggesting a downstream switch failure or misconfiguration.

Why candidates pick the wrong answer

B

Candidates may think that any network connectivity issue could be due to DHCP problems, but the valid IP address and other users' connectivity rule out DHCP exhaustion here.

C

Candidates may think Wi-Fi issues are always related to radio frequency problems, overlooking client-specific configuration errors like DNS.

D

Candidates may think that since the laptop is connected via Wi-Fi, the switch port is still part of the path and could be faulty, overlooking that the problem is isolated to one device with correct IP settings.

34
MCQhard

A network architect is designing a Software-Defined Networking (SDN) based network. Which of the following components is responsible for making centralized forwarding decisions and communicating those decisions to the physical switches using southbound APIs?

A.Application layer
B.Control layer
C.Data plane
D.East-west interfaces
AnswerB

The control layer, embodied by the SDN controller, centralizes the network's control plane. It acts as the "brain" of the SDN architecture, making all forwarding decisions and maintaining a global view of the network topology. The controller then programs the underlying data plane devices (switches) with these decisions via southbound APIs, such as OpenFlow, dictating exactly how packets should be processed and forwarded. This centralization allows for dynamic and programmable network management.

Why this answer

In SDN architecture, the control layer (also known as the SDN controller) is the centralized entity responsible for making all forwarding decisions. It communicates these decisions to the physical switches via southbound APIs, such as OpenFlow, which program the flow tables in the data plane. This separation of the control plane from the data plane is the fundamental principle of SDN.

Exam trap

The trap here is that candidates confuse the control layer with the data plane, thinking that the physical switches themselves make forwarding decisions, but in SDN the control layer is logically centralized and the switches are simple forwarding devices.

Why the other options are wrong

A

The application layer in SDN contains business logic and network applications, but it does not make centralized forwarding decisions or communicate with switches via southbound APIs; that is the role of the control layer.

C

The data plane is responsible for forwarding packets based on decisions made by the control plane, not for making centralized forwarding decisions itself. In SDN, the control layer makes those decisions and communicates them via southbound APIs.

D

East-west interfaces are used for communication between controllers in a distributed SDN control plane, not for making centralized forwarding decisions or communicating with physical switches via southbound APIs.

When would these options actually be correct?

A

In an SDN architecture question asking which layer hosts network applications such as load balancers, firewalls, or monitoring tools, the application layer would be the correct answer.

C

A question asking which component forwards packets according to flow tables populated by the controller would have the data plane as the correct answer. For example: 'Which SDN layer is responsible for actual packet forwarding based on rules installed by the controller?'

D

In a question about SDN controller clustering or high availability, east-west interfaces would be the correct answer for synchronizing state and forwarding decisions between multiple controllers.

Why candidates pick the wrong answer

A

Candidates may confuse the application layer with the control layer because both are part of the SDN architecture, and the term 'application' can be misinterpreted as the controlling entity.

C

Candidates may confuse the data plane with the control plane, thinking that because switches forward packets, they also make forwarding decisions. They overlook the separation of control and data planes in SDN.

D

Candidates may confuse east-west interfaces with southbound APIs because both involve communication between layers, but east-west is horizontal (controller-to-controller) while southbound is vertical (controller-to-switch).

35
MCQmedium

A network engineer needs to securely transfer router configuration files to a central backup server. The backup server supports SCP and TFTP. Which protocol should the engineer use?

A.SCP
B.TFTP
C.HTTP
D.FTP
AnswerA

SCP (Secure Copy Protocol) leverages SSH (Secure Shell) for data transfer, inherently providing strong encryption for the entire session, including the file content and authentication credentials. This ensures confidentiality and integrity of sensitive router configuration files, making it the ideal choice for secure backups. It also provides robust authentication mechanisms to verify both client and server identities, preventing unauthorized access.

Why this answer

SCP (Secure Copy Protocol) is the correct choice because it encrypts both the authentication and the data transfer using SSH, ensuring confidentiality and integrity of the router configuration files during transit. TFTP, while simple and often used for network device backups, lacks any encryption or authentication, making it insecure for transferring sensitive configuration data over a network.

Exam trap

The trap here is that TFTP is commonly associated with router configuration backups in many study materials, leading candidates to overlook the 'securely' keyword in the question and choose TFTP despite its lack of encryption.

Why the other options are wrong

C

HTTP does not provide encryption or authentication, making it insecure for transferring sensitive router configuration files. The question specifies a need for secure transfer, and HTTP lacks the security features required.

D

FTP transmits data and credentials in cleartext, lacking encryption, which makes it insecure for transferring sensitive router configuration files. The question specifies a need for secure transfer, and SCP provides encryption via SSH, while FTP does not.

When would these options actually be correct?

C

When the question asks for a protocol to transfer configuration files to a web server for remote access via a browser, and security is not a concern (e.g., in a lab environment).

D

A question that asks for a protocol to transfer large files quickly over a trusted internal network where security is not a concern, and the backup server supports FTP but not SCP or SFTP.

Why candidates pick the wrong answer

C

Candidates may confuse HTTP with HTTPS, assuming HTTP provides security, or they might think HTTP is commonly used for file transfers in network management contexts.

D

Candidates may know FTP is commonly used for file transfers and overlook the security requirement, or they may confuse FTP with SFTP (which is secure) due to similar names.

36
MCQhard

An organization needs to authenticate network administrators and control which commands each administrator can execute on routers and switches. The solution must support granular per-command authorization and encrypt the entire session. Which protocol is best suited for this requirement?

A.TACACS+
B.RADIUS
C.LDAP
D.Kerberos
AnswerA

TACACS+ (Terminal Access Controller Access Control System Plus) is the correct protocol for this scenario because it provides robust Authentication, Authorization, and Accounting (AAA) services specifically designed for network device administration. It encrypts the entire communication session, not just the password, and offers granular command authorization, allowing administrators to define precisely which commands a user or group can execute on a network device. This level of control is essential for security and compliance in managing critical infrastructure.

Why this answer

TACACS+ is the correct choice because it separates authentication, authorization, and accounting (AAA) functions, allowing granular per-command authorization on routers and switches. It encrypts the entire session, including the username, password, and all command traffic, unlike RADIUS which only encrypts the password. This makes TACACS+ ideal for environments requiring strict command-level control and full session encryption.

Exam trap

CompTIA often tests the distinction that RADIUS is commonly used for network access control (e.g., 802.1X) but fails for device administration because it lacks per-command authorization and full-session encryption, leading candidates to mistakenly choose RADIUS due to its familiarity.

Why the other options are wrong

B

RADIUS encrypts only the password in the authentication packet, not the entire session, and does not support per-command authorization; it is designed for network access control, not device administration.

D

Kerberos is designed for authentication and single sign-on in a trusted network, but it does not provide per-command authorization or session encryption for network device administration.

When would these options actually be correct?

B

When the requirement is to authenticate users for network access (e.g., VPN or 802.1X) and optionally authorize network services, but does not require per-command authorization or full-session encryption.

D

An organization needs to implement single sign-on for users accessing multiple services within a Windows domain, with mutual authentication and ticket-based access control.

Why candidates pick the wrong answer

B

Candidates often confuse RADIUS with TACACS+ because both are AAA protocols, and they may assume RADIUS also provides command authorization and encryption, not realizing its limitations in device administration contexts.

D

Candidates may associate Kerberos with strong authentication and encryption, mistakenly believing it can also handle granular command authorization for network devices.

37
MCQmedium

A network security analyst notices that a switch's CPU utilization is spiking and that the switch is flooding unicast frames to all ports. The analyst suspects a MAC address table overflow attack. Which of the following security features should be configured on the switch's access ports to mitigate this type of attack?

A.BPDU guard
B.Port security
C.DHCP snooping
D.Dynamic ARP Inspection (DAI)
AnswerB

Port security is a crucial layer 2 security feature that limits the number of MAC addresses allowed to be learned on a specific switch port. By configuring a maximum MAC address limit, it directly mitigates MAC flooding attacks, which attempt to overwhelm the switch's MAC address table. If the configured limit is exceeded, the port can be set to shut down, restrict traffic, or send an alert, preventing the switch from entering a hub-like state and maintaining network integrity.

Why this answer

Port security mitigates MAC address table overflow attacks by limiting the number of MAC addresses that can be learned on an access port. When the configured limit is exceeded, the switch can take action (e.g., shutdown or restrict) to prevent an attacker from flooding the CAM table with fake source MAC addresses, which would otherwise cause the switch to fail open and flood unicast frames out all ports.

Exam trap

The trap here is that candidates often confuse port security with other Layer 2 security features like BPDU guard or DHCP snooping, but only port security directly limits the number of MAC addresses learned on a port to prevent CAM table overflow.

Why the other options are wrong

A

BPDU guard prevents bridge loops by disabling ports receiving BPDUs, but it does not protect against MAC address table overflow attacks, which are mitigated by limiting the number of MAC addresses learned per port via port security.

When would these options actually be correct?

A

BPDU guard is correct when the question asks how to prevent a rogue switch from being connected to an access port and causing a spanning tree topology change (e.g., 'A network administrator wants to ensure that no unauthorized switches are connected to access ports. Which feature should be enabled?').

Why candidates pick the wrong answer

A

Candidates may confuse BPDU guard with port security because both are common switch security features, and the term 'guard' sounds like it could prevent attacks, leading them to incorrectly associate it with MAC flooding.

38
MCQeasy

At which layer of the OSI model does a network device encapsulate data into frames and add source and destination MAC addresses?

A.Layer 1 – Physical
B.Layer 2 – Data Link
C.Layer 3 – Network
D.Layer 4 – Transport
AnswerB

The Data Link layer (Layer 2) is responsible for node-to-node data transfer within the same local network segment, handling the physical addressing (MAC addresses) and framing of data into manageable units. It creates these frames, adds the necessary MAC addresses for local delivery, and provides error detection and correction mechanisms to ensure reliable data transmission across the physical medium. This layer is crucial for direct communication between devices on the same broadcast domain, such as within a single Ethernet network.

Why this answer

The Data Link layer (Layer 2) is responsible for node-to-node communication and encapsulates packets from the Network layer into frames. It adds a header containing the source and destination MAC addresses, which are used for delivery within the same local network segment. This process is defined by IEEE 802 standards such as Ethernet (802.3) and Wi-Fi (802.11).

Exam trap

CompTIA often tests the distinction between MAC addresses (Layer 2) and IP addresses (Layer 3), and the trap here is that candidates may confuse the encapsulation process and incorrectly associate MAC addressing with the Network layer due to familiarity with IP addressing.

Why the other options are wrong

A

Frames and MAC addresses are data link layer (Layer 2) concepts; Layer 1 handles raw bit transmission without framing or addressing.

C

Layer 3 (Network) handles logical addressing (e.g., IP addresses) and routing, not frame encapsulation or MAC addresses. Frames and MAC addresses are specific to Layer 2 (Data Link).

D

Layer 4 (Transport) handles end-to-end communication, segmentation, and reassembly, not frame encapsulation or MAC addressing. Frames and MAC addresses are specific to Layer 2 (Data Link).

When would these options actually be correct?

A

A question asking which layer defines electrical signals, cable types, or bit rates (e.g., 'At which layer are voltage levels and connector types defined?') would have Layer 1 as the correct answer.

C

A question asking 'At which OSI layer does a router operate based on IP addresses?' or 'Which layer adds source and destination IP addresses to packets?' would have Layer 3 as the correct answer.

D

A question asking: 'At which layer does TCP segment data and add port numbers?' would make Layer 4 correct, as TCP operates at the Transport layer.

Why candidates pick the wrong answer

A

Candidates may confuse physical transmission of bits with the framing and addressing that occurs at Layer 2, or they may think MAC addresses are part of the physical hardware.

C

Candidates may confuse MAC addresses with IP addresses or think that network devices like switches (Layer 2) and routers (Layer 3) both deal with addressing, leading them to incorrectly select Layer 3.

D

Candidates may confuse the encapsulation process, thinking that adding headers (like TCP headers) is similar to adding MAC addresses, or they may not clearly distinguish between layers.

39
MCQeasy

A network administrator wants to automate IP address assignment for client devices. Which protocol should be used?

A.DHCP
B.DNS
C.ARP
D.ICMP
AnswerA

DHCP (Dynamic Host Configuration Protocol) is the foundational network protocol for automatically assigning IP addresses and other crucial network configuration parameters to client devices. Upon booting or connecting to a network, a client initiates a DHCP discovery process to obtain an IP address, subnet mask, default gateway, and DNS server information from a DHCP server. This automation significantly reduces administrative overhead and prevents IP address conflicts, ensuring efficient network operation.

Why this answer

DHCP (Dynamic Host Configuration Protocol) automates IP address assignment by leasing IP configurations to client devices from a defined pool. This eliminates the need for manual static IP configuration, making it the correct protocol for automated IP address management.

Exam trap

CompTIA often tests the distinction between DHCP for address assignment and DNS for name resolution, leading candidates to confuse the two when the question mentions 'automating IP address assignment'.

Why the other options are wrong

B

DNS resolves domain names to IP addresses, but does not automate IP address assignment for client devices.

C

ARP (Address Resolution Protocol) is used to map IP addresses to MAC addresses on a local network, not to automate IP address assignment for client devices.

D

ICMP is used for network diagnostics and error reporting (e.g., ping, traceroute), not for automating IP address assignment. DHCP is the correct protocol for dynamic IP allocation.

When would these options actually be correct?

B

When a question asks which protocol translates a domain name like 'example.com' into an IP address, DNS is the correct answer.

C

When a question asks which protocol is used to resolve a known IP address to its corresponding MAC address on a local network segment, ARP is the correct answer.

D

A question asking which protocol is used to test network connectivity or report errors, such as 'Which protocol does the ping command use?' would make ICMP the correct answer.

Why candidates pick the wrong answer

B

Candidates may confuse DNS with DHCP because both involve IP addresses and are commonly used in network configuration.

C

Candidates may confuse ARP with DHCP because both involve IP addresses, but ARP deals with mapping, not assignment.

