N10-009 · domain
Network Operations
Network Operations is 19% of N10-009 and covers the day-to-day running of a network: documentation and diagrams, monitoring and SNMP, configuration and change management, backups, remote access, and disaster recovery. Expect scenario questions asking which tool, command, or process fits a described operational situation rather than simple recall.
Focused practice
Practice Network Operations questions
Scored sessions drawing only from this domain — pick a length below.
Start 20-question practice test →What this domain covers
What to know about Network Operations
You must choose and apply the right operational tool for a scenario: SNMP traps, syslog, NetFlow, RDP/SSH, TFTP config backups, or a documented change-management process. The single most important thing is matching the tool or process to the described task.
Interpreting network documentation, physical and logical diagrams, and change-management records
Applying configuration management, backups, and version control to network device changes
Watch out for
Common Network Operations exam traps
- ▸Confusing syslog with SNMP traps: syslog pushes event logs, while SNMP polling and traps carry MIB-based metrics and alerts
- ▸Assuming RPO and RTO mean the same thing; RPO is tolerable data loss, RTO is tolerable downtime
- ▸Treating out-of-band management as identical to in-band, ignoring that it survives a failed production network path
Question index
All Network Operations questions (93)
Click any question to see the full explanation, or start a practice session above.
A network operations center uses SNMP to monitor device health. An administrator needs to retrieve the current CPU utilization from a router. Which SNMP operation is most appropriate?
Medium2A network administrator has configured SNMPv3 on a router to send traps to a central management server. The administrator notices that no traps are being received. The management server is reachable via ping from the router. Which configuration step is most likely missing?
Medium3A network administrator needs to maintain a record of all configuration changes made to network switches, including the date, time, and the administrator who made the change. Which document should be used for this purpose?
Easy4A network engineer needs to securely transfer router configuration files to a central backup server. The backup server supports SCP and TFTP. Which protocol should the engineer use?
Medium5A network administrator is troubleshooting an intermittent connectivity issue between two buildings. The administrator suspects a physical layer problem and wants to measure the signal loss on a fiber optic cable run. Which tool should the administrator use?
Medium6A network administrator needs to document the network for auditing purposes. Which type of documentation provides the most detailed information about the physical connections between devices, including cable types and patch panel ports?
Medium7A network administrator needs to be notified immediately when the CPU utilization on a core router exceeds 90%. Which SNMP mechanism should be configured on the router?
Medium8A network technician needs to retrieve the operating system and uptime information from a router for inventory purposes. Which protocol is specifically designed for network management and monitoring?
Easy9Drag and drop the steps to troubleshoot a network connectivity issue using the OSI model into the correct order (top-down approach).
Medium10A network administrator needs to centrally collect and analyze log messages from multiple routers and switches. Which protocol should be used to forward these log messages to a central server?
Medium11A network administrator needs to document the physical placement of devices in a server room, including exact rack location, port labels, and cable connections between patch panels and switches. Which type of diagram is most appropriate?
Easy12A network administrator is configuring a monitoring system to collect metrics from network devices. The administrator needs to ensure that the monitoring system can automatically discover the devices and obtain detailed information about their configuration and status, such as interface descriptions and software versions. Which protocol is best suited for this purpose?
Hard13A network administrator needs to schedule a firmware upgrade for a critical router. Which document should be used to formally communicate the change, seek approval, and track the implementation?
Easy14A network administrator is creating documentation for a new data center. Which type of diagram is BEST for showing the logical relationships between VLANs and their associated subnets?
Medium15An NOC technician observes that the CPU usage on a core switch has been consistently above 90% for the past hour. Which SNMP operation should the technician use to monitor the CPU load over time with minimal network overhead?
Hard16A network administrator wants to centrally monitor the status of all network devices and receive alerts when an interface goes down. Which protocol and feature combination should the administrator use?
Medium17A network administrator configures a router to send syslog messages to a central log server. The administrator can ping the server from the router, but the server is not receiving any logs. What is the most likely cause?
Hard18A network administrator needs to ensure that all changes to network devices are properly reviewed, approved, and tracked. Which process should the administrator implement?
