N10-009 - Network Implementation (20% of the exam) - Section 2.4

Compare and contrast physical and virtual devices and their placement, and configure network services such as DHCP, DNS, and NAT.

Select and place physical, virtual, and cloud-based devices appropriately - placing a firewall at the network edge and a load balancer in front of a server pool. Configure the core network services that make a network usable: DHCP for dynamic addressing with scopes and reservations, DNS record types (A, AAAA, CNAME, MX, PTR), and NAT/PAT to translate private addresses for internet access.

DHCP scopes and reservationsDNS record typesNAT and PATDevice placement

Practice question for this objective

Free sampleNetwork Implementationmedium

A network is being designed so that hosts on the private 172.16.0.0/16 network can reach the internet over a single ISP link. On which device should NAT be configured to translate between the private and public address spaces?

AOn the border router or edge firewall at the boundary between the internal LAN and the ISP link, translating at its inside and outside interfaces. Correct
BOn the internal access-layer switch connecting the workstations, so that translation happens as close to the hosts as possible.
COn each workstation's own network adapter, so that every internal host translates its own private address before it transmits.
DOn the ISP's core router several hops upstream, after the office traffic has already been carried onto the public internet.

NAT is configured at the network edge, on the border router or firewall, where the private inside meets the public outside. NAT operates at the Layer 3 perimeter, so the edge router or firewall is the single point that rewrites private source addresses to public ones as traffic leaves and reverses the mapping on the return.

Why A is correct: NAT belongs at the Layer 3 boundary where private meets public, so the edge router or firewall translates each outbound packet's source as it crosses between the inside and outside interfaces.

Why B is wrong: Access switches forward at Layer 2 by MAC address and do not rewrite IP headers, so a standard switch cannot perform NAT; placing it there reflects a layer misconception.

Why C is wrong: End hosts do not perform NAT for themselves; the translation must occur once at the network edge rather than independently on every client, so this placement is incorrect.

Why D is wrong: Private RFC 1918 addresses are non-routable and are discarded before reaching an upstream core router, so translating there is too late to help, even though the ISP owns the public space.

See more N10-009 practice questions, answers explained.

Exam traps in Network Implementation

Answers that look right on this material and are not. Each one is a distractor from a different question in the N10-009 bank for this domain.

Configure a DHCP reservation for each device so every host has a guaranteed binding.
Why it is wrong: Reservations guarantee a specific address per device, but they still draw from the same 100-address pool and add no capacity, so late arrivals would still find the pool empty.
The reservation's lease time is shorter than the scope's default lease duration.
Why it is wrong: A lease mismatch can cause frequent renewals, but lease duration only controls how long a binding lasts, not whether a reservation matches the requesting client.
An A record maps a hostname to a 128-bit IPv6 address, while an AAAA record maps a hostname to a 32-bit IPv4 address.
Why it is wrong: This reverses the mapping: the AAAA record is the one that holds a 128-bit IPv6 address and the A record holds the 32-bit IPv4 address, so the two roles are inverted.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.