D

Candidates may confuse ICMP with a protocol that manages network addresses because both involve IP communication, or they might think ICMP can assign addresses due to its role in network layer operations.

40
MCQmedium

A user reports they can access internal servers and the default gateway but cannot reach external websites. The technician checks the router's ACL and finds a rule that permits all outbound traffic. What is the most likely cause?

A.DNS resolution failure
B.Incorrect default gateway
C.NAT configuration issue
D.Proxy server misconfiguration
AnswerC

Network Address Translation (NAT) is crucial for allowing devices with private IP addresses to communicate with the public internet. Without proper NAT configuration, the router will not translate the private source IP addresses of internal hosts into a routable public IP address. Consequently, while internal servers and the default gateway remain accessible, any packets destined for external internet resources will be dropped by upstream routers because their source IP is non-routable, effectively blocking all external communication despite ACLs permitting it.

Why this answer

The user can access internal servers and the default gateway, indicating Layer 3 connectivity within the local network. However, external websites are unreachable. Since the ACL permits all outbound traffic, the issue is not a blocked outbound rule.

The most likely cause is a NAT configuration issue, such as missing or incorrect IP masquerading (PAT) on the router's outside interface, which prevents internal private IP addresses from being translated to a public IP address for internet access.

Exam trap

CompTIA often tests the misconception that an ACL permitting all outbound traffic guarantees internet access, when in fact NAT must be properly configured to translate private IP addresses to a routable public IP address for external reachability.

Why the other options are wrong

A

The user can access internal servers and the default gateway, indicating that DNS resolution is working for internal resources. The issue is with external websites, which points to a NAT problem, not DNS.

B

The user can access internal servers and the default gateway, which indicates the default gateway is correctly configured. An incorrect default gateway would prevent access to both internal servers and external websites.

D

The user can access internal servers and the default gateway, which indicates that DNS resolution is working for internal resources. However, the inability to reach external websites points to a NAT issue, not a proxy misconfiguration, as the ACL permits all outbound traffic.

When would these options actually be correct?

A

A user cannot access any websites (internal or external) but can ping IP addresses. The technician checks DNS settings and finds the DNS server address is incorrect or unreachable. In that scenario, DNS resolution failure is the most likely cause.

B

A user cannot access any network resources, including internal servers and the default gateway. The technician verifies that the IP configuration shows a gateway IP that is not on the same subnet as the host.

D

A proxy server misconfiguration would be correct if users could access internal resources but external websites required proxy settings, and the proxy was incorrectly configured or unreachable. For example, if the browser is set to use a proxy that is down or misconfigured, external access fails while internal access works.

Why candidates pick the wrong answer

A

Candidates often associate inability to reach external websites with DNS issues, overlooking that internal access works, which rules out DNS failure.

B

Candidates may confuse symptoms of a default gateway issue (no external access) with the fact that internal access is still working, overlooking that the gateway is reachable.

D

Candidates may confuse proxy server issues with NAT problems because both can cause external access failures. They might assume that a proxy is needed for internet access, overlooking that the scenario's symptoms (internal access works) and the ACL rule point to a NAT issue instead.

41
MCQmedium

A network administrator adds a new server to VLAN 20. The switch port is configured as an access port in VLAN 20, and the server has a correct static IP address in that subnet. However, the server cannot communicate with other devices in the same VLAN. The VLAN exists on the switch and other devices in VLAN 20 are working. What is the most likely cause of this issue?

A.The switch port is configured as a trunk port instead of an access port
B.VLAN 20 is not allowed on the trunk to the router
C.The server does not have a default gateway configured
D.The port is administratively down
AnswerA

A server typically sends standard untagged Ethernet frames, as it is generally unaware of VLAN tagging. If the switch port connected to this server is mistakenly configured as a trunk port, it will expect incoming frames to be 802.1Q tagged with a specific VLAN ID. Since the server's frames arrive untagged, the switch will not correctly associate them with VLAN 20, effectively dropping them or placing them in a default native VLAN, thereby preventing communication within VLAN 20. This misconfiguration is a very common cause of connectivity failure for end devices.

Why this answer

The scenario states the switch port is configured as an access port in VLAN 20, but the server cannot communicate with other devices in the same VLAN. If the port were actually configured as a trunk port, it would expect frames to be tagged with a VLAN ID. An untagged frame from the server would be placed into the native VLAN (typically VLAN 1), not VLAN 20, causing a mismatch.

This explains why the server, despite having a correct static IP in VLAN 20's subnet, cannot reach other devices in VLAN 20.

Exam trap

CompTIA often tests the distinction between access and trunk ports by presenting a scenario where a device has correct IP settings but cannot communicate within its VLAN, tempting candidates to blame routing or gateway issues when the real problem is a layer 2 VLAN mismatch caused by trunk mode on an access port.

Why the other options are wrong

B

The question states the server cannot communicate with other devices in the same VLAN. A trunk to a router is irrelevant for intra-VLAN communication, which occurs at Layer 2 within the switch. The issue is local to the switch port configuration.

C

The server has a correct static IP address in the same subnet, and other devices in VLAN 20 are working, so communication within the VLAN does not require a default gateway. The issue is at Layer 2, not Layer 3.

D

The question states the server cannot communicate with other devices in the same VLAN, but other devices in VLAN 20 are working. If the port were administratively down, no devices on that port would work, and the server would not have link. The issue is specific to this server, not a port status problem.

When would these options actually be correct?

B

This option would be correct if the server needed to communicate with devices in a different VLAN or access the internet, and the trunk port connecting the switch to the router did not have VLAN 20 allowed, preventing inter-VLAN routing.

C

A server in VLAN 20 cannot communicate with devices in a different VLAN or subnet, and the question specifies that inter-VLAN routing is required. In that case, a missing default gateway would prevent traffic from leaving the local subnet.

D

A network administrator reports that a newly connected device has no network connectivity at all, and the switch port shows 'administratively down' in the interface status. The most likely cause is that the port was manually disabled (shutdown) and needs to be enabled with 'no shutdown'.

Why candidates pick the wrong answer

B

Candidates may confuse intra-VLAN communication with inter-VLAN routing, assuming that a missing VLAN on a trunk would affect all communication, including local traffic within the same VLAN.

C

Candidates often associate network connectivity issues with missing default gateways, but they overlook that intra-VLAN communication does not need a gateway.

D

Candidates may think 'administratively down' is a common misconfiguration, but the question's symptom (server can't communicate with same VLAN) points to a VLAN mismatch, not a disabled port. They overlook that other devices in VLAN 20 work, ruling out a global VLAN issue.

42
MCQmedium

A user reports that they cannot access a web server at 10.0.1.200. The user can ping the server's IP address but cannot open the web page. The web server is known to be running and accessible from other users on the same subnet. What is the most likely cause?

A.Default gateway is misconfigured
B.ACL blocking port 80 or 443
C.DNS resolution failure
D.Duplicate IP address
AnswerB

An Access Control List (ACL) is a set of rules configured on a network device, such as a router or firewall, to filter network traffic. The ability to successfully ping the web server indicates basic Layer 3 (IP) connectivity is established, as ping utilizes ICMP. However, the inability to access web services specifically suggests that TCP traffic destined for ports 80 (HTTP) or 443 (HTTPS) is being explicitly denied by an ACL, a common security measure.

Why this answer

The user can ping the server (ICMP works) but cannot access the web page, which indicates Layer 3 connectivity is fine but the specific TCP ports (80 for HTTP or 443 for HTTPS) are being blocked. An ACL applied on the server, a switch, or a router between the user and the server is the most likely cause, as it would permit ICMP echo requests while denying HTTP/HTTPS traffic. Other users on the same subnet can access the server, ruling out server-side or subnet-wide issues.

Exam trap

The trap here is that candidates assume a successful ping means full network connectivity, but ICMP and TCP are separate protocols that can be filtered independently by ACLs, so ping working does not guarantee web access.

Why the other options are wrong

C

DNS resolution failure would prevent the user from resolving a hostname to an IP address, but the user can ping the server's IP address (10.0.1.200) directly, indicating that name resolution is not the issue.

D

A duplicate IP address would cause intermittent connectivity or complete failure for both devices, but the user can ping the server successfully, ruling out an IP conflict.

When would these options actually be correct?

C

A user reports they cannot access a website by its domain name (e.g., www.example.com) but can access it by IP address. Other users on the same subnet can access the site by name. DNS resolution failure would be the most likely cause.

D

A user reports intermittent connectivity to a server; pinging the server sometimes fails and sometimes succeeds, and other users on the same subnet also experience similar issues. This scenario suggests an IP address conflict.

Why candidates pick the wrong answer

C

Candidates often associate web access issues with DNS problems, overlooking that the user can successfully ping the IP address, which eliminates DNS as the cause.

D

Candidates may confuse symptoms of IP conflicts with application-layer issues, or assume that any connectivity problem could be due to duplicate IPs without considering that ping success eliminates that possibility.

43
MCQeasy

A network technician is explaining the difference between a hub and a switch to a junior technician. Which statement correctly describes a key difference between these devices?

A.A hub operates at Layer 2, while a switch operates at Layer 1.
B.A hub sends frames out all ports except the incoming port; a switch sends frames only to the port with the matching MAC address.
C.A hub uses MAC addresses to make forwarding decisions, while a switch uses IP addresses.
D.A hub creates a separate collision domain for each port, while a switch creates a single collision domain.
AnswerB

A hub is a Layer 1 device that simply regenerates electrical signals, broadcasting incoming data frames to all connected ports except the one from which the frame originated, without any intelligence. In contrast, a switch is a Layer 2 device that intelligently learns the MAC addresses of connected devices and stores them in its MAC address table. When a switch receives a frame, it examines the destination MAC address and forwards the frame only to the specific port associated with that MAC address, significantly reducing unnecessary network traffic and improving efficiency.

Why this answer

B is correct because a hub operates at Layer 1 (physical layer) and blindly repeats electrical signals out all ports except the incoming port, creating a single collision domain. In contrast, a switch operates at Layer 2 (data link layer) and uses the MAC address table to forward frames only to the specific port associated with the destination MAC address, reducing unnecessary traffic and creating separate collision domains per port.

Exam trap

The N10-009 exam often tests the confusion between Layer 1 and Layer 2 operations, where candidates mistakenly think a hub operates at Layer 2 or that a switch uses IP addresses, but the key trap is reversing the collision domain behavior—hub creates one collision domain, switch creates many.

Why the other options are wrong

A

Hubs operate at Layer 1 (physical layer) and do not process MAC addresses, while switches operate at Layer 2 (data link layer) and use MAC addresses for forwarding. This option reverses the OSI layers for hubs and switches.

C

Hubs operate at Layer 1 and do not use MAC addresses; switches use MAC addresses at Layer 2. This option reverses the roles: hubs do not use MAC addresses, and switches do not use IP addresses for forwarding.

D

A hub creates a single collision domain for all ports, while a switch creates a separate collision domain per port. The statement reverses these facts.

When would these options actually be correct?

A

This option would be correct if the question asked: 'Which statement incorrectly describes the difference between a hub and a switch?' or if the question was about a device that operates at Layer 2 (like a switch) versus a device that operates at Layer 1 (like a hub), but with the layers swapped.

C

This option would be correct in a question comparing a router and a switch, where the router uses IP addresses (Layer 3) and the switch uses MAC addresses (Layer 2).

D

If the question asked 'Which statement correctly describes a key difference between a hub and a switch regarding collision domains?' and the options were reversed (e.g., 'A hub creates a single collision domain, a switch creates separate collision domains'), then this option would be correct.

Why candidates pick the wrong answer

A

Candidates may confuse the OSI layers, thinking hubs are more intelligent than they are, or they may misremember that switches operate at Layer 2 and hubs at Layer 1, leading to a reversal of the correct layer assignments.

C

Candidates may confuse the layers of operation, thinking hubs use MAC addresses because they deal with frames, or they may mix up the functions of hubs and switches with those of routers.

D

Candidates may confuse the concepts of collision and broadcast domains, or mistakenly think that hubs segment collision domains because they are older devices, while switches are more advanced.

44
MCQmedium

A network administrator needs to connect two buildings 2 km apart using single-mode fiber. Which transceiver type should be used?

A.1000BASE-T
B.1000BASE-SX
C.1000BASE-LX
D.10GBASE-SR
AnswerC

1000BASE-LX is the correct choice because it is specifically designed for Gigabit Ethernet over single-mode fiber optic cabling. The "LX" in its name signifies "Long Wavelength," indicating its use of longer wavelength lasers (1310 nm) suitable for extended distances. This standard supports reliable data transmission up to 5 kilometers, making it perfectly suitable for the 2 km distance between the two buildings using single-mode fiber.

Why this answer

1000BASE-LX (Long Wavelength) operates at 1310 nm over single-mode fiber and supports distances up to 5 km (and often up to 10 km with proper link budgets), making it the correct choice for a 2 km link. Single-mode fiber is required for distances beyond 550 m, and 1000BASE-LX is the Gigabit Ethernet standard designed for such single-mode runs.

Exam trap

The N10-009 exam often tests the misconception that 1000BASE-SX can be used for long distances because it is a common Gigabit Ethernet standard, but the trap is that SX is strictly for multimode fiber and limited to 550 m, while LX is the correct choice for single-mode runs beyond that distance.

Why the other options are wrong

A

1000BASE-T uses twisted-pair copper cabling with a maximum distance of 100 meters, far short of the 2 km requirement. Single-mode fiber requires a different transceiver type.

B

1000BASE-SX uses multimode fiber and has a maximum reach of about 550 meters, insufficient for a 2 km link.

D

10GBASE-SR is designed for multimode fiber and supports distances up to 300 meters, insufficient for 2 km over single-mode fiber.

When would these options actually be correct?

A

A question asking for a transceiver to connect two switches within the same data center, less than 100 meters apart, using existing Cat6a cabling. 1000BASE-T would be correct for that scenario.

B

A question specifying a link distance under 550 meters (e.g., within a data center) using multimode fiber would make 1000BASE-SX the correct choice.

