Free Practice Questions for CompTIA N10-009 Exam

URL filtering can block access to websites based on their domain or country code TLDs (e.g., .cn, .ru). This is the correct method to block by location identifiers in URLs.

B. Content filtering blocks based on keywords or categories within websites, not country code.

C. DNS poisoning is an attack, not a control mechanism.

D. MAC filtering restricts devices, not websites.

References (CompTIA Network+ N10-009):

Domain: Network Security — Filtering technologies, URL vs content filtering.

The correct answer is Test the theory, which aligns directly with the CompTIA Network+ N10-009 troubleshooting methodology. According to the official troubleshooting steps, once a problem has been identified and relevant information gathered, the next step is to establish a theory of probable cause and then test that theory to determine whether it is valid.

In this scenario, the engineer has already completed the problem identification phase by confirming that all users are experiencing latency and correlating the issue with the installation of a new switch. The engineer has also formed a theory: that a network loop caused by the lower bridge ID of the new switch may be impacting Spanning Tree Protocol (STP), resulting in congestion and latency. Because this theory has already been developed, the next logical and required step is to test the theory—for example, by reviewing STP states, temporarily disabling ports, or adjusting bridge priorities.

Implementing a solution would be premature without validating the theory, and verifying full system functionality occurs only after a fix has been applied. The Network+ objectives stress following a structured methodology to avoid unnecessary changes and minimize network disruption. Testing the theory ensures accuracy before corrective action is taken, reducing risk and downtime.

Switch 1

spanning-tree vlan 10 root primary

spanning-tree vlan 20 root secondary

Switch 2

spanning-tree vlan 20 root primary

spanning-tree vlan 10 root secondary

This PBQ is pointing to a switching loop / MAC flapping problem. The biggest clues are the high CPU utilization and the fact that the MAC table is continuously changing. That behavior is classic for a Layer 2 loop when redundant links exist between switches and no proper spanning-tree root role has been established.

The available commands shown in the screenshots are limited to spanning-tree vlan, so this is not an interface shutdown question. The fix is to use STP per VLAN and make one switch the preferred root for one VLAN and the other switch the preferred root for the other VLAN. That prevents both uplinks from forwarding in an uncontrolled loop while still giving redundancy.

A clean design is:

Switch 1 root primary for VLAN 10

Switch 2 root primary for VLAN 20

Make each opposite switch root secondary for failover

That stabilizes Layer 2 forwarding, stops MAC address flapping, reduces CPU load, and restores normal connectivity. After applying the STP root settings, the user should be able to ping 192.168.1.31 from PC 1 successfully. If your simulator asks for validation, run the ping again from PC 1 to the database server.

Content filtering blocks access to restricted or malicious websites. When a user attempts to visit a site that violates company policies, they are redirected to a restriction page.

This is a common security measure to prevent employees from accessing phishing or malware-infected sites.

Content filters work by scanning URLs, keywords, or categories and blocking inappropriate or harmful content.

Option A (DLP - Data Loss Prevention): Focuses on preventing sensitive data leaks rather than blocking web access.

Option B (Captive portal): Used mainly in public Wi-Fi to authenticate users before granting access, not to restrict sites.

Option D (DNS sinkholing): Redirects malicious domain requests to a safe address but is not responsible for policy-based restrictions on general content.

? Reference: CompTIA Network+ (N10-009) Official Study Guide – Section: Security Solutions

Building materials and electrical interference are the two best factors to consider when designing a wireless network for maximum coverage and signal strength. Wireless signals can be weakened or blocked by concrete, brick, metal, glass, insulation, elevator shafts, walls, and other structural materials. These materials can absorb, reflect, or scatter radio frequency signals, creating weak coverage areas or dead zones.

Electrical interference is also important because wireless networks can be affected by devices that generate electromagnetic or radio frequency interference. Examples include microwaves, motors, fluorescent lighting, cordless devices, industrial equipment, and neighboring wireless networks. Interference can reduce signal quality, increase retransmissions, and cause unstable connectivity.

The CompTIA Network+ N10-009 objectives include wireless site surveys, signal strength, antenna placement, interference, and environmental factors. These considerations are central to proper wireless design. Distance from the server room does not directly determine wireless signal coverage. Encryption affects security, not radio signal strength. Power over Ethernet affects how APs receive power but not coverage by itself. Client device type can affect performance, but the best design factors for coverage and signal strength are building materials and electrical interference.

An SFP (Small Form-factor Pluggable) transceiver is a modular device that provides the interface between fiber-optic or copper cabling and the networking equipment (e.g., switch or router). It operates primarily at Layer 2 (Data Link), converting optical or electrical signals into frames usable by the network device.

A. SC is a fiber connector type, not the transceiver.

B. DAC (Direct Attach Copper) is a passive copper cable assembly with fixed transceivers, not a general-purpose module.

D. Twinaxial cable is a copper medium, not an interface device.

References (CompTIA Network+ N10-009):

Domain: Networking Concepts — Transceivers (SFP, GBIC, QSFP), fiber connectivity, OSI model mapping.

A Power Distribution Unit (PDU) provides multiple power outlets in a data center or IDF (Intermediate Distribution Frame), while offering features like surge protection, load balancing, and sometimes remote monitoring, making it a cost-effective and reliable solution. The document confirms:

“PDUs (Power Distribution Units) are a cost-effective way to expand outlet capacity in a structured cabling environment like an IDF. They ensure safe power delivery to networking equipment and often include monitoring features.”

A Security Information and Event Management (SIEM) system collects, correlates, and analyzes logs from multiple sources in real-time, providing enhanced visibility across multivendor environments.

