Free Network+ N10-009 Practice Test

The provided command output shows a Maximum Transmission Unit (MTU) mismatch between the two switches. Switch10 is configured with an MTU of 9000 bytes (for jumbo frames), while Switch11 is configured with a standard MTU of 1500 bytes. When Switch10 sends a frame larger than 1500 bytes, Switch11's interface correctly identifies it as a "giant" frame and discards it, incrementing the "Input errors" and "Giants" counters. This packet loss forces retransmissions at the transport layer, causing the observed latency, poor video performance, and slow file transfers. Modifying Switch10's MTU to 1500 will align the settings and resolve the issue.

A. The output shows both switches have successfully negotiated a 1000 Mbps, full-duplex link, indicating auto-negotiation is working correctly.
C. Spanning Tree Protocol (STP) is used to prevent Layer 2 loops. The error counters point to a frame size issue, not a network loop.
D. A native VLAN mismatch would typically cause control plane or specific VLAN connectivity issues, not "giant" frame errors on an interface.

1. Cisco Systems

Inc.

Catalyst 3560 Switch System Message Guide

Cisco IOS Release 12.2(25)SE. "Giants" are described as frames received that are larger than the maximum transmittable size (e.g.

1518 bytes for Ethernet). The document explains that this is often caused by a misconfigured device on the network. (Reference to specific error message interpretation in official vendor documentation).

2. Kurose

J. F.

& Ross

K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. In Chapter 5

"The Link Layer

" the concept of the Maximum Transmission Unit (MTU) is detailed. The text explains that all devices on a link must agree on the MTU

and a mismatch can lead to packet loss and performance degradation when larger frames are dropped by a device with a smaller MTU setting. (Peer-reviewed

widely used academic textbook).

3. University of California

Berkeley

EECS Department. CS 168: Introduction to the Internet: Architecture and Protocols

Lecture 10: Datalink II. The course materials discuss Ethernet framing and MTU. It is explained that the standard Ethernet MTU is 1500 bytes

and "jumbo frames" (e.g.

9000 bytes) are a non-standard extension that requires consistent configuration on all devices in the path to function correctly. A mismatch will result in dropped packets. (University courseware from a reputable institution).

The absence of indicator lights (link/activity lights) on both the network interface card (NIC) and the switch port signifies a problem at the Physical Layer (Layer 1) of the OSI model. This means no electrical signal is being successfully negotiated between the two devices. While a faulty cable or hardware could be the cause, an administratively shut down port is a very common and likely reason. When a network administrator disables a port on a managed switch (e.g., using a shutdown command), the port stops transmitting or receiving data, and the physical link is severed, causing the indicator lights to go out.

A. The switch failed: A complete switch failure would impact all connected devices, not just a single user as described in the scenario.
B. The default gateway is wrong: This is a Network Layer (Layer 3) configuration issue. It would prevent communication with other networks but would not affect the Physical Layer link, so the lights would be on.
D. The VLAN assignment is incorrect: This is a Data Link Layer (Layer 2) configuration error. An incorrect VLAN would isolate the user from the correct network segment, but the physical link would still be active, and the lights would be on. ---

1. Cisco Systems

Inc. (2023). Troubleshooting Switch Port and Interface Problems. In the section "Troubleshooting Port and Interface Problems

" Step 3 advises to "Check the Port Status on the Switch." It explicitly states: "If the port is in the administratively down state

the link does not come up... Use the no shutdown interface configuration mode command to enable the interface." This directly supports that a shutdown port results in a down link state with no active lights.

Source Document: Cisco Technical Support & Documentation

Document ID: 116136.

2. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 1

Section 1.5

"Protocol Layers and Their Service Models

" the physical layer is defined as being "responsible for transporting the individual bits... from one node to the next." An administratively disabled port prevents this fundamental function

thus no link can be established.

3. Ousterhout

J. (2019). Lecture 3: Physical and Link Layers. CS 144: Introduction to Computer Networking

Stanford University. The lecture notes emphasize that the physical layer's job is to transmit bits. The absence of link lights is a primary indicator of a physical layer failure

which includes the port being powered off or administratively disabled.