Easy19A network administrator needs to schedule a firmware upgrade for a critical switch during a maintenance window. After the upgrade is completed and verified, which document should the administrator update to reflect the new firmware version?
Easy20A network administrator needs to schedule a firmware update for several switches during a maintenance window. Which of the following documents should be updated immediately after the changes are complete?
Medium21A network engineer plans to change the routing protocol configuration on a core router that will affect connectivity to all branches. According to change management best practices, which step should the engineer perform BEFORE implementing the change?
Medium22A network monitoring system uses SNMP to poll interface statistics from switches every 5 minutes. This polling is causing high CPU utilization on the switches. Which of the following actions would BEST reduce the CPU load on the switches while still providing monitoring data?
Easy23A network administrator is creating a performance baseline for a new VoIP application. Which metric is most critical to monitor in order to ensure good voice quality for end users?
Hard24A network administrator wants to collect performance data from network devices over time and receive alerts when thresholds are exceeded. Which protocol should be used?
Medium25A network administrator needs to collect detailed data about network traffic flows, including source/destination IP addresses, ports, and protocols, to analyze bandwidth usage patterns. Which technology should be used?
Medium26An NOC technician observes that the average latency on a critical WAN link has risen sharply. To determine which applications are consuming the most bandwidth and contributing to the latency, which tool should the technician use?
Medium27A network administrator must monitor network devices using SNMP. The security policy mandates strong encryption for both authentication and data integrity. Which SNMP version and security level should be implemented?
Hard28A network administrator wants to collect logs from multiple routers and switches to a central server for analysis. Which protocol should be configured on the devices to send logs to the server?
Medium29A network administrator scheduled a change window to upgrade the firmware on a core switch. During the upgrade, the switch fails to boot properly. The administrator needs to restore the switch to its previous operational state. Which of the following should the administrator have done before the upgrade to facilitate a successful rollback?
Hard30A network administrator needs to automatically back up the configuration files of all network devices (routers, switches, firewalls) to a central server every night. The administrator requires the transfer to be encrypted to protect sensitive configuration data. Which protocol should the administrator use to retrieve the configuration files?
Medium31A network administrator has completed a scheduled firmware upgrade on a core switch. After verifying successful operation, which document should the administrator update to reflect the new firmware version?
Medium32A network administrator wants to centrally monitor the bandwidth utilization on a router's serial interface over time. The monitoring tool needs to periodically poll the router for current interface counters. Which protocol should be used for this polling?
Medium33A network administrator needs to upgrade the firmware on a core switch. According to change management best practices, which step should be performed first?
Medium34A network administrator is preparing to upgrade the firmware on a critical router. Which document should the administrator consult to understand the steps required to minimize downtime and ensure a successful upgrade?
Medium35A network administrator needs to analyze bandwidth usage by application and identify top talkers on the network. Which protocol or technology should be used to export detailed traffic flow information from routers and switches to a central collector?
Medium36A network monitoring tool uses SNMP to collect data from devices. What is the primary purpose of SNMP traps?
Easy37A network administrator wants to automate the backup of configuration files from multiple routers and switches. Which protocol is commonly used for this purpose and is supported by most network devices?
Easy38A network administrator wants to be alerted immediately when any interface on a core router goes down. The administrator has already configured SNMP community strings. Which additional configuration is necessary to receive these alerts?
Medium39A network administrator needs to identify which hosts are generating the most traffic on the network and what types of traffic (e.g., HTTP, FTP). Which monitoring technology should be deployed?
Medium40A network administrator is setting up SNMPv3 on a router for secure monitoring. Which of the following is required for SNMPv3 authentication?
Medium41A network technician needs to capture and analyze packets on a specific network segment to identify the source of a performance slowdown. Which tool is best suited for this task?
Medium42A network monitoring system alerts that a specific router interface has been flapping (repeatedly going up and down) for the past hour. Which of the following is the MOST likely cause of this behavior?
Medium43A network administrator needs to schedule a firmware upgrade on a core switch during the next maintenance window. According to best practices, which document should the administrator create and have approved before making the change?
