CompTIA N10-009 Online Practice Questions and Exam Preparation

CompTIA N10-009 Online Questions & Answers

• Question 401:

  Which of the following attacks utilizes a network packet that contains multiple network tags?

  A. MAC flooding
  B. VLAN hopping
  C. DNS spoofing
  D. ARP poisoning
  B. VLAN hopping

• Question 402:

  An organization has a security staff shortage and must prioritize efforts in areas where the staff will have the most impact. In particular, the focus is to avoid expending resources on identifying non-relevant events. A security analyst is reviewing web server logs and sees the following:

  

  Which of the following should the analyst recommend?

  A. Configuring the web server log to filter out 404 errors on image files
  B. Updating firewall rules to block 202.180.155.1
  C. Resyncing the network time server and monitoring logs for future anomalous behavior
  D. Checking with the penetration testing team to see if the team ran any scans on January 14, 2021
  A. Configuring the web server log to filter out 404 errors on image files

  ---

  Explanation

  Filtering out repeated 404 errors for image files helps reduce noise in log data and allows the analyst to focus on relevant security events.

  These errors are typically caused by missing resources or misconfigurations and do not indicate malicious activity.

  Blocking the source IP is unnecessary because the traffic is not malicious.

  Resynchronizing time is unrelated to the issue.

  Contacting the penetration testing team is not appropriate, as there is no indication of scanning or attack activity.

  Therefore, filtering non-relevant log entries is the correct action.

• Question 403:

  An organization wants better network visibility. The organization's requirements include:

  1. Multivendor/OS-monitoring capabilities

  2. Real-time collection

  3. Data correlation

  Which of the following meets these requirements?

  A. SNMP
  B. SIEM
  C. Nmap
  D. Syslog
  B. SIEM

  ---

  Explanation

  A Security Information and Event Management (SIEM) system collects, correlates, and analyzes logs from multiple sources in real-time, providing enhanced visibility across multivendor environments.

  Breakdown of Options:

  Option A. SNMP-SNMP is used for network device monitoring, but it lacks real-time correlation across multiple vendors.

  Option

  B. SIEM-Correct answer. SIEM aggregates, analyzes, and correlates logs from multiple sources, providing real-time visibility. Option

  C. Nmap-Nmap is a network scanning tool used for mapping hosts and detecting open ports but does not provide log correlation.

  Option D. Syslog-Syslog collects logs but does not correlate or analyze them in real-time.

• Question 404:

  A network administrator needs to connect two routers in a point-to-point configuration and conserve IP space.

  Which of the following subnets should the administrator use?

  A. 724
  B. /26
  C. /28
  D. /30
  D. /30

  ---

  Explanation

  Using a /30 subnet mask is the most efficient way to conserve IP space for a point-to-point connection between two routers. A /30 subnet provides four IP addresses, two of which can be assigned to the router interfaces, one for the network address, and one for the broadcast address. This makes it ideal for point-to-point links where only two usable IP addresses are needed.

  References:

  CompTIA Network+ study materials and subnetting principles.

• Question 405:

  A user wants to avoid using a password to access a third-party website.

  Which of the following does the user need in order to allow this type of access to the third-party website?

  A. Multifactor
  B. RADIUS
  C. SSO
  D. Local authentication
  C. SSO

  ---

  Explanation

  Single Sign-On (SSO) permits a user to use one set of login credentials (e.g., username and password) to access multiple applications.

  SSO can allow a user to access a third-party website without needing to enter a password specifically for that site, as long as the user is already authenticated through a central SSO service.

• Question 406:

  A company recently experienced outages of one of its critical, customer-facing applications. The root cause was an overutilized network router, but the Chief Technology Officer is concerned that the support staff was unaware of the issue until notified by customers.

  Which of the following is the best way to address this issue in the future?

