N10-009 Network Troubleshooting Practice Question
A user reports intermittent connectivity issues. The technician runs ping tests and notices that pings to the default gateway sometimes fail and sometimes succeed. While pinging, the technician observes that some replies have high latency. Which tool should the technician use to analyze the path and identify where packets are being delayed?
⚠ Common exam trap
CompTIA often tests that candidates confuse ping (which only tests end-to-end reachability and latency) with traceroute (which isolates the problematic hop), leading them to overlook traceroute when the question explicitly asks for path analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
traceroute / tracert
Traceroute (tracert on Windows) is the correct tool because it sends packets with incrementing Time-to-Live (TTL) values to map the entire Layer 3 path from source to destination. By measuring the round-trip time (RTT) for each hop, it can pinpoint exactly which router or link is introducing high latency or packet loss, addressing the intermittent connectivity and delayed replies observed in the ping tests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
traceroute / tracert
Why this is correct
Traceroute, or `tracert` on Windows, is the correct tool because it maps the entire network path to a destination by sending packets with progressively increasing Time-To-Live (TTL) values. Each intermediate router decrements the TTL and, when it reaches zero, sends an ICMP Time Exceeded message back to the source, revealing its IP address and the latency to that hop. This hop-by-hop analysis is crucial for pinpointing exactly where intermittent delays or packet loss are occurring along the route, which `ping` alone cannot determine.
- ✗
nslookup
Why it's wrong here
The `nslookup` command is specifically designed for querying Domain Name System (DNS) servers to resolve hostnames into IP addresses or vice-versa. While DNS resolution failures can certainly cause perceived connectivity issues, `nslookup` itself does not trace the network path that packets take to a destination. It only tests the functionality and response of DNS servers, offering no insight into latency or packet loss on the actual data path.
When this WOULD be correct
A user reports that they cannot access a website by its domain name but can access it by IP address. The technician should use nslookup to verify DNS resolution and identify if the DNS server is returning correct records.
- ✗
ipconfig
Why it's wrong here
The `ipconfig` utility is used to display the current TCP/IP network configuration settings of the local machine, including its IP address, subnet mask, default gateway, and DNS server addresses. While essential for verifying a host's own network setup, it does not provide any information about the network path to a remote destination or measure latency across intermediate devices. Therefore, it cannot diagnose where intermittent connectivity issues are occurring beyond the local host's configuration.
When this WOULD be correct
A user cannot connect to the internet. The technician needs to verify the IP address, subnet mask, and default gateway configuration on the client machine to ensure it is correctly configured for the network.
- ✗
arp
Why it's wrong here
The Address Resolution Protocol (ARP) command displays and modifies the IP-to-MAC address mappings stored in the local ARP cache. This protocol is fundamental for resolving Layer 3 IP addresses to Layer 2 MAC addresses within the same local broadcast domain, enabling direct communication between devices on the same segment. However, `arp` provides no information about network paths extending beyond the local network segment or the latency involved in reaching remote hosts across routers.
When this WOULD be correct
A technician needs to determine if there is a duplicate IP address on the local network causing intermittent connectivity. Running 'arp -a' and checking for multiple MAC addresses for the same IP would be the correct approach.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓traceroute / tracertCorrect answer▾
Why this is correct
Traceroute, or `tracert` on Windows, is the correct tool because it maps the entire network path to a destination by sending packets with progressively increasing Time-To-Live (TTL) values. Each intermediate router decrements the TTL and, when it reaches zero, sends an ICMP Time Exceeded message back to the source, revealing its IP address and the latency to that hop. This hop-by-hop analysis is crucial for pinpointing exactly where intermittent delays or packet loss are occurring along the route, which `ping` alone cannot determine.
✗nslookupWrong answer — click to see why▾
Why this is wrong here
nslookup is used for DNS queries to resolve domain names to IP addresses, not for analyzing network path or packet delays. It cannot identify where packets are being delayed along a route.
★ When this WOULD be the correct answer
A user reports that they cannot access a website by its domain name but can access it by IP address. The technician should use nslookup to verify DNS resolution and identify if the DNS server is returning correct records.
Why candidates choose this
Candidates may confuse nslookup as a network troubleshooting tool for connectivity issues, not realizing it is specific to DNS and does not analyze path latency or hop-by-hop delays.
✗ipconfigWrong answer — click to see why▾
Why this is wrong here
ipconfig displays IP configuration settings (e.g., IP address, subnet mask, default gateway) but does not trace network paths or measure latency between hops, so it cannot identify where packets are being delayed.
★ When this WOULD be the correct answer
A user cannot connect to the internet. The technician needs to verify the IP address, subnet mask, and default gateway configuration on the client machine to ensure it is correctly configured for the network.
Why candidates choose this
Candidates may think ipconfig can diagnose connectivity issues because it shows network settings, but they overlook that it provides only static configuration data, not dynamic path analysis.
✗arpWrong answer — click to see why▾
Why this is wrong here
ARP is used to resolve IP addresses to MAC addresses on a local network, not to trace the path or measure latency across multiple hops. It cannot identify where packets are being delayed along a route.
★ When this WOULD be the correct answer
A technician needs to determine if there is a duplicate IP address on the local network causing intermittent connectivity. Running 'arp -a' and checking for multiple MAC addresses for the same IP would be the correct approach.
Why candidates choose this
Candidates may confuse ARP with a tool that can analyze network paths because it deals with network layer addressing, but it only operates on the local link and does not provide hop-by-hop latency information.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Troubleshoot: Cable and Physical Layer
Key term
Packet
A packet is a small unit of data that is sent over a network, containing both the actual data and control information for delivery.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.