N10-009 Network Troubleshooting Practice Question
A user reports that they can access the internet but cannot access the company's internal web application at https://intranet.company.local. The technician can ping the server's IP address (192.168.10.50) successfully from the user's workstation. However, when the technician runs 'nslookup intranet.company.local', it returns 'Non-existent domain'. What is the most likely cause?
⚠ Common exam trap
CompTIA often tests the distinction between connectivity (ping) and name resolution (nslookup), trapping candidates who assume that successful ping to an IP means the web application should work, ignoring that DNS failure prevents the browser from even initiating the HTTP request.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The client's DNS server does not have a record for the internal domain.
The user can access the internet and ping the server's IP address, which confirms Layer 3 connectivity and that the web server is reachable. However, 'nslookup intranet.company.local' returns 'Non-existent domain', indicating that the DNS server used by the client does not have an A or CNAME record for that internal hostname. Since the browser relies on DNS resolution to translate the FQDN to an IP address, the failure to resolve the name prevents the web application from loading, even though the server itself is online and reachable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The web server is not running on port 443.
Why it's wrong here
This option is incorrect because the problem manifests as a DNS resolution failure, indicated by the `nslookup` command returning NXDOMAIN. A client device must first successfully resolve a hostname to an IP address before it can even attempt to establish a TCP connection to a specific port, such as 443 for HTTPS. Since the hostname cannot be resolved, the client never reaches the stage of trying to connect to any port on the server.
When this WOULD be correct
A user reports being unable to access an internal HTTPS website, but nslookup resolves the hostname correctly. The technician can ping the server IP, and telnet to port 443 fails. In this scenario, the web server not running on port 443 would be the correct answer.
- ✓
The client's DNS server does not have a record for the internal domain.
Why this is correct
This is the correct answer because an 'NXDOMAIN' (Non-existent domain) response from `nslookup` explicitly indicates that the DNS server queried could not find a corresponding A or CNAME record for the internal hostname. Since external internet access works, the client's DNS server is functional for public lookups but lacks the necessary zone information or conditional forwarders to resolve internal company domain names, preventing any connection attempts to internal resources.
- ✗
A firewall is blocking traffic to the internal web server.
Why it's wrong here
If DNS resolution fails, the browser never attempts to connect to the server, so a firewall block would not be the primary cause; the user wouldn't even get to the point of a TCP connection.
When this WOULD be correct
A user cannot access an internal web application, and pinging the server's IP address fails. A firewall rule blocking the specific port (e.g., 443) would be the likely cause, especially if other services on the server are reachable.
- ✗
The hostname is misspelled in the browser.
Why it's wrong here
This option is incorrect because the technician explicitly ran `nslookup` and received an NXDOMAIN response. The `nslookup` utility directly queries the configured DNS server for a hostname's IP address, bypassing any potential typos made by a user in a web browser. The NXDOMAIN result confirms the issue lies with the DNS server's inability to resolve the name, not with the client's input.
When this WOULD be correct
In a scenario where a user reports being unable to access a website, but nslookup resolves correctly and the server is reachable, the most likely cause could be a typo in the browser's address bar. For example, if the user typed 'intranet.company,local' instead of 'intranet.company.local'.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓The client's DNS server does not have a record for the internal domain.Correct answer▾
Why this is correct
This is the correct answer because an 'NXDOMAIN' (Non-existent domain) response from `nslookup` explicitly indicates that the DNS server queried could not find a corresponding A or CNAME record for the internal hostname. Since external internet access works, the client's DNS server is functional for public lookups but lacks the necessary zone information or conditional forwarders to resolve internal company domain names, preventing any connection attempts to internal resources.
✗The web server is not running on port 443.Wrong answer — click to see why▾
Why this is wrong here
The user can access the internet but not the internal web app, and nslookup returns 'Non-existent domain', indicating a DNS resolution failure. The web server being down on port 443 would not cause a DNS lookup to fail; it would cause a connection timeout or refusal after successful resolution.
