N10-009 Free Practice Questions — Page 20 (2026)

Question 191

A network administrator wants to update a geofencing policy to limit access to the corporate network based on location. Which of the following will the administrator most likely leverage?

A. MAC filtering

B. Administrative distance

C. Bluetooth beacon signals

D. IP address blocks

Show Answer

Correct Answer: D

Explanation:
Geofencing for network access is most commonly enforced by using IP geolocation, allowing or denying connections from specific geographic regions via IP address ranges or blocks. MAC filtering is unrelated to geographic location, administrative distance concerns routing protocol preference, and Bluetooth beacons are used for proximity-based location services rather than typical remote corporate network geofencing.

Question 192

A security administrator is looking for rogue servers on the network and would also like to determine which services are running on those servers. Which of the following software tools should the administrator use?

A. tracert

B. nmap

C. netstat

D. ping

Show Answer

Correct Answer: B

Explanation:
Nmap is designed for network discovery and port/service scanning. It can identify hosts on a network and determine which services are running on open ports, making it appropriate for finding rogue servers and enumerating their services. Tracert traces network paths, netstat displays local network connections and statistics, and ping only tests host reachability.

Question 193

A network administrator is configuring a subnet that needs to support 13 usable IP addresses. Which of the following subnet masks best meets this requirement?

A. 255.255.255.128

B. 255.255.256.192

C. 255.285.256.224

D. 255.255.255.240

Show Answer

Correct Answer: D

Explanation:
A /28 subnet mask (255.255.255.240) provides 16 total addresses, with 14 usable host addresses after excluding the network and broadcast addresses, satisfying the requirement for 13 usable IPs. Option A (/25) is much larger than needed, while B and C contain invalid octet values and are not valid subnet masks.

Question 194

Which of the following routing technologies uses an attribute list for path selection?

A. BGP

B. RIP

C. EIGRP

D. OSPF

Show Answer

Correct Answer: A

Explanation:
BGP selects the best path using a sequence of path attributes such as AS_PATH, LOCAL_PREF, MED, ORIGIN, and others. RIP uses hop count, OSPF uses cost, and EIGRP uses a composite metric rather than an attribute list.

Question 195

A network engineer adds a tunnel for a new branch network. Which of the following ensures that all data is encrypted inside the tunnel?

A. ESP

B. SSH

C. GRE

D. IKE

Show Answer

Correct Answer: A

Explanation:
ESP (Encapsulating Security Payload) is the IPsec component that provides encryption (confidentiality) for payload data, along with optional integrity and authentication. GRE only encapsulates traffic without encryption, SSH secures remote shell sessions rather than network tunnels, and IKE negotiates keys and security associations but does not itself encrypt tunneled data.

Question 196

A network administrator needs to deploy a new wireless solution at a customer site. All external users must provide credentials before being granted access to the wireless solution. Which of the following would best meet the requirements of this installation?

A. Adjust the bands to be non-overlapping.

B. Set up lightweight access points.

C. Enable enterprise authentication.

D. Add a captive portal for the guest network.

Show Answer

Correct Answer: D

Explanation:
A captive portal on a guest wireless network is the standard solution for external users who must provide credentials before being granted network access. Enterprise authentication (802.1X) is typically intended for managed organizational users with supplicant configuration and directory/RADIUS integration, whereas guest/external access is best handled through a captive portal.

Question 197

A network engineer runs ipconfig and notices that the default gateway is 0.0.0.0. Which of the following address types is in use?

A. APIPA

B. Multicast

C. Class C

D. Experimental

Show Answer

Correct Answer: A

Explanation:
A default gateway of 0.0.0.0 commonly indicates the host did not obtain normal network configuration from DHCP. Windows will self-assign an APIPA address (169.254.0.0/16) when DHCP fails, and APIPA does not include a default gateway, so ipconfig shows 0.0.0.0.

Question 198

A technician is alarmed after noticing more than 5,000 CRCs on a switchport. Which of the following should the technician do next?

A. Move to a different switchport.

B. Check for errdisable,

C. Swap out the patch cable.

D. Enable class-of-service.

Show Answer

Correct Answer: C

Explanation:
A high number of CRC (Cyclic Redundancy Check) errors on a switchport typically indicates corrupted Ethernet frames, most commonly caused by a bad cable, damaged connector, duplex mismatch, or physical-layer interference. The first and simplest troubleshooting step is to replace the patch cable with a known-good cable. The other options do not directly address the most likely cause of CRC errors.

Question 199

A network administrator received reports that a 40Gb connection is saturated. The only server the administrator can use for data collection in that location has a 10Gb connection to the network. Which of the following is the best method to use on the server to determine the source of the saturation?

A. Port mirroring

B. Log aggregation

C. Flow data

D. Packet capture

Show Answer

Correct Answer: C

Explanation:
Flow data (such as NetFlow, sFlow, or IPFIX) provides summarized traffic metadata that identifies top talkers, conversations, and bandwidth usage with far less overhead than full packet capture. Because the available server only has a 10Gb connection, it cannot reliably receive or capture all traffic from a saturated 40Gb link via port mirroring. Log aggregation does not directly identify link utilization sources, and full packet capture is impractical in this scenario due to the bandwidth mismatch.

Question 200

A network technician is designing a LAN for a new facility. The company is expecting more than 300 devices to connect to the network. Which of the following masks will provide the most efficient subnet?

A. 255.255.0.0

B. 255.255.192.0

C. 255.255.254.0

D. 255.255.255.254

Show Answer

Correct Answer: C

Explanation:
A subnet supporting more than 300 hosts requires at least 302 addresses (including network and broadcast). A /23 mask (255.255.254.0) provides 512 total addresses, 510 usable hosts, making it the smallest subnet that accommodates over 300 devices. A /24 is too small, /18 and /16 are much larger than necessary, and /31 supports only point-to-point links.