N10-009 Network Troubleshooting Practice Question
Users in a branch office report intermittent connectivity to the corporate data center. A technician runs a continuous ping from a workstation to the data center server and observes packet loss after the third hop. Which command should the technician run next to identify the specific router causing the issue?
⚠ Common exam trap
The trap here is that candidates often jump to running a longer ping (option A) to confirm loss, but the question already states loss is observed; the correct next step is to isolate the failing hop using `tracert`, not to gather more loss statistics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
tracert server_ip
The technician has already identified packet loss after the third hop using a continuous ping. The next logical step is to use `tracert` (or `traceroute` on Linux) to map the path and pinpoint which router (hop) is dropping packets. This command sends ICMP echo requests with incrementing TTL values, forcing each router along the path to reply with a Time Exceeded message, thereby revealing the specific hop where loss occurs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ping -n 1000 server_ip
Why it's wrong here
While `ping -n 1000 server_ip` can confirm basic end-to-end reachability and measure overall packet loss and latency to the destination, it does not provide visibility into the intermediate hops. This command sends a large number of ICMP echo requests to the target, providing an aggregate statistical summary for the entire path. Consequently, it cannot pinpoint *which* specific router or link along the route is responsible for the intermittent connectivity, making it less effective for isolating the fault.
When this WOULD be correct
A technician needs to test for packet loss over a long duration to assess link stability. Running 'ping -n 1000 server_ip' would send 1000 pings to measure loss percentage and round-trip time consistency.
- ✓
tracert server_ip
Why this is correct
The `tracert` command is the most effective tool for diagnosing intermittent connectivity issues along a network path because it maps the route a packet takes to its destination. By sending a series of ICMP echo requests with incrementally increasing Time To Live (TTL) values, `tracert` elicits ICMP "Time Exceeded" messages from each router along the path, revealing each hop. This detailed output, including round-trip times and potential packet loss at each hop, allows a technician to precisely identify the specific router or network segment causing the intermittent problem.
- ✗
nslookup server_ip
Why it's wrong here
The `nslookup` utility is specifically designed for querying the Domain Name System (DNS) to resolve hostnames to IP addresses or to find other DNS records. When provided with an IP address, it attempts a reverse DNS lookup to find the associated hostname. While DNS resolution is a fundamental network service, `nslookup` offers no diagnostic capabilities for analyzing network path performance, latency, or packet loss between the client and a remote server, making it unsuitable for diagnosing intermittent connectivity issues.
When this WOULD be correct
A user reports that they can access a server by IP address but not by its hostname. The technician should run nslookup to verify DNS resolution and identify if the DNS server is failing to resolve the name.
- ✗
ipconfig /all
Why it's wrong here
The `ipconfig /all` command is used to display the complete TCP/IP configuration for all network adapters on a local Windows host. This includes essential details such as IP addresses, subnet masks, default gateways, DNS server addresses, and MAC addresses. While critical for verifying the local machine's network setup and ensuring it can communicate on its immediate segment, `ipconfig /all` provides no information about the network path to a remote server or any issues occurring beyond the local network interface.
When this WOULD be correct
A user cannot connect to the internet. The technician needs to verify the local IP address, subnet mask, default gateway, and DNS server settings to ensure the workstation is properly configured. In that scenario, ipconfig /all would be the correct first step.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓tracert server_ipCorrect answer▾
Why this is correct
The `tracert` command is the most effective tool for diagnosing intermittent connectivity issues along a network path because it maps the route a packet takes to its destination. By sending a series of ICMP echo requests with incrementally increasing Time To Live (TTL) values, `tracert` elicits ICMP "Time Exceeded" messages from each router along the path, revealing each hop. This detailed output, including round-trip times and potential packet loss at each hop, allows a technician to precisely identify the specific router or network segment causing the intermittent problem.
✗ping -n 1000 server_ipWrong answer — click to see why▾
Why this is wrong here
The question asks to identify the specific router causing packet loss after the third hop. Ping only tests end-to-end connectivity and does not show the path or which hop is failing.
★ When this WOULD be the correct answer
A technician needs to test for packet loss over a long duration to assess link stability. Running 'ping -n 1000 server_ip' would send 1000 pings to measure loss percentage and round-trip time consistency.
Why candidates choose this
Candidates may think that a continuous ping with many packets can pinpoint the faulty hop by observing loss patterns, but ping lacks hop-by-hop visibility.
✗nslookup server_ipWrong answer — click to see why▾
Why this is wrong here
nslookup is used for DNS resolution, not for tracing the network path or identifying packet loss at specific hops. It cannot show where packet loss occurs along the route.
★ When this WOULD be the correct answer
A user reports that they can access a server by IP address but not by its hostname. The technician should run nslookup to verify DNS resolution and identify if the DNS server is failing to resolve the name.
Why candidates choose this
Candidates may confuse nslookup with a network troubleshooting tool, thinking it can diagnose connectivity issues beyond DNS, or they may incorrectly assume it provides hop-by-hop path information.
✗ipconfig /allWrong answer — click to see why▾
Why this is wrong here
The ipconfig /all command displays local network configuration details (IP address, MAC, DNS, etc.) but does not perform any path tracing or connectivity testing to remote hosts, so it cannot identify which router is causing packet loss.
★ When this WOULD be the correct answer
A user cannot connect to the internet. The technician needs to verify the local IP address, subnet mask, default gateway, and DNS server settings to ensure the workstation is properly configured. In that scenario, ipconfig /all would be the correct first step.
Why candidates choose this
Candidates may think ipconfig /all provides comprehensive network information that could help diagnose connectivity issues, but they overlook that it only shows local configuration, not the path to a remote server.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Troubleshoot: Network Connectivity
Key term
TTL
TTL (Time to Live) is a field in IP packets that limits the number of hops a packet can traverse before being discarded.
Key term
ICMP
ICMP is a network-layer protocol used by network devices to send error messages and operational information about network connectivity.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.