D

When connecting devices within a data center using multimode fiber at distances up to 300 meters, 10GBASE-SR is the correct choice for 10 Gbps Ethernet.

Why candidates pick the wrong answer

A

Candidates may confuse transceiver types or assume 'T' stands for fiber, or they might overlook the distance limitation and focus only on the speed requirement.

B

Candidates may confuse SX with LX or assume 'S' stands for single-mode, not short wavelength, leading to incorrect selection for longer distances.

D

Candidates may confuse SR with LX, assuming both support long distances, or overlook the fiber type requirement (multimode vs. single-mode).

45
MCQmedium

A network administrator has just connected a new access switch to the core switch via a trunk port. The administrator configured the trunk port on both switches with the same allowed VLAN list. However, hosts on VLAN 10 connected to the new access switch cannot communicate with hosts on VLAN 10 on the core switch. The trunk is operational and shows up/up. What is the most likely cause?

A.A) VLAN 10 has not been created on the new access switch
B.B) Native VLAN mismatch on the trunk
C.C) Trunk encapsulation mismatch (ISL vs 802.1Q)
D.D) STP is blocking the VLAN 10 traffic on the trunk
AnswerA

If VLAN 10 has not been explicitly created and activated within the new access switch's VLAN database, the switch will not recognize or process frames tagged with VLAN 10. Even if the trunk port is configured to permit VLAN 10, the switch will drop incoming frames for an unknown VLAN ID, effectively preventing traffic flow. A switch must have a local understanding of a VLAN to forward frames associated with it, regardless of trunk allowance.

Why this answer

The most likely cause is that VLAN 10 has not been created on the new access switch. Even though the trunk port is up/up and the allowed VLAN list matches, a switch will not forward traffic for a VLAN that does not exist in its local VLAN database. Without the VLAN being created, the switch drops all frames tagged with VLAN 10, preventing communication between hosts on that VLAN across the trunk.

Exam trap

The N10-009 exam often tests the misconception that a trunk with matching allowed VLAN lists is sufficient for traffic to pass, but candidates forget that the VLAN must exist in the local VLAN database on both switches for traffic to be forwarded.

Why the other options are wrong

B

A native VLAN mismatch would cause issues with untagged traffic, but the problem is that hosts on VLAN 10 cannot communicate. Since both switches have the same allowed VLAN list and the trunk is up/up, a native VLAN mismatch would not prevent tagged VLAN 10 traffic from passing.

C

The trunk is operational and shows up/up, indicating that the encapsulation is correctly negotiated or configured. If there were an encapsulation mismatch, the trunk would not come up, or at least show errors. The problem is specific to VLAN 10, not all VLANs.

D

STP blocking VLAN 10 traffic on the trunk would prevent communication, but the question states the trunk is operational and up/up, and STP typically blocks redundant paths, not a single trunk unless it's a loop. The issue is more likely that VLAN 10 doesn't exist on the new switch.

When would these options actually be correct?

B

This would be correct if the question stated that hosts on the native VLAN (e.g., VLAN 1) cannot communicate, or if there were symptoms like CDP/LLDP not working or management access issues across the trunk, indicating a native VLAN mismatch.

C

This option would be correct in a scenario where a trunk link between two switches is down or not passing any traffic, and the switches use different trunking protocols (e.g., one switch is Cisco using ISL and the other is a non-Cisco switch using 802.1Q). The encapsulation mismatch would prevent the trunk from forming.

D

In a scenario where two switches are connected via redundant trunk links, and one link is blocked by STP to prevent loops, causing VLAN 10 traffic to be blocked on that specific trunk. The question would indicate multiple connections between switches and that the trunk is up but not forwarding traffic.

Why candidates pick the wrong answer

B

Candidates often confuse native VLAN mismatch with general VLAN communication issues, as it is a common trunk misconfiguration that can cause connectivity problems, but it specifically affects untagged traffic, not tagged VLANs like VLAN 10.

C

Candidates may confuse trunk encapsulation issues with VLAN-specific problems, especially if they have encountered encapsulation mismatches in the past that caused connectivity issues. They might assume that any trunk problem is due to encapsulation mismatch without considering that the trunk is up.

D

Candidates may think STP is a common cause for VLAN traffic issues on trunks, especially if they've seen STP blocking ports in loop prevention scenarios, and they might overlook the simpler VLAN creation requirement.

46
MCQhard

A security analyst needs to deploy a device that can perform deep packet inspection and block specific application-layer attacks in real time. Which of the following devices is MOST appropriate for this purpose?

A.Stateful firewall
B.Intrusion Prevention System (IPS)
C.Proxy server
D.VPN concentrator
AnswerB

An Intrusion Prevention System (IPS) is deployed inline within the network path, allowing it to perform deep packet inspection (DPI) on all passing traffic. This capability enables the IPS to analyze packet payloads and protocol behavior at the application layer, identifying and actively blocking known attack signatures, anomalous activities, and zero-day threats in real-time. It is specifically designed to mitigate sophisticated application-layer attacks that bypass traditional firewalls.

Why this answer

An Intrusion Prevention System (IPS) is designed to inspect traffic in real time, perform deep packet inspection (DPI) up to Layer 7, and automatically block malicious traffic, including application-layer attacks such as SQL injection or cross-site scripting. Unlike a passive IDS, an IPS sits inline and can drop or reset sessions based on signature or anomaly detection, making it the most appropriate device for this requirement.

Exam trap

The trap here is that candidates often confuse an IPS with a stateful firewall, assuming that stateful inspection includes deep packet inspection, but stateful firewalls only check packet headers and connection state, not application-layer payloads.

Why the other options are wrong

A

A stateful firewall tracks connection states and filters traffic based on state and port/protocol, but it does not perform deep packet inspection or block application-layer attacks in real time.

C

A proxy server primarily acts as an intermediary for client requests, often caching content or filtering URLs, but it does not perform deep packet inspection or block application-layer attacks in real time like an IPS does.

D

A VPN concentrator is designed to manage VPN tunnels and encrypt/decrypt traffic, not to perform deep packet inspection or block application-layer attacks in real time.

When would these options actually be correct?

A

A stateful firewall would be correct when the requirement is to filter traffic based on connection state (e.g., allowing return traffic for established connections) and enforce basic access control policies without needing deep packet inspection or application-layer attack blocking.

C

A proxy server would be correct if the question asked for a device that provides anonymous web browsing, content caching, or URL filtering to enforce acceptable use policies, without requiring real-time attack blocking.

D

A question asking for a device that securely connects remote users to a corporate network over the internet, with emphasis on encryption and tunnel management, would make a VPN concentrator the correct answer.

Why candidates pick the wrong answer

A

Candidates may confuse stateful firewalls with next-generation firewalls (NGFWs) that do include DPI and application-layer filtering, or they may overestimate the capabilities of standard stateful firewalls.

C

Candidates may confuse proxy servers with security devices because proxies can filter web traffic and block certain content, leading them to overestimate the proxy's ability to inspect and block application-layer attacks.

D

Candidates may confuse VPN concentrators with security devices because they handle encrypted traffic, but they lack the inspection and blocking capabilities required for application-layer attack prevention.

47
MCQeasy

A user reports that they can access a website by its IP address but not by its domain name. Which of the following is most likely the issue?

A.A) DNS resolution failure
B.B) Incorrect default gateway
C.C) Duplicate IP address
D.D) Corrupted TCP/IP stack
AnswerA

A DNS resolution failure is the correct diagnosis because the Domain Name System (DNS) is solely responsible for translating human-readable domain names (like example.com) into numerical IP addresses. If DNS is not functioning correctly, the system cannot resolve the name to an IP, preventing access by name. However, since direct IP address access bypasses the DNS lookup process entirely, it would continue to work without issue.

Why this answer

Accessing a website by IP address but not by domain name indicates that the client can reach the web server over the network, but the name-to-IP translation process is failing. This is a classic symptom of a DNS resolution failure, where the client cannot query or receive a valid A or AAAA record for the domain from its configured DNS server.

Exam trap

The trap here is that candidates often confuse DNS failure with a gateway or routing issue, but the ability to reach the server by IP proves Layer 3 connectivity is working, isolating the problem to the application layer name resolution process.

Why the other options are wrong

B

The issue is that the user can access the website by IP address but not by domain name, which points to a name resolution problem, not a routing issue. An incorrect default gateway would prevent access to any external IP addresses, not just domain names.

C

A duplicate IP address would cause intermittent connectivity or complete loss of network access, but it would not specifically prevent domain name resolution while allowing access by IP address.

D

A corrupted TCP/IP stack would cause connectivity issues regardless of whether the destination is accessed by IP or domain name, but the user can access the website by IP, so the stack is functioning correctly.

When would these options actually be correct?

B

A user reports they cannot access any external websites or services, but can access local network resources. In this scenario, an incorrect default gateway would be the most likely issue because it prevents traffic from leaving the local subnet.

C

A user reports that they cannot access any network resources, and an IP conflict is detected in the logs. The correct answer would be 'Duplicate IP address' because the conflict disrupts all IP communication.

D

A user cannot access any network resources, and ipconfig /all shows an invalid IP address (e.g., 169.254.x.x). In that scenario, a corrupted TCP/IP stack could prevent proper IP configuration.

Why candidates pick the wrong answer

B

Candidates may confuse network connectivity issues with DNS issues, assuming that if a website is unreachable, it must be a gateway problem. They might not realize that successful access via IP address rules out gateway and routing problems.

C

Candidates may confuse symptoms of IP conflicts with DNS issues, thinking that a duplicate IP could cause name resolution failures, but DNS operates independently of IP uniqueness.

D

Candidates may think that any network problem could be due to a corrupted TCP/IP stack, especially when they cannot immediately identify the DNS issue, leading them to choose a more generic 'system-level' cause.

48
MCQhard

A network engineer is designing a new IPv6 addressing scheme. The company has been assigned a /48 prefix and needs to support up to 250 subnets. Which subnet size should be used to minimize waste while meeting the requirement?

A./52
B./56
C./64
D./60
AnswerB

A /48 global routing prefix is typically assigned to an organization. To create 250 subnets, additional bits beyond the /48 must be used for subnetting. A /56 prefix length means 8 bits are available for subnetting (56 - 48 = 8). This yields 2^8, or 256, possible subnets, which perfectly accommodates the requirement for 250 subnets with minimal address space waste.

Why this answer

A /56 subnet provides 256 subnets (2^(56-48) = 2^8 = 256), which meets the requirement of up to 250 subnets with minimal waste. A /48 prefix is the site-level allocation, and using a /56 subnet mask leaves 8 bits for subnetting, offering exactly the needed capacity without over-allocating address space.

Exam trap

The N10-009 exam often tests the misconception that /64 is the only valid subnet size in IPv6, but the question asks for subnet size to minimize waste for subnets, not for SLAAC, so candidates incorrectly choose /64 without considering the requirement for only 250 subnets.

Why the other options are wrong

A

A /52 prefix provides 16 subnets (2^(52-48)=16), which is insufficient for the requirement of up to 250 subnets.

C

A /64 subnet provides 2^64 addresses per subnet, which is far more than needed for 250 subnets. Using /64 would waste a huge number of addresses and does not minimize waste given the /48 prefix.

D

A /60 subnet provides only 2^(60-48)=4096 subnets, which is far more than the required 250, but it wastes more addresses than a /56 (which gives 256 subnets). The question asks to minimize waste, so /56 is optimal.

When would these options actually be correct?

A

If the requirement were to support up to 16 subnets, a /52 would be the correct choice to minimize waste.

C

If the question required each subnet to support SLAAC (Stateless Address Autoconfiguration) or needed a standard subnet size for end-user networks, /64 is the correct choice because IPv6 standards mandate /64 for SLAAC.

D

If the requirement were to support up to 4000 subnets, a /60 would be correct because it provides 4096 subnets, meeting the need with minimal waste compared to larger subnet sizes like /64.

Why candidates pick the wrong answer

A

Candidates may mistakenly think that a /52 offers more subnets than a /56 because it has a larger subnet portion, but they forget that the number of subnets is 2^(subnet bits), and /52 gives only 16 subnets, far fewer than needed.

C

Candidates often default to /64 because it is the most common IPv6 subnet size and is required for SLAAC, forgetting that the question emphasizes minimizing waste for a specific number of subnets.

D

Candidates may think a larger subnet prefix (like /60) is more efficient because it provides more subnets, but they overlook that the requirement is only 250 subnets, so a /56 wastes fewer addresses overall.

49
MCQhard

A network engineer is troubleshooting intermittent call drops on a VoIP deployment. The network uses separate VLANs for voice (VLAN 20) and data (VLAN 10). Switch ports connecting the IP phones are configured with the correct voice VLAN. Which of the following is the MOST likely cause to check NEXT?

A.Verify that QoS markings and queuing are configured on the switches and routers
B.Check the DNS server for the phone's name resolution
C.Replace the patch cables from the phones to the switches
D.Increase the DHCP lease time for the phones
AnswerA

Verifying QoS markings and queuing is crucial because Quality of Service mechanisms are designed to prioritize real-time traffic like VoIP over less time-sensitive data. By configuring appropriate DSCP (Differentiated Services Code Point) or CoS (Class of Service) markings, network devices can identify voice packets and place them into high-priority queues. This ensures that even during periods of network congestion, voice packets are forwarded with minimal latency and jitter, preventing the intermittent call drops that occur when voice traffic competes equally with other data.

Why this answer

Intermittent call drops on a VoIP deployment with separate voice and data VLANs most likely stem from insufficient or misconfigured QoS markings and queuing. Voice traffic is sensitive to latency, jitter, and packet loss, which occur when data traffic competes for bandwidth without proper prioritization. Verifying that switches and routers have consistent QoS policies (e.g., marking with DSCP EF for RTP and queuing with strict priority) is the logical next step after ensuring the voice VLAN is correctly assigned.

Exam trap

CompTIA often tests the misconception that physical layer issues (like bad cables) are the primary cause of intermittent VoIP problems, when in fact intermittent drops are more commonly due to QoS misconfiguration in a converged network.

