N10-009 Network Implementation Practice Question
A network administrator is configuring Quality of Service (QoS) on a router to prioritize voice traffic. Which of the following fields should be used to mark packets for classification and prioritization?
⚠ Common exam trap
Test-takers frequently confuse classification (using source IP, port, or MAC to identify traffic) with marking (setting a QoS field like DSCP or CoS), leading them to choose a valid classification method instead of the actual marking field required by the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DSCP
DSCP (Differentiated Services Code Point) is the correct field because it is a 6-bit value in the IP header used to mark packets for QoS classification and prioritization, as defined in RFC 2474. Voice traffic typically uses DSCP EF (Expedited Forwarding, value 46) to ensure low latency and jitter, making it the standard choice for QoS marking on routers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Source IP address
Why it's wrong here
Source IP address can be used to classify traffic but does not mark the packet; marking is done by setting a specific field so downstream devices can prioritize based on the mark, not the original source.
When this WOULD be correct
If the question asked about filtering traffic from a specific host for QoS policing or shaping, the source IP address would be used to match packets from that host. For example, 'Which field is used to identify traffic from a particular subnet for bandwidth limiting?'
- ✓
DSCP
Why this is correct
DSCP (Differentiated Services Code Point) is a 6-bit field within the Type of Service (ToS) byte of the IPv4 header, or the Traffic Class field in IPv6. Routers use DSCP values to classify and mark packets, assigning them to specific per-hop behaviors (PHBs) such as expedited forwarding (EF) for voice or assured forwarding (AF) for critical data. This marking enables consistent end-to-end QoS prioritization across diverse network devices, ensuring that high-priority traffic receives preferential treatment regardless of its origin or destination.
- ✗
Source port number
Why it's wrong here
A source port number is a Layer 4 (Transport Layer) identifier used by an application to initiate communication. While routers can indeed use source port numbers to classify traffic flows for QoS policies (e.g., prioritizing HTTP traffic from port 80), they do not serve as a mechanism for marking the packet itself for downstream prioritization. Marking involves modifying a field within the packet header (like DSCP) that subsequent network devices can read and act upon, which port numbers do not facilitate for end-to-end QoS.
When this WOULD be correct
In a scenario where a firewall or router must prioritize traffic based on application type without relying on DSCP markings, source port number can be used to classify voice traffic (e.g., UDP port 5060 for SIP).
- ✗
MAC address
Why it's wrong here
A MAC (Media Access Control) address is a Layer 2 identifier used for local frame delivery within a single broadcast domain. While MAC addresses are fundamental for forwarding frames between directly connected devices, they are stripped and re-added at each Layer 3 hop. Consequently, MAC addresses are entirely unsuitable for marking packets to carry QoS prioritization information across multiple network segments or routers, as their relevance is strictly limited to the immediate link.
When this WOULD be correct
In a Layer 2 QoS scenario, such as configuring Class of Service (CoS) on a switch to prioritize traffic based on MAC addresses or VLAN tags, MAC address could be used for classification.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓DSCPCorrect answer▾
Why this is correct
DSCP (Differentiated Services Code Point) is a 6-bit field within the Type of Service (ToS) byte of the IPv4 header, or the Traffic Class field in IPv6. Routers use DSCP values to classify and mark packets, assigning them to specific per-hop behaviors (PHBs) such as expedited forwarding (EF) for voice or assured forwarding (AF) for critical data. This marking enables consistent end-to-end QoS prioritization across diverse network devices, ensuring that high-priority traffic receives preferential treatment regardless of its origin or destination.
✗Source IP addressWrong answer — click to see why▾
Why this is wrong here
QoS marking for classification and prioritization uses Layer 3 fields like DSCP or IP Precedence, not the source IP address. The source IP identifies the sender but does not carry QoS priority information.
★ When this WOULD be the correct answer
If the question asked about filtering traffic from a specific host for QoS policing or shaping, the source IP address would be used to match packets from that host. For example, 'Which field is used to identify traffic from a particular subnet for bandwidth limiting?'
Why candidates choose this
Candidates may think that since IP addresses are used in ACLs for traffic classification, they can also be used for QoS marking, but marking requires a dedicated field like DSCP, not the source IP itself.
✗Source port numberWrong answer — click to see why▾
Why this is wrong here
Source port number is a transport-layer field used for identifying applications, but QoS marking for voice traffic is typically done at Layer 3 using DSCP (e.g., EF for voice), not by source port.
★ When this WOULD be the correct answer
In a scenario where a firewall or router must prioritize traffic based on application type without relying on DSCP markings, source port number can be used to classify voice traffic (e.g., UDP port 5060 for SIP).
Why candidates choose this
Candidates may think source port numbers are used for QoS classification because they associate specific ports with voice protocols (e.g., SIP, RTP), but DSCP is the standard method for packet marking in QoS.
✗MAC addressWrong answer — click to see why▾
Why this is wrong here
MAC addresses operate at Layer 2 and are not used for QoS marking in IP networks; QoS classification and prioritization rely on Layer 3 fields like DSCP or IP precedence.
★ When this WOULD be the correct answer
In a Layer 2 QoS scenario, such as configuring Class of Service (CoS) on a switch to prioritize traffic based on MAC addresses or VLAN tags, MAC address could be used for classification.
Why candidates choose this
Candidates may confuse Layer 2 QoS mechanisms (like CoS) with Layer 3 QoS (DSCP), or think MAC addresses can be used for traffic prioritization because they are unique identifiers.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Physical Network Infrastructure
Key term
Quality of Service
Quality of Service (QoS) is a set of technologies used to manage network traffic by prioritizing certain types of data to ensure reliable performance for critical applications.
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.