N10-009 Networking Concepts Practice Question
Which protocol is used to resolve a known IP address to a corresponding MAC address on a local network?
⚠ Common exam trap
Test-takers frequently confuse ARP with DNS, as both involve 'resolution,' but DNS resolves names to IPs (Layer 3) while ARP resolves IPs to MACs (Layer 2), and candidates often forget ARP operates only within a local broadcast domain.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP
ARP (Address Resolution Protocol) is used to resolve a known IP address to its corresponding MAC address on a local network. When a host needs to send a frame to another host on the same subnet, it broadcasts an ARP request containing the target IP; the host with that IP responds with its MAC address, which is then cached for future use.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ARP
Why this is correct
ARP (Address Resolution Protocol) is a Layer 2 protocol responsible for mapping a known Layer 3 IPv4 address to its corresponding Layer 2 MAC (Media Access Control) address within the same local network segment. When a device needs to send data to another host on the same local network and only knows the destination's IP address, it uses ARP to discover the necessary MAC address for direct frame delivery. This process is fundamental for local network communication.
- ✗
DNS
Why it's wrong here
DNS (Domain Name System) is a hierarchical and decentralized naming system that translates human-readable domain names (e.g., www.example.com) into numerical IP addresses (e.g., 192.0.2.1) that computers use to identify each other on the internet. This resolution allows users to access websites and services by name rather than by their numerical IP addresses. DNS operates at the application layer and is concerned with name-to-IP mapping, not IP-to-MAC address resolution.
When this WOULD be correct
DNS would be correct if the question asked: 'Which protocol is used to resolve a fully qualified domain name (e.g., www.example.com) to an IP address?' or 'Which protocol translates human-readable domain names into numerical IP addresses?'
- ✗
DHCP
Why it's wrong here
DHCP (Dynamic Host Configuration Protocol) is a network management protocol that automatically assigns IP addresses, subnet masks, default gateways, and DNS server information to devices on a network. Its primary function is to simplify network configuration and prevent IP address conflicts by centralizing address allocation. DHCP provides IP addresses to hosts but does not resolve a known IP address to a MAC address; it operates at a different stage of network communication.
When this WOULD be correct
A question asking 'Which protocol automatically assigns IP addresses to devices on a network?' would have DHCP as the correct answer. Also, 'Which protocol provides IP configuration including subnet mask and default gateway?' would be answered with DHCP.
- ✗
ICMP
Why it's wrong here
ICMP operates at the network layer (Layer 3) to report errors and perform diagnostic functions such as reachability testing via ping or traceroute, but it has no mechanism to query or map a known IP address to a data-link layer MAC address. The temptation arises because ICMP is commonly used for network troubleshooting when connectivity fails, leading one to assume it can resolve address mismatches. In a scenario where the goal is to test whether a host is reachable after address resolution has already occurred, ICMP would be the correct choice.
When this WOULD be correct
ICMP would be correct for a question like: 'Which protocol is used to test reachability and measure round-trip time to a remote host?' or 'Which protocol is used by the ping command?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓ARPCorrect answer▾
Why this is correct
ARP (Address Resolution Protocol) is a Layer 2 protocol responsible for mapping a known Layer 3 IPv4 address to its corresponding Layer 2 MAC (Media Access Control) address within the same local network segment. When a device needs to send data to another host on the same local network and only knows the destination's IP address, it uses ARP to discover the necessary MAC address for direct frame delivery. This process is fundamental for local network communication.
✗DNSWrong answer — click to see why▾
Why this is wrong here
DNS resolves domain names to IP addresses, not IP addresses to MAC addresses. The question specifically asks for mapping an IP address to a MAC address on a local network, which is ARP's function.
★ When this WOULD be the correct answer
DNS would be correct if the question asked: 'Which protocol is used to resolve a fully qualified domain name (e.g., www.example.com) to an IP address?' or 'Which protocol translates human-readable domain names into numerical IP addresses?'
Why candidates choose this
Candidates often confuse 'resolution' tasks, assuming DNS handles all address resolution, or they misread the question as resolving a name to an IP rather than an IP to a MAC.
✗DHCPWrong answer — click to see why▾
Why this is wrong here
DHCP is used to dynamically assign IP addresses and other network configuration parameters to devices, not to resolve IP addresses to MAC addresses. The resolution of IP to MAC addresses on a local network is performed by ARP.
★ When this WOULD be the correct answer
A question asking 'Which protocol automatically assigns IP addresses to devices on a network?' would have DHCP as the correct answer. Also, 'Which protocol provides IP configuration including subnet mask and default gateway?' would be answered with DHCP.
Why candidates choose this
Candidates may confuse DHCP with ARP because both operate at the network layer and involve IP addresses, but they serve different purposes. The similarity in acronyms (both four-letter protocols) can also cause confusion.
✗ICMPWrong answer — click to see why▾
Why this is wrong here
ICMP is used for network diagnostics (e.g., ping, traceroute) and error reporting, not for resolving IP addresses to MAC addresses. The Address Resolution Protocol (ARP) is the correct protocol for this purpose.
★ When this WOULD be the correct answer
ICMP would be correct for a question like: 'Which protocol is used to test reachability and measure round-trip time to a remote host?' or 'Which protocol is used by the ping command?'
Why candidates choose this
Candidates may confuse ICMP with ARP because both operate at the network layer and are involved in local network communication, or they may mistakenly think ICMP handles address resolution due to its role in network diagnostics.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Network Virtualization and VXLAN
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
Media Access Control
Media Access Control (MAC) is a sublayer of the Data Link Layer in networking that controls how devices on the same network share access to the physical medium and uniquely identifies each device with a hardware address.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.