N10-009 Network Troubleshooting Practice Question
A user reports that they can connect to the corporate Wi-Fi network but cannot access any network resources including the intranet and internet. The IP configuration shows an IP address of 169.254.25.100 with a subnet mask of 255.255.0.0. What is the most likely cause?
⚠ Common exam trap
Watch out — candidates often confuse APIPA with a DNS failure, but the 169.254.x.x address is a definitive indicator of DHCP failure, not a name resolution problem.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DHCP server is unavailable or the request is not reaching it
The IP address 169.254.25.100 with a subnet mask of 255.255.0.0 is an Automatic Private IP Addressing (APIPA) address, which is assigned by the operating system when a DHCP server is unavailable or the DHCP request fails. Since the user can connect to Wi-Fi but cannot access any network resources, the most likely cause is that the DHCP server is not responding or the DHCP discover/offer/request/ack sequence is failing, leaving the device with a link-local address that cannot route to the corporate network or internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DNS server is not responding
Why it's wrong here
A non-responsive DNS server affects name resolution, preventing the client from translating domain names into IP addresses, but it does not interfere with the initial IP address assignment process. A client first needs a valid IP address, subnet mask, and default gateway, typically provided by DHCP, before it can even attempt to query a DNS server. Therefore, if DNS is the sole issue, the client would still receive a routable IP address from DHCP and would not resort to APIPA.
When this WOULD be correct
A user has a valid DHCP-assigned IP address (e.g., 192.168.1.10) but cannot access the internet or intranet by name, while IP-based access (e.g., pinging 8.8.8.8) works. In that scenario, a non-responding DNS server is the most likely cause.
- ✓
The DHCP server is unavailable or the request is not reaching it
Why this is correct
When a client obtains an APIPA address (169.254.x.x), it signifies a fundamental failure in the DHCP process. This occurs because the client's DHCP discovery broadcast did not receive an offer from a DHCP server within a specified timeout period. Potential causes include the DHCP server being offline, a misconfigured DHCP relay agent preventing broadcasts from reaching the server across subnets, or a VLAN mismatch isolating the client from the DHCP server's broadcast domain. Consequently, the client cannot obtain a routable IP address for broader network communication.
- ✗
The subnet mask is incorrect
Why it's wrong here
An incorrect subnet mask is not the primary cause for a client obtaining an APIPA address. APIPA automatically assigns an IP address in the 169.254.0.0/16 range, which inherently uses a 255.255.0.0 subnet mask. While an incorrect subnet mask would certainly cause communication issues, it would typically manifest after a valid IP address is obtained, preventing routing or communication outside the local subnet, rather than triggering the APIPA assignment process itself. The core problem is the failure to acquire *any* DHCP-assigned IP address.
When this WOULD be correct
A user has a static IP configuration with a subnet mask of 255.255.255.0 but the network uses a /16 subnet (e.g., 10.0.0.0/16). The user can connect to the local subnet but cannot reach resources on other subnets because the incorrect subnet mask causes the device to think remote hosts are local.
- ✗
The switch port has port security enabled that has blocked the device
Why it's wrong here
Port security, when enabled and violated, typically results in the switch port either shutting down, restricting traffic, or sending an SNMP trap, effectively blocking all network communication for the connected device. If port security had blocked the device, it would not be able to establish any Layer 2 connectivity or even attempt DHCP, let alone obtain an APIPA address. The presence of an APIPA address indicates that Layer 2 connectivity to the Wi-Fi network exists, but Layer 3 IP configuration via DHCP has failed.
When this WOULD be correct
A user cannot connect to the network at all, and the switch port shows an err-disabled state or security violation. The correct answer would be port security if the question describes a scenario where the device was previously working but then blocked due to MAC address violation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓The DHCP server is unavailable or the request is not reaching itCorrect answer▾
Why this is correct
When a client obtains an APIPA address (169.254.x.x), it signifies a fundamental failure in the DHCP process. This occurs because the client's DHCP discovery broadcast did not receive an offer from a DHCP server within a specified timeout period. Potential causes include the DHCP server being offline, a misconfigured DHCP relay agent preventing broadcasts from reaching the server across subnets, or a VLAN mismatch isolating the client from the DHCP server's broadcast domain. Consequently, the client cannot obtain a routable IP address for broader network communication.
✗The DNS server is not respondingWrong answer — click to see why▾
Why this is wrong here
The IP address 169.254.25.100 is an Automatic Private IP Addressing (APIPA) address, which indicates that the DHCP server was not reached. DNS issues would not cause the client to obtain an APIPA address; they would typically result in name resolution failures while the client still has a valid DHCP-assigned IP.
★ When this WOULD be the correct answer
A user has a valid DHCP-assigned IP address (e.g., 192.168.1.10) but cannot access the internet or intranet by name, while IP-based access (e.g., pinging 8.8.8.8) works. In that scenario, a non-responding DNS server is the most likely cause.
Why candidates choose this
Candidates often associate inability to access network resources with DNS failure, overlooking that the APIPA address directly points to a DHCP issue. They may not fully understand that APIPA is a fallback mechanism when DHCP fails.
✗The subnet mask is incorrectWrong answer — click to see why▾
Why this is wrong here
The IP address 169.254.25.100 is an Automatic Private IP Addressing (APIPA) address, which is assigned when DHCP fails. A subnet mask of 255.255.0.0 is correct for APIPA addresses (169.254.0.0/16), so the subnet mask is not the cause of the connectivity issue.
★ When this WOULD be the correct answer
A user has a static IP configuration with a subnet mask of 255.255.255.0 but the network uses a /16 subnet (e.g., 10.0.0.0/16). The user can connect to the local subnet but cannot reach resources on other subnets because the incorrect subnet mask causes the device to think remote hosts are local.
Why candidates choose this
Candidates may think an incorrect subnet mask could cause total loss of connectivity, but in this scenario the APIPA address indicates a DHCP failure, not a subnet mask problem.
✗The switch port has port security enabled that has blocked the deviceWrong answer — click to see why▾
Why this is wrong here
The IP address 169.254.25.100 is an Automatic Private IP Addressing (APIPA) address, which indicates DHCP failure, not port security. Port security would typically cause a complete loss of connectivity or a specific error, not an APIPA address.
★ When this WOULD be the correct answer
A user cannot connect to the network at all, and the switch port shows an err-disabled state or security violation. The correct answer would be port security if the question describes a scenario where the device was previously working but then blocked due to MAC address violation.
Why candidates choose this
Candidates may confuse port security with DHCP issues because both can prevent network access, but they overlook that APIPA addresses are a hallmark of DHCP failure, not port blocking.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Troubleshoot: Network Connectivity
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.