A toner, which consists of a tone generator and an inductive probe, is the most efficient tool for this task. The tone generator is connected to the network jack in the office, sending an electrical signal through the U-T-P cable. The technician then uses the probe at the patch panel. By sweeping the probe across the ports, it will emit an audible tone when it detects the signal from the generator, thus quickly and easily identifying the correct port without needing to physically plug into each one. This process is known as "toning out" a cable and is the standard industry practice for tracing unlabeled wires.

B. Laptop: Using a laptop is inefficient. It would require connecting a patch cord from the switch to each panel port sequentially until the laptop shows a network link.
C. Cable tester: A basic cable tester requires plugging its remote unit into the wall jack and the main unit into each patch panel port one by one, which is slower than a toner.
D. Visual fault locator: This tool is used exclusively for locating breaks and identifying ends of fiber optic cables by transmitting a visible red light; it is incompatible with copper UTP cabling.

1. West

J.

Andrews

J.

& Dean

T. (2022). Network+ Guide to Networks (9th ed.). Cengage Learning.

In Chapter 2

"Networking Tools

" the text describes the function of a tone generator and probe: "To trace a wire

you connect the tone generator to the wire at one end... Then you use the probe at the other end... to find the same wire by listening for the tone. This process is called toning a wire." This directly supports its use for identifying a specific cable in a bundle or at a patch panel.

2. University of Washington

IT Connect. (2021). Cabling & Wiring: Tools.

In the section describing standard tools for network technicians

the documentation explains that a "Tone and Probe Kit" is used to "identify a specific wire pair or conductor within a bundle

at a cross-connect point

or at a remote end." This aligns perfectly with the scenario of identifying an unlabeled port on a patch panel. (Reference: UW IT Connect

Tools section for network cabling).

3. Michigan State University

Infrastructure Planning and Facilities. (2019). Telecommunication Systems Cabling Guidelines

Section 01700.

Section 1.05

"Quality Assurance

" subsection A.3

specifies required test equipment for cable installers

which includes a "wire mapping tester with tone generation." This indicates that tone generation is a standard

required method for identifying and verifying cable runs in a professional installation environment.

The cable test for PC2 indicates an open circuit on pin 3. This means there is a break in the physical continuity of that specific wire within the cable or a bad connection at the connector. An open circuit prevents the electrical signals from traversing the full length of the wire, leading to a complete loss of connectivity. Replacing the faulty patch cable with a known good one is the most direct solution.

 The test result for PC4 shows it is assigned to VLAN 11, while all other devices intended for communication on that subnet are on VLAN 10. Virtual LANs (VLANs) segment a physical network into separate logical broadcast domains. Devices in different VLANs cannot communicate directly at Layer 2. To resolve this logical connectivity issue, the switch port connected to PC4 must be reconfigured from VLAN 11 to VLAN 10.

The cable test for PC5 reveals a miswired cable with an incorrect pin-out. The diagram shows that the wire pairs are not mapped correctly according to the T568A or T568B wiring standards (e.g., it appears to have split pairs). This physical layer fault disrupts the differential signaling used by Ethernet, leading to excessive crosstalk and preventing a stable network link, especially at Gigabit speeds. The cable must be re-terminated correctly or, more simply, replaced.

For VLANs: Cisco Systems, Inc. (2022). Catalyst 9300 Series Switches, Cisco IOS XE Amsterdam 17.3.x (Catalyst 9300 Switches) - VLANs. "VLANs provide a mechanism to partition a physical network into smaller, logical broadcast domains. [...] Traffic between different VLANs must be routed through a Layer 3 device." This supports the diagnosis that PC4's placement in VLAN 11 isolates it from devices in VLAN 10.

For Cable Faults (Open/Short, Pin-out): Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 5, the text discusses the physical layer and the importance of correct wiring for twisted-pair copper cables to mitigate electrical interference and ensure signal integrity. A miswired cable (incorrect pin-out) or a broken wire (open circuit) directly violates these physical layer requirements, leading to connection failure.

For Wiring Standards: Telecommunications Industry Association. (2018). ANSI/TIA-568.2-D: Balanced Twisted-Pair Telecommunications Cabling and Components Standard. This standard specifies the pin-pair assignments for T568A and T568B wiring schemes. The diagrams for PC5 clearly show a deviation from these standards, confirming an "Incorrect pin-out." The standard also defines continuity testing, where a failure (like the open on PC2) indicates a non-compliant cable.

