Free N10-009 practice test: 20 questions
Twenty questions across the five N10-009 domains, weighted roughly as the real exam is. Troubleshooting carries the most weight, so it gets the most questions here too.
Networking concepts
Question 1. At which OSI layer does a device that forwards frames using MAC addresses operate?
- A. Layer 1
- B. Layer 2
- C. Layer 3
- D. Layer 4
Show answer
Answer: B
Switching on MAC addresses is a layer 2 function. Layer 3 forwards on IP addresses, and layer 1 concerns physical signalling.
Question 2. A host is configured with 10.20.5.130/26. What is its network address?
- A. 10.20.5.0
- B. 10.20.5.64
- C. 10.20.5.128
- D. 10.20.5.192
Show answer
Answer: C
A /26 has 64-address blocks: 10.20.5.128 to 10.20.5.191. The host 10.20.5.130 therefore sits in the 10.20.5.128 network.
Question 3. Which protocol and port pair is used by a client to obtain an IP address automatically?
- A. DHCP, UDP 67 and 68
- B. DNS, UDP 53
- C. NTP, UDP 123
- D. SNMP, UDP 161
Show answer
Answer: A
DHCP uses UDP ports 67 and 68. DNS uses 53, NTP uses 123, and SNMP uses 161.
Question 4. An organisation needs private address space for roughly 900 internal hosts in one subnet. Which allocation is the tightest fit?
- A. 172.16.0.0/23
- B. 172.16.0.0/22
- C. 172.16.0.0/21
- D. 172.16.0.0/24
Show answer
Answer: B
A /22 provides 1,022 usable addresses, which covers 900 with room to grow. A /23 gives only 510, and a /21 wastes over a thousand addresses.
Question 5. Which statement about IPv6 link-local addresses is correct?
- A. They begin with 2001:: and are globally routable
- B. They must be assigned manually by an administrator
- C. They are routed between subnets by default
- D. They begin with fe80::/10 and are not routed off the local link
Show answer
Answer: D
Link-local addresses begin with fe80::/10, are configured automatically and are not routed beyond the local link.
Network implementation
Question 6. Two switches must carry traffic for eight VLANs between them over one physical link. What should the link be configured as?
- A. An 802.1Q trunk port
- B. An access port in VLAN 1
- C. A routed port with an IP address
- D. A mirrored port
Show answer
Answer: A
A trunk port carries tagged traffic for multiple VLANs over one link. An access port belongs to a single VLAN.
Question 7. A wireless network in a dense office suffers interference between neighbouring access points on 2.4 GHz. Which channel plan is standard?
- A. Channels 1, 2 and 3
- B. All access points on channel 6
- C. Channels 1, 6 and 11
- D. Channels 1, 5 and 9
Show answer
Answer: C
Channels 1, 6 and 11 are the only non-overlapping 20 MHz channels in the 2.4 GHz band in most regions.
Question 8. A run of copper cable between two buildings 180 metres apart keeps failing. What is the most likely cause?
- A. Incorrect VLAN assignment
- B. The run exceeds the 100-metre limit for twisted-pair Ethernet
- C. Duplex mismatch on the switch
- D. An expired DHCP lease
Show answer
Answer: B
Twisted-pair Ethernet is limited to 100 metres per run; 180 metres exceeds it. Fibre is the usual answer for inter-building runs at that distance.
Question 9. Which device type terminates many access points and applies consistent wireless policy centrally?
- A. A media converter
- B. A wireless repeater
- C. A layer 2 switch
- D. A wireless LAN controller
Show answer
Answer: D
A wireless LAN controller centralises configuration, policy and roaming across access points. A repeater and a media converter serve different purposes.
Network operations
Question 10. A change to a core switch must be reversible if it causes an outage. What belongs in the change record?
- A. A tested back-out plan and the prior configuration
- B. The engineer’s mobile number only
- C. A list of affected users only
- D. The cost of the change
Show answer
Answer: A
A documented back-out plan defines how to restore the prior state. Approval and timing matter, but they do not restore service if the change fails.
Question 11. Which document records the agreed uptime and response times between a provider and a customer?