★ When this WOULD be the correct answer
A user reports being unable to access an internal HTTPS website, but nslookup resolves the hostname correctly. The technician can ping the server IP, and telnet to port 443 fails. In this scenario, the web server not running on port 443 would be the correct answer.
Why candidates choose this
Candidates may think that since HTTPS uses port 443, a port issue is a common cause of web access problems, and they overlook the DNS failure evidence provided in the question.
✗A firewall is blocking traffic to the internal web server.Wrong answer — click to see why▾
Why this is wrong here
The technician can ping the server's IP address successfully, indicating that network connectivity and firewall rules are not blocking traffic to the server. The issue is DNS resolution, not firewall filtering.
★ When this WOULD be the correct answer
A user cannot access an internal web application, and pinging the server's IP address fails. A firewall rule blocking the specific port (e.g., 443) would be the likely cause, especially if other services on the server are reachable.
Why candidates choose this
Candidates often assume that any connectivity issue to a web server is due to a firewall, overlooking that successful ping to the IP proves basic network access is allowed.
✗The hostname is misspelled in the browser.Wrong answer — click to see why▾
Why this is wrong here
The user can access the internet and ping the server IP, but nslookup returns 'Non-existent domain', indicating a DNS resolution failure, not a browser misspelling. A misspelling would still result in a DNS query, not a 'Non-existent domain' error.
★ When this WOULD be the correct answer
In a scenario where a user reports being unable to access a website, but nslookup resolves correctly and the server is reachable, the most likely cause could be a typo in the browser's address bar. For example, if the user typed 'intranet.company,local' instead of 'intranet.company.local'.
Why candidates choose this
Candidates may assume that a simple typo is the easiest explanation for a web access issue, overlooking the DNS error message that clearly indicates the hostname cannot be resolved at all.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Common DNS Record Types
| Record | Purpose | Example |
|---|---|---|
| A | IPv4 address mapping | example.com → 93.184.216.34 |
| AAAA | IPv6 address mapping | example.com → 2606:2800::1 |
| CNAME | Alias to another hostname | www → example.com |
| MX | Mail server for domain | example.com → mail.example.com (priority 10) |
| TXT | Text data (SPF, DKIM, verification) | v=spf1 include:_spf.example.com ~all |
| NS | Authoritative name servers | example.com NS ns1.example.com |
| PTR | Reverse DNS (IP → hostname) | 34.216.184.93.in-addr.arpa → example.com |
| SOA | Zone authority record | Primary NS, admin email, serial, TTL defaults |
Go deeper
Related to this question
Learn chapter
Troubleshoot: Cable and Physical Layer
Key term
FQDN
A complete domain name that specifies the exact location of a host in the DNS hierarchy, ending with a trailing dot.
Key term
ICMP
ICMP is a network-layer protocol used by network devices to send error messages and operational information about network connectivity.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on N10-009
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user reports that they cannot access a web server by its URL but can access it by IP address. A technician checks the DNS server and finds it is reachable. What is the most likely cause?
medium- A.Incorrect default gateway
- ✓ B.DNS resolution failure for that specific record
- C.Firewall blocking port 80
- D.IP conflict on the user's workstation
Why B: The user can access the web server by IP address but not by URL, which indicates that the name-to-IP resolution is failing. Since the DNS server is reachable, the issue is not with network connectivity to the DNS server but rather with the specific DNS record for that web server. This is a classic DNS resolution failure for that specific record, often due to a missing or incorrect A or AAAA record.
Variation 2. A user reports that they can access a website by its IP address but not by its domain name. Which of the following is most likely the issue?
easy- ✓ A.A) DNS resolution failure
- B.B) Incorrect default gateway
- C.C) Duplicate IP address
- D.D) Corrupted TCP/IP stack
Why A: Accessing a website by IP address but not by domain name indicates that the client can reach the web server over the network, but the name-to-IP translation process is failing. This is a classic symptom of a DNS resolution failure, where the client cannot query or receive a valid A or AAAA record for the domain from its configured DNS server.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.