Pass the CompTIA Network+ N10-009 Questions and answers with ExamsMirror

To provide a complete solution for configuring the access layer switches, let ' s proceed with the following steps:

Identify the correct VLANs for each device and port.

Enable necessary ports and disable unused ports.

Configure fault-tolerant connections between the switches.

Port 1 Configuration (Uplink to Core Switch)

Status: Enabled

LACP: Enabled

Speed: 1000

Duplex: Full

VLAN Configuration: Tagged for VLAN60, VLAN90, VLAN120, VLAN150, VLAN220

Port 2 Configuration (Uplink to Core Switch)

Status: Enabled

LACP: Enabled

Speed: 1000

Duplex: Full

VLAN Configuration: Tagged for VLAN60, VLAN90, VLAN120, VLAN150, VLAN220

Port 3 Configuration (Server Connection)

Status: Enabled

LACP: Disabled

Speed: 1000

Duplex: Full

VLAN Configuration: Untagged for VLAN90 (Servers)

Port 4 Configuration (Server Connection)

Status: Enabled

LACP: Disabled

Speed: 1000

Duplex: Full

VLAN Configuration: Untagged for VLAN90 (Servers)

Port 5 Configuration (Wired Users and WLAN)

Status: Enabled

LACP: Enabled

Speed: 1000

Duplex: Full

VLAN Configuration: Tagged for VLAN60, VLAN120, VLAN150

Port 6 Configuration (Wired Users and WLAN)

Status: Enabled

LACP: Enabled

Speed: 1000

Duplex: Full

VLAN Configuration: Tagged for VLAN60, VLAN120, VLAN150

Port 7 Configuration (Voice and Wired Users)

Status: Enabled

LACP: Enabled

Speed: 1000

Duplex: Full

VLAN Configuration: Tagged for VLAN60, VLAN90, VLAN120, VLAN220

Port 8 Configuration (Voice, Printers, and Wired Users)

Status: Enabled

LACP: Enabled

Speed: 1000

Duplex: Full

VLAN Configuration: Tagged for VLAN60, VLAN90, VLAN120, VLAN220

Port 1 Configuration (Unused)

Status: Disabled

LACP: Disabled

Port 2 Configuration (Unused)

Status: Disabled

LACP: Disabled

Port 3 Configuration (Connection to Device)

Status: Enabled

LACP: Disabled

Speed: 1000

Duplex: Full

VLAN Configuration: Untagged for VLAN1 (Default)

Port 4 Configuration (Connection to Device)

Status: Enabled

LACP: Disabled

Speed: 1000

Duplex: Full

VLAN Configuration: Untagged for VLAN1 (Default)

Port 5 Configuration (Connection to Device)

Status: Enabled

LACP: Disabled

Speed: 1000

Duplex: Full

VLAN Configuration: Untagged for VLAN1 (Default)

Port 6 Configuration (Connection to Device)

Status: Enabled

LACP: Disabled

Speed: 1000

Duplex: Full

VLAN Configuration: Untagged for VLAN1 (Default)

Port 7 Configuration (Connection to Device)

Status: Enabled

LACP: Disabled

Speed: 1000

Duplex: Full

VLAN Configuration: Untagged for VLAN1 (Default)

Ports 1 and 2 on Switch 1 are configured as trunk ports with VLAN tagging enabled for all necessary VLANs.

Ports 3 and 4 on Switch 1 are configured for server connections with VLAN 90 untagged.

Ports 5, 6, 7, and 8 on Switch 1 are configured for devices needing access to multiple VLANs.

Unused ports on Switch 3 are disabled.

Ports 3, 4, 5, 6, and 7 on Switch 3 are enabled for default VLAN1.

Core Switch Ports should be configured as needed for uplinks to Switch 1.

Ensure LACP is enabled for redundancy on trunk ports between switches.

By following these configurations, each device will access only its correctly associated network, unused switch ports will be disabled, and fault-tolerant connections will be established between the switches.

SSH (Secure Shell) is the best and most secure method for accessing a network appliance from an external location, according to the CompTIA Network+ N10-009 objectives related to secure management protocols and network security. SSH provides encrypted remote command-line access, ensuring that authentication credentials, commands, and session data are protected from interception, eavesdropping, and man-in-the-middle attacks.

Telnet is an insecure legacy protocol that transmits all data, including usernames and passwords, in cleartext, making it unsuitable for any external or untrusted network access. RDP is primarily used for graphical remote desktop access to Windows systems and is not commonly used for managing network appliances such as routers, switches, firewalls, or load balancers. Additionally, RDP introduces a larger attack surface if exposed externally. FTPS is a secure file transfer protocol and is designed for transferring files, not for interactive device management or configuration.

