CompTIA N10-009 Online Practice Questions and Exam Preparation

CompTIA N10-009 Online Questions & Answers

• Question 71:

  A company's network is experiencing high levels of suspicious network traffic. The security team finds that the traffic is coming from an unknown, foreign IP address.

  Which of the following is the most cost-efficient way to mitigate this threat?

  A. ACL
  B. IDS
  C. NAT
  D. DoS prevention
  A. ACL

  ---

  Explanation

  The correct answer is ACL (Access Control List). According to the CompTIA Network+ N10-009 objectives, ACLs are a fundamental and cost-effective method for controlling traffic flow at routers and firewalls. An ACL allows administrators to permit or deny traffic based on source IP address, destination IP address, protocol, or port number.

  In this scenario, the suspicious traffic is identified as originating from a specific unknown foreign IP address. The most direct and economical mitigation strategy is to configure an ACL rule that denies traffic from that specific IP address (or subnet) at the network perimeter. This approach leverages existing network infrastructure without requiring additional hardware or licensing costs.

  An IDS (Intrusion Detection System) monitors and alerts on malicious activity but does not actively block traffic unless paired with IPS functionality, and it may involve additional cost and complexity. NAT is used for address translation and does not provide traffic filtering based on threat intelligence. DoS prevention solutions are typically more advanced, specialized, and costly, often intended for large-scale distributed denial-of-service attacks rather than blocking traffic from a single suspicious IP.

  The Network+ objectives emphasize implementing layered security controls, starting with simple and effective measures. In this case, applying an ACL at the firewall or router is the most cost-efficient and immediate method to mitigate the identified threat.

• Question 72:

  Which of the following can be implemented add an additional layer of security to between a corporate network and network management interfaces?

  A. Jump box
  B. Console server
  C. API interface
  D. In-band management
  A. Jump box

  ---

  Explanation

  A jump box is a hardened, isolated system that provides secure access critical infrastructure devices to like routers and firewalls.

• Question 73:

  A network administrator needs to monitor data from recently installed firewalls in multiple locations.

  Which of the following solutions would best meet the administrator's needs?

  A. IDS
  B. IPS
  C. SIEM
  D. SNMPv2
  C. SIEM

• Question 74:

  A security engineer is trying to connect cameras to a 12-port PoE switch, but only eight cameras turn on.

  Which of the following should the engineer check first?

  A. Ethernet cable type
  B. Voltage
  C. Transceiver compatibility
  D. DHCP addressing
  B. Voltage

  ---

  Explanation

  Power over Ethernet (PoE) allows devices such as cameras, access points, and VoIP phones to receive both power and data over the same Ethernet cable. If only eight out of twelve cameras turn on, the most likely issue is that the PoE switch has exceeded its power budget (total wattage capacity).

  PoE Budget Limitation: PoE switches have a maximum power output, which can limit the number of devices they support simultaneously.

  Voltage Check: Different PoE standards exist:

  802.3af (PoE): Supplies up to 15.4W per port 802.3at (PoE+): Supplies up to 30W per port 802.3bt (PoE++): Supplies up to 60-100W per port

  Power Draw Calculation: If each camera requires 15W and the switch can only provide 120W, then only 8 cameras (8 x15W = 120W) will turn on.

  Incorrect Options:

  Option

  A. Ethernet Cable Type: Most PoE devices work with Cat5e and above. Cable type could be an issue, but power limitation is the more immediate concern. Option

  C. Transceiver Compatibility: Only relevant if fiber transceivers or modules are in use, but not likely the root cause for power-related issues.

  Option D. DHCP Addressing: DHCP issues affect network connectivity, not power delivery.

• Question 75:

  A network administrator needs to locate a specific AP using a spectrum analyzer to complete an 802.11ax device migration.

  Which of the following should display on the analyzer to locate the AP?