- A. A memorandum of understanding
- B. A non-disclosure agreement
- C. A service level agreement
- D. An acceptable use policy
Show answer
Answer: C
A service level agreement defines availability and response commitments. An MOU records intent, and an NDA covers confidentiality.
Question 12. Monitoring must alert when a WAN link exceeds 80% utilisation for five minutes. Which mechanism suits this?
- A. A one-off packet capture
- B. SNMP interface polling with a threshold and time condition
- C. Syslog severity filtering only
- D. A daily ping test
Show answer
Answer: B
SNMP polling of interface counters with a threshold and duration produces exactly this alert. Syslog reports events, not sustained utilisation, and a packet capture is a diagnostic tool.
Question 13. A company must restore network services at an alternate site within four hours of a disaster. Which term describes that four hours?
- A. Recovery time objective
- B. Recovery point objective
- C. Mean time between failures
- D. Maximum transmission unit
Show answer
Answer: A
Recovery time objective is the maximum acceptable time to restore service. Recovery point objective describes acceptable data loss instead.
Network security
Question 14. Guest wireless users must reach the internet but never internal servers. What is the standard approach?
- A. A stronger shared wireless password
- B. MAC address filtering on the access points
- C. A separate guest VLAN with an ACL permitting only internet traffic
- D. Reducing the wireless signal strength
Show answer
Answer: C
Placing guests in a separate VLAN or segment with an ACL permitting only internet-bound traffic enforces the separation. A shared password does not isolate traffic.
Question 15. An attacker plugs a rogue switch into an access port and sends superior BPDUs to become root bridge. Which feature prevents this?
- A. Port mirroring
- B. BPDU guard on access ports
- C. Jumbo frames
- D. Link aggregation
Show answer
Answer: B
BPDU guard disables an access port that receives BPDUs, blocking this attack. Port mirroring and DHCP snooping address different problems.
Question 16. A rogue DHCP server on the user VLAN hands out wrong gateways. Which control stops this?
- A. Spanning tree portfast
- B. Static ARP entries on every host
- C. A faster DHCP lease renewal
- D. DHCP snooping with trusted uplink ports
Show answer
Answer: D
DHCP snooping permits DHCP server responses only on trusted ports. 802.1X controls who may connect but would not by itself stop an authorised host running a DHCP server.
Network troubleshooting
Question 17. A user cannot reach an internal server by name but can reach it by IP address. What should you check first?
- A. DNS resolution and the client’s configured DNS servers
- B. The patch cable at the user’s desk
- C. The routing table on the core switch
- D. The server’s power supply
Show answer
Answer: A
Working by IP but not by name isolates the fault to name resolution. Cabling and routing are both proven functional by the successful IP connection.
Question 18. A link shows a high rate of late collisions and poor throughput, though it is up. What is the classic cause?
- A. An expired DHCP lease
- B. An incorrect default gateway
- C. A duplex mismatch between the two ends
- D. A blocked firewall port
Show answer
Answer: C
Late collisions on an otherwise functional link typically indicate a duplex mismatch between the two ends. A failed cable would usually show errors or no link at all.
Question 19. Traffic to one remote subnet fails while all others work. Which tool best localises where it stops?
- A. nslookup against the destination name
- B. traceroute or tracert to the destination
- C. ipconfig on the local host
- D. A speed test to the internet
Show answer
Answer: B
Traceroute shows the hop at which the path fails, localising the fault. A ping to the destination confirms failure but not where, and nslookup tests name resolution.
Question 20. Users report intermittent slowness that never appears during your tests. What is the most productive next step?
- A. Replace the switch and see if it improves
- B. Ask users to work at a different time
- C. Reboot the core router nightly
- D. Set up continuous monitoring and baselining to capture the event when it happens
Show answer
Answer: D
Continuous monitoring captures the condition when it actually occurs, which spot tests miss by definition. Replacing hardware without evidence is guesswork.
How did you do?
Sixteen or more correct is a solid position. Below fourteen, work through the domain guides in this section — N10-009 leans hard on troubleshooting method, and questions usually hand you the clue that rules three options out.