N10-009 Network Implementation Practice Question
A network engineer has configured an IPsec site-to-site VPN between two offices. The tunnel is established and shows as active. However, users at the branch office (10.0.1.0/24) cannot reach servers at the main office (192.168.1.0/24). Both routers have the correct VPN policies and firewall rules permitting IPsec traffic. What should the engineer check next?
⚠ Common exam trap
The N10-009 exam often tests the misconception that a 'green light' tunnel status guarantees traffic flow, but candidates forget that routing is a separate layer that must explicitly direct traffic into the tunnel interface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
B) That the routing tables on both routers include routes to the remote subnet
The tunnel being active means Phase 1 and Phase 2 of IPsec are established, but traffic still cannot flow because the routers lack routes to the remote subnets. Without a route for 10.0.1.0/24 on the main office router (or 192.168.1.0/24 on the branch router), packets will be dropped or sent out the wrong interface, even though the VPN policy and firewall rules are correct. The engineer must verify that static routes or a dynamic routing protocol (e.g., OSPF over the tunnel) are in place to direct traffic into the IPsec tunnel interface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A) That the DNS server addresses are correctly configured
Why it's wrong here
Domain Name System (DNS) servers translate human-readable domain names into IP addresses, which is essential for accessing resources by name. While correct DNS configuration is vital for users to resolve internal or external hostnames, it does not directly impact the ability of an IPSec site-to-site VPN tunnel to establish or forward IP packets between two specific IP subnets. The problem described, where the tunnel is "up" but no traffic passes, points to a Layer 3 routing issue, not a name resolution failure.
When this WOULD be correct
In a scenario where users can reach servers by IP address but not by hostname, and the VPN tunnel is working, the engineer should check DNS server addresses to ensure name resolution is functioning correctly.
- ✓
B) That the routing tables on both routers include routes to the remote subnet
Why this is correct
Routers use their routing tables to determine the next hop for packets destined for a particular network. For a site-to-site VPN, the router must have a static or dynamic route indicating that traffic for the remote office's private subnet should be encapsulated and sent through the IPSec tunnel interface, rather than out the default internet gateway. Without this specific route, packets will not be directed into the VPN tunnel, preventing communication.
- ✗
C) That the MTU size is set to 1500 on both ends
Why it's wrong here
The Maximum Transmission Unit (MTU) defines the largest packet size, in bytes, that a network interface can send without fragmentation. While an MTU mismatch or an MTU that is too large for the encapsulated VPN traffic can lead to fragmentation, reassembly issues, or even packet drops (often referred to as "black holing"), it typically manifests as intermittent connectivity or slow performance rather than a complete lack of traffic when the tunnel is established. The core problem of "no traffic passes" when the tunnel is up usually indicates a fundamental routing misconfiguration preventing packets from even entering the tunnel.
When this WOULD be correct
In a scenario where VPN is established but large packets (e.g., file transfers) fail or performance is poor, and ping with smaller packets works, checking MTU size (e.g., 1400) would be correct.
- ✗
D) That the SSID is correctly configured on the access points
Why it's wrong here
The Service Set Identifier (SSID) is a name that identifies a wireless local area network (WLAN) and is broadcast by access points for client devices to connect. While crucial for wireless client connectivity, the SSID configuration on access points is entirely irrelevant to the establishment or traffic forwarding of a site-to-site IPSec VPN tunnel between two routers. VPN tunnels operate at Layer 3 (Network Layer) and above, typically over wired connections or existing internet infrastructure, independent of wireless network identifiers.
When this WOULD be correct
In a question where users cannot connect to a wireless network, and the engineer has verified security settings and signal strength, checking the SSID configuration on the access points would be the next step.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓B) That the routing tables on both routers include routes to the remote subnetCorrect answer▾
Why this is correct
Routers use their routing tables to determine the next hop for packets destined for a particular network. For a site-to-site VPN, the router must have a static or dynamic route indicating that traffic for the remote office's private subnet should be encapsulated and sent through the IPSec tunnel interface, rather than out the default internet gateway. Without this specific route, packets will not be directed into the VPN tunnel, preventing communication.
✗A) That the DNS server addresses are correctly configuredWrong answer — click to see why▾
Why this is wrong here
The tunnel is active and IPsec traffic is permitted, so DNS is not the issue. The problem is that the branch office cannot reach the main office subnet, which indicates a routing problem, not DNS resolution.
★ When this WOULD be the correct answer
In a scenario where users can reach servers by IP address but not by hostname, and the VPN tunnel is working, the engineer should check DNS server addresses to ensure name resolution is functioning correctly.
Why candidates choose this
Candidates often default to DNS as a common cause of connectivity issues, but here the tunnel is up and the issue is subnet reachability, not name resolution.
✗C) That the MTU size is set to 1500 on both endsWrong answer — click to see why▾
Why this is wrong here
The tunnel is active, indicating IPsec is working; MTU issues typically cause fragmentation or packet loss, not complete unreachability between subnets.
★ When this WOULD be the correct answer
In a scenario where VPN is established but large packets (e.g., file transfers) fail or performance is poor, and ping with smaller packets works, checking MTU size (e.g., 1400) would be correct.
Why candidates choose this
Candidates may confuse MTU issues with routing problems, as both can cause connectivity failures, but MTU problems usually manifest as partial or intermittent failures, not complete unreachability.
✗D) That the SSID is correctly configured on the access pointsWrong answer — click to see why▾
Why this is wrong here
The SSID is a wireless network identifier for Wi-Fi, which is unrelated to IPsec site-to-site VPN connectivity between branch and main office networks.
★ When this WOULD be the correct answer
In a question where users cannot connect to a wireless network, and the engineer has verified security settings and signal strength, checking the SSID configuration on the access points would be the next step.
Why candidates choose this
Candidates may confuse SSID with VPN configuration or think it's a general network setting, leading them to select it when troubleshooting connectivity issues.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
Learn chapter
Physical Network Infrastructure
Key term
VPN
A VPN creates an encrypted tunnel over a public network to securely connect remote users or sites to a private network.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.