Why the other options are wrong

C

Intermittent call drops are typically caused by network congestion or QoS misconfiguration, not by physical cabling issues. Patch cable faults usually cause complete loss of connectivity or persistent problems, not intermittent drops.

D

Intermittent call drops are typically caused by network congestion or QoS misconfiguration, not DHCP lease time. Increasing DHCP lease time would not address the root cause of packet loss or jitter affecting voice traffic.

When would these options actually be correct?

C

A question describing a scenario where IP phones intermittently lose connectivity entirely (not just call drops) and other devices on the same switch port work fine. The correct answer would be to replace patch cables after verifying link lights and cable tester results.

D

A question where IP phones are losing their IP addresses and re-registering frequently, causing call drops. For example: 'Users report that VoIP phones disconnect and reconnect every few hours. Which setting should be adjusted?'

Why candidates pick the wrong answer

C

Candidates may default to physical layer troubleshooting (cables) when faced with intermittent issues, overlooking that VoIP call drops are more often due to QoS or network congestion problems.

D

Candidates may think that DHCP lease expiration causes phones to lose connectivity, but intermittent call drops during active calls are rarely due to lease time—phones renew leases well before expiration.

50
MCQmedium

A user reports intermittent connectivity on a laptop that moves between floors. The signal strength fluctuates. Which tool would best help identify signal interference and dead zones?

A.Cable tester
B.Multimeter
C.Spectrum analyzer
D.Protocol analyzer
AnswerC

This tool is crucial for diagnosing intermittent wireless connectivity issues, especially when a device moves between locations. A spectrum analyzer graphically displays the strength of radio frequency (RF) signals across different frequencies, allowing technicians to identify sources of interference (e.g., other Wi-Fi networks, microwave ovens, cordless phones) or areas with poor signal coverage. By observing the RF environment, it can pinpoint why a laptop experiences drops as it changes location, making it the most appropriate tool for this scenario.

Why this answer

A spectrum analyzer is the correct tool because it visualizes radio frequency (RF) energy across the 2.4 GHz and 5 GHz bands, allowing you to identify sources of interference (e.g., cordless phones, microwave ovens) and locate dead zones where signal strength drops below usable thresholds. Unlike other tools, it directly measures the RF environment rather than relying on logical-layer data.

Exam trap

The trap here is that candidates confuse a protocol analyzer (which sees logical traffic) with a spectrum analyzer (which sees physical RF energy), leading them to choose D because they think packet captures reveal interference, when in fact interference is invisible at the protocol level.

Why the other options are wrong

A

A cable tester is used to verify physical cabling (e.g., continuity, wiring faults) and cannot measure wireless signal interference or dead zones, which are the issues described in the question.

B

A multimeter measures electrical properties like voltage, current, and resistance, not wireless signal interference or dead zones. It cannot analyze RF spectrum or identify sources of Wi-Fi interference.

D

A protocol analyzer captures and decodes network traffic, but it does not measure signal strength or identify physical-layer interference and dead zones, which are the issues described in the question.

When would these options actually be correct?

A

A cable tester would be correct when troubleshooting a wired connectivity issue, such as a user reporting intermittent network drops on a desktop PC connected via Ethernet, where you suspect a faulty cable or improper termination.

B

A technician is troubleshooting a PoE device that intermittently loses power. Using a multimeter to check voltage at the switch port and at the device can confirm if the power supply is within spec.

D

A protocol analyzer would be correct when the question involves analyzing packet-level issues, such as identifying excessive retransmissions, protocol errors, or application-layer problems, rather than physical-layer signal issues.

Why candidates pick the wrong answer

A

Candidates may confuse cable testers with network troubleshooting tools, or assume that intermittent connectivity always involves cabling, overlooking that the problem is wireless (laptop moving between floors).

B

Candidates may confuse a multimeter with a spectrum analyzer, thinking it can measure signal strength, or they may overestimate its capabilities in wireless troubleshooting.

D

Candidates may confuse 'analyzer' with tools that diagnose network problems, assuming a protocol analyzer can also detect interference, or they may think it can analyze wireless signals at a low level.

51
MCQmedium

A network engineer needs to segment a single physical switch into multiple broadcast domains to improve security and reduce traffic. Which technology should be implemented?

A.Spanning Tree Protocol (STP)
B.Virtual LAN (VLAN)
C.VLAN Trunking Protocol (VTP)
D.Access Control List (ACL)
AnswerB

A Virtual LAN (VLAN) is a logical grouping of network devices that allows a single physical switch to be segmented into multiple distinct broadcast domains. By assigning specific switch ports or even hosts to different VLANs, broadcast traffic originating within one VLAN is strictly confined to only the devices belonging to that same VLAN. This effectively isolates network segments, significantly improving security, reducing unnecessary network traffic, and enhancing network performance without requiring additional physical switches.

Why this answer

A VLAN (Virtual LAN) segments a physical switch into multiple isolated broadcast domains at Layer 2. By assigning ports to different VLANs, broadcast traffic is confined to each VLAN, improving security and reducing unnecessary traffic. This directly meets the requirement without requiring additional hardware.

Exam trap

CompTIA often tests the distinction between VLANs (which create broadcast domains) and VTP (which only propagates VLAN information), leading candidates to confuse configuration management with actual segmentation.

Why the other options are wrong

A

STP prevents loops in a network topology but does not segment a switch into multiple broadcast domains; it operates at Layer 2 to manage redundant paths, not to create separate broadcast domains.

D

ACLs filter traffic based on IP addresses or protocols but do not segment a switch into multiple broadcast domains; they operate at Layer 3/4, not Layer 2.

When would these options actually be correct?

A

A question asking which protocol prevents bridging loops in a redundant switched network would have STP as the correct answer, e.g., 'Which technology ensures a loop-free topology in a network with redundant switches?'

D

A question asking 'Which technology can be used to restrict traffic between two subnets on a router?' would make ACLs correct, as they filter packets based on rules.

Why candidates pick the wrong answer

A

Candidates may confuse STP's role in managing network traffic with segmentation, or think that breaking a network into segments involves loop prevention.

D

Candidates may confuse traffic filtering (ACLs) with traffic isolation (VLANs), thinking that controlling traffic flow achieves segmentation.

52
MCQmedium

A company is deploying VoIP phones and wants to ensure voice packets receive priority over data packets on the network. Which technology should be implemented on the switches and routers?

A.VLAN
B.Quality of Service (QoS)
C.Spanning Tree Protocol (STP)
D.Power over Ethernet (PoE)
AnswerB

Quality of Service (QoS) is essential for real-time applications like VoIP because it allows network administrators to prioritize specific types of traffic. By classifying voice packets and marking them with values like Differentiated Services Code Point (DSCP) or Class of Service (CoS), network devices can place them into high-priority queues. This ensures that voice traffic receives preferential treatment over less time-sensitive data, minimizing latency, jitter, and packet loss, which are critical for maintaining call quality.

Why this answer

Quality of Service (QoS) is the correct technology because it allows network devices to classify, mark, and prioritize voice traffic (e.g., using DSCP EF or CoS 5) over data traffic, ensuring low latency, jitter, and packet loss for VoIP. Switches and routers use QoS queuing mechanisms like LLQ or CBWFQ to guarantee bandwidth for voice packets, which is essential for real-time communications.

Exam trap

The N10-009 exam often tests the misconception that VLANs alone provide traffic prioritization, but VLANs only separate traffic; QoS is the actual mechanism for priority handling, and candidates frequently confuse logical separation with performance guarantees.

Why the other options are wrong

A

VLANs segment network traffic into separate broadcast domains but do not prioritize voice packets over data; they only isolate traffic, not provide quality of service.

C

STP prevents loops in redundant network topologies but does not prioritize voice traffic over data; it has no mechanism for traffic classification or queuing.

D

PoE provides power to devices like VoIP phones over Ethernet cables but does not prioritize voice packets over data packets. The question specifically asks for packet prioritization, which is handled by QoS, not PoE.

When would these options actually be correct?

A

A question asking how to separate voice and data traffic on the same physical network to improve security or reduce broadcast traffic would make VLAN the correct answer.

C

A question asking which protocol prevents bridging loops in a switched network with redundant links would have STP as the correct answer.

D

PoE would be correct if the question asked about powering VoIP phones without needing separate power adapters, e.g., 'A company is deploying VoIP phones and wants to avoid running separate power cables. Which technology should be implemented?'

Why candidates pick the wrong answer

A

Candidates may confuse traffic isolation with traffic prioritization, thinking that separating voice into its own VLAN inherently gives it priority.

C

Candidates may confuse STP with QoS because both involve network performance, but STP is about loop prevention, not traffic prioritization.

D

Candidates may confuse PoE with QoS because both are commonly associated with VoIP deployments, leading them to think PoE also handles traffic prioritization.

53
MCQeasy

A user reports that they cannot access any company resources. The technician runs 'ipconfig' and sees that the workstation has an IP address of 169.254.100.25 with a subnet mask of 255.255.0.0. The technician also notices that the 'Default Gateway' is blank. What is the most likely cause?

A.The DNS server is not responding.
B.The DHCP server is unavailable or unreachable.
C.The workstation has a static IP address configured.
D.The network cable is unplugged.
AnswerB

When a workstation is configured to obtain an IP address automatically via DHCP, it initiates a discovery process to locate a DHCP server. If the DHCP server is either offline, misconfigured, or unreachable on the network segment, the client will fail to receive a DHCP offer. In such scenarios, the operating system automatically assigns itself an APIPA (Automatic Private IP Addressing) address from the 169.254.0.0/16 range, which allows for limited local network communication but prevents access to external company resources.

Why this answer

The IP address 169.254.100.25 with a subnet mask of 255.255.0.0 is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when a DHCP client fails to obtain a lease. The blank Default Gateway confirms that no DHCP server responded, so the workstation cannot reach any company resources beyond its local subnet.

Exam trap

The trap here is that candidates often confuse APIPA with a link-local address caused by a physical cable issue, but APIPA requires the interface to be in a connected state; a disconnected cable would show no IP address or a 'Media disconnected' status in ipconfig.

Why the other options are wrong

A

The IP address 169.254.100.25 is an Automatic Private IP Addressing (APIPA) address, which is assigned when DHCP fails. A non-responsive DNS server would not cause this; it would result in name resolution failures but the workstation would still have a valid DHCP-assigned IP and default gateway.

C

A static IP address would not result in an APIPA address (169.254.x.x). If a static IP were configured, the workstation would use that address, not self-assign an APIPA address.

D

An unplugged network cable would result in no IP address or a disconnected status, not an Automatic Private IP Addressing (APIPA) address like 169.254.100.25. The workstation would show 'Media disconnected' in ipconfig.

When would these options actually be correct?

A

A user reports they can access internal resources by IP address but not by hostname. The technician checks the workstation's IP configuration and finds a valid DHCP address and default gateway. In this scenario, a non-responsive DNS server is the most likely cause.

C

This option would be correct in a scenario where a user reports no network access, and ipconfig shows a manually configured IP address (e.g., 192.168.1.100) that is not in the correct subnet or conflicts with another device, causing connectivity issues.

D

If a user reports no network access and ipconfig shows 'Media disconnected' with no IP address, the most likely cause is an unplugged or faulty network cable.

Why candidates pick the wrong answer

A

Candidates often associate any network connectivity issue with DNS, especially when the symptom is 'cannot access resources.' They may overlook the APIPA address and default gateway being blank, which clearly points to DHCP failure rather than DNS.

C

Candidates may think that a static IP could cause misconfiguration, but they overlook that APIPA addresses are only assigned when DHCP fails, not when a static IP is set.

D

Candidates may associate any connectivity issue with a physical layer problem like an unplugged cable, overlooking the specific APIPA address which indicates DHCP failure.

54
MCQeasy

A company wants to allow employees to securely access internal resources (email, file servers) when working from home over the internet. Which technology should be implemented to create an encrypted tunnel between the employee's remote computer and the corporate network?

A.VPN concentrator
B.Firewall
C.DMZ
D.Intrusion detection system (IDS)
AnswerA

A VPN concentrator is a dedicated network device or service specifically designed to terminate numerous encrypted VPN tunnels from remote clients. It authenticates users and establishes secure, encrypted connections, allowing employees to securely access internal network resources like email servers and file shares as if they were physically on the corporate LAN. This device is crucial for enabling secure remote work by ensuring data confidentiality and integrity over untrusted public networks.

Why this answer

A VPN concentrator is the correct technology because it terminates VPN tunnels from remote users, creating an encrypted tunnel (using protocols like IPsec or TLS) between the employee's remote computer and the corporate network. This ensures that all traffic to internal resources such as email and file servers is securely encapsulated and protected from interception over the internet.

Exam trap

The trap here is that candidates may confuse a firewall's ability to allow or block VPN traffic (e.g., permitting UDP 500 for IPsec) with the firewall itself being the device that terminates the VPN tunnel, but only a VPN concentrator or VPN gateway performs the actual encryption and tunnel management.

Why the other options are wrong

B

A firewall controls traffic based on rules but does not create encrypted tunnels; it lacks the encryption and encapsulation capabilities needed for secure remote access over the internet.

C

A DMZ is a network segment that exposes external-facing services to the internet while isolating the internal network, but it does not create encrypted tunnels for individual remote user access.

D

An intrusion detection system (IDS) monitors network traffic for suspicious activity but does not create encrypted tunnels or provide remote access connectivity.

When would these options actually be correct?

B

A firewall would be the correct answer for a question asking which device should be placed at the network perimeter to filter incoming and outgoing traffic based on security policies, such as blocking unauthorized access from the internet.

C

A company wants to host a public web server that must be accessible from the internet while protecting the internal network. Which network architecture should be used?

D

A company needs to monitor its internal network for malicious activity and receive alerts when potential intrusions are detected, but does not require active prevention or encrypted remote access.

Why candidates pick the wrong answer

B

Candidates may think a firewall provides security for remote access because it is a common security device, but they overlook that it does not establish encrypted connections or tunnels.