Medium44A network administrator wants to configure routers to send syslog messages only for events of severity 'error' (3) or higher (more severe). Which severity level should be set as the trap level?
Medium45A network administrator is documenting the network topology. Which of the following tools is best suited for creating a diagram that shows the logical connections between network devices?
Easy46A network administrator needs to identify which devices are generating the most traffic on a WAN link. The administrator requires detailed flow data including source and destination IP addresses, ports, and protocols. Which technology should be deployed?
Medium47A network administrator needs to analyze bandwidth utilization and application traffic patterns on a WAN link. The administrator requires detailed flow-level data, including source/destination IP addresses, ports, and protocol. Which technology should be deployed?
Medium48A network technician needs to find which physical patch panel port in the server room connects to a specific office wall jack. Which type of network documentation should the technician consult?
Medium49A network administrator is reviewing syslog messages generated by a switch. The administrator wants to see only the most critical events, such as system failures. Which syslog severity level should be configured as the filter?
Easy50A network administrator is investigating reports of slow network performance. Which tool should the administrator use to capture and analyze individual packets to identify the cause of the latency?
Easy51A network administrator needs to securely transfer backup configuration files from a router to a remote server over the internet. Which protocol should be used?
Medium52A network administrator plans to make a configuration change on a core switch during a maintenance window. According to best practices, which document should the administrator prepare and have approved before making the change?
Medium53A network administrator needs to ensure that network device configurations are automatically backed up to a central server. Which protocol is commonly used for secure file transfer of configurations?
Easy54A network administrator needs to monitor the health and performance of network devices and receive alerts when link failures occur. Which of the following protocols should be implemented?
Easy55A network technician needs to back up the configuration file of a managed switch to a central server on a regular basis. The switch supports a simple and widely used protocol for this purpose. Which of the following protocols should the technician use?
Easy56An organization is implementing a network monitoring solution that uses SNMP. The administrator wants to receive traps from all devices but is concerned about the security of SNMPv1/v2c community strings. Which SNMP version should be used to provide authentication and encryption?
Hard57A network administrator needs to create a diagram that shows the IP addressing scheme, VLAN assignments, and routing protocols used in the network. This diagram will be used for troubleshooting and future planning. Which type of documentation should the administrator create?
Medium58A network technician needs to discover directly connected network devices and their capabilities for documentation purposes. Which protocol should be used?
Easy59Match each cable type to its maximum segment length (Ethernet).
Medium60A network administrator is implementing a change management process. Which of the following is the PRIMARY benefit of following this process?
Easy61A network administrator needs to identify which application protocols are consuming the most bandwidth on the company WAN link. Which of the following tools should the administrator use?
Medium62A network administrator wants to collect and analyze logs from multiple network devices in a central location. Which of the following protocols should be used?
Medium63A network engineer plans to change the routing protocol configuration on a core router that will affect all branch connectivity. According to change management best practices, which step should the engineer perform BEFORE implementing the change?
Medium64A network technician notices a high volume of broadcast traffic on a flat network. Which device will best reduce the size of the broadcast domain?
Easy65A network administrator wants to centrally collect and analyze event logs from routers, switches, and firewalls. Which protocol is most commonly used for sending log messages from network devices to a central log server?
Medium66A network administrator has configured a router to send syslog messages to a server with the command 'logging trap 4'. The administrator notices that the syslog server is receiving messages with severity levels 0, 1, and 2. Which of the following best explains why these messages are being received?
Hard67An NOC technician receives an alert that latency on a critical WAN link has increased significantly. The technician needs to analyze the latency trend over the past week to identify patterns. Which approach is the most efficient for gathering this historical data?
Medium68A network administrator needs to monitor network traffic to identify which hosts are consuming the most bandwidth. Which of the following tools is BEST suited for this task?
Medium69A network administrator needs to replace a core switch that is nearing end-of-life. According to change management best practices, which step should the administrator perform FIRST?
Medium70A network administrator needs to monitor network devices using SNMP. The security policy requires that both authentication and data encryption must be enforced for all SNMP operations. Which SNMPv3 security level should be configured?