  A. SSID
  B. RSSI
  C. Channel number
  D. BSSID
  D. BSSID

  ---

  Explanation

  To locate a specific access point (AP), the most reliable identifier to view is the BSSID. In 802.11 networks, the BSSID is the radio interface identifier for the AP (typically the AP radio's MAC address). Unlike an SSID, which can be shared across many APs in the same wireless network (especially in an enterprise deployment using the same SSID across multiple APs), the BSSID uniquely distinguishes one AP radio from another. This is critical during an 802.11ax (Wi-Fi 6) migration, where multiple APs may broadcast identical SSIDs and operate on the same channels in different areas.

  While RSSI is useful for physically walking toward the strongest signal (a technique used in locating RF sources), RSSI alone does not confirm you are tracking the correct AP-only that you are near an RF transmitter. Channel number also does not uniquely identify the AP because multiple APs can share the same channel (and channels may overlap depending on band and width). SSID similarly is not unique. Therefore, viewing the BSSID on the analyzer (or Wi-Fi analyzer mode) allows the administrator to confirm the exact AP being measured and located.

• Question 76:

  Which of the following cloud components can filter inbound and outbound traffic between cloud resources?

  A. NAT gateways
  B. Service endpoints
  C. Network security groups
  D. Virtual private cloud
  C. Network security groups

  ---

  Explanation

  Network security groups are cloud components that can filter inbound and outbound traffic between cloud resources based on rules and priorities. Network security groups can be applied to virtual machines, subnets, or network interfaces to control the network access and security. Network security groups can allow or deny traffic based on the source, destination, port, and protocol of the packets. Network security groups are different from NAT gateways, service endpoints, and virtual private clouds, which are other cloud components that have different functions and purposes.

• Question 77:

  Which of the following protocols provides secure remote login to network devices?

  A. Telnet
  B. FTP
  C. SSH
  D. HTTP
  C. SSH

  ---

  Explanation

  Secure Shell (SSH) provides encrypted remote access to network devices, ensuring that credentials and session data are protected from interception. Telnet transmits data in plaintext and is insecure. FTP is used for file transfer, and HTTP is for web communication. SSH uses cryptographic techniques to provide confidentiality, integrity, and authentication, making it the preferred method for secure remote administration.

• Question 78:

  A network administrator wants to implement security zones in the corporate network to control access to only individuals inside of the corporation.

  Which of the following security zones is the best solution?

  A. Extranet
  B. Trusted
  C. VPN
  D. Public
  B. Trusted

• Question 79:

  A network administrator wants to analyze attacks directed toward the company's network.

  Which should be implemented?

  A. Honeypot
  B. Network segmentation
  C. Antivirus
  D. Screened subnet
  A. Honeypot

• Question 80:

  A user tries to visit www.abc.com, but the website that displays is www.cba.com.

  Which of the following should be done in order to reach the correct website?

  A. Modify the CNAME record.
  B. Update the PTR record.
  C. Change the NTP settings.
  D. Delete the TXT record.
  A. Modify the CNAME record.

  ---

  Explanation

  The correct answer is Modify the CNAME record because a CNAME (Canonical Name) record maps one domain name (alias) to another domain name. If a user enters www.abc.com but is redirected to www.cba. com, it is likely that the DNS configuration includes an incorrect CNAME entry pointing abc.com to cba.com. Updating or correcting the CNAME record ensures the alias resolves to the intended host.

  According to CompTIA Network+ (N10-009) objectives covering DNS record types, a CNAME record is used to alias one domain name to another, commonly for load balancing, CDN services, or website redirection.

  A PTR record (Option B) is used for reverse DNS lookups (IP address to hostname) and does not control forward name resolution for websites. NTP settings (Option C) are used for time synchronization and have no impact on DNS resolution. A TXT record (Option D) stores descriptive text information (such as SPF, DKIM, or domain verification data) and does not affect website redirection.

  Therefore, correcting the CNAME record resolves the issue and ensures users reach the correct website.