C

Candidates may confuse DMZ with a secure remote access method because DMZs are often used in conjunction with VPNs or firewalls, leading them to think DMZ alone provides encrypted remote access.

D

Candidates may confuse IDS with VPN because both involve network security, or mistakenly think IDS provides secure remote access due to its role in protecting network boundaries.

55
MCQhard

A network administrator is concerned about DHCP security. To prevent rogue DHCP servers from offering incorrect IP addresses, the administrator enables DHCP snooping on the switches. Additionally, the administrator wants to prevent DHCP starvation attacks that exhaust the DHCP pool. Which feature should be enabled on the switch to specifically mitigate DHCP starvation?

A.Dynamic ARP Inspection (DAI)
B.IP Source Guard (IPSG)
C.Port Security
D.Rate limiting on DHCP packets
AnswerD

DHCP rate limiting, often configured as part of DHCP snooping on network switches, restricts the maximum number of DHCP messages (e.g., Discover, Request, Offer) that can be processed from a specific port within a given time frame. This mechanism is crucial for preventing denial-of-service attacks, such as DHCP starvation, where an attacker floods the network with requests to exhaust the legitimate DHCP server's address pool. By limiting the rate, it also effectively mitigates the impact of rogue DHCP servers attempting to respond to numerous client requests, as their excessive traffic would be dropped.

Why this answer

Rate limiting on DHCP packets (option D) is the correct feature to mitigate DHCP starvation attacks. DHCP starvation works by flooding the network with fake DHCP discover messages, each using a different MAC address, to exhaust the DHCP server's address pool. By limiting the rate at which DHCP packets are accepted from a given interface, the switch can drop excessive requests before they reach the DHCP server, preventing pool exhaustion without blocking legitimate traffic.

Exam trap

The N10-009 exam often tests the distinction between DHCP snooping features: candidates confuse DHCP snooping's role in preventing rogue servers (by filtering DHCP server messages) with the need for a separate rate-limiting mechanism to prevent starvation attacks.

Why the other options are wrong

A

Dynamic ARP Inspection (DAI) validates ARP packets to prevent ARP spoofing attacks, not DHCP starvation. DHCP starvation is mitigated by rate limiting DHCP packets to prevent an attacker from exhausting the DHCP pool.

B

IP Source Guard (IPSG) prevents IP spoofing by filtering traffic based on DHCP snooping bindings, but it does not limit the rate of DHCP packets, which is required to mitigate DHCP starvation attacks.

C

Port Security limits the number of MAC addresses per port but does not control the rate of DHCP packets, so it cannot prevent DHCP starvation attacks that exhaust the DHCP pool by flooding DHCP requests.

When would these options actually be correct?

A

A question asks: 'A network administrator wants to prevent a man-in-the-middle attack where an attacker sends fake ARP replies to associate their MAC address with the default gateway's IP. Which feature should be enabled?' In that scenario, DAI is the correct answer.

B

IP Source Guard would be correct in a question asking: 'Which feature prevents a host from using a statically assigned IP address that conflicts with a DHCP lease?' or 'Which feature blocks traffic from unauthorized IP addresses on a switch port?'

C

Port Security would be correct in a question asking how to prevent unauthorized devices from connecting to the network by limiting the number of MAC addresses allowed on a switch port, such as in a scenario to stop MAC flooding attacks.

Why candidates pick the wrong answer

A

Candidates may confuse DHCP snooping with DAI because both are often enabled together as part of DHCP security, leading them to think DAI also addresses DHCP starvation.

B

Candidates often confuse IPSG with DHCP rate limiting because both are related to DHCP snooping, and they may think IPSG's filtering capability can also prevent excessive DHCP requests.

C

Candidates may confuse DHCP starvation with MAC flooding or think that limiting MAC addresses per port can also limit DHCP requests, not realizing that DHCP starvation is a rate-based attack requiring rate limiting.

56
MCQmedium

An organization uses OSPF as its interior gateway protocol in a multi-area design. After a core router failure, the network takes several seconds to reconverge. Which technology can be implemented to improve convergence speed?

A.Implement LSA throttling
B.Enable OSPF fast hello timers
C.Configure BFD (Bidirectional Forwarding Detection)
D.Convert all areas to stub areas
AnswerC

Configuring BFD (Bidirectional Forwarding Detection) establishes a lightweight, independent detection mechanism that rapidly monitors the forwarding path between two routers. By sending small, periodic BFD control packets at sub-second intervals, it can detect link or neighbor failures significantly faster than OSPF's default hello/dead timers. This rapid detection allows OSPF to be immediately notified of a topology change, triggering a much quicker recalculation of routes and thus accelerating network convergence after a failure.

Why this answer

BFD provides sub-second failure detection times (as low as 50 ms) independent of the routing protocol, allowing OSPF to reconverge much faster than relying on its default dead timer intervals. By detecting link failures in milliseconds, BFD triggers OSPF to immediately recalculate routes, drastically reducing the convergence delay after a core router failure.

Exam trap

The N10-009 exam often tests the distinction between OSPF fast hello timers (which still rely on seconds-based dead intervals) and BFD (which provides true sub-second detection), leading candidates to mistakenly choose fast hello timers as the faster solution.

Why the other options are wrong

A

LSA throttling controls the rate of LSA generation and flooding, which can reduce CPU load during instability but does not speed up failure detection or convergence; it may actually delay convergence.

B

OSPF fast hello timers reduce the time to detect a neighbor failure, but they do not speed up the overall reconvergence process after a core router failure, which involves LSA flooding, SPF calculation, and routing table updates. BFD provides faster failure detection than fast hello timers and integrates with OSPF to trigger quicker reconvergence.

When would these options actually be correct?

A

In a scenario where OSPF routers are experiencing excessive LSA flooding causing CPU spikes and instability, LSA throttling would be correct to stabilize the network by limiting LSA generation rates.

B

A question asks: 'An organization wants to reduce OSPF neighbor dead timer detection from 40 seconds to 10 seconds without changing the hello interval. Which feature should be configured?' In this scenario, enabling OSPF fast hello timers (or adjusting hello/dead intervals) would be correct.

Why candidates pick the wrong answer

A

Candidates may confuse throttling with optimization, thinking that reducing LSA overhead will speed up convergence, but throttling primarily prevents router overload, not faster detection.

B

Candidates may think that faster hello timers directly speed up convergence, but they only improve failure detection time; the overall reconvergence still depends on OSPF's LSA propagation and SPF calculation, which BFD addresses more effectively.

57
MCQmedium

A company is implementing 802.1X port-based authentication on its wired network to ensure only authorized devices can connect. Which of the following servers is required to authenticate users and devices?

A.A) RADIUS server
B.B) Syslog server
C.C) TACACS+ server
D.D) NTP server
AnswerA

Correct. RADIUS is the most common protocol for 802.1X authentication and is widely supported.

Why this answer

802.1X port-based authentication relies on the Extensible Authentication Protocol (EAP) over LAN (EAPoL) between the supplicant (device) and the authenticator (switch), which then forwards authentication requests to a central authentication server. A RADIUS server is the required backend because it validates credentials (e.g., username/password or certificates) and returns an Accept/Reject decision to the switch, enabling or disabling the port. RADIUS is the standard protocol defined in IEEE 802.1X for this purpose, supporting EAP methods like PEAP, EAP-TLS, and EAP-FAST.

Exam trap

The N10-009 exam often tests the misconception that TACACS+ can replace RADIUS in 802.1X environments, but TACACS+ encrypts the entire packet body and is designed for device administration (e.g., CLI access), not for 802.1X port-based authentication, which mandates RADIUS per the IEEE 802.1X standard.

Why the other options are wrong

C

TACACS+ is used for device administration authentication (e.g., router/switch login), not for 802.1X port-based network access control. 802.1X requires a RADIUS server to authenticate users and devices connecting to the network.

D

NTP (Network Time Protocol) servers synchronize clocks across network devices, but they do not perform authentication of users or devices. 802.1X requires a RADIUS server to validate credentials and authorize access.

When would these options actually be correct?

C

A question asks: 'Which server is used to authenticate network administrators when they log into routers and switches?' In that context, TACACS+ would be the correct answer because it separates authentication, authorization, and accounting for device administration.

D

A question asking which server ensures accurate timestamps for logs or certificate validation in a PKI environment would have NTP as the correct answer. For example: 'A company needs to synchronize clocks for log correlation and certificate validity checks. Which server is required?'

Why candidates pick the wrong answer

C

Candidates confuse TACACS+ with RADIUS because both are AAA protocols. They may think TACACS+ can also handle network access authentication, but 802.1X specifically requires RADIUS.

D

Candidates may confuse NTP with authentication servers because time synchronization is critical for Kerberos and certificate-based authentication, leading them to incorrectly assume NTP is part of the 802.1X authentication process.

58
MCQmedium

An employee plugs a personal laptop into a network jack and then the laptop is infected with malware that spreads to other devices on the network. Which security control would have most effectively prevented this scenario?

A.MAC filtering on the switch
B.802.1X authentication
C.VLAN segmentation
D.Access control lists on the router
AnswerB

802.1X authentication provides robust port-based network access control, requiring devices to successfully authenticate with an authentication server (typically RADIUS) before the switch port is activated and granted network access. This mechanism effectively prevents unauthorized personal laptops or other devices from gaining any network connectivity, even at the link layer, until proper credentials or certificates are presented and validated.

Why this answer

802.1X authentication requires devices to authenticate before gaining network access, typically via EAP (Extensible Authentication Protocol) over RADIUS. In this scenario, the employee's personal laptop would be blocked at the port level because it lacks valid credentials, preventing the malware from ever reaching the internal network and spreading to other devices.

Exam trap

The N10-009 exam often tests the misconception that MAC filtering or VLAN segmentation alone can prevent unauthorized device access, when in fact 802.1X is the only option that provides per-port authentication and dynamic VLAN assignment based on credentials.

Why the other options are wrong

A

MAC filtering only controls which devices can connect based on their MAC address, but it does not authenticate users or prevent an infected laptop from spreading malware once connected. It also does not enforce endpoint compliance.

C

VLAN segmentation separates network traffic into logical groups but does not authenticate devices; it would not prevent an unauthenticated personal laptop from connecting to the network and spreading malware.

D

Access control lists on the router control traffic between subnets but do not prevent an unauthorized device from connecting to the network jack in the first place. They cannot block the initial infection or lateral spread within the same VLAN.

When would these options actually be correct?

A

MAC filtering would be correct in a scenario where the goal is to prevent unauthorized devices from connecting to a network by allowing only pre-approved MAC addresses, such as in a small office with a static device inventory and no need for user authentication.

C

A question asks which control limits broadcast traffic or isolates sensitive systems from general user traffic to reduce attack surface, e.g., 'Which security control separates guest Wi-Fi from corporate devices?'

D

An ACL on the router would be correct in a scenario where the question asks how to restrict traffic between different network segments (e.g., preventing a compromised device in the guest VLAN from accessing the corporate server subnet).

Why candidates pick the wrong answer

A

Candidates may think MAC filtering provides strong access control because it restricts devices by hardware address, but they overlook that it can be bypassed via MAC spoofing and does not address malware propagation from an already connected device.

C

Candidates know VLANs improve security by isolating traffic, so they mistakenly believe VLANs can block unauthorized devices, confusing network segmentation with access control.

D

Candidates may think ACLs can block malicious traffic at the network perimeter, but they overlook that the malware spreads locally before reaching the router, and ACLs do not enforce device authentication at the access layer.

59
MCQmedium

A user reports that they can access the internet but cannot access the internal web server at 10.10.10.100. The technician can ping the server's IP from the router that serves as the user's default gateway. Which of the following is the MOST likely cause?

A.The server's default gateway is misconfigured
B.The user's workstation has a firewall blocking port 80
C.The router has a missing route to the server's network
D.The server's subnet mask is incorrect
AnswerA

The problem states the user can access the internet but not the internal web server, yet the router can ping the server. This implies the server can *receive* traffic from the router and, by extension, from the user. However, if the server's default gateway is incorrect, it will attempt to send its *reply* packets to the wrong router or an unreachable address. This results in a one-way communication where the server gets the request but the client never receives the response, manifesting as an inability to access the internal web.

Why this answer

The user can reach the internet but not the internal web server at 10.10.10.100, while the technician can ping that server from the router (the default gateway). This indicates that the router has a valid route to the server's network and the server is reachable from the router's perspective. The most likely cause is that the server's default gateway is misconfigured: the server does not know how to send return traffic back to the user's subnet, so the TCP handshake fails (the SYN-ACK never reaches the user).

Exam trap

The trap here is that candidates assume a successful ping from the router to the server means end-to-end connectivity is fine, but they overlook the fact that the server's return path to the user's subnet requires a correctly configured default gateway on the server itself.

Why the other options are wrong

B

The user can access the internet, indicating general connectivity works. The technician can ping the server from the router, so the router has a route. A workstation firewall blocking port 80 would not explain why the server is unreachable from the user's perspective if the server itself is reachable via ping from the router.

C

The technician can ping the server's IP from the router, which means the router has a route to the server's network. A missing route would prevent the router from reaching the server, contradicting the given information.

D

An incorrect subnet mask on the server would prevent it from communicating with devices on other subnets, but the technician can ping the server from the router, indicating the server's IP configuration is reachable. The issue is that the user cannot access the web server, which suggests the server cannot reply to the user because its default gateway is misconfigured, not its subnet mask.

When would these options actually be correct?

B

A user reports they cannot access a specific website (e.g., https://example.com) but can access other websites. The technician verifies the user's firewall is enabled and blocking outbound port 443. In this case, the workstation firewall blocking the port would be the most likely cause.

C

This option would be correct if the technician could not ping the server from the router, indicating that the router lacks a route to the server's subnet, or if the server is on a different network segment not directly connected to the router.

D

In a scenario where a user cannot reach a server at all (no ping, no access), and the technician finds that the server's IP address is in a different subnet than expected due to a subnet mask error, then an incorrect subnet mask would be the cause. For example, if the server is configured with /24 instead of /16, it may not communicate with hosts outside its perceived subnet.

