N10-009 Network Troubleshooting Practice Question
A user reports that they cannot access the internet, but they can access local resources on the same subnet. The network administrator pings the default gateway and gets a response. Which tool should be used next to trace the path to an external website?
⚠ Common exam trap
The N10-009 exam often tests the misconception that a successful ping to the default gateway guarantees internet connectivity, but the trap here is that the problem may be at a subsequent hop, and traceroute is the correct tool to isolate that hop.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
traceroute
B is correct because traceroute (tracert on Windows) is the appropriate tool to identify where packets are being dropped or delayed along the path from the local host to an external website. Since the user can access local resources and the default gateway responds to pings, the issue likely lies beyond the gateway, and traceroute will reveal the hop where connectivity fails.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
netstat
Why it's wrong here
Netstat (network statistics) is a command-line utility that displays various network information on the local host, including active connections, listening ports, routing tables, and interface statistics. While useful for examining the local machine's network state or verifying local routing table entries, `netstat` does not trace the path packets take across multiple network hops to a remote destination. It cannot identify intermediate routers or pinpoint where traffic is being dropped or failing to forward beyond the local gateway, making it unsuitable for diagnosing external routing problems.
When this WOULD be correct
A user reports slow network performance, and you need to check which active connections are consuming bandwidth or if there are unexpected connections. Netstat would be the correct tool to list all current TCP/UDP connections and listening ports.
- ✓
traceroute
Why this is correct
Traceroute (or `tracert` on Windows) is the ideal tool for diagnosing connectivity issues beyond the local network, such as the inability to reach the internet while local resources are accessible. It works by sending packets with incrementally increasing Time-to-Live (TTL) values, causing each successive router along the path to return an ICMP "Time Exceeded" message. This process maps the entire route to the destination, clearly identifying the specific hop where packets stop forwarding or time out, thereby pinpointing the exact point of failure in the internet path.
- ✗
nslookup
Why it's wrong here
Nslookup queries DNS servers to resolve hostnames to IP addresses. The user can already access local resources, but the problem is connectivity, not name resolution. If the issue were DNS, nslookup could help, but the scenario points to a routing problem.
When this WOULD be correct
nslookup would be correct in a scenario where a user cannot access a website by name but can access it by IP address, indicating a DNS resolution problem. The question would ask which tool to use to verify DNS resolution.
- ✗
arp
Why it's wrong here
The Address Resolution Protocol (ARP) is a Layer 2 protocol used to resolve IP addresses to MAC addresses exclusively within a local broadcast domain or subnet. Since the user can access local resources, their device is successfully performing ARP resolution for the local gateway. ARP provides no visibility into network paths or routing beyond the immediate local segment, making it ineffective for diagnosing internet connectivity issues that occur past the local router.
When this WOULD be correct
When a user cannot access any network resources, including local ones, and you suspect an IP address conflict or incorrect MAC address mapping. In that scenario, using ARP to check the local ARP cache or verify the gateway's MAC address would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓tracerouteCorrect answer▾
Why this is correct
Traceroute (or `tracert` on Windows) is the ideal tool for diagnosing connectivity issues beyond the local network, such as the inability to reach the internet while local resources are accessible. It works by sending packets with incrementally increasing Time-to-Live (TTL) values, causing each successive router along the path to return an ICMP "Time Exceeded" message. This process maps the entire route to the destination, clearly identifying the specific hop where packets stop forwarding or time out, thereby pinpointing the exact point of failure in the internet path.
✗netstatWrong answer — click to see why▾
Why this is wrong here
Netstat displays network connections, routing tables, and interface statistics, but it does not trace the path packets take to a destination. The question requires tracing the route to an external website, which is exactly what traceroute does.
★ When this WOULD be the correct answer
A user reports slow network performance, and you need to check which active connections are consuming bandwidth or if there are unexpected connections. Netstat would be the correct tool to list all current TCP/UDP connections and listening ports.
Why candidates choose this
Candidates may confuse netstat with traceroute because both are network diagnostic tools, or they might think netstat can show the route by examining routing tables, but it cannot trace the actual path to a remote host.
✗nslookupWrong answer — click to see why▾
Why this is wrong here
nslookup is used to query DNS servers to resolve domain names to IP addresses, not to trace the network path. The issue here is about tracing the route to an external website, which requires path discovery, not DNS resolution.
★ When this WOULD be the correct answer
nslookup would be correct in a scenario where a user cannot access a website by name but can access it by IP address, indicating a DNS resolution problem. The question would ask which tool to use to verify DNS resolution.
Why candidates choose this
Candidates may confuse network connectivity issues with DNS issues, thinking that if a website is unreachable, the problem must be with name resolution, so they choose nslookup without considering that local resources are accessible and the gateway responds.
✗arpWrong answer — click to see why▾
Why this is wrong here
ARP is used to resolve IP addresses to MAC addresses on a local network, not to trace the path to an external website. Since the user can access local resources and the default gateway responds, ARP is not the next step for diagnosing internet connectivity.
★ When this WOULD be the correct answer
When a user cannot access any network resources, including local ones, and you suspect an IP address conflict or incorrect MAC address mapping. In that scenario, using ARP to check the local ARP cache or verify the gateway's MAC address would be appropriate.
Why candidates choose this
Candidates may confuse ARP with tools that diagnose network connectivity issues, thinking it can help trace routes because it deals with network layer addressing, but it only operates on the local link.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Troubleshoot: Network Connectivity
Key term
Traceroute
Traceroute is a network diagnostic tool that maps the route data packets take from your computer to a destination, showing each intermediate hop and the time taken.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.