CompTIA N10-008 Online Practice Questions and Exam Preparation

CompTIA N10-008 Online Questions & Answers

• Question 571:

  An organization has a security staff shortage and must prioritize efforts in areas where the staff will have the most impact. In particular, the focus is to avoid expending resources on identifying non-relevant events. A security analyst is reviewing web server logs and sees the following:

  

  Which of the following should the analyst recommend?

  A. Configuring the web server log to filter out 404 errors on image files
  B. Updating firewall rules to block 202.180.155.1
  C. Resyncing the network time server and monitoring logs for future anomalous behavior
  D. Checking with the penetration testing team to see if the team ran any scans on January 14, 2021
  A. Configuring the web server log to filter out 404 errors on image files

  ---

  Explanation/Reference:

  This answer will help the organization to avoid expending resources on identifying non- relevant events, as the 404 errors on image files are not indicative of any security threat or issue, but rather a misconfiguration or a broken link on the web server. The 404 errors on image files are also very frequent and repetitive, as shown by the web server log, which can clutter the log and make it harder to spot any relevant events. By filtering out these errors, the analyst can focus on more important events and reduce the noise in the log. The other answers are not as good as A, because they either do not address the problem of identifying non-relevant events, or they are based on incorrect assumptions or information. For example:

  B. Updating firewall rules to block 202.180.155.1 is not a good answer, because the IP address 202.180.155.1 is not doing anything malicious or suspicious, but rather requesting image files that do not exist on the web server. Blocking this IP address will not improve the security of the web server, but rather create unnecessary firewall rules and possibly deny legitimate access to the web server. C. Resyncing the network time server and monitoring logs for future anomalous behavior is not a good answer, because there is no evidence that the network time server is out of sync or causing any problems. The web server log shows that the entries are all within a few minutes of each other, which is normal and expected. Resyncing the network time server will not help the analyst to identify non-relevant events, but rather waste time and resources on an unrelated task. D. Checking with the penetration testing team to see if the team ran any scans on January 14, 2021 is not a good answer, because the web server log does not show any signs of a penetration test or a scan. The log shows only 404 errors on image files, which are not typical of a penetration test or a scan, which would usually target different types of files, ports, or vulnerabilities. Checking with the penetration testing team will not help the analyst to identify non-relevant events, but rather distract the analyst from the actual events and possibly create false alarms.

  https://www.professormesser.com/network-plus/n10-008/n10-008-video/general-network- troubleshooting-n10-008/

• Question 572:

  A network technician plugged a workstation in to a network device. When the technician turned on the workstation, it was not connected at full duplex. Which of the following devices was the workstation connected to?

  A. Media converter
  B. Hub
  C. Bridge
  D. Layer 3 switch
  B. Hub

• Question 573:

  Which of the following BEST describes a North-South traffic flow?

  A. A public Internet user accessing a published web server
  B. A database server communicating with another clustered database server
  C. A Layer 3 switch advertising routes to a router
  D. A management application connecting to managed devices
  A. A public Internet user accessing a published web server

  ---

  Explanation/Reference:

  North-South traffic flow refers to data communication between networks or devices located in different geographical locations, usually between a client or end-user device and a server or data center. This is commonly used to describe a public Internet user accessing a published web server.

• Question 574:

  A network technician is troubleshooting a connectivity issue. All users within the network report that they are unable to navigate to websites on the internet; however, they can still access local network resources. The technician issues a command and receives the following results:

  

  Which of the following best explains the result of this command?

  A. Incorrect VLAN settings
  B. Upstream routing loop
  C. Network collisions
  D. DNS misconfiguration
  B. Upstream routing loop

  ---

  Explanation/Reference:

  TTL expired in transit typically occurs when there is a routing loop in the network, causing packets to continually loop through routers without reaching their destination.

• Question 575:

  Which of the following attacks encrypts user data and requires a proper backup implementation to recover?

  A. DDoS
  B. Phishing
  C. Ransomware
  D. MAC spoofing
  C. Ransomware

  ---

  Explanation/Reference:

  Ransomware is a type of malware that encrypts user data and demands a ransom for its decryption. Ransomware can prevent users from accessing their files and applications, and cause data loss or corruption. A proper backup implementation is essential to recover from a ransomware attack, as it can help restore the encrypted data without paying the ransom or relying on the attackers' decryption key.

  References: https://www.comptia.org/blog/what-is-ransomware

• Question 576:

  An ISP configured an internet connection to provide 20Mbps, but actual data rates are occurring at 10Mbps and causing a significant delay in data transmission. Which of the following specifications should the ISP check?

  A. Throughput
  B. Latency
  C. Bandwidth
  D. Jitter
  A. Throughput

• Question 577:

  A network engineer is monitoring a fiber uplink to a remote office and notes the uplink has been operating at 100% capacity for a long duration. Which of the following performance metrics is MOST likely to be impacted with sustained link saturation?

  A. Latency
  B. Jitter
  C. Speed
  D. Bandwidth
  A. Latency

  ---

  Explanation/Reference:

  When a fiber uplink is operating at 100% capacity for an extended period of time, it can cause sustained link saturation. This can impact the network's performance by increasing latency. Latency is the time it takes for a packet to travel from the source to its destination. When there is link saturation, packets may have to wait in a queue before being transmitted, which increases the time it takes for them to reach their destination. As a result, users may experience delays or timeouts when accessing network resources. Other metrics such as jitter, speed, and bandwidth are also important, but they are not as directly impacted by sustained link saturation as latency.

• Question 578:

  A network engineer needs to pass both data and telephony on an access port. Which or the following features should be configured to meet this requirement?

  A. VLAN
  B. VoIP
  C. VIP
  D. VRRP
  A. VLAN

• Question 579:

  A network administrator needs to provide evidence to confirm that recent network outages were caused by increased traffic generated by a recently released application. Which of the following actions will BEST support the administrator's response?

  A. Generate a network baseline report for comparison.
  B. Export the firewall traffic logs.
  C. Collect the router's NetFlow data.
  D. Plot interface statistics for dropped packets.
  C. Collect the router's NetFlow data.

  ---

  Explanation/Reference:

  NetFlow data provides information on network traffic, including the source and destination IP addresses, port numbers, and type of traffic, as well as bandwidth and volume of data transferred. This information can help the administrator determine if there was an increase in traffic from the recently released application and if it was the cause of the network outages.

• Question 580:

  A client moving into a new office wants the IP network set up to accommodate 412 network-connected devices that are all on the same subnet. The subnet needs to be as small as possible.

  Which of the following subnet masks should be used to achieve the required result?

  A. 255.255.0.0
  B. 255.255.252.0
  C. 255.255.254.0
  D. 255.255.255.0
  B. 255.255.252.0
  C. 255.255.254.0