Why candidates pick the wrong answer

B

Candidates often assume client-side firewall issues are common and may overlook that the problem is server-side, especially when symptoms involve a single inaccessible server.

C

Candidates may assume that any connectivity issue between different subnets is due to a missing route, overlooking that the router's successful ping proves the route exists.

D

Candidates may confuse subnet mask issues with default gateway issues, thinking that an incorrect subnet mask could prevent the server from sending replies to the user, but in this case the server is reachable from the router, ruling out a subnet mask problem.

60
MCQhard

A network administrator is configuring OSPF on a router that has interfaces in only one area and does not perform route redistribution. Which OSPF router type best describes this router?

A.Backbone router
B.Internal router
C.Area Border Router (ABR)
D.Autonomous System Boundary Router (ASBR)
AnswerB

An internal router operates entirely within a single OSPF area and does not have any interfaces connecting to other OSPF areas or external routing domains. Its primary function is to maintain a link-state database for its local area and forward traffic within that area. The description perfectly matches this role, as the router has interfaces in only one OSPF area.

Why this answer

An internal router has all its interfaces in a single OSPF area and does not perform route redistribution. Since the router's interfaces are confined to one area and it does not connect to other routing domains, it fits the definition of an internal router. This type of router maintains a single link-state database for that area and does not generate Type 3 or Type 5 LSAs.

Exam trap

The N10-009 exam often tests the distinction between an internal router and an ABR by making candidates assume that any router not in area 0 is an internal router, but the trap is that an ABR must have interfaces in multiple areas, while an internal router has all interfaces in a single area regardless of which area it is.

Why the other options are wrong

A

A backbone router must have at least one interface in Area 0, but the question states the router has interfaces in only one area, which is not necessarily Area 0.

C

An Area Border Router (ABR) connects multiple OSPF areas, but the question states the router has interfaces in only one area, so it cannot be an ABR.

D

An ASBR is a router that redistributes routes from other routing protocols or autonomous systems into OSPF. The question states the router does not perform route redistribution, so it cannot be an ASBR.

When would these options actually be correct?

A

If the question specified that the router has at least one interface in Area 0, even if it also has interfaces in other areas, then it would be a backbone router.

C

This option would be correct in a question where a router has interfaces in at least two different OSPF areas and is responsible for routing between them, summarizing routes from one area to another.

D

A router that redistributes external routes (e.g., from EIGRP or BGP) into OSPF, regardless of its interfaces being in one or multiple areas, would be correctly identified as an ASBR.

Why candidates pick the wrong answer

A

Candidates often assume that any OSPF router in a single-area network must be a backbone router, forgetting that the backbone is specifically Area 0.

C

Candidates may confuse the term 'area border' with any router that is at the edge of an area, not realizing that ABR specifically requires multiple area connections.

D

Candidates may confuse the term 'Autonomous System Boundary Router' with any router that connects to external networks, or they may mistakenly think that any router with multiple interfaces is an ASBR.

61
MCQmedium

A network administrator is creating a new VLAN that will contain 20 devices. The administrator wants to use the most efficient subnet that provides enough usable IP addresses while minimizing waste. Which of the following subnet masks should be used?

A.255.255.255.240 (/28)
B.255.255.255.224 (/27)
C.255.255.255.248 (/29)
D.255.255.255.192 (/26)
AnswerB

This subnet mask, corresponding to a /27 CIDR prefix, allocates 5 host bits (32-27). This allows for 2^5 = 32 total IP addresses within the subnet. After reserving the network address and the broadcast address, there are 30 usable host addresses available. This is the smallest and most efficient subnet size that can accommodate the required 20 devices without significant waste of IP address space.

Why this answer

A /27 subnet mask (255.255.255.224) provides 32 total addresses, of which 30 are usable (2^5 - 2 = 30). This is the most efficient choice for 20 devices because it offers exactly enough usable IPs with minimal waste (only 10 unused addresses), whereas a /28 would provide only 14 usable addresses (insufficient) and a /29 would provide only 6 usable addresses (also insufficient).

Exam trap

The trap here is that candidates often confuse the total number of addresses in a subnet with the number of usable host addresses, forgetting to subtract 2 for the network and broadcast addresses, and may incorrectly select a /28 thinking it provides 16 addresses (when only 14 are usable).

Why the other options are wrong

A

A /28 subnet provides only 14 usable IP addresses (2^4 - 2 = 14), which is insufficient for 20 devices.

C

A /29 subnet provides only 6 usable IP addresses (2^(32-29)-2 = 6), which is insufficient for 20 devices.

D

A /26 subnet provides 62 usable addresses, which is excessive for 20 devices and wastes IP space. The question asks for the most efficient subnet with minimal waste, so /27 (30 usable addresses) is better.

When would these options actually be correct?

A

This subnet mask would be correct for a VLAN that needs exactly 14 usable IP addresses, such as a small management or printer VLAN with 14 devices.

C

This subnet mask would be correct for a VLAN requiring exactly 6 usable addresses, such as a point-to-point link or a small management network with only a few devices.

D

This subnet mask would be correct if the VLAN needed to support 50 devices, as a /26 provides 62 usable addresses, which is the smallest subnet that can accommodate 50 hosts.

Why candidates pick the wrong answer

A

Candidates may mistakenly think 16 total addresses (2^4) are enough for 20 devices, or they may confuse usable addresses with total addresses.

C

Candidates may mistakenly think a /29 is sufficient because they forget to subtract the network and broadcast addresses, or they misapply the formula for usable hosts.

D

Candidates may mistakenly think a larger subnet is safer or fail to calculate the exact number of usable addresses needed, leading them to choose a subnet with more capacity than necessary.

62
MCQhard

A user's computer obtains an IP address from DHCP, can ping the default gateway, but cannot access any external websites. The technician runs 'tracert 8.8.8.8' from the user's computer. The first hop shows the default gateway with low latency, but the second hop shows a timeout. What is the most likely cause?

A.The user's computer firewall is blocking outbound web traffic.
B.The DNS server is not resolving domain names.
C.The router's default route pointing to the ISP is missing or incorrectly configured.
D.The ISP's DNS server is unreachable.
AnswerC

When a traceroute successfully reaches the first hop (the local router) but fails at subsequent hops, it indicates the local router received the packet but cannot forward it further towards the destination. This scenario strongly suggests that the router lacks a proper default route (0.0.0.0/0) configured to point to the next-hop router at the Internet Service Provider (ISP). Without this critical route, the router doesn't know where to send traffic destined for external networks, causing packets to be dropped or timed out beyond the local network.

Why this answer

The traceroute shows that the user's computer can reach the default gateway (first hop) but times out at the second hop, which is the ISP's router. This indicates that the local router does not have a valid default route pointing to the ISP, so it cannot forward traffic beyond the local subnet. Without a correct default route, packets destined for external networks (like 8.8.8.8) are dropped, even though the user's computer can ping the gateway and obtain an IP via DHCP.

Exam trap

The trap here is that candidates often confuse a DNS resolution failure with a routing failure, but the traceroute to an IP address bypasses DNS entirely, so the timeout at the second hop isolates the issue to the router's default route rather than DNS or the local firewall.

Why the other options are wrong

A

The user can ping the default gateway and tracert shows the first hop succeeds, indicating outbound traffic is not blocked by the local firewall. The issue is beyond the gateway, at the second hop, which points to a routing problem.

B

The user can ping the default gateway and tracert shows the first hop succeeds, indicating local network connectivity is fine. DNS issues would prevent name resolution, but the question states the user cannot access external websites, and tracert to an IP address (8.8.8.8) shows a timeout at the second hop, which points to a routing problem beyond the gateway, not DNS.

D

The user can ping the default gateway, and tracert shows the first hop (gateway) succeeds, indicating local connectivity is fine. The second hop timeout suggests the issue is beyond the gateway, likely a missing or incorrect default route on the router, not the ISP's DNS server being unreachable.

When would these options actually be correct?

A

A user cannot access external websites but can ping internal IPs and the default gateway. Tracert shows the first hop succeeds but subsequent hops time out, and the firewall logs show outbound HTTP/HTTPS traffic being dropped. In that case, the local firewall blocking outbound web traffic would be correct.

B

In a scenario where a user can obtain an IP address from DHCP, ping the default gateway, but cannot access external websites by name, and 'nslookup' fails to resolve domain names while pinging external IP addresses succeeds, then the DNS server being unreachable or misconfigured would be the correct answer.

D

In a scenario where a user can access external websites by IP address (e.g., pinging 8.8.8.8 works) but cannot resolve domain names, and the DNS server is configured on the ISP's side, then an unreachable ISP DNS server would be the correct answer.

Why candidates pick the wrong answer

A

Candidates may assume that inability to access websites is always due to firewall rules, overlooking that the tracert result localizes the problem to the router's upstream routing, not the local host.

B

Candidates often confuse inability to access websites with DNS failure, especially when they see that pinging an IP works but browsing fails. They may overlook the tracert output showing a routing issue at the second hop, which clearly indicates the problem is beyond DNS.

D

Candidates often confuse DNS resolution issues with routing problems, and since external websites are unreachable, they may incorrectly attribute it to DNS, especially when the ISP provides DNS services.

63
MCQmedium

A network administrator needs to document the network for auditing purposes. Which type of documentation provides the most detailed information about the physical connections between devices, including cable types and patch panel ports?

A.Logical diagram
B.Network topology map
C.Wiring schematic
D.Asset management database
AnswerC

A wiring schematic is the most appropriate document for auditing purposes because it provides an exhaustive, granular view of the physical network infrastructure. It meticulously details every cable run, including specific cable types, lengths, and their exact termination points on patch panels, wall jacks, and device ports. This level of precision is essential for verifying physical layer compliance, troubleshooting connectivity issues, and ensuring accurate inventory of the physical cabling plant.

Why this answer

A wiring schematic provides the most detailed information about physical connections, including cable types, patch panel ports, and exact pin-to-pin wiring. This level of detail is essential for auditing physical infrastructure, as it documents the actual cabling plant rather than logical or high-level connectivity.

Exam trap

The trap here is that candidates often confuse a network topology map (which shows device interconnections) with a wiring schematic, but the topology map lacks the specific cable type and patch panel port details required for physical-layer auditing.

Why the other options are wrong

A

A logical diagram shows the flow of data and logical relationships (e.g., IP subnets, VLANs) but does not include physical details like cable types or patch panel ports.

B

A network topology map shows the logical or physical layout of devices and links, but it does not provide detailed information about cable types, patch panel ports, or specific wiring connections.

D

An asset management database tracks inventory details like device serial numbers, warranties, and software licenses, but it does not document physical cabling connections, cable types, or patch panel port mappings.

When would these options actually be correct?

A

When the question asks for documentation that illustrates the high-level network architecture, such as IP addressing, routing protocols, and VLAN assignments, without physical connection details.

B

When the question asks for a high-level overview of device interconnections and network structure without requiring cable-level details, such as 'Which document best illustrates the arrangement of routers, switches, and firewalls in the network?'

D

When the question asks for a tool that records device ownership, location, purchase date, and configuration history for auditing hardware assets, the asset management database is the correct answer.

Why candidates pick the wrong answer

A

Candidates may confuse 'logical' with 'physical' or think that a diagram of the network inherently includes all connection details, overlooking the specific focus on physical cabling.

B

Candidates may confuse 'topology map' with 'wiring schematic' because both can show physical connections, but they overlook that a topology map typically lacks the granularity of cable types and patch panel port assignments.

D

Candidates may confuse asset management with network documentation because both involve tracking network components, but asset management focuses on inventory and lifecycle, not physical connectivity details.

64
MCQmedium

A network administrator needs to be notified immediately when the CPU utilization on a core router exceeds 90%. Which SNMP mechanism should be configured on the router?

A.SNMP get
B.SNMP trap
C.SNMP walk
D.SNMP set
AnswerB

An SNMP Trap is an unsolicited message sent by a managed device to the NMS when a significant event or predefined threshold is crossed, such as high CPU utilization. This push mechanism allows the device to immediately alert administrators to critical conditions without the NMS constantly polling, ensuring prompt notification for urgent issues.

Why this answer

B is correct because SNMP traps are unsolicited notifications sent from an SNMP agent (the router) to the manager when a predefined condition occurs, such as CPU utilization exceeding 90%. This allows immediate notification without waiting for the manager to poll, which is essential for urgent alerts.

Exam trap

The N10-009 exam often tests the distinction between polling (get/walk) and event-driven notifications (trap/inform), and the trap here is that candidates confuse SNMP get with a proactive alert mechanism, forgetting that get requires the manager to initiate the request.

Why the other options are wrong

C

SNMP walk is used to retrieve a sequence of OID values from a MIB tree, not to send unsolicited notifications. The requirement is for immediate notification when CPU exceeds 90%, which requires an event-driven alert, not a polling mechanism.

D

SNMP set is used to modify configuration parameters on a managed device, not to receive unsolicited notifications. The question requires immediate notification when CPU exceeds 90%, which is a trap condition, not a set operation.

When would these options actually be correct?

C

An SNMP walk would be correct when an administrator needs to retrieve all values from a MIB subtree, such as when performing a full inventory of interface statistics or system parameters on a device for baseline monitoring.

D

An SNMP set would be correct if the question asked: 'A network administrator needs to change the SNMP community string on a router remotely. Which SNMP mechanism should be used?'

Why candidates pick the wrong answer

C

Candidates may confuse SNMP walk with trap because both involve data retrieval, but walk is a polling operation that requires the manager to initiate the request, whereas trap is a push notification from the agent.

D

Candidates may confuse SNMP set with trap because both involve sending data from the agent, but set is for writing values, not for alerting on threshold events.

65
MCQeasy

A network technician is explaining the difference between connection-oriented and connectionless protocols to a junior technician. Which of the following protocols is connectionless at the transport layer?