  A. Packet capture
  B. SNMP
  C. Syslog collector
  D. SIEM
  B. SNMP

  ---

  Explanation

  The best answer is SNMP (Simple Network Management Protocol). SNMP enables monitoring of network devices (routers, switches, firewalls, servers) and provides performance data such as CPU usage, bandwidth utilization, and interface status. In this scenario, if SNMP monitoring had been in place, administrators would have received alerts that the router was overutilized before customers noticed outages.

  Option A: Packet capture (e.g., Wireshark) is useful for deep troubleshooting but is reactive, not proactive, and not scalable for continuous monitoring.

  Option C: Syslog collects log messages but generally does not provide proactive resource utilization metrics. It is complementary but not the best fit for this problem.

  Option D: SIEM aggregates logs and security events for analysis, but the primary requirement here is performance and availability monitoring.

  By implementing SNMP monitoring (and potentially integrating it with a network monitoring tool such as Nagios, PRTG, or SolarWinds), the organization can track utilization trends, set thresholds, and automatically generate alerts, thereby preventing downtime from going unnoticed.

  References:

  Domain: Network Operations -- SNMP monitoring, proactive network performance management.

• Question 407:

  To reduce costs and increase mobility, a Chief Technology Officer (CTO) wants to adopt cloud services for the organization and its affiliates. To reduce the impact for users, the CTO wants key services to run from the on-site data center and enterprise services to run in the cloud.

  Which of the following deployment models is the best choice for the organization?

  A. Public
  B. Hybrid
  C. SaaS
  D. Private
  B. Hybrid

  ---

  Explanation

  A hybrid cloud deployment model is the best choice for the CTO's requirements. It allows the organization to run key services from the on-site data center while leveraging the cloud for enterprise services. This approach provides flexibility, scalability, and cost savings, while also minimizing disruptions to users by keeping critical services local. The hybrid model integrates both private and public cloud environments, offering the benefits of both.

  References:

  CompTIA Network+ study materials and cloud computing principles.

• Question 408:

  In the troubleshooting methodology, which of the following actions comes after verifying that the initial problem has been resolved?

  A. If necessary, escalating the issue
  B. Attempting to replicate the problem
  C. Documenting findings
  D. Implementing the plan
  C. Documenting findings

  ---

  Explanation

  In the CompTIA Network+ (N10-009) troubleshooting methodology, the step that follows verifying full system functionality (confirming the issue is resolved and validating with the user/requirements) is documenting findings, actions, and outcomes. Documentation is a required closing step because it captures what the original symptoms were, what troubleshooting steps were performed, what root cause was identified (if found), what remediation was applied, and what validation confirmed success. This record supports operational continuity by enabling faster resolution if the issue recurs, improving knowledge transfer across teams, and meeting organizational change-control or compliance requirements.

  The other options fall in different parts of the methodology. Attempting to replicate the problem is typically performed earlier-after identifying symptoms and before or during isolation-to confirm the issue and help narrow scope. Implementing the plan occurs before verification; you implement the selected solution or escalation plan and then test/verify. Escalating the issue occurs when the technician lacks access, expertise, time, or evidence to proceed, and it can happen during troubleshooting-but it is not the standard step that comes after verifying resolution.

• Question 409:

  Two offices require:

  Secure connection

  Full network access

  Persistent tunnel

  Which solution should be implemented?

  A. Client VPN
  B. Site-to-site VPN
  C. SSL VPN
  D. Split tunnel
  B. Site-to-site VPN

• Question 410:

  An organization moved its DNS servers to new IP addresses. After this move, customers are no longer able to access the organization's website.

  Which of the following DNS entries should be updated?

  A. AAAA
  B. CNAME
  C. MX
  D. NS
  D. NS

  ---

  Explanation

  NS records define the authoritative DNS servers for a domain.

  When DNS servers change IP addresses, the NS records must be updated so clients query the correct servers. Otherwise, DNS resolution will fail or return outdated results.

  AAAA records map domain names to IPv6 addresses.

  CNAME records are used for domain aliasing.

  MX records are used for email routing.

  Therefore, NS records must be updated.