CompTIA N10-009 Online Practice Questions and Exam Preparation

CompTIA N10-009 Online Questions & Answers

• Question 161:

  A network switch is generating excessive logs to a syslog server.

  Which configuration change should be made to reduce log volume?

  A. Change syslog server IP
  B. Disable SSH logging
  C. Adjust logging severity level
  D. Enable asynchronous logging
  C. Adjust logging severity level

• Question 162:

  A network engineer needs to correlate findings and receive alerts if there are brute force attacks, DDoS attacks, or port scanning happening within their network.

  Which of the following network monitoring technologies should the engineer implement?

  A. Packet capture
  B. SNMPv3
  C. SIEM
  D. Syslog collector
  C. SIEM

  ---

  Explanation

  A SIEM (Security Information and Event Management) platform is built to collect, correlate, and alert on security-relevant events across many sources, which is exactly what's needed to identify patterns such as brute force attempts port scanning,, and DDoS indicators. In Network+ (N10-009) security operations concepts, correlation is key: a SIEM can ingest logs from firewalls, IDS/IPS, servers, authentication systems, endpoint agents, and network devices, then apply rules/ analytics to detect suspicious behavior that might not be obvious from a single log source. It can also generate real-time alerts, dashboards, and incident timelines-helping the engineer respond quickly and prioritize threats.

  Packet capture provides deep visibility into traffic but is not inherently designed for enterprise-wide correlation and alerting without significant additional tooling and expertise. SNMPv3 is used for secure device monitoring (status, counters, performance) rather than detecting coordinated attack patterns. A syslog collector centralizes logs but generally does not provide the same level of correlation, enrichment, and automated alerting capabilities as a SIEM. Therefore, SIEM is the best answer.

• Question 163:

  Which of the following routing protocols uses an autonomous system number?

  A. IS-IS
  B. EIGRP
  C. OSPF
  D. BGP
  D. BGP

  ---

  Explanation

  An autonomous system (AS) is a collection of IP networks and routers under the control of a single entity that presents a common routing policy to the internet. BGP (Border Gateway Protocol) is the routing protocol commonly used to exchange routing and reachability information between autonomous systems on the internet. BGP uses an autonomous system number (ASN) to uniquely identify each autonomous system.

• Question 164:

  Which of the following is the correct order of components in a bottom-up approach for the three-tier hierarchical model?

  A. Access, distribution, and core
  B. Core, root, and distribution
  C. Core, spine, and leaf
  D. Access, core, and roof
  A. Access, distribution, and core

  ---

  Explanation

  The three-tier hierarchical model in network design consists of three layers: access, distribution, and core. The access layer is where devices like PCs and printers connect to the network. The distribution layer aggregates the data received from the access layer switches before it is transmitted to the core layer, which is responsible for high-speed data transfer and routing. This approach improves scalability and performance in larger networks.

  References:

  CompTIA Network+ Exam Objectives and official study guides.

• Question 165:

  An employee has a new laptop and reports slow performance when using the wireless network. Switch firmware was updated the previous night. A network administrator logs in to the switch and sees the following statistics on the switch interface for that employee:

  98469 packets input, 1681937 bytes, 0 no buffer

  Received 1548 broadcasts (25285 multicasts)

  65335 runts, 0 giants, 0 throttles

  11546 input errors, 5 CRC, 0 frame, 0 overrun, 0 ignored

  0 input packets with dribble condition detected

  22781 packets output, 858040 bytes, 0 underruns

  0 output errors, 89920 collisions, 0 interface resets

  0 babbles, 0 late collision, 0 deferred

  0 lost carrier, 0 no carrier

  0 output buffer failures, 0 output buffers swapped out

  Which of the following is most likely the cause of the issue?

  A. The patch cord from the wall jack is faulty.
  B. The switchport bandwidth needs to be increased.
  C. Multicast is not configured correctly on the switch.
  D. The NIC is set to half duplex.
  D. The NIC is set to half duplex.

• Question 166:

  Which of the following is used to describe the average duration of an outage for a specific service?

  A. RPO
  B. MTTR
  C. RTO
  D. MTBF
  B. MTTR

  ---

  Explanation

  MTTR (Mean Time to Repair) is the average time it takes to repair a system or service after a failure. It helps in measuring the downtime and planning recovery processes.

• Question 167:

  A small business is deploying new phones, and some of the phones have full HD videoconferencing features. The Chief Information Officer (CIO) is concerned that the network might not be able to handle the traffic if it reaches a certain threshold.

  Which of the following can the network engineer configure to help ease these concerns?

  A. A VLAN with 100Mbps speed limits
  B. An IP helper to direct VoIP traffic
  C. A smaller subnet mask
  D. Full duplex on all user ports
  D. Full duplex on all user ports

  ---

  Explanation

  Full duplex modeallows devices to send and receive data simultaneously, improving network performance and reducing congestion, which is critical for VoIP and video conferencing.

  Breakdown of Options:

  Option A. A VLAN with 100Mbps speed limits?VLANs segment traffic but limiting speeds 100Mbps to would worsen video performance.

  Option B. An IP helper to direct VoIP traffic?IP helper is used for DHCP relay not, for VoIP optimization.

  Option C. A smaller subnet mask?A smaller subnet reduces IP address availability but does not improve network performance.

  Option D. Full duplex on all user ports?Correct answer.Full duplex eliminates collisions, allowing better VoIP and video performance.

• Question 168:

  Which of the following VPN types provides secure remote access to the network resources through a web portal?

  A. Proxy
  B. Clientless
  C. Site-to-site
  D. Direct connect
  B. Clientless

  ---

  Explanation

  Clientless VPNsallow users to access network resources through a secure web portal using a browser, with no VPN software needed. This is ideal for occasional access to internal resources via HTTPS.

  Option A. Proxyis a gateway for accessing web content, not a VPN.

  Option C. Site-to-siteVPN connects entire networks, not individual users.

  Option D. Direct Connectusually refers to dedicated cloud connections, not VPNs.

  References:

  CompTIA Network+ N10-009 Official Objectives: 3.3?Given a scenario, configure and deploy common VPN technologies.

• Question 169:

  A network administrator prepares a VLAN for a new office while planning for minimal IP address waste.

  The new office will have approximately 800 workstations.

  Which of the following network schemes meets the requirements?

  A. 10.0.100.0/22
  B. 172.16.8.0/23
  C. 172.16.15.0/20
  D. 192.168.4.0/21
  A. 10.0.100.0/22

  ---

  Explanation

  To support approximately 800 hosts, the smallest suitable subnet must provide at least 800 usable IP addresses.

  A /22 subnet provides 1022 usable addresses, which satisfies the requirement with minimal waste.

  A /23 provides only 510 usable addresses, which is insufficient.

  A /21 and /20 provide significantly more addresses than required, resulting in unnecessary waste.

  Therefore, 10.0.100.0/22 is the most appropriate choice.

• Question 170:

  At which OSI layer is an IP header located?

  A. Layer 2
  B. Layer 3
  C. Layer 4
  D. Layer 7
  B. Layer 3