A.TCP
B.UDP
C.ICMP
D.ARP
AnswerB

User Datagram Protocol (UDP) is a connectionless transport layer protocol. It prioritizes speed and low overhead by sending data packets, called datagrams, without first establishing a formal connection or guaranteeing delivery. This makes UDP suitable for applications where real-time performance is critical, such as streaming video, online gaming, and DNS lookups, where occasional packet loss is acceptable. However, it offers no error checking, retransmission, or flow control mechanisms.

Why this answer

UDP (User Datagram Protocol) is the correct answer because it is a connectionless transport-layer protocol. It does not establish a session or guarantee delivery, instead sending datagrams independently without handshaking or acknowledgments, which makes it suitable for real-time applications like VoIP and streaming.

Exam trap

The trap here is that candidates often confuse ICMP or ARP as transport-layer protocols because they are involved in network communication, but the question specifically asks for the transport layer, where only TCP and UDP reside, and UDP is the connectionless one.

Why the other options are wrong

A

TCP is a connection-oriented protocol at the transport layer, meaning it establishes a reliable connection before data transfer, which is the opposite of connectionless.

C

ICMP operates at the network layer (Layer 3), not the transport layer. The question specifically asks for a connectionless protocol at the transport layer, which is UDP.

D

ARP operates at the Data Link layer (Layer 2) and resolves IP addresses to MAC addresses; it is not a transport layer protocol and does not provide connectionless transport services.

When would these options actually be correct?

A

If the question asked 'Which of the following is a connection-oriented protocol at the transport layer?', then TCP would be the correct answer.

C

A question asking 'Which protocol is used for error reporting and diagnostic functions at the network layer?' would make ICMP the correct answer.

D

A question asking which protocol is used to map an IP address to a MAC address on a local network, or which protocol operates at Layer 2 and is essential for Ethernet communication.

Why candidates pick the wrong answer

A

Candidates may confuse TCP with UDP due to both operating at the transport layer, or they might think TCP's reliability implies it is connectionless because it can handle packet loss.

C

Candidates may confuse ICMP as connectionless because it does not establish a connection before sending messages, but they overlook that it belongs to the network layer, not the transport layer.

D

Candidates may confuse ARP's lack of connection establishment with connectionless transport, or mistakenly think ARP operates at the transport layer because it works with IP addresses.

66
MCQeasy

A network technician needs to retrieve the operating system and uptime information from a router for inventory purposes. Which protocol is specifically designed for network management and monitoring?

A.SMTP
B.SNMP
C.HTTP
D.FTP
AnswerB

SNMP (Simple Network Management Protocol) is the industry-standard protocol specifically designed for monitoring and managing network devices from a central location. It operates by querying Management Information Bases (MIBs), which are hierarchical databases containing device-specific information. A technician can use SNMP to retrieve critical system details such as the operating system version, device uptime, interface statistics, and even configuration parameters from routers, switches, servers, and other SNMP-enabled hardware, making it ideal for inventory and status checks.

Why this answer

SNMP (Simple Network Management Protocol) is the standard protocol specifically designed for network management and monitoring. It allows a network management station to query managed devices (like routers) for system information, including operating system version and uptime, via OIDs (Object Identifiers) in the MIB (Management Information Base).

Exam trap

CompTIA often tests that candidates confuse SNMP with other application-layer protocols like HTTP or FTP, assuming any protocol that can 'retrieve information' qualifies, but only SNMP is purpose-built for network management with standardized MIB structures.

Why the other options are wrong

A

SMTP is designed for email transmission, not for network management or retrieving system information like OS and uptime from network devices.

C

HTTP is a web protocol for transferring hypertext, not designed for network management or monitoring. It cannot retrieve OS or uptime information from network devices like routers.

D

FTP (File Transfer Protocol) is designed for transferring files between systems, not for retrieving network management data like OS and uptime from routers.

When would these options actually be correct?

A

A question asking which protocol is used to send alert notifications from a network monitoring system to an administrator's email would have SMTP as the correct answer.

C

A question asking which protocol is used to access a router's web-based configuration interface for manual settings would make HTTP correct, as many routers provide a web GUI over HTTP/HTTPS.

D

A question asking which protocol is used to transfer firmware or configuration files to a router would make FTP correct, as it is commonly used for such file transfers in network device management.

Why candidates pick the wrong answer

A

Candidates may confuse SMTP with SNMP due to similar acronyms, or mistakenly think email protocols are used for device monitoring.

C

Candidates may confuse HTTP with SNMP because both can be used to interact with network devices, but HTTP is for web interfaces, not standardized management data retrieval.

D

Candidates may confuse FTP with SNMP because both are used in network management contexts, but FTP handles file transfers while SNMP handles monitoring and data retrieval.

67
MCQeasy

At which layer of the OSI model does logical addressing (e.g., IP addresses) and routing occur?

A.Data Link layer
B.Network layer
C.Transport layer
D.Physical layer
AnswerB

The Network layer (Layer 3) uses IP addresses for logical addressing and routing decisions.

Why this answer

The Network layer (Layer 3) of the OSI model is responsible for logical addressing, such as IPv4 and IPv6 addresses, and for routing packets between different networks. Routers operate at this layer, using routing tables and protocols like OSPF, BGP, or static routes to determine the best path for data. This layer provides end-to-end delivery and handles packet fragmentation and reassembly when necessary.

Exam trap

The trap here is that candidates often confuse the Network layer's logical addressing with the Data Link layer's MAC addressing, especially when they see 'addressing' in the question and default to Layer 2 without considering the 'routing' keyword that clearly points to Layer 3.

Why the other options are wrong

A

Logical addressing (IP addresses) and routing are functions of the Network layer (Layer 3), not the Data Link layer (Layer 2), which handles physical addressing (MAC addresses) and frame forwarding within a local network.

C

The Transport layer (Layer 4) is responsible for end-to-end communication, segmentation, and flow control, not logical addressing or routing. IP addresses and routing are functions of the Network layer (Layer 3).

D

The Physical layer (Layer 1) is responsible for the transmission and reception of raw bit streams over a physical medium, not for logical addressing or routing.

When would these options actually be correct?

A

This option would be correct for a question asking: 'At which OSI layer does physical addressing (MAC addresses) and switching occur?' or 'Which layer is responsible for error detection in frames using CRC?'

C

A question asking 'At which layer does port addressing (e.g., TCP/UDP ports) and segmentation occur?' would have the Transport layer as the correct answer.

D

A question asking 'At which layer do physical network interface specifications (e.g., voltage levels, cable types, and data rates) reside?' would have the Physical layer as the correct answer.

Why candidates pick the wrong answer

A

Candidates often confuse the Data Link layer's role in local network addressing (MAC) with the Network layer's global logical addressing (IP), especially when they think of 'addressing' broadly without distinguishing between logical and physical.

C

Candidates may confuse the Transport layer's role in managing connections (like TCP) with the Network layer's addressing, or mistakenly think that IP addresses are part of transport protocols.

D

Candidates may confuse the Physical layer with the Network layer because both involve 'addresses' (MAC vs. IP) or think that routing requires physical connectivity.

68
MCQhard

A network administrator needs to ensure that only authorized devices can connect to the wired network. Each user must authenticate using their domain credentials. Which of the following should be implemented?

A.MAC filtering
B.802.1X with EAP-TLS
C.WPA2-PSK
D.Port security
AnswerB

802.1X with EAP-TLS provides user authentication using certificates, typically tied to domain credentials. It ensures that only authenticated users can gain access to the network, and it can be integrated with Active Directory.

Why this answer

802.1X with EAP-TLS is correct because it provides port-based network access control that requires each user to authenticate using their domain credentials (via a RADIUS server) before the switch port is opened for traffic. EAP-TLS uses mutual authentication with digital certificates, ensuring only authorized devices and users gain access to the wired network.

Exam trap

CompTIA often tests the distinction between port security (which is MAC-based and does not authenticate users) and 802.1X (which provides user authentication via RADIUS), leading candidates to mistakenly choose port security when the question explicitly requires domain credential authentication.

Why the other options are wrong

A

MAC filtering only checks device MAC addresses, not user credentials, so it cannot authenticate users with domain credentials.

C

WPA2-PSK is a wireless security protocol, not suitable for wired network authentication. It uses a pre-shared key rather than individual domain credentials, failing to meet the requirement for per-user authentication with domain credentials.

D

Port security limits access by MAC address, not by user authentication with domain credentials. It does not require per-user authentication via 802.1X, so it fails to meet the requirement of authenticating each user individually.

When would these options actually be correct?

A

A question asking for a simple method to restrict network access to a list of known devices without user authentication, such as in a small office with static devices.

C

In a scenario where a small office needs to secure a wireless network for guest access with a simple shared password, and there is no requirement for individual user authentication or integration with domain credentials, WPA2-PSK would be the correct choice.

D

A network administrator needs to prevent unauthorized devices from plugging into switch ports by limiting the number of MAC addresses per port or by allowing only specific MAC addresses. The question would not mention user authentication or domain credentials.

Why candidates pick the wrong answer

A

Candidates may confuse device-based access control with user authentication, assuming MAC filtering can enforce per-user security.

C

Candidates may confuse wireless security protocols with wired authentication methods, or mistakenly think that WPA2-PSK can be adapted for wired networks, especially if they overlook the 'wired network' specification in the question.

D

Candidates may confuse port security with network access control, thinking it can authenticate users, but it only controls devices based on MAC addresses, not user identity.

69
MCQmedium

A user reports that they can access the company's intranet website by IP address but not by its hostname (intranet.company.local). A technician checks the DNS server and finds that the A record exists and returns the correct IP. However, the user's browser still cannot resolve the hostname. Which of the following is the most likely cause?

A.The DNS cache on the user's workstation is corrupt.
B.The web server's certificate is expired.
C.The default gateway is misconfigured.
D.The file server is overloaded.
AnswerA

A corrupt DNS cache on the user's workstation stores incorrect or outdated hostname-to-IP address mappings. When the user attempts to access the intranet by its hostname, the local system consults this faulty cache first, leading to a resolution failure. However, direct access via the IP address bypasses the entire name resolution process, allowing the connection to succeed without relying on the compromised cache. This specific symptom strongly points to a local DNS resolution issue.

Why this answer

The user can access the intranet by IP but not by hostname, which indicates that name resolution is failing. Since the DNS server has the correct A record, the issue is likely on the client side. A corrupt DNS cache on the workstation can cause the browser to use stale or invalid cached data, preventing successful resolution even though the authoritative DNS server returns the correct IP.

Flushing the DNS cache with `ipconfig /flushdns` would resolve this.

Exam trap

CompTIA often tests the distinction between server-side DNS configuration and client-side caching; the trap here is that candidates see 'A record exists and returns correct IP' and assume the DNS is fully functional, overlooking the client's local cache as the source of the problem.

Why the other options are wrong

B

An expired web server certificate would cause browser security warnings but would not prevent hostname resolution; the user can access by IP, indicating DNS resolution is working, but the browser fails to resolve the hostname, pointing to a client-side DNS caching issue.

D

An overloaded file server would not prevent DNS resolution of a hostname; the user can access the intranet via IP, indicating network connectivity and web server functionality are intact.

When would these options actually be correct?

B

This option would be correct in a scenario where a user reports being unable to access a secure website (HTTPS) and receives a certificate error, while other users can access the same site without issues, and the certificate is confirmed expired.

D

A user reports slow access to shared files on a file server, and other users experience similar issues. The technician finds high CPU and disk usage on the file server. In that scenario, an overloaded file server would be the likely cause.

Why candidates pick the wrong answer

B

Candidates may confuse certificate errors with name resolution failures, assuming that an expired certificate blocks all access, or they may think the browser's inability to load the site is due to a security certificate issue rather than DNS.

D

Candidates may confuse file server and web server roles, or assume any server overload could cause name resolution failures, overlooking that DNS is a separate service.

70
Drag & Dropmedium

Drag and drop the steps to troubleshoot a network connectivity issue using the OSI model into the correct order (top-down approach).

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Top-down troubleshooting starts at the application layer and works down to physical.

71
MCQmedium

A network technician is troubleshooting inter-VLAN routing. Hosts in VLAN 10 can communicate with hosts in VLAN 20, but cannot communicate with hosts in VLAN 30. All VLANs are configured on the same Layer 3 switch with SVIs. Which of the following should the technician verify FIRST?

A.VLAN 30 is not allowed on the trunk port to the switch.
B.The SVI for VLAN 30 is missing an IP address.
C.The default gateway on hosts in VLAN 10 is incorrect.
D.The routing table does not have a route to VLAN 30.
AnswerB

An SVI (Switched Virtual Interface) serves as the Layer 3 interface for a VLAN, acting as the default gateway for all devices within that VLAN. For inter-VLAN routing to function, each SVI must be configured with a unique IP address within its respective VLAN's subnet. If the SVI for VLAN 30 is missing an IP address, the Layer 3 switch cannot route traffic into or out of VLAN 30, effectively isolating it from other VLANs like VLAN 10 and VLAN 20.

Why this answer

Since all VLANs are configured on the same Layer 3 switch with SVIs, inter-VLAN routing occurs internally. Hosts in VLAN 10 can reach VLAN 20, proving the Layer 3 switch is routing correctly for those VLANs. The failure to reach VLAN 30 most likely indicates that the SVI for VLAN 30 is missing an IP address, which prevents the switch from having a local interface to route traffic to that subnet.

Exam trap

The N10-009 exam often tests the misconception that a missing VLAN on a trunk is the cause of inter-VLAN routing failure, but when all VLANs reside on the same Layer 3 switch, the SVI configuration is the first thing to verify.

Why the other options are wrong

A

The question states all VLANs are configured on the same Layer 3 switch with SVIs, so inter-VLAN routing occurs within the switch. A trunk port is not involved in this scenario, making VLAN 30 not allowed on a trunk irrelevant.

C

The question states that hosts in VLAN 10 can communicate with VLAN 20 but not VLAN 30, indicating inter-VLAN routing is partially working. If the default gateway on VLAN 10 hosts were incorrect, they would not be able to reach any other VLAN, including VLAN 20.