A Firewall is required at the network edge to inspect all incoming Internet traffic, satisfying the security requirement. A Router is then used to handle traffic between the internal network and the firewall.

Inside Building A, a Switch is the appropriate device to connect desktops. Unlike a hub, a switch intelligently forwards traffic only to the specific destination port, preventing other devices on the network from seeing that traffic.

To connect Building B wirelessly, a Wireless Access Point (WAP) is placed in Building A. A Wireless range extender in Building B receives this signal and provides access to local wireless devices. For the extender to connect to the WAP, the SSID, security mode, and security key must match. The simulation shows a mismatched Key or Passphrase, which must be corrected.

Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Firewalls: Section 8.6, "Network Security," describes firewalls as devices that filter packet traffic at the network perimeter (p. 718).

Switches: Section 6.3, "Link-Layer Switches," explains that switches forward frames selectively to output ports based on MAC addresses, thus isolating traffic between ports (p. 518).

WAP Association: Section 7.3.3, "Associating with an AP," details that a wireless host must configure its network parameters, including the SSID and passphrase, to match the AP's configuration to associate with it (p. 605).

IEEE Std 802.11™-2020. (2020). IEEE Standard for Information Technology—Telecommunications and information exchange between systems Local and metropolitan area networks—Specific requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications.

Authentication: Section 12.3, "Authentication and association," specifies the procedures for a station to connect to an access point, which involves authenticating with shared credentials such as a Pre-Shared Key (PSK) for WPA2.

Lowe, D. (2018). Networking All-in-One For Dummies (7th ed.). John Wiley & Sons.

Range Extenders: Chapter 7, "Extending Your Network," explains that a wireless extender (or repeater) connects to an existing access point and rebroadcasts its signal, and for it to work, "the SSID, channel, and security settings on the repeater must be configured to match the settings on the main access point" (p. 581).

Band steering is a technology used by dual-band (2.4 GHz and 5 GHz) access points to encourage or force client devices to connect to the less-congested and higher-performance 5 GHz frequency band. The access point identifies dual-band capable clients and actively "steers" them away from the 2.4 GHz band. This automatic process optimizes the wireless experience by balancing the client load and utilizing the best available frequency, which directly addresses the technician's requirement.

B. Wireless LAN controller: A WLC is a centralized management device for access points; it is not the specific technology that navigates clients between frequencies, although it may be used to configure it.
C. Directional antenna: This hardware component focuses a wireless signal in a specific direction to increase range and strength, but it does not influence the frequency band a client uses.
D. Autonomous access point: This describes an access point's management architecture (standalone vs. controller-based) and is not a feature for automatic frequency selection.

1. Cisco Systems, Inc. (2019). Radio Resource Management: AI Enhanced RRM Configuration Guide, Cisco IOS XE Gibraltar 16.12.x. "Band Select" section. This document explains Cisco's implementation of band steering, stating, "The Band Select feature works by regulating probe responses to clients. It delays probe responses to clients on the 2.4-GHz band." This demonstrates the mechanism for steering clients to the 5 GHz band.

2. Aruba Networks (a Hewlett Packard Enterprise company). (2021). ArubaOS 8.9.0.x User Guide. "ClientMatch" chapter, "Steering Modes" section. The guide describes how ClientMatch, an enhanced form of band steering, "monitors the RF neighborhood for each client to proactively steer the client to a better radio." This confirms its role in navigating devices to the best frequency.

3. University of California, Berkeley, Information Services and Technology. (2022). Wireless Network Design Standards. Section 4.2 "Access Point Features". The standard specifies that access points must support "Band Steering to encourage 5GHz capable clients to use that band." This illustrates its implementation as a standard technology in enterprise environments for frequency optimization.

A CNAME (Canonical Name) record is a type of DNS record that maps an alias name to a true or canonical domain name. In this scenario, the network resource has moved to a SaaS provider, which will provide a new hostname (e.g., company.saasprovider.com). The administrator can create a CNAME record to point the old, familiar internal hostname (e.g., resource.company.com) to the new SaaS hostname. This acts as a redirection, ensuring that when users try to access the old name, the DNS resolver provides the address of the new SaaS location. This is the standard method for handling such migrations.

