N10-009 Network Troubleshooting Practice Question
A user reports they can access internal servers and the default gateway but cannot reach external websites. The technician checks the router's ACL and finds a rule that permits all outbound traffic. What is the most likely cause?
⚠ Common exam trap
CompTIA often tests the misconception that an ACL permitting all outbound traffic guarantees internet access, when in fact NAT must be properly configured to translate private IP addresses to a routable public IP address for external reachability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NAT configuration issue
The user can access internal servers and the default gateway, indicating Layer 3 connectivity within the local network. However, external websites are unreachable. Since the ACL permits all outbound traffic, the issue is not a blocked outbound rule. The most likely cause is a NAT configuration issue, such as missing or incorrect IP masquerading (PAT) on the router's outside interface, which prevents internal private IP addresses from being translated to a public IP address for internet access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS resolution failure
Why it's wrong here
A DNS resolution failure would specifically prevent users from accessing external resources by their domain names, as the system would be unable to translate hostnames into IP addresses. However, if the user could still successfully ping or browse to external IP addresses (e.g., 8.8.8.8), then the underlying network connectivity to the internet would still be functional. The scenario describes a complete inability to reach external destinations, which is a broader issue than just name resolution.
When this WOULD be correct
A user cannot access any websites (internal or external) but can ping IP addresses. The technician checks DNS settings and finds the DNS server address is incorrect or unreachable. In that scenario, DNS resolution failure is the most likely cause.
- ✗
Incorrect default gateway
Why it's wrong here
If the default gateway were incorrect, the user would not be able to access the default gateway itself, nor internal servers on different subnets. The user can access internal servers, so the gateway is correct.
When this WOULD be correct
A user cannot access any network resources, including internal servers and the default gateway. The technician verifies that the IP configuration shows a gateway IP that is not on the same subnet as the host.
- ✓
NAT configuration issue
Why this is correct
Network Address Translation (NAT) is crucial for allowing devices with private IP addresses to communicate with the public internet. Without proper NAT configuration, the router will not translate the private source IP addresses of internal hosts into a routable public IP address. Consequently, while internal servers and the default gateway remain accessible, any packets destined for external internet resources will be dropped by upstream routers because their source IP is non-routable, effectively blocking all external communication despite ACLs permitting it.
- ✗
Proxy server misconfiguration
Why it's wrong here
A misconfigured proxy server could indeed prevent internet access by incorrectly filtering requests or failing to forward them to external destinations. However, the problem statement indicates that the Access Control List (ACL) permits all outbound traffic, implying that network-layer forwarding rules are not the issue. While a proxy operates at a higher layer, the fundamental problem described—inability to reach any external destination despite internal and gateway access—points more directly to a core routing or address translation failure rather than an application-layer intermediary.
When this WOULD be correct
A proxy server misconfiguration would be correct if users could access internal resources but external websites required proxy settings, and the proxy was incorrectly configured or unreachable. For example, if the browser is set to use a proxy that is down or misconfigured, external access fails while internal access works.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓NAT configuration issueCorrect answer▾
Why this is correct
Network Address Translation (NAT) is crucial for allowing devices with private IP addresses to communicate with the public internet. Without proper NAT configuration, the router will not translate the private source IP addresses of internal hosts into a routable public IP address. Consequently, while internal servers and the default gateway remain accessible, any packets destined for external internet resources will be dropped by upstream routers because their source IP is non-routable, effectively blocking all external communication despite ACLs permitting it.
✗DNS resolution failureWrong answer — click to see why▾
Why this is wrong here
The user can access internal servers and the default gateway, indicating that DNS resolution is working for internal resources. The issue is with external websites, which points to a NAT problem, not DNS.
★ When this WOULD be the correct answer
A user cannot access any websites (internal or external) but can ping IP addresses. The technician checks DNS settings and finds the DNS server address is incorrect or unreachable. In that scenario, DNS resolution failure is the most likely cause.
Why candidates choose this
Candidates often associate inability to reach external websites with DNS issues, overlooking that internal access works, which rules out DNS failure.
✗Incorrect default gatewayWrong answer — click to see why▾
Why this is wrong here
The user can access internal servers and the default gateway, which indicates the default gateway is correctly configured. An incorrect default gateway would prevent access to both internal servers and external websites.
★ When this WOULD be the correct answer
A user cannot access any network resources, including internal servers and the default gateway. The technician verifies that the IP configuration shows a gateway IP that is not on the same subnet as the host.
Why candidates choose this
Candidates may confuse symptoms of a default gateway issue (no external access) with the fact that internal access is still working, overlooking that the gateway is reachable.
✗Proxy server misconfigurationWrong answer — click to see why▾
Why this is wrong here
The user can access internal servers and the default gateway, which indicates that DNS resolution is working for internal resources. However, the inability to reach external websites points to a NAT issue, not a proxy misconfiguration, as the ACL permits all outbound traffic.
★ When this WOULD be the correct answer
A proxy server misconfiguration would be correct if users could access internal resources but external websites required proxy settings, and the proxy was incorrectly configured or unreachable. For example, if the browser is set to use a proxy that is down or misconfigured, external access fails while internal access works.
Why candidates choose this
Candidates may confuse proxy server issues with NAT problems because both can cause external access failures. They might assume that a proxy is needed for internet access, overlooking that the scenario's symptoms (internal access works) and the ACL rule point to a NAT issue instead.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Troubleshoot: Cable and Physical Layer
Key term
PAT
PAT (Port Address Translation) is a method of network address translation that maps multiple private IP addresses to a single public IP address by using different port numbers for each connection.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.