Free N10-009 practice questions

A technician troubleshooting a slow 100 Mbps server link has just formed the idea that a duplex mismatch between the switch port and the server NIC is the likely cause. Following the CompTIA seven-step troubleshooting methodology, what should the technician do next?

• ATest the theory by checking the interface counters and duplex settings on both ends to confirm the mismatch.check_circle Correct
• BImplement the solution by hard-coding both interfaces to the same speed and duplex.
• CDocument the findings and the corrective action taken in the ticketing system.
• DEstablish a plan of action and identify the potential effects of changing the duplex settings.

Why A is correct: After a theory of probable cause is established, the methodology's next step is to test that theory to determine whether it is actually the cause.

Why B is wrong: This is the eventual corrective action and feels efficient, but implementing a change comes only after the theory has been tested and a plan of action has been established.

Why C is wrong: Documentation is a real methodology step, but it is the final one performed after the fix is verified, not the step that follows forming a theory.

Why D is wrong: Planning is a genuine step, but it belongs after the theory is confirmed by testing, so building a plan now skips the required test step.

A service-desk technician receives a report that email is broken. Before changing anything, the technician questions the user about exactly what fails, asks when it began and whether anything changed, and attempts to reproduce the fault. Which step of the CompTIA troubleshooting methodology do these actions belong to?

• AEstablish a theory of probable cause by questioning the obvious and considering likely faults.
• BIdentify the problem by gathering information, questioning users, and duplicating the fault.check_circle Correct
• CTest the theory to determine the cause and then decide on the appropriate next steps.
• DVerify full system functionality and implement any needed preventive measures afterwards.

Why A is wrong: Forming a theory is tempting because it is closely related, but a probable cause can only be proposed after the symptoms have first been gathered and understood.

Why B is correct: Gathering information, questioning the user, asking what changed, and reproducing the fault are exactly the activities that define identifying the problem.

Why C is wrong: Testing a theory sounds plausible, but no theory has been formed yet, so there is nothing to test at the information-gathering stage.

Why D is wrong: Verification is a genuine step but a closing one performed after a fix, whereas the technician here is still at the very start of the process.

While troubleshooting a printer that cannot be reached, a technician theorised a failed patch cable and then confirmed it by testing continuity and swapping the cable onto a known-good port. With the theory now confirmed, what is the next step in the CompTIA methodology?

• ATest the theory again with a different cable tester to be doubly certain of the result.
• BDocument the outcome and the lessons learned, and then close out the ticket for the user.
• CEstablish a plan of action to resolve the problem and identify its potential effects.check_circle Correct
• DVerify full system functionality and implement preventive measures for the future.

Why A is wrong: Retesting reflects a good verification instinct, but the theory has already been confirmed, so repeating the test is not the prescribed next step.

Why B is wrong: Documentation is a real step but the final one, performed after the fix has been made and verified, not immediately after confirming a cause.

Why C is correct: Once a theory is confirmed, the methodology moves to establishing a plan of action to resolve the problem while considering potential effects.

Why D is wrong: Verification is tempting but follows implementing the solution, so it cannot come directly after the theory is confirmed and before any fix is planned.

A network designer needs each subnet to provide exactly six usable host addresses, with no addresses wasted beyond the network and broadcast addresses. Which IPv4 prefix length meets this requirement?

• A/29check_circle Correct
• B/27
• C/28
• D/30

Why A is correct: A /29 leaves three host bits, so two to the third power is eight addresses, and subtracting the network and broadcast addresses leaves exactly six usable hosts.

Why B is wrong: A /27 leaves five host bits, giving 32 addresses and 30 usable hosts; tempting if you stop at the host-bit field, but it is far larger than six.

Why C is wrong: A /28 leaves four host bits, giving 16 addresses and 14 usable hosts; tempting if you miscount by a single host bit, but it doubles the size needed.

Why D is wrong: A /30 leaves two host bits, giving four addresses and two usable hosts, the point-to-point size; tempting but it supplies only two hosts, not six.

A technician sees an interface auto-configure the address fe80::1a2b:3cff:fe4d:5e6f with no DHCP server present. Which statement about this address is correct?

• AIt is a global unicast address routable across the public internet.
• BIt is a link-local address valid within the local link and not forwarded by routers.check_circle Correct
• CIt is a unique local address intended for private site-wide routing.
• DIt is a multicast address used to reach a defined group of interfaces.