Breakdown of Options:

A. SNMP – SNMP is used for network device monitoring, but it lacks real-time correlation across multiple vendors.

B. SIEM – Correct answer. SIEM aggregates, analyzes, and correlates logs from multiple sources, providing real-time visibility.

C. Nmap – Nmap is a network scanning tool used for mapping hosts and detecting open ports but does not provide log correlation.

D. Syslog – Syslog collects logs but does not correlate or analyze them in real-time.

The key difference is that an Intrusion Prevention System (IPS) is installed in line with network traffic, allowing it to actively block threats. In contrast, an Intrusion Detection System (IDS) only monitors and alerts without actively blocking traffic.

Breakdown of Options:

A. An IPS needs to be installed in line with traffic and an IDS does not. ✅ Correct answer. IPS actively prevents threats, while IDS only detects them.

B. An IPS is signature-based and an IDS is not. – False, both can use signature-based detection.

C. An IPS is less susceptible to false positives than an IDS. – False, both can produce false positives, depending on configurations.

D. An IPS requires less administrative overhead than an IDS. – False, IPS requires more administrative effort due to real-time blocking decisions.

Understanding VoIP and VLANs:

VoIP (Voice over IP) phones often use VLANs (Virtual Local Area Networks) to separate voice traffic from data traffic for improved performance and security.

Tagging Traffic to Voice VLAN:

Voice VLAN Configuration: The port on the switch needs to be configured to tag traffic for the specific voice VLAN. This ensures that voice packets are prioritized and handled correctly.

VLAN Tagging: VLAN tagging allows the switch to identify and separate voice traffic from other types of traffic on the network, reducing latency and jitter for VoIP communications.

Comparison with Other Options:

Trunk all VLANs on the port: Trunking all VLANs is typically used for links between switches, not for individual device ports.

Configure the native VLAN: The native VLAN is for untagged traffic and does not address the need for separating and prioritizing voice traffic.

Disable VLANs: Disabling VLANs would mix voice and data traffic, leading to potential performance issues and lack of traffic separation.

Implementation:

Configure the switch port connected to the VoIP phone to tag the traffic for the designated voice VLAN, ensuring proper network segmentation and quality of service.

The correct answer is B. Spanning tree. At the distribution layer, switch redundancy is common because multiple paths are usually built into the design to avoid a single point of failure. The problem with redundant Layer 2 paths is that they can create switching loops, broadcast storms, and unstable MAC address tables if nothing controls them. Spanning Tree Protocol solves that problem by logically blocking one or more redundant paths while still keeping those paths available as backups.

That makes spanning tree the best fit for a feature that supports both redundancy and safe scaling. As the switched environment grows, STP helps maintain a stable topology and prevents loop-related failures. If the active path fails, a blocked redundant path can be brought into service.

The other options do not address the real need. VLAN assignment is used to segment broadcast domains, but it does not manage redundant Layer 2 paths. Port speed only affects throughput on an interface. Full duplex improves communication efficiency on a link, but it also does not provide redundancy control or loop prevention.

When a Network+ question mentions redundancy on switches and asks for the best switching feature, spanning tree is the strongest answer.

The troubleshooting methodology requires following a logical sequence. In this case, the engineer has already identified the problem (firewall blocking traffic) and confirmed it with evidence (packet captures). The next appropriate step is to create a plan of action that outlines how to resolve the issue and considers potential effects.

A. Implementing the solution is premature without planning.

C. Establishing a theory was already completed during problem isolation.

D. Documentation occurs after resolution.

By carefully planning, the engineer ensures that corrective action won’t cause additional outages or security issues, especially given the scale of the incident (3,000 users).

References (CompTIA Network+ N10-009):

Domain: Network Troubleshooting — Troubleshooting methodology, plan of action.

AnAccess Control List (ACL)configured on theedge firewallis the correct and most effective solution tofilter inbound traffic. The administrator can allow TCP port 443 (HTTPS) and deny all other traffic. This is a classic firewall configuration for securing public-facing servers.

The best mitigation is implementing 802.1X, which provides port-based Network Access Control (NAC). With 802.1X enabled on access switch ports, a device plugged into a wall jack cannot gain normal network access until it successfully authenticates using credentials/certificates via an authentication server (commonly RADIUS). This directly addresses the threat of unauthorized users plugging into publicly accessible conference room jacks, because the switch keeps the port in an unauthenticated state (or places it into a restricted/guest VLAN) until authentication succeeds. This aligns with Network+ security objectives that emphasize controlling access at the edge, enforcing authentication, and reducing the risk of rogue or unmanaged devices on internal networks.

MAC filtering is weaker because MAC addresses can be spoofed and managing allow-lists at scale is error-prone. Creating a trusted zone is vague and does not prevent initial port access; segmentation helps limit blast radius but doesn’t enforce authentication at the jack. Disabling unused services is a general hardening practice, but it does not stop someone from connecting physically to an active switch port and attempting access. 802.1X is purpose-built for this exact scenario.

===========

The correct answer is Static because static routes have a lower administrative distance (AD) than most dynamic routing protocols, giving them higher priority when a router selects routes for the same destination network. According to CompTIA Network+ (N10-009) routing objectives, administrative distance is used to determine the trustworthiness of a route source when multiple routing protocols provide a path to the same subnet. The lower the administrative distance, the more preferred the route.

By default, a static route has an administrative distance of 1, which is lower than OSPF (110) and BGP (20 for eBGP, 200 for iBGP). Because of this, when identical routes to a subnet exist from both static and dynamic sources, the router installs the static route in the routing table.

A default route (0.0.0.0/0) is only used when no more specific route exists and does not take precedence over specific static or dynamic routes.

Therefore, when building the routing table for a given subnet and comparing route sources, static routes take precedence due to their lower administrative distance.