Medium71A network administrator needs to analyze bandwidth usage on a WAN link to determine which applications are generating the most traffic. The administrator requires detailed flow-level data including source/destination IP, ports, and protocol. Which technology should be used to collect this information?
Hard72A network administrator needs to collect traffic flow data from routers and switches to analyze bandwidth usage patterns. Which protocol should be implemented on the devices to export flow data to a collector?
Medium73A network administrator notices that log timestamps from different switches are inconsistent, making correlation of events difficult. Which protocol should be implemented to ensure all devices have the same time?
Easy74A network administrator wants to monitor network devices using SNMP. The security policy requires both authentication and encryption of SNMP packets. Which SNMP version and security level should be configured?
Medium75Which SNMPv3 security level provides both authentication and encryption?
Easy76A network administrator needs to perform a critical firmware upgrade on a core switch during a maintenance window. Which of the following should the administrator do FIRST before making the change?
Medium77A network administrator needs to implement a solution that allows for centralized management of user authentication, authorization, and accounting for network device access. The solution must support encryption of the entire authentication process. Which protocol should be selected?
Medium78A network administrator is planning a maintenance window to upgrade the firmware on critical switches. Which step should the administrator perform first to ensure minimal downtime?
Medium79A network administrator receives an automated alert from the network monitoring system indicating that the bandwidth utilization on a specific switch port has exceeded the threshold for the past 10 minutes. According to best practices for network operations, what should the administrator do FIRST?
Easy80A network administrator is configuring a syslog server to receive logs from network devices. The administrator wants to capture all messages with a severity level of 'critical' (2) and higher (more severe). What severity threshold should be set on the devices?
Medium81A network administrator needs to be notified immediately when a critical switch interface goes down. Which SNMP feature should be configured?
Medium82A network administrator wants to be notified immediately when any interface on a core router goes down. The administrator has already configured SNMP community strings on the router. What additional configuration is necessary to receive these notifications?
Medium83A network administrator needs to monitor bandwidth utilization on a router interface in real time. Which of the following protocols is best suited for this purpose?
Medium84A company has a change management policy that requires all network changes to be approved and documented. An administrator needs to replace a faulty switch in the core network. According to best practices, which step should be performed after the replacement is complete?
Easy85A network administrator wants to ensure all network devices have synchronized time for accurate log correlation and security event analysis. Which protocol should be implemented?
Easy86A network administrator wants to implement a protocol to automatically assign IP addresses to devices on the network. Which of the following protocols is used for this purpose?
Medium87An organization wants to centrally manage and monitor network devices from a single interface. The solution should support auto-discovery, configuration management, and performance monitoring. Which type of system should be deployed?
Easy88A network administrator needs to remotely manage multiple routers and switches. The management traffic must be encrypted. Which protocol should be used for the remote terminal sessions?
Easy89A network administrator wants to ensure that SNMP traffic between the network monitoring server and managed devices is encrypted and provides authentication of the data origin. Which version of SNMP should be implemented?
Hard90A network administrator needs to automate the backup of router configuration files to a remote server over the internet. The backup must be encrypted and authenticated. Which protocol should the administrator use in the automated script?
Hard91A network administrator needs to ensure that in the event of a switch failure, the switch can be replaced and brought online with minimal downtime. Which of the following tasks should the administrator perform regularly?
Easy92A network administrator is creating a standard operating procedure for firmware upgrades. Which step should be performed FIRST according to best practices?
Easy93A network administrator is preparing documentation for a new branch office. The administrator needs a diagram that shows the logical relationships between network devices and how VLANs are trunked over inter-switch links. Which type of document should be created?
MediumOther domains
All N10-009 exam domains
Frequently asked questions
- What does the Network Operations domain cover on the N10-009 exam?
- You must choose and apply the right operational tool for a scenario: SNMP traps, syslog, NetFlow, RDP/SSH, TFTP config backups, or a documented change-management process. The single most important thing is matching the tool or process to the described task.
- How many questions are in this domain?
- This page lists all 93 Network Operations questions in the N10-009 question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
- What is the best way to practise this domain?
- Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
- Can I practise only Network Operations questions?
- Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.