Why A is wrong: Global unicast addresses begin 2000::/3 and are internet-routable; tempting because both are unicast, but the fe80 prefix confines this one to the local link.

Why B is correct: Addresses in fe80::/10 are link-local, generated automatically on every IPv6 interface, and routers do not forward them beyond the link on which they appear.

Why C is wrong: Unique local addresses use fc00::/7, commonly fd00::/8, for private routing within a site; tempting as a private analogue, but fe80 marks link-local, not ULA.

Why D is wrong: Multicast addresses begin ff00::/8 and target a group; tempting because IPv6 relies heavily on multicast, but fe80 is a unicast link-local address.

A Windows host fails to obtain a lease because no DHCP server responds, and it self-assigns an address so it can still communicate on the local segment. From which range does the host draw this address?

• A10.0.0.0/8, the largest RFC 1918 private block
• B172.16.0.0/12, an RFC 1918 private block
• C169.254.0.0/16, the IPv4 link-local blockcheck_circle Correct
• D192.168.0.0/16, an RFC 1918 private block

Why A is wrong: 10.0.0.0/8 is an RFC 1918 private range assigned by administrators or DHCP; tempting as private space, but hosts do not self-assign from it when DHCP fails.

Why B is wrong: 172.16.0.0/12 is an RFC 1918 private block used inside organisations; tempting because it is internal, but it is administrator-assigned, not the fallback range.

Why C is correct: APIPA uses 169.254.0.0/16, the IPv4 link-local block; a host self-assigns from it for same-segment connectivity only when no DHCP lease can be obtained.

Why D is wrong: 192.168.0.0/16 is the RFC 1918 range common in homes and small offices; tempting because DHCP often serves it, but a failed lease does not draw from it.

On a single access switch, PC-A sits in VLAN 10 (subnet 10.1.10.0/24) and PC-B sits in VLAN 20 (subnet 10.1.20.0/24). Both link lights are up and each PC reaches other hosts inside its own VLAN, but PC-A cannot ping PC-B. What is required to let the two PCs communicate while keeping the VLANs separate?

• AEnable an 802.1Q trunk between the two switchports so the VLAN tags carry the traffic across.
• BAdd a Layer 3 device such as a router or multilayer switch to route between the VLAN 10 and VLAN 20 subnets.check_circle Correct
• CEnable Spanning Tree Protocol for VLAN 10 and VLAN 20 to open a forwarding path between them.
• DConfigure port security on both switchports to permit each PC's MAC address.

Why A is wrong: Trunking sounds like it connects VLANs, but an 802.1Q trunk multiplexes several VLANs onto one switch-to-switch link; it does not route packets from one VLAN subnet into another.

Why B is correct: Each VLAN is a separate broadcast domain on its own IP subnet, so traffic between them must cross a Layer 3 boundary provided by a router subinterface or a multilayer switch SVI.

Why C is wrong: STP is tempting because it manages forwarding paths, but it only prevents Layer 2 loops within a broadcast domain and never routes traffic between two different VLAN subnets.

Why D is wrong: Port security is tempting when a host cannot pass traffic, but it only limits which MAC addresses a port accepts and does nothing to forward traffic between two separate VLAN subnets.

Switch-1 and Switch-2 are joined by a single 802.1Q trunk, and VLAN 40 already passes across it. A technician creates VLAN 60 on both switches and assigns access ports to it, but VLAN 60 hosts on Switch-1 cannot reach VLAN 60 hosts on Switch-2 while VLAN 40 keeps working. What is the most likely cause?

• AThe native VLAN is set to 60 on both ends of the trunk, which strips and discards the VLAN 60 tags.
• BPer-VLAN Spanning Tree has blocked the trunk for VLAN 60 only while leaving VLAN 40 forwarding.
• CVLAN 60 is not in the trunk's allowed VLAN list, so the trunk is not forwarding VLAN 60 frames.check_circle Correct
• DPort security on the trunk is dropping VLAN 60 frames because their source MACs are unknown.

Why A is wrong: This looks plausible because the native VLAN is carried untagged, but if both ends agreed on native VLAN 60 the untagged frames would still be delivered, so this would not break VLAN 60 connectivity.

Why B is wrong: Per-VLAN STP can block a port, but with only a single trunk there is no redundant path to create a loop, so STP has no reason to place VLAN 60 into a blocking state.

