CompTIA N10-009 Online Practice Questions and Exam Preparation

CompTIA N10-009 Online Questions & Answers

• Question 681:

  A company security policy requires all network traffic from remote employees' corporate laptops to use the company's VPN.

  Which of the following network access methods best describes this scenario?

  A. Clientless VPN
  B. Full-tunnel
  C. Site-to-site tunnel
  D. Split-tunnel
  B. Full-tunnel

  ---

  Explanation

  The correct answer is Full-tunnel because the policy requires all network traffic from remote corporate laptops to pass through the company's VPN. In a full-tunnel VPN configuration, once the VPN connection is established, all traffic-including internet-bound traffic-is routed through the corporate network before reaching its destination. This ensures centralized monitoring, content filtering, logging, and enforcement of security controls such as IDS/IPS and firewalls.

  According to CompTIA Network+ (N10-009) security objectives, full-tunnel VPNs enhance security by preventing users from directly accessing the internet from their local connection, thereby reducing exposure to local network threats (e.g., public Wi-Fi attacks).

  A split-tunnel VPN (Option D) allows users to access the internet directly while only sending corporate-bound traffic through the VPN, which does not meet the "all traffic" requirement.

  A site-to-site tunnel (Option C) connects entire networks rather than individual remote users.

  A clientless VPN (Option A) typically provides web-based access without a full network tunnel and does not necessarily route all traffic.

  Therefore, full-tunnel best matches the policy requirement.

• Question 682:

  A company is concerned that the public can use network wall jacks in publicly available conference rooms to access company servers.

  Which of the following is the best way to mitigate the vulnerability?

  A. Create a trusted zone.
  B. Disable unused services.
  C. Use MAC filtering.
  D. Implement 802.1X.
  D. Implement 802.1X.

  ---

  Explanation

  The best mitigation is implementing 802.1X, which provides port-based Network Access Control (NAC). With 802.1X enabled on access switch ports, a device plugged into a wall jack cannot gain normal network access until it successfully authenticates using credentials/certificates via an authentication server (commonly RADIUS). This directly addresses the threat of unauthorized users plugging into publicly accessible conference room jacks, because the switch keeps the port in an unauthenticated state (or places it into a restricted/guest VLAN) until authentication succeeds. This aligns with Network+ security objectives that emphasize controlling access at the edge, enforcing authentication, and reducing the risk of rogue or unmanaged devices on internal networks.

  MAC filtering is weaker because MAC addresses can be spoofed and managing allow-lists at scale is error-prone. Creating a trusted zone is vague and does not prevent initial port access; segmentation helps limit blast radius but doesn't enforce authentication at the jack. Disabling unused services is a general hardening practice, but it does not stop someone from connecting physically to an active switch port and attempting access. 802.1X is purpose-built for this exact scenario.

• Question 683:

  Which of the following indicates a computer has reached end-of-support?

  A. The computer does not have any users.
  B. The antivirus protection is expired.
  C. The operating system license is expired.
  D. No more patches or bug fixes are available indefinitely.
  D. No more patches or bug fixes are available indefinitely.

• Question 684:

  A network administrator is extending a network beyond the primary equipment location.

  Which of the following is where the administrator should install additional network switches?

  A. MDF
  B. VPC
  C. VXLAN
  D. IDF
  D. IDF

  ---

  Explanation

  When extending a network beyond the primary equipment location, additional access/distribution switches are typically placed in an IDF (Intermediate Distribution Frame). Network+ (N10-009) infrastructure objectives differentiate between the MDF and IDF: the MDF is the main, central wiring/equipment location (often where core switches, routers, WAN demarcation, and main cross-connects reside). As a building grows or spans multiple floors/areas, an IDF is used as a secondary wiring closet to reduce cable runs, provide local switching, and aggregate user access connections back to the MDF using backbone cabling (often fiber). This supports scalability, cable management, and performance by keeping horizontal runs within recommended distance limits.

  VPC (Virtual Private Cloud) is a cloud networking construct, not a physical wiring location. VXLAN is an overlay tunneling technology used in virtualized/data center networks, not where you physically install switches. The question specifically references extending the network beyond the primary equipment location, which is a classic use case for deploying an IDF to host additional switches closer to endpoint areas while uplinking back to the MDF.

• Question 685:

  A network administrator needs to set up a multicast network for audio and video broadcasting.