A. TXT: This record is used to hold arbitrary, human-readable text and is often used for email security protocols like SPF or domain verification, not for redirecting traffic.
B. AAA: This is not a standard DNS record type. If it is a typo for AAAA, that record maps a hostname to an IPv6 address, not to another hostname as required for a SaaS redirection.
C. PTR: A Pointer record is used for reverse DNS lookups, mapping an IP address back to a hostname. This is the opposite of the required function.

1. Mockapetris

P. (1987). RFC 1035: Domain Names - Implementation and Specification. Internet Engineering Task Force (IETF).

Section 3.3.1

CNAME RDATA format: "CNAME RRs specify the canonical or primary name for a domain name. The owner of a CNAME RR is an alias... If a CNAME RR is present at a node

no other data should be present; this ensures that the data for a canonical name and its aliases cannot be different." This defines the CNAME record's function as an alias for another name.

2. Elz

R.

& Bush

R. (1997). RFC 2181: Clarifications to the DNS Specification. Internet Engineering Task Force (IETF).

Section 10

CNAME resource records: This document clarifies the behavior of CNAME records

reinforcing that an alias name (defined by a CNAME record) effectively substitutes for the canonical name for all other DNS lookups.

3. University of Illinois at Urbana-Champaign. (n.d.). CS 438: Communication Networks - DNS Slides. Department of Computer Science.

In typical networking courseware covering DNS

the CNAME record is explained as an alias mechanism. For example

lecture notes often state: "CNAME: foo.com is an alias for realserver.com." This directly aligns with the use case of pointing a local name to an external SaaS provider's name.

4. Cisco. (2023). DNS Best Practices

Network Protections

and Attack Identification. Cisco Systems

Inc.

In documentation discussing DNS security and configuration

Cisco explains the function of various record types. Such guides describe CNAME records as a method to "point a hostname to another hostname

" which is precisely the requirement for redirecting to a SaaS solution.

The Network Time Protocol (NTP) is specifically designed to synchronize the clocks of computer systems over a packet-switched, variable-latency data network. For security incident investigations, having precisely synchronized time across all devices, such as servers and firewalls, is critical. It allows security analysts to accurately correlate log entries from different sources to create a coherent timeline of events. Without synchronized time, determining the correct sequence of actions during an attack becomes extremely difficult, if not impossible.

A. Syslog server: A Syslog server is used for centralized log collection and storage. It does not synchronize the time on the devices that generate the logs.
B. SMTP: The Simple Mail Transfer Protocol (SMTP) is a standard for transmitting electronic mail (email) and is unrelated to network time synchronization.
C. SNMP: The Simple Network Management Protocol (SNMP) is used for managing and monitoring network devices. It is not the standard protocol for high-accuracy time synchronization.

1. National Institute of Standards and Technology (NIST). (2006). Special Publication 800-92

Guide to Computer Security Log Management.

Section 2.4

Log Generation

Page 2-4: "Organizations should also synchronize the clocks of all log sources on the network. Using a common time source

such as one provided by the Network Time Protocol (NTP) or an authenticated time source

makes it much easier to correlate and analyze log data from multiple sources."

2. Mills

D.

Martin

J.

et al. (2010). RFC 5905 - Network Time Protocol Version 4: Protocol and Algorithms Specification. Internet Engineering Task Force (IETF).

Section 1

Introduction

Page 3: "This document describes the Network Time Protocol (NTP)

which is widely used to synchronize computer clocks in the global Internet... It provides the mechanisms to select synchronization sources

mitigate the effects of network path asymmetry

and discipline the computer clock."

3. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Chapter 2

Application Layer

Section 2.6

Page 151: This section describes SMTP as the principal application-layer protocol for Internet electronic mail.

Chapter 9

Network Management

Section 9.2

Page 802: This section details SNMP as the primary protocol for conveying network-management control and information messages between a managing server and an agent executing on behalf of that managing server. This function is distinct from time synchronization.

Following a security breach, implementing foundational security principles is paramount. The principle of least privilege ensures that users, applications, and systems are granted only the specific access rights and permissions necessary to perform their required tasks. This drastically limits the potential damage an attacker can inflict if they compromise an account. Central policy management allows an organization to define, distribute, and enforce security policies consistently across the entire network from a single point of control. This is critical for rapidly deploying new, stronger security rules and ensuring there are no gaps in coverage, which is a common issue discovered after a breach.

