CompTIA N10-009 Online Practice Questions and Exam Preparation

CompTIA N10-009 Online Questions & Answers

• Question 621:

  Which of the following, in addition to a password, can be asked of a user for MFA?

  A. PIN
  B. Favorite color
  C. Hard token
  D. Mother's maiden name
  A. PIN

  ---

  Explanation

  MFA stands for Multi-Factor Authentication, which is a method of verifying the identity of a user by requiring two or more pieces of evidence that belong to different categories: something the user knows, something the user has, or something the user is. A password is something the user knows, and it is usually combined with another factor such as a PIN (Personal Identification Number) or a hard token (a physical device that generates a one-time code) that the user has. A favorite color or a mother's maiden name are not suitable for MFA, as they are also something the user knows and can be easily guessed or compromised.

• Question 622:

  A company is migrating a data center from on premises to the cloud.

  Which of the following tools will help maintain consistency, reliability, and efficiency of provisioning and management?

  A. IaC
  B. CDN
  C. SASE
  D. ZTA
  A. IaC

  ---

  Explanation

  The correct answer is A. IaC. Infrastructure as Code is used to define and deploy infrastructure through templates, configuration files, or code rather than building everything manually. During a cloud migration, that approach helps keep deployments consistent across environments and reduces the chance of human error.

  This fits the question especially well because it mentions consistency, reliability, and efficiency in both provisioning and management. Those are exactly the kinds of benefits IaC is meant to provide. Instead of configuring servers, networks, and services one by one, administrators can reuse tested deployment definitions and apply the same settings repeatedly. That makes rollouts faster and easier to audit.

  The other options do not match the task. A CDN improves content delivery performance. SASE is a networking and security architecture. ZTA focuses on access control and trust decisions. All of those are important in the right context, but none is primarily a provisioning and management automation tool.

  In a cloud migration, the organization usually wants repeatable builds, standardization, and faster recovery if something has to be recreated. That is why IaC is the strongest answer here. It directly supports automated, dependable, and scalable infrastructure deployment.

• Question 623:

  A network engineer receives a vendor alert regarding a vulnerability in a router CPU.

  Which of the following should the engineer do to resolve the issue?

  A. Update the firmware.
  B. Replace the system board.
  C. Patch the OS.
  D. Isolate the system.
  A. Update the firmware.

• Question 624:

  A network administrator is notified that a user cannot access resources on the network. The network administrator checks the physical connections to the workstation labeled User 3 and sees the Ethernet is properly connected. However, the network interface's indicator lights are not blinking on either the computer or the switch.

  Which of the following Is the most likely cause?

  A. The switch failed.
  B. The default gateway is wrong.
  C. The port Is shut down.
  D. The VLAN assignment is incorrect.
  C. The port Is shut down.

  ---

  Explanation

  When a network interface's indicator lights are not blinking on either the computer or the switch, it suggests a physical layer issue. Here is the detailed reasoning:

  Ethernet Properly Connected: The Ethernet cable is correctly connected, eliminating issues related to a loose or faulty cable.

  No Indicator Lights: The absence of blinking indicator lights on both the computer and the switch typically points to the port being administratively shut down.

  Switch Port Shut Down: In networking, a switch port can be administratively shut down, disabling it from passing any traffic. This state is configured by network administrators and can be verified and changed using the command-line interface (CLI) of the switch.

  Command to Check and Enable Port: bash Copy code Switch> enable

  Switch# configure terminal

  Switch(config)# interface [interface id]

  Switch(config-if)# no shutdown

• Question 625:

  A network administrator needs to change where the outside DNS records are hosted.

  Which of the following records should the administrator change the registrar to accomplish this task?

  A. NS
  B. SOA
  C. PTR
  D. CNAME
  A. NS

  ---

  Explanation

  To change where the outside DNS records are hosted, the network administrator needs to update the NS (Name Server) records at the domain registrar. NS records specify the authoritative name servers for a domain, directing where DNS queries should be sent.

