N10-009 Network Troubleshooting Practice Question
A user reports that they can access internal resources such as file shares and printers by name, but they cannot access any external websites. The technician checks the IP configuration and finds the workstation has a valid IP address, subnet mask, default gateway, and DNS server addresses. The technician can successfully ping the default gateway and an external IP address like 8.8.8.8. Which of the following should the technician check NEXT?
⚠ Common exam trap
Many exam-takers assume a successful ping to an external IP means all network layers are fine, but they overlook that DNS resolution is a separate service that can fail independently, leading them to waste time on traceroute or firewall checks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the DNS server can resolve external domain names.
The user can access internal resources by name and can ping an external IP address (8.8.8.8), which confirms that IP routing, the default gateway, and basic network connectivity are working. The inability to access external websites by name, despite having DNS server addresses configured, points directly to a DNS resolution failure for external domains. Therefore, the next logical step is to verify that the configured DNS server can resolve external domain names, such as by using `nslookup` or `dig` to query a public domain like google.com.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform a traceroute to the external website to identify the point of failure.
Why it's wrong here
Performing a traceroute to an external website would not resolve this issue because the ability to successfully ping external IP addresses (e.g., 8.8.8.8) already confirms that the network path to external destinations is functional. Traceroute is primarily used to diagnose routing problems or identify where network traffic is being dropped or delayed along the path. The symptom of being unable to access external websites *by name* while still being able to reach external IPs points specifically to a name resolution failure, not a path or connectivity issue.
When this WOULD be correct
A user cannot access an external website, but can ping the external IP and internal resources. The technician suspects a routing issue at an intermediate hop, so traceroute would identify where packets are dropped.
- ✓
Verify that the DNS server can resolve external domain names.
Why this is correct
The user can access internal resources by name and can reach external IPs, so the DNS server must be able to resolve external names. If the DNS server is not configured to forward queries or is using a root hint that fails, this would explain the symptom.
- ✗
Check the Windows Firewall on the workstation to ensure it is not blocking outbound HTTP traffic.
Why it's wrong here
If the firewall were blocking HTTP, the user would likely not be able to load any web pages, but the ability to ping external IPs suggests basic connectivity exists. The issue is specific to name resolution.
When this WOULD be correct
If the user could not access external websites but could ping external IPs and internal resources, and the DNS server was known to be functioning, then checking the Windows Firewall for outbound HTTP/HTTPS rules would be appropriate.
- ✗
Renew the DHCP lease on the workstation.
Why it's wrong here
Renewing the DHCP lease on the workstation is ineffective because the problem description indicates the workstation already has a valid IP configuration, as evidenced by its ability to access internal resources and ping external IP addresses. DHCP lease renewal primarily addresses issues where a client has no IP address, an incorrect IP address, or an expired lease. Since basic network connectivity and internal name resolution are functional, re-obtaining the same network parameters would not resolve a specific failure in external domain name resolution.
When this WOULD be correct
A user cannot access any network resources, and the workstation has an APIPA address (169.254.x.x) or an incorrect IP configuration. Renewing the DHCP lease would obtain a valid address from the DHCP server.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Verify that the DNS server can resolve external domain names.Correct answer▾
Why this is correct
The user can access internal resources by name and can reach external IPs, so the DNS server must be able to resolve external names. If the DNS server is not configured to forward queries or is using a root hint that fails, this would explain the symptom.
✗Perform a traceroute to the external website to identify the point of failure.Wrong answer — click to see why▾
Why this is wrong here
The technician can already ping an external IP (8.8.8.8), proving that routing to the internet works. Traceroute would only confirm the same path; the issue is name resolution, not routing.
★ When this WOULD be the correct answer
A user cannot access an external website, but can ping the external IP and internal resources. The technician suspects a routing issue at an intermediate hop, so traceroute would identify where packets are dropped.
Why candidates choose this
Candidates often default to traceroute for any connectivity issue, not recognizing that successful external IP ping rules out routing problems, making DNS the more logical next step.
✗Check the Windows Firewall on the workstation to ensure it is not blocking outbound HTTP traffic.Wrong answer — click to see why▾
Why this is wrong here
The technician can already ping an external IP (8.8.8.8), proving outbound IP connectivity and that the firewall is not blocking all outbound traffic. The issue is name resolution, not HTTP blocking.
★ When this WOULD be the correct answer
If the user could not access external websites but could ping external IPs and internal resources, and the DNS server was known to be functioning, then checking the Windows Firewall for outbound HTTP/HTTPS rules would be appropriate.
Why candidates choose this
Candidates often assume that inability to browse websites is due to firewall blocking HTTP/HTTPS, overlooking that successful external pings rule out a general outbound block.
✗Renew the DHCP lease on the workstation.Wrong answer — click to see why▾
Why this is wrong here
The workstation has a valid IP configuration and can ping external IPs, so DHCP is functioning correctly. Renewing the lease would not resolve DNS resolution issues.
★ When this WOULD be the correct answer
A user cannot access any network resources, and the workstation has an APIPA address (169.254.x.x) or an incorrect IP configuration. Renewing the DHCP lease would obtain a valid address from the DHCP server.
Why candidates choose this
Candidates may think that DHCP issues are the cause of connectivity problems, but here the IP configuration is valid, so DHCP is not the problem.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Troubleshoot: Network Connectivity
Key term
ICMP
ICMP is a network-layer protocol used by network devices to send error messages and operational information about network connectivity.
Key term
Ping
Ping is a network utility used to test whether a remote computer or device is reachable across an IP network and to measure the round-trip time of data packets.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.