B. Dynamic inventories: This provides visibility into network assets, which supports security, but it is a monitoring/management tool, not a direct security control implementation like access control.
D. Zero-touch provisioning: This is an automation method for deploying network devices to reduce manual configuration. Its primary goal is operational efficiency, not enhancing security posture.
E. Configuration drift prevention: While important, this is a more specific security practice that is often a feature or outcome of a robust central policy management system, making the latter a broader and more foundational choice.
F. Subnet range limits: This is a specific network configuration technique (e.g., DHCP scopes, ACLs) rather than a comprehensive security strategy like least privilege or central policy management.

1. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5

"Security and Privacy Controls for Information Systems and Organizations."

Page 101

Control AC-6 "Least Privilege": This control explicitly states

"The organization employs the principle of least privilege

allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks..." This directly supports implementing least privilege to enhance security.

2. National Institute of Standards and Technology (NIST) Special Publication 800-46

Revision 2

"Guide to Enterprise Telework

Remote Access

and Bring Your Own Device (BYOD) Security."

Page 3-1

Section 3.1 "Security Policy": The document emphasizes the need for a centralized policy

stating

"The organization should have a single telework security policy that is applicable to all of its telework programs... Centralizing policy management helps to ensure that the policy is consistent..." This highlights the importance of central policy management for consistent security.

3. Saltzer

J. H.

& Schroeder

M. D. (1975). "The Protection of Information in Computer Systems." Communications of the ACM

18(7)

38-49. (A foundational academic paper on computer security).

Section I.A.3

"Principle of Least Privilege": This seminal paper defines the principle: "Every program and every user of the system should operate using the least set of privileges necessary to complete the job." This establishes least privilege as a core

time-tested security design principle.

The scenario describes the presence of an unauthorized wireless access point broadcasting the SSID myaccess within the company's physical location. A rogue access point (AP) is any wireless AP installed on a network without the network administrator's explicit authorization. The appearance of this unknown SSID indicates a potential rogue device. This device could be connected to the corporate network, creating an unsecured backdoor, or it could be a standalone device intended to lure users. In either case, it represents an unauthorized, or rogue, access point.

A. On-path: This attack involves intercepting traffic between two parties. While a rogue AP can be used to facilitate an on-path attack, the attack described is the presence of the unauthorized AP itself.
C. Evil twin: An evil twin is a specific type of rogue AP that impersonates a legitimate network by broadcasting the exact same SSID (in this case, business) to trick users into connecting to it.
D. Tailgating: This is a physical security breach where an unauthorized person follows an authorized individual into a secure location; it is not a wireless network attack. ---

1. National Institute of Standards and Technology (NIST) Special Publication 800-153

Guidelines for Securing Wireless Local Area Networks (WLANs).

Section 3.3.1

Rogue Access Points: "A rogue AP is an AP that is connected to an organization’s network without the organization’s knowledge or permission... Rogue APs pose a major threat to organizations because they are not managed by the organization’s network administrators and usually do not have the same security configurations as legitimate APs." This directly defines the situation described.

Section 3.3.2

Evil Twin Access Points: "An evil twin AP is a rogue AP that is configured to be a copy of a legitimate AP... An evil twin AP has the same Service Set Identifier (SSID) as a legitimate AP." This reference clarifies why option C is incorrect

as the SSIDs in the scenario are different.

2. Purdue University

Information Technology Department

Rogue Wireless Access Points.

"What is a Rogue Wireless Access Point?" section: "A rogue wireless access point is a wireless access point that has been installed on a secure network without the explicit authorization of the network administrator. It can be set up by a well-meaning employee or by a malicious attacker." This university documentation supports the definition of a rogue AP as any unauthorized AP on the premises.

3. Kim

D.

& Solomon

M. G. (2021). Mike Meyers’ CompTIA Network+ Certification Passport

Seventh Edition (Exam N10-008). McGraw-Hill. (Note: While a commercial book

its content is based on official exam objectives and provides academically sound definitions aligned with the N10-009 domain).

Chapter 12

"Network Security": The text distinguishes between a rogue AP as any unauthorized WAP and an evil twin as a specific type of rogue AP that "looks for all the world like a legitimate WAP" by using the same SSID and security settings. This aligns with the distinction made in the explanation.