  NS (Name Server) Records: These records indicate the servers that are authoritative for a domain. Changing the NS records at the registrar points DNS resolution to the new hosting provider.

  SOA (Start of Authority): Contains administrative information about the domain, including the primary name server.

  PTR (Pointer) Records: Used for reverse DNS lookups, mapping IP addresses to domain names.

  CNAME (Canonical Name) Records: Used to alias one domain name to another, not relevant for changing DNS hosting.

  References:

  CompTIA Network+ N10-007 Official Certification Guide: Discusses DNS records, their purposes, and how to manage them.

  Cisco Networking Academy: Provides training on DNS management and the role of different DNS record types.

  Network+ Certification All-in-One Exam Guide: Explains DNS records and their configuration for domain management.

• Question 626:

  A network engineer must determine which ports are currently established from a client device.

  Given the following:

  Active Connections

  

  Which of the following commands was used to produce the output?

  A. nslookup
  B. dig
  C. nmap
  D. netstat
  D. netstat

  ---

  Explanation

  The correct choice is D. netstat because the display shown is a classic list of active TCP sessions, including the protocol, local address, remote address, and the connection state such as ESTABLISHED and TIME_WAIT. That is exactly the kind of information a technician checks when trying to see what connections a workstation currently has open.

  The distractors do different jobs. nslookup and dig are DNS utilities. They help query name resolution records, but they do not list active client sessions. nmap is mainly used to scan hosts and ports across the network, usually to discover services or assess exposure on target systems. It does not normally produce a local session table in this format.

  For Network+ purposes, this falls under troubleshooting with command-line tools. When the goal is to inspect current sessions on the local device and confirm whether a port is open, listening, or already connected, netstat is the expected command. The wording "currently established from a client device" is the clue that matters most. The question is not asking what ports exist on a remote server; it is asking what active connections are present on the machine itself. That makes netstat the best fit.

• Question 627:

  Which of the following helps a network administrator understand security risk from external malicious actors and offers insights on which threats to mitigate?

  A. Compliance benchmarks
  B. CIA triad
  C. SAML
  D. Honeypot
  B. CIA triad

  ---

  Explanation

  The CIA triad (Confidentiality, Integrity, Availability) is a foundational security model used in Network+ (N10-009) to evaluate risk and guide prioritization of mitigations. By categorizing assets and threats based on how they could impact confidentiality (data exposure), integrity (unauthorized alteration), or availability (service disruption), administrators can better understand which attacks from external actors matter most to the business and which controls to apply first. For example, a public-facing portal might prioritize availability protections (DDoS mitigation, redundancy), while sensitive customer records demand strong confidentiality controls (encryption, access control), and financial systems require integrity controls (logging, validation, change control). This model helps translate "threats" into business impact, which is central to deciding what to mitigate.

  Compliance benchmarks support meeting regulatory/industry requirements, but they don't inherently provide a conceptual lens for analyzing external attacker impact across all systems. SAML is a federation /authentication standard, not a risk model. A honeypot can provide insight into attacker behavior, but it doesn't broadly structure risk prioritization the way CIA does. Therefore, CIA triad is the best answer.

• Question 628:

  Which of the following cloud service models most likely requires the greatest up-front expense by the customer when migrating a data center to the cloud?

  A. Infrastructure as a service
  B. Software as a service
  C. Platform as a service
  D. Network as a service
  A. Infrastructure as a service

  ---

  Explanation

  References:

  CompTIA Network+ Certification Exam Objectives - Cloud Models section.

• Question 629:

  Which of the following protocols can be used to change device configurations via encrypted and authenticated sessions? (Select TWO)

  A. SNMPv3
  B. SSH
  C. Telnet
  D. IPSec
  E. ESP
  F. Syslog
  A. SNMPv3
  B. SSH

• Question 630:

  Which of the following layers in the OSI model is responsible for establishing, maintaining, and terminating connections between nodes?

  A. Physical
  B. Network
  C. Session
  D. Transport
  C. Session