Free Practice Questions for CompTIA N10-009 Exam

The correct answer is A. TACACS+ . This protocol is commonly used for authentication, authorization, and accounting (AAA) when administrators need to access network infrastructure devices such as routers, switches, and firewalls. The key part of the question is not just authentication, but also logging capabilities . TACACS+ supports accounting functions, which means it can record administrative actions and login events. That makes it especially useful when organizations want traceability for device access and configuration changes.

The other options do not fit as well. SAML is primarily used for federated identity and web-based authentication between identity providers and service providers. SSO is a general authentication convenience feature that allows one login to access multiple systems, but it does not itself provide detailed device-level accounting. MFA strengthens authentication by requiring multiple factors, but it is not the protocol best known for centralized access control and activity logging on network devices.

For Network+ exam purposes, TACACS+ is strongly associated with administrative access to network equipment and with maintaining an audit trail of who accessed devices and what actions were performed. Because the question asks for both simple authentication and logging, TACACS+ is the best match.

If a SQL server is allowing FTP access to all users, the most direct and best practice action is to disable unused services/ports on the server itself. Network+ (N10-009) security objectives emphasize host hardening and the principle of least functionality: only required services should be running and listening. If FTP is not required for the SQL server’s role, stopping and disabling the FTP service (and closing the associated ports on the host firewall) reduces the attack surface regardless of network firewall rules. This approach ensures the server cannot be reached via FTP even if it is placed on a different network segment or if upstream controls are misconfigured later.

Changing default passwords is important, but it does not address the unnecessary exposure of an unneeded service. Deleting NGFW rules that allow all FTP traffic could help at the perimeter, but it may unintentionally break legitimate FTP usage elsewhere and still doesn’t guarantee the server isn’t reachable from internal networks. Switch ACLs along SQL traffic paths are indirect and easy to misapply; they also add operational complexity and may not cover all access paths. The best “only required services are allowed” control is to disable the unused service/ports on the server.

===========

When two devices on different subnets are unable to communicate, but can communicate with other devices on their own subnet, the issue is most often related to routing. Devices on different subnets require a default gateway to route traffic between networks.

If the default gateway is incorrectly configured, the device won’t know how to reach other subnets.

Faulty cables (Option B) or duplex mismatches (Option C) would likely cause connectivity issues even within the local subnet, which is not the case here.

VLAN mismatches (Option D) are typically issues with switch port configurations and would likely cause total loss of connectivity, including within the same subnet.

✅ So, the most probable and logical cause is an incorrect default gateway.

The correct answer is Modify the CNAME record because a CNAME (Canonical Name) record maps one domain name (alias) to another domain name. If a user enters www.abc.com but is redirected to www.cba.com, it is likely that the DNS configuration includes an incorrect CNAME entry pointing abc.com to cba.com. Updating or correcting the CNAME record ensures the alias resolves to the intended host.

According to CompTIA Network+ (N10-009) objectives covering DNS record types, a CNAME record is used to alias one domain name to another, commonly for load balancing, CDN services, or website redirection.

A PTR record (Option B) is used for reverse DNS lookups (IP address to hostname) and does not control forward name resolution for websites. NTP settings (Option C) are used for time synchronization and have no impact on DNS resolution. A TXT record (Option D) stores descriptive text information (such as SPF, DKIM, or domain verification data) and does not affect website redirection.

Therefore, correcting the CNAME record resolves the issue and ensures users reach the correct website.

Inconsistent arrival of RTP (Real-Time Protocol) packets indicates jitter or latency variation. A protocol analyzer (packet sniffer, e.g., Wireshark) can capture and analyze RTP streams, showing delay, jitter, and packet loss statistics.

A. Toner and probe locates cable runs, not packet analysis.

C. Cable tester checks wiring faults, not packet timing.

D. Spectrum reader is for identifying wireless interference, not analyzing RTP traffic.

References (CompTIA Network+ N10-009):

Domain: Network Troubleshooting — Protocol analyzers, VoIP troubleshooting, jitter analysis.

Comprehensive and Detailed Explanation (aligned to N10-009):

Multitenancy is a cloud concept where multiple customers share the same physical resources (servers, storage, and networks) but remain logically separated for security and privacy.

A. Elasticity is auto-scaling resources.

B. Hybrid cloud combines private and public resources.

C. Scalability is the ability to grow resources but doesn’t imply multiple customers.

References (CompTIA Network+ N10-009):

Domain: Networking Concepts — Cloud computing models, multitenancy in public cloud.

Network Functions Virtualization (NFV): NFV is a technology that virtualizes network services like routing, firewalls, and load balancers. It allows these services to run on virtual machines rather than requiring dedicated hardware. This is ideal for remote branch locations where deploying physical devices is costly and complex.

VRF (B): Virtual Routing and Forwarding is used for segmenting routing tables but does not virtualize services.

VLAN (C): Virtual Local Area Networks help segregate broadcast domains but are unrelated to virtualizing network functions.

VPC (D): Virtual Private Cloud is used for cloud computing but does not pertain to virtualizing network services.

Understanding 2.4GHz Interference:

The 2.4GHz frequency range is commonly used by many devices, including Wi-Fi, Bluetooth, and various industrial equipment. This can lead to interference and degraded performance.

Mitigation Strategies:

5GHz Frequency:

The 5GHz frequency band offers more channels and less interference compared to the 2.4GHz band. Devices operating on 5GHz are less likely to encounter interference from other devices, including industrial equipment.