Why C is correct: A trunk restricted by an allowed VLAN list silently drops frames for any VLAN not on the list, so a newly created VLAN 60 will not cross the trunk while the already-permitted VLAN 40 continues to work.

Why D is wrong: Port security is tempting as a frame-dropping cause, but it is applied to access ports rather than trunk uplinks and it filters by MAC address, not by VLAN membership.

A trunk connects Switch-A and Switch-B. On Switch-A the trunk's native VLAN is 1, while on Switch-B the trunk's native VLAN is 99. Untagged traffic from the two switches is unexpectedly ending up in the same broadcast domain, and both switches log a native VLAN mismatch. What is the correct fix?

• ADisable the trunk and reconfigure both ports as access ports in VLAN 99.
• BAdd VLAN 99 to the trunk's allowed VLAN list on Switch-A so the tags are honoured.
• CEnable port security on the trunk to block the mismatched VLAN traffic.
• DSet the native VLAN to the same value on both ends of the trunk.check_circle Correct

Why A is wrong: Reverting to access ports removes the mismatch symptom, but it also stops the link carrying multiple VLANs, breaking every VLAN except 99 that needs to cross between the switches.

Why B is wrong: Adjusting the allowed VLAN list is tempting, but the fault is the disagreeing native VLAN assignment, not a filtered VLAN, so editing the allowed list does not resolve the untagged-traffic merge.

Why C is wrong: Port security seems to promise blocking the leak, but it filters by source MAC on access ports and cannot correct a native VLAN mismatch between two trunk endpoints.

Why D is correct: The native VLAN is sent untagged, so both trunk ends must agree on it; matching the native VLAN stops untagged frames from being placed into the wrong VLAN and clears the mismatch.

A network administrator must poll performance counters from routers across a shared provider link and requires that both the login credentials and the payload of every SNMP message be encrypted in transit. Which SNMP configuration meets this requirement?

• ASNMPv2c using a non-default, read-only community string.
• BSNMPv3 operating in authPriv mode with SHA authentication and AES privacy.check_circle Correct
• CSNMPv1 with a read-write community restricted by an access list.
• DSNMPv3 operating in authNoPriv mode with SHA authentication only.

Why A is wrong: A non-default community string is safer than the default 'public', but SNMPv2c carries the community string and the message payload in cleartext, so nothing is encrypted in transit.

Why B is correct: authPriv authenticates the user and applies a privacy protocol such as AES to the payload, so both the credentials and the data are protected in transit as required.

Why C is wrong: An access list limits which hosts may connect, yet SNMPv1 offers no encryption at all and sends the community string and data as cleartext, failing the requirement.

Why D is wrong: SNMPv3 can encrypt, but authNoPriv authenticates the user without applying privacy, so the payload travels unencrypted and only half the requirement is met.

A monitoring server can successfully poll interface counters from a switch, but the failure notifications the switch generates when a link goes down never arrive at the server. A stateful firewall sits between the two devices. Which port must be permitted inbound to the monitoring server so these notifications can arrive?

• AUDP port 161, the same port already used for successful polling.
• BTCP port 161, used for reliable SNMP polling sessions.
• CUDP port 162, the destination for SNMP trap and inform messages.check_circle Correct
• DTCP port 162, used for acknowledged SNMP notifications.

Why A is wrong: UDP 161 is where the agent listens for the manager's polling requests, which already work here; notifications are not sent to this port, so opening it does not fix the problem.

Why B is wrong: SNMP polling uses UDP 161, not TCP; there is no standard TCP 161 SNMP session, so this port would not carry the agent's notifications.

Why C is correct: SNMP agents send traps and informs to the manager on UDP 162, so the firewall must allow UDP 162 inbound to the monitoring server for the link-down notifications to arrive.

Why D is wrong: SNMP notifications, including acknowledged informs, are carried over UDP 162 rather than TCP 162, so permitting TCP 162 would not let the messages through.

Over an unreliable WAN link, a network team notices that some SNMP notifications sent by a remote router are silently lost, and the manager has no record of them. The team needs each notification to be confirmed as received. Which SNMP message type should the router be configured to send?

• AAn SNMP trap, which the agent retransmits until the manager replies.
• BAn SNMP GET request, which the manager confirms for each polled value.
• CAn SNMP GETBULK request, which batches and confirms multiple values.
• DAn SNMP inform, which the manager acknowledges and the sender resends if unacknowledged.check_circle Correct

Why A is wrong: Traps are tempting because they are the default SNMP notification, but they are unacknowledged and fire-and-forget, so a trap lost on the WAN is never retransmitted or confirmed.