D

The routing table not having a route to VLAN 30 would cause inter-VLAN routing failure for all VLANs, but hosts in VLAN 10 can already communicate with VLAN 20, indicating routing is functional. The issue is specific to VLAN 30, suggesting a missing SVI IP rather than a missing route.

When would these options actually be correct?

A

This would be correct if the Layer 3 switch were connected to a separate Layer 2 switch via a trunk, and hosts in VLAN 10 and 20 could reach VLAN 30 through that trunk, but the trunk port on the Layer 2 switch did not have VLAN 30 allowed.

C

In a scenario where hosts in VLAN 10 cannot communicate with any other VLAN (e.g., VLAN 20 and VLAN 30), but hosts within VLAN 10 can communicate, the first thing to verify would be the default gateway configuration on the hosts in VLAN 10.

D

This option would be correct in a scenario where a Layer 3 switch has SVIs for all VLANs with correct IPs, but static or dynamic routing is not configured to reach a remote VLAN (e.g., VLAN 30 is on a different router). The technician must verify the routing table for a route to that subnet.

Why candidates pick the wrong answer

A

Candidates may confuse inter-VLAN routing on a single switch with a multi-switch topology where trunk ports are critical for VLAN propagation, leading them to incorrectly suspect a trunk misconfiguration.

C

Candidates often default to checking client-side configuration (default gateway) as a common cause of connectivity issues, without considering that partial connectivity (working with VLAN 20) rules out a global default gateway problem.

D

Candidates may assume that inter-VLAN routing failures are always due to missing routes, overlooking that SVIs must have IP addresses to enable routing. The symptom of partial connectivity (VLAN 10 to 20 works) suggests routing is active, making a missing route seem plausible.

72
MCQmedium

A company wants to deploy a wireless network in an office with high-density client requirements. Which 802.11 technology allows multiple antennas to transmit multiple spatial streams to increase throughput?

A.MIMO (Multiple-Input Multiple-Output)
B.OFDM (Orthogonal Frequency Division Multiplexing)
C.DSSS (Direct Sequence Spread Spectrum)
D.CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance)
AnswerA

MIMO (Multiple-Input Multiple-Output) is a crucial technology for high-density wireless networks because it utilizes multiple antennas at both the transmitter and receiver to send and receive multiple data streams concurrently. This spatial multiplexing significantly increases the overall network capacity and throughput, allowing an access point to efficiently serve numerous clients or provide higher bandwidth to individual users. By leveraging spatial diversity, MIMO effectively multiplies the available data paths within the same frequency channel, which is essential for environments with many connected devices.

Why this answer

MIMO (Multiple-Input Multiple-Output) is the correct technology because it uses multiple antennas at both the transmitter and receiver to send and receive multiple independent spatial streams simultaneously. This spatial multiplexing directly increases data throughput without requiring additional bandwidth or higher modulation, making it ideal for high-density client environments.

Exam trap

The trap here is that candidates confuse OFDM with MIMO because both are associated with 802.11n/ac/ax, but OFDM is a modulation scheme, not a spatial-stream technology; MIMO is the specific antenna-array technique that multiplies throughput via parallel streams.

Why the other options are wrong

B

OFDM is a modulation scheme that divides a channel into multiple subcarriers, but it does not use multiple antennas to transmit multiple spatial streams. The question specifically asks for technology enabling multiple antennas and spatial streams, which is MIMO.

C

DSSS is a spread spectrum technique used in older 802.11b networks to reduce interference, but it does not use multiple antennas or spatial streams to increase throughput.

D

CSMA/CA is a media access control method used to avoid collisions on shared wireless channels, not a technology that uses multiple antennas to transmit multiple spatial streams for increased throughput.

When would these options actually be correct?

B

OFDM would be correct if the question asked: 'Which technology divides a wireless channel into multiple orthogonal subcarriers to improve spectral efficiency and reduce interference?'

C

A question asking: 'Which spread spectrum technique uses a chipping code to spread the signal over a wider frequency band, providing resistance to interference in 802.11b networks?'

D

A question asking 'Which mechanism does 802.11 use to reduce the probability of collisions on a shared wireless medium?' would make CSMA/CA the correct answer.

Why candidates pick the wrong answer

B

Candidates often confuse OFDM with MIMO because both are used in modern Wi-Fi (e.g., 802.11n/ac/ax) to increase throughput, but they serve different purposes: OFDM handles subcarrier modulation, while MIMO handles spatial streams.

C

Candidates may confuse DSSS with MIMO because both are associated with wireless throughput improvements, but DSSS is an older technology unrelated to spatial multiplexing.

D

Candidates may confuse CSMA/CA with MIMO because both are associated with wireless performance improvements, but CSMA/CA deals with access control rather than spatial multiplexing.

73
MCQhard

A network engineer is configuring a router to provide IPv6 addressing via SLAAC for hosts on a subnet. The ISP has delegated a prefix 2001:db8:1::/48 and requires the router to advertise a specific prefix 2001:db8:1:1::/64. Which command must be configured on the router's interface to advertise this prefix?

A.ipv6 nd prefix
B.ipv6 address autoconfig
C.ipv6 unicast-routing
D.ipv6 dhcp server
AnswerA

This command is applied on a router interface to specify the IPv6 prefix(es) that the router should include in its Router Advertisement (RA) messages. By advertising a prefix with the "on-link" and "autonomous" flags set (which are default for SLAAC), it instructs IPv6 hosts on that segment to use this prefix to automatically generate their own unique IPv6 addresses, thereby enabling Stateless Address Autoconfiguration (SLAAC). This is the fundamental mechanism for a router to provide IPv6 addressing via SLAAC.

Why this answer

The 'ipv6 nd prefix' command is used on a router interface to advertise a specific IPv6 prefix in Router Advertisement (RA) messages for Stateless Address Autoconfiguration (SLAAC). This command allows the network engineer to override the default prefix derived from the interface address and explicitly advertise the delegated prefix 2001:db8:1:1::/64 as required by the ISP.

Exam trap

The N10-009 exam often tests the distinction between host-side SLAAC commands (like 'ipv6 address autoconfig') and router-side prefix advertisement commands (like 'ipv6 nd prefix'), leading candidates to confuse the device role in the SLAAC process.

Why the other options are wrong

B

The 'ipv6 address autoconfig' command enables stateless address autoconfiguration (SLAAC) on the interface, causing the router to generate its own IPv6 address from the advertised prefix, but it does not configure the router to advertise a prefix to other hosts. The question requires advertising a specific prefix, which is done with 'ipv6 nd prefix'.

C

The command 'ipv6 unicast-routing' enables IPv6 routing globally on the router, but it does not advertise a specific prefix on an interface for SLAAC. The question requires the interface-level command to advertise the prefix 2001:db8:1:1::/64, which is 'ipv6 nd prefix'.

D

The 'ipv6 dhcp server' command configures a DHCPv6 server on the interface, which is used for stateful address assignment or other configuration options, not for advertising prefixes via SLAAC. SLAAC relies on Router Advertisement messages, which are controlled by the 'ipv6 nd prefix' command.

When would these options actually be correct?

B

This command would be correct in a scenario where a router interface needs to obtain an IPv6 address automatically via SLAAC from a neighboring router's router advertisements, such as on a downstream router in a hierarchical network where the upstream router provides prefix delegation.

C

This command would be correct in a scenario where a router is not forwarding IPv6 packets, and the question asks which global configuration command enables IPv6 routing. For example: 'A network engineer needs to enable IPv6 routing on a router. Which command must be configured?'

D

This command would be correct in a scenario where the network engineer needs to provide IPv6 addresses and other configuration parameters (like DNS servers) to hosts using stateful DHCPv6, rather than relying on SLAAC for address assignment. For example, when the network requires central management of IP addresses or needs to deliver additional options beyond prefix information.

Why candidates pick the wrong answer

B

Candidates may confuse the process of the router obtaining an address via SLAAC with the router advertising a prefix for other hosts to use, as both involve SLAAC and IPv6 addressing.

C

Candidates may confuse enabling IPv6 routing with the ability to advertise prefixes, thinking that routing must be enabled first for any IPv6 functionality, but the question specifically asks for the command to advertise the prefix, not to enable routing.

D

Candidates may confuse DHCPv6 with SLAAC, thinking that DHCPv6 is required for IPv6 address assignment in all cases, or they may mistakenly believe that the 'ipv6 dhcp server' command is used to advertise prefixes.

74
MCQhard

A security administrator observes that an employee's workstation is sending large amounts of data to an external IP address on TCP port 443. The workstation is not supposed to initiate outbound connections, and there is no business need for it. What is the most likely cause?

A.The workstation is part of a botnet and is communicating with a command-and-control server
B.A legitimate software update is being downloaded
C.The workstation is acting as a VPN client connecting to a corporate VPN server
D.The workstation is hosting a web server that is being accessed externally
AnswerA

A botnet infection is highly probable given the workstation's unauthorized outbound transmission of large data volumes to an unknown external IP, without any legitimate business justification. Botnets often leverage common ports like HTTPS (TCP 443) for command-and-control (C2) communication to evade detection, making the traffic appear innocuous. This activity typically involves data exfiltration, participation in DDoS attacks, or receiving further instructions from the botmaster.

Why this answer

The workstation is sending large amounts of data to an external IP on TCP port 443, which is commonly used for HTTPS traffic. Since the workstation is not authorized to initiate outbound connections and has no business need for this traffic, the most likely cause is that it has been compromised and is part of a botnet, using HTTPS to communicate with a command-and-control (C2) server to evade detection by blending in with legitimate encrypted web traffic.

Exam trap

The trap here is that candidates may assume TCP 443 always indicates legitimate HTTPS traffic, such as a software update or VPN, without considering that attackers commonly use this port to hide malicious C2 communications, especially when the workstation has no business need for outbound connections.

Why the other options are wrong

C

The workstation is not supposed to initiate outbound connections, and there is no business need for it, so acting as a VPN client would be an authorized, business-justified activity, not a security concern.

D

The workstation is sending data to an external IP on port 443, but hosting a web server would involve inbound connections, not outbound. The question states the workstation initiates outbound connections, which is opposite to a server being accessed externally.

When would these options actually be correct?

C

In a scenario where a workstation is configured to connect to a corporate VPN server for remote access, and the security administrator observes outbound traffic on TCP port 443, this would be the correct answer if the VPN uses HTTPS-based encapsulation.

D

In a scenario where a security administrator observes a workstation receiving unsolicited inbound traffic on TCP port 443 from external IPs, and the workstation is not supposed to be a server, then the most likely cause would be that the workstation is hosting a web server that is being accessed externally.

Why candidates pick the wrong answer

C

Candidates may confuse outbound HTTPS traffic (port 443) with VPN traffic, especially if they know that some VPNs use port 443 to bypass firewalls, but they overlook the question's context that the workstation should not initiate outbound connections.

D

Candidates may confuse outbound and inbound traffic, or think that port 443 always implies web server activity, without considering the direction of the connection.

75
MCQhard

A security administrator is configuring a wireless network to use WPA3-Enterprise. Which authentication server protocol is required for WPA3-Enterprise?

A.RADIUS
B.LDAP
C.TACACS+
D.Kerberos
AnswerA

WPA3-Enterprise leverages the 802.1X standard for robust authentication, which mandates the use of an external authentication server. RADIUS (Remote Authentication Dial-In User Service) is the industry-standard protocol for this purpose, providing centralized Authentication, Authorization, and Accounting (AAA) services. It acts as an intermediary between the wireless access point (authenticator) and the user database, verifying user credentials and assigning network access policies.

Why this answer

WPA3-Enterprise requires 802.1X/EAP authentication, which uses RADIUS as the backend authentication server protocol. RADIUS handles the exchange of EAP frames between the authenticator (access point) and the authentication server, enforcing per-user credentials and supporting the mandatory 192-bit security suite for WPA3-Enterprise. Without RADIUS, the 802.1X framework cannot operate, making it the only required protocol for this deployment.

Exam trap

The trap here is that candidates often confuse TACACS+ with RADIUS because both are AAA protocols, but TACACS+ is used for device administration (e.g., router login) while RADIUS is the only protocol that supports 802.1X/EAP for wireless network access.

Why the other options are wrong

B

WPA3-Enterprise requires an 802.1X/EAP authentication framework, which uses RADIUS as the backend authentication server protocol. LDAP is a directory access protocol, not an authentication server protocol for 802.1X.

C

WPA3-Enterprise requires 802.1X/EAP authentication, which uses RADIUS as the backend authentication server protocol. TACACS+ is a Cisco-proprietary protocol for device administration, not for wireless network authentication.

D

WPA3-Enterprise requires an 802.1X/EAP authentication framework, which uses RADIUS as the backend authentication server protocol. Kerberos is a network authentication protocol for domain environments, not for 802.1X wireless authentication.

When would these options actually be correct?

B

LDAP would be correct in a question asking: 'Which protocol is used to query and modify directory services (e.g., Active Directory) for user account information?' or 'Which protocol is commonly used for centralized authentication in a non-802.1X environment?'

C

TACACS+ would be correct in a question about authenticating network device administrators (e.g., router or switch login) where the protocol provides separate authentication, authorization, and accounting for management access.

D

Kerberos would be the correct answer if the question asked about the authentication protocol used by Active Directory for domain logon or for securing network services like NFS or SMB, not for wireless enterprise authentication.

Why candidates pick the wrong answer

B

Candidates often confuse LDAP with RADIUS because both are used in authentication contexts, and LDAP is commonly integrated with RADIUS servers to retrieve user credentials, leading to the mistaken belief that LDAP itself can serve as the authentication server.

C

Candidates may confuse TACACS+ with RADIUS because both are AAA protocols, but TACACS+ is typically used for device administration rather than network access authentication like WPA3-Enterprise.

D

Candidates may confuse Kerberos with RADIUS because both are used for authentication in enterprise networks, and Kerberos is commonly associated with Windows domain authentication, leading to the assumption it could be used for wireless.

Page 1 of 7

Page 2

All pages