Non-overlapping Channels:

In the 2.4GHz band, using non-overlapping channels (such as channels 1, 6, and 11) can help reduce interference. Non-overlapping channels do not interfere with each other, providing clearer communication paths for Wi-Fi signals.

Why Other Options are Less Effective:

Mesh Network: While useful for extending network coverage, a mesh network does not inherently address interference issues.

Omnidirectional Antenna: This type of antenna broadcasts signals in all directions but does not mitigate interference.

Captive Portal: A web page that users must view and interact with before accessing a network, unrelated to frequency interference.

Ad Hoc Network: A decentralized wireless network that does not address interference issues directly.

Implementation:

Switch Wi-Fi devices to the 5GHz band if supported by the network infrastructure and client devices.

Configure Wi-Fi access points to use non-overlapping channels within the 2.4GHz band to minimize interference.

The netstat command provides information about network connections, routing tables, interface statistics, masquerade connections, and multicast memberships. Running netstat on the server can help the administrator verify that the web server process is listening on the expected port (e.g., port 80 for HTTP or port 443 for HTTPS) and that there are no issues with network connections. This is a crucial first step in diagnosing why the web server is not accessible via a browser.References: CompTIA Network+ study materials. ​

The correct answer is D. Administratively down . The question states that another technician had already turned off unused switchports as part of hardening. When a port is intentionally disabled by configuration, its status is described as administratively down . In other words, the switchport is not broken and has not failed on its own; it has simply been shut down by an administrator.

This is a common security practice. Unused ports are often disabled so unauthorized devices cannot be plugged in and gain access to the network. If a legitimate device later needs that port, the administrator must re-enable it before the link can come up.

The other answer choices do not line up as well with the scenario. Error disabled usually points to a protective shutdown caused by a violation or fault, such as port security or BPDU guard. Idle is not the standard description for a manually shut switchport in this context. Suspended can appear with certain switch features, but it is not the normal label for a port deliberately turned off as part of hardening.

The phrase “turned off unused switchports” is the key detail. That clearly indicates a manual administrative shutdown, so administratively down is the best answer.

Single Sign-On (SSO) enables a user to access multiple resources or applications with one set of credentials, improving usability and security. The document confirms:

“Single Sign-On (SSO) allows a user to authenticate once and gain access to multiple resources or applications without needing to log in again for each. It streamlines the login process and improves security by reducing the number of passwords that need to be managed.”

Security Assertion Markup Language (SAML) is an XML-based standard used for exchanging authentication and authorization data between parties, particularly between an identity provider (IdP) and a service provider (SP). SAML is commonly used in Single Sign-On (SSO) solutions to pass sensitive user information, such as login credentials and attributes, securely between the identity provider and the service provider.

SAML (Security Assertion Markup Language): Facilitates web-based authentication and authorization, allowing users to access multiple services with a single set of credentials.

XML-based: Uses XML to encode the authentication and authorization data, ensuring secure transmission of user information.

Identity Federation: Enables secure sharing of identity information across different security domains, making it ideal for enterprise SSO solutions.

Network References:

CompTIA Network+ N10-007 Official Certification Guide: Covers authentication protocols, including SAML.

Cisco Networking Academy: Provides training on identity management and federation technologies.

Network+ Certification All-in-One Exam Guide: Explains SAML and its role in secure identity management and SSO.

A Content Delivery Network (CDN) stores cached versions of content in edge locations to deliver data faster and more reliably to users based on geographical proximity.

From Andrew Ramdayal’s guide:

“CDNs distribute content to multiple, geographically dispersed servers. This enhances performance and reliability for end-users by reducing latency and load times.”

WPA3-Enterprise provides strong security and supports authentication using domain identities through a RADIUS server and 802.1X authentication. This is the best choice for a corporate environment requiring user-based authentication.

WPA3-Enterprise Benefits:

Uses 802.1X with EAP (Extensible Authentication Protocol) to authenticate users via a directory service (e.g., Active Directory).

Eliminates shared passwords (PSK) for authentication.

Provides strong encryption and resistance to brute-force attacks.

Incorrect Options:

A. Enable MAC Security:

MAC filtering is not secure because MAC addresses can be spoofed.

B. Generate a PSK for Each User:

Pre-shared keys (PSK) are used in WPA-Personal, not in an enterprise setting.

Does not scale well in corporate environments.

C. Implement WPS:

Wi-Fi Protected Setup (WPS) is a vulnerable security method meant for home users.

Not suitable for enterprise authentication.

Console Access:

Purpose: Console access to a switch allows administrators to configure and manage the device directly. This is typically done using a terminal emulator program on a computer.

RJ45 Connector:

Common Use: The RJ45 connector is widely used for Ethernet cables and also for console connections to network devices like switches and routers.

Console Cables: Console cables often have an RJ45 connector on one end (for the switch) and a DB9 serial connector on the other end (for the computer).

Comparison with Other Connectors:

ST (Straight Tip): A fiber optic connector used for networking, not for console access.

BNC (Bayonet Neill-Concelman): A connector used for coaxial cable, typically in older network setups and not for console access.

SFP (Small Form-factor Pluggable): A modular transceiver used for network interfaces, not for console access.

Practical Application:

Connection Process: Connect the RJ45 end of the console cable to the console port of the switch. Connect the DB9 end (or USB via adapter) to the computer. Use a terminal emulator (e.g., PuTTY, Tera Term) to access the switch’s command-line interface (CLI).