Why B is wrong: GET is a manager-initiated polling request, not an agent-generated notification, so a router cannot use it to push confirmed alerts to the manager.

Why C is wrong: GETBULK is a manager-initiated bulk retrieval used during polling, not a notification the agent sends, so it does not provide confirmed delivery of router-generated alerts.

Why D is correct: An inform is acknowledged by the manager, so the sending router can retransmit when no acknowledgement returns, giving the confirmed delivery that a plain trap cannot over a lossy link.

A technician captures traffic on a switch mirror port and finds that user login credentials for an internal web application are travelling in readable cleartext over HTTP, so anyone with packet-capture access can read them. Which element of the CIA triad is most directly compromised by this finding?

• AIntegrity, because an attacker who reads the credentials could later modify the account, so the trustworthiness of the stored data is the main loss.
• BAvailability, because exposing the login could lead to the account being locked out and the legitimate user then denied access to the application.
• CConfidentiality, because the credentials can be read by an unauthorised party who captures the packets, defeating the aim of keeping data secret in transit.check_circle Correct
• DNon-repudiation, because cleartext credentials would make it impossible to prove who carried out a given action later on.

Why A is wrong: Integrity concerns unauthorised alteration of data; capturing readable credentials exposes them but does not change any stored value, so this is not the principle harmed here.

Why B is wrong: Availability is about authorised users reaching a service; the web application stays reachable and no disruption has occurred, so availability is not what the cleartext exposure breaks.

Why C is correct: Confidentiality is the assurance that data is disclosed to authorised parties alone; cleartext credentials on the wire can be read by anyone capturing packets, which is precisely this loss.

Why D is wrong: Non-repudiation is the inability to deny an action and is not one of the three CIA-triad pillars, so it cannot be the triad element compromised by packet exposure.

Staff at a clinic can no longer open any files on the shared drive because a ransomware infection has encrypted them in place, and the investigation confirms no copies were exfiltrated from the network. Considering the immediate operational impact, which CIA triad principle is most directly harmed?

• AConfidentiality, because the ransomware encrypted the files and could have disclosed their contents to the attacker during the infection.
• BIntegrity, because the files were changed into an encrypted form and no longer hold their original readable values on the drive.
• CAccounting, because the encryption disrupts the audit records that track which staff opened which files on the shared drive.
• DAvailability, because encrypting the files in place blocks every authorised user from reaching the data they need to do their work.check_circle Correct

Why A is wrong: Confidentiality would be harmed if the data had been disclosed to an unauthorised party, but the investigation confirms nothing left the network, so secrecy is not the loss here.

Why B is wrong: Integrity covers undetected falsification of data into a plausible false value; here the files are plainly unusable rather than silently altered, so integrity is not the primary principle affected.

Why C is wrong: Accounting is the usage-tracking element of AAA and is not part of the CIA triad, so it cannot be the triad principle harmed by the encryption of shared files.

Why D is correct: Availability is the assurance that authorised users can reach data when needed; encrypting the files in place denies all legitimate access, which is the direct operational harm.

Before flashing a downloaded switch firmware image, an engineer wants to confirm that the file was not altered or corrupted in transit. Which action most directly protects the integrity of the firmware?

• ACompute the image's SHA-256 hash and compare it with the vendor-published checksum before installing it.check_circle Correct
• BDownload the image again over an HTTPS link so that the whole transfer is encrypted end to end.
• CStore the image on a RAID-protected server that is backed up to tape every night.
• DRequire multi-factor authentication before the engineer may reach the vendor download portal.

Why A is correct: A cryptographic hash uniquely fingerprints the file; matching the computed SHA-256 value against the vendor checksum proves the contents were not altered or corrupted, which is exactly integrity.

Why B is wrong: HTTPS encrypts the transfer and protects confidentiality in transit, but it does not prove the resulting file matches the vendor original, so it does not verify integrity.

Why C is wrong: RAID and backups keep a copy available if hardware fails, which serves availability; they do nothing to confirm the downloaded contents were not modified.

Why D is wrong: MFA strengthens who can authenticate to the portal, but controlling access to the download is not the same as verifying that the file's contents remain unchanged.