Question Q-5879 A company wants to monitor network device health and receive…
2 comments · last active May 25, 2026
CompTIA Network+ N10-009 - Domains 3 4 5 Operations Security Troubleshooting
By Jordan Blake · Updated Jul 10, 2026
| Questions | 25 |
| Passing Score | 75% |
| Format | 100% Multiple Choice |
| Sessions Logged | 795 |
| Your progress | Log in / Register to track times taken, best score, questions mastered, and coverage on this quiz. |
| Rating |
Topics covered
Uncategorized25 questions
Discussion
Log in to post a comment, reply, or expand a question.
NTP keeps logs trustworthy across devices. Stratum levels — lower = closer to reference clock.
Without time sync, correlating SIEM events across routers is painful — exam scenario often hints log timestamps off by hours.
Intermittent drops every 2–3 min screams STP reconvergence or flapping link — check error counters and duplex mismatch.
Half/full duplex mismatch = collisions and late collisions on old gear; still in troubleshooting objectives.
Cable certifier vs toner vs loopback plug — certifier validates standards compliance for install sign-off.
Toner traces physical path; loopback tests NIC/port — match tool to 'which layer' in the question stem.
ping tests ICMP reachability; tracert/traceroute shows path; nslookup/dig for DNS; pathping mixes both on Windows.
+2 votestcpdump vs Wireshark — know when capture on host vs mirror port. telnet/ssh for remote admin (ssh only in prod).
ACL order: first match wins. Implicit deny at end. Extended ACL near source, standard near destination (Cisco-ism still tested).
Deny statements are easy to misconfigure — one wrong ACE and you lock yourself out of SSH.
Documentation: network diagram, IP schema, baselines, change log. Close ticket only after user confirms fix.
Escalate when you've hit your time box or need provider — ISP demarc is a common boundary.
Defense in depth for networks: firewall, IDS/IPS, NAC, segmentation, WPA3-Enterprise. Know IPS inline vs IDS tap.
802.1X + RADIUS for port auth — ties to Sec+ IAM if you're cross-studying.
SPAN/port mirroring copies traffic to analyzer without inline tap. RSPAN extends across switches.
Promiscuous mode on NIC captures all frames — need mirror because switch normally unicasts to MAC table.
Question catalog for this preview
Catalog listing of the 5 preview questions for this quiz.
Question 1
An attacker sends millions of ping requests to a network target from a botnet of compromised hosts, overwhelming the target's bandwidth. What type of attack is this?
Explanation
DDoS (Distributed Denial of Service) attacks use multiple compromised systems (botnet) to flood a target with traffic, exhausting resources (bandwidth, CPU, connections). This differs from DoS (single source) by the distributed, harder-to-block nature of the attack.
Question 2
What is the primary difference between an IDS (Intrusion Detection System) and an IPS (Intrusion Prevention System)?
Explanation
An IDS is deployed out-of-band (using SPAN/tap) and can only detect and alert on threats. An IPS is deployed inline in the traffic path and can detect AND block threats by dropping malicious packets in real-time. IPS adds latency but provides active protection.
Question 3
A network admin runs `show interface GigabitEthernet0/1` on a Cisco router and sees "input errors" and "CRC errors" incrementing. What is the MOST likely physical cause?
Explanation
CRC errors and input errors on an interface indicate physical layer problems — damaged cables, bad connectors, excessive cable length, EMI interference, or bent/pinched fiber. These cause bit errors in frames, detected by CRC checks.
Question 4
A company implements a SIEM (Security Information and Event Management) system. What is the PRIMARY purpose of a SIEM in network operations?
Explanation
A SIEM aggregates logs from firewalls, IDS/IPS, servers, applications, and network devices, then correlates events across sources to identify patterns indicative of security incidents. It provides real-time alerting, dashboards, and forensic capabilities.
Question 5
A company experiences a network outage. Post-incident, they want to identify the root cause and prevent recurrence. Which document is produced?
Explanation
A Root Cause Analysis (RCA) or post-incident report documents: what happened, the timeline, contributing factors, the root cause, and corrective actions to prevent recurrence. This is standard practice in ITIL incident management.
SNMPv3 = auth + privacy; v1/v2c community strings are cleartext — know why v3 is preferred.
MIB + OID walk with snmpwalk — traps are async alerts vs polling.