  Which of the following networks would be the most appropriate for this application?

  A. 172.16.0.0/24
  B. 192.168.0.0/24
  C. 224.0.0.0/24
  D. 240.0.0.0/24
  C. 224.0.0.0/24

  ---

  Explanation

  References:

  CompTIA Network+ Certification Exam Objectives - IP Addressing section.

• Question 686:

  A network administrator wants to implement an authentication process for temporary access to an organization's network.

  Which of the following technologies would facilitate this process?

  A. Captive portal
  B. Enterprise authentication
  C. Ad hoc network
  D. WPA3
  A. Captive portal

  ---

  Explanation

  A captive portal is a technology that facilitates the authentication process for temporary access to a network. It is commonly used in public Wi-Fi hotspots, hotels, airports, and other environments where temporary network access is provided.

  When users connect to the network, they are redirected to a captive portal page where they must authenticate or agree to terms and conditions before gaining access to the internet or other network resources.

• Question 687:

  A network administrator wants to update a geofencing policy to limit remote access to the corporate network based on country location.

  Which of the following would the administrator most likely leverage?

  A. MAC filtering
  B. Administrative distance
  C. Bluetooth beacon signals
  D. IP address blocks
  D. IP address blocks

  ---

  Explanation

  The correct answer is IP address blocks because geofencing policies typically rely on public IP address ranges associated with specific geographic regions or countries. According to CompTIA Network+ (N10-009) security objectives, geofencing is a security control used to restrict or allow traffic based on geographic location. This is commonly implemented on firewalls, VPN concentrators, or security gateways by referencing databases that map IP address blocks to countries or regions.

  When configuring geofencing, administrators create access control rules that permit or deny traffic from specific country-based IP ranges. This method is effective for limiting remote access to approved geographic locations and reducing exposure to international threat sources.

  MAC filtering (Option A) is used within local networks and does not function over the internet for geographic control. Administrative distance (Option B) is a routing concept that determines route preference and has no relation to access control policies. Bluetooth beacon signals (Option C) are used for proximity-based services and indoor positioning, not for country-level remote access restrictions.

  Therefore, leveraging IP address blocks is the correct approach for implementing geofencing controls.

• Question 688:

  An ISP provided a company with a pre-configured modem and five public static IP addresses.

  Which of the following does the company's firewall require to access the internet? (Select TWO).

  A. NTP server
  B. Default gateway
  C. The modem's IP address
  D. One static IP address
  E. DNS servers
  F. DHCP server
  B. Default gateway
  D. One static IP address

  ---

  Explanation

  To access the internet using static IPs, the firewall (or router) must be configured correctly: Option B. Default gateway: This is essential because it tells the firewall where to send outbound traffic destined for outside the local network.

  Option D. One static IP address: The firewall must be assigned one of the static IPs to communicate over the public internet.

  The other options are not essential for basic internet connectivity in this context: Option A. NTP server: Useful for time synchronization but not required for internet access.

  Option C. The modem's IP address: Irrelevant unless doing modem-level configuration.

  Option E. DNS servers: Important for name resolution but not for basic layer 3 connectivity.

  Option F. DHCP server: Not used when static IPs are assigned.

  References:

  CompTIA Network+ N10-009 Official Objectives: 2.2?Compare and contrast addressing technologies.

• Question 689:

  A new backup system takes too long to copy files to the new SAN each night. A network administrator makes a simple change to the network and the devices to decrease backup times.

  Which of the following does the network administrator change?

  A. QoS
  B. SDN
  C. MTU
  D. VXLAN
  E. TTL
  C. MTU

  ---

  Explanation

  Increasing the MTU (Maximum Transmission Unit) size allows larger frames to be transmitted, reducing overhead and improving throughput -- especially for large file transfers like backups.

  Option A: QoS prioritizes traffic but doesn't reduce backup times directly.

  Option B: SDN is a network management model, not a parameter change.

  Option D: VXLAN encapsulates VLANs, not relevant to backup speeds.

  Option E. TTL is for packet lifetime, not throughput.

  References:

  Domain: Network Infrastructure -- MTU, jumbo frames, performance tuning.

• Question 690:

  Which of the following ports should a network administrator enable for encrypted login to a network switch?

  A. 22
  B. 23
  C. 80
  D. 123
  A. 22