The Network+ N10-009 exam emphasizes the use of secure administrative access methods, and SSH is the industry-standard protocol for managing network infrastructure devices. It supports strong encryption, key-based authentication, and secure tunneling, making it ideal for remote administration over untrusted networks such as the internet.

The correct answer is Integrity because a hashing algorithm ensures that data has not been altered. According to CompTIA Network+ (N10-009) security objectives, hashing is a cryptographic process that takes input data of any size and produces a fixed-length output known as a hash value or digest. If even a single bit of the original data changes, the resulting hash value will be significantly different.

Hashing is commonly used to verify file integrity, validate message authenticity, and securely store passwords. For example, when downloading software, the vendor may publish a hash value so users can calculate the hash of the downloaded file and confirm it matches, ensuring the file was not tampered with.

Non-repudiation (Option A) typically requires digital signatures that combine hashing with asymmetric encryption to verify the sender’s identity. Confidentiality (Option C) is achieved through encryption, which protects data from unauthorized access. Availability (Option D) refers to ensuring systems and data are accessible when needed and is not related to hashing functions.

Therefore, hashing primarily provides data integrity verification.

A site-to-site VPN is used to securely connect two networks over an untrusted network, most commonly the public internet. In Network+ (N10-009) objectives, VPNs are described as providing confidentiality and integrity for data in transit by creating an encrypted tunnel between sites (for example, headquarters and a branch office). This allows systems at both locations to communicate as if on the same private WAN, while preventing eavesdropping or tampering by intermediate networks. Typical implementations use IPsec tunneling and rely on negotiated encryption/authentication parameters to protect traffic end-to-end between VPN gateways.

Encrypting data at rest refers to storage encryption (disk/database), not VPN tunneling. Filtering traffic between two internal subnets is usually handled by ACLs, firewalls, or segmentation controls, not a site-to-site VPN. Hosting public-facing applications is a DMZ / reverse proxy / WAF design concern; a VPN is not the primary control for exposing public services (and generally you would not require the public to use a VPN to reach a public website). Therefore, securing site connectivity across an untrusted network is the best match.

===========

WPA2/WPA3 mixed mode provides compatibility for older devices (that only support WPA2) while allowing newer devices to take advantage of stronger WPA3 encryption. This ensures maximum compatibility and security in a mixed-device environment.

A. WPA3 only is most secure but not compatible with legacy devices.

B. WPA2 only is secure but does not future-proof against WPA3-capable devices.

D. WPA/WPA2 mixed mode is weaker due to WPA (deprecated, insecure).

References (CompTIA Network+ N10-009):

Domain: Network Security — Wi-Fi encryption standards, WPA2 vs WPA3, mixed-mode compatibility.

If the administrator is concerned a new discovery tool could disrupt operations, the safest option is to configure scheduled scans. Network+ (N10-009) operations guidance emphasizes minimizing impact by running potentially noisy tasks (discovery, vulnerability checks, inventory scans) during defined maintenance windows or off-peak hours. A scheduled scan allows controlled timing, predictable load, and easier coordination with change management, monitoring, and support teams. This reduces the risk of saturating links, overwhelming devices with queries, or triggering alerts during business-critical periods.

Ad hoc scanning is on-demand and may occur at any time, which increases the chance of disruption if run during peak usage. Authenticated versus unauthenticated describes whether the scanner uses credentials to log into systems for deeper visibility; that choice affects depth and accuracy, but it doesn’t directly address when scanning occurs to reduce business impact. An authenticated scan can still be disruptive if run at the wrong time, and an unauthenticated scan can still generate significant traffic. Since the key concern is operational disruption, controlling scan timing via scheduled scans is the best mitigation.

===========

When a network administrator installs a new Network Interface Card (NIC) and users are unable to reach the server, one of the common issues is the use of an incorrect cable type. Network cables must match the specifications required by the NIC and the network infrastructure (e.g., Cat5e, Cat6 for Ethernet).

NIC Compatibility: The new NIC might require a specific type of cable to function properly. Using a cable not rated for the NIC ' s required speeds or capabilities can result in connectivity issues.

Cable Standards: Different NICs and network devices might need different cabling standards (straight-through vs. crossover cables, or specific fiber optic types).

Connection Types: Ensuring that the cable connectors are appropriate for the NIC ports (e.g., RJ45 for Ethernet, LC connectors for fiber optics).

Network References:

CompTIA Network+ N10-007 Official Certification Guide: Discusses network cabling standards and NIC specifications.

Cisco Networking Academy: Provides insights into cabling and NIC configurations for optimal network performance.

Network+ Certification All-in-One Exam Guide: Offers comprehensive details on troubleshooting network connectivity issues, including cabling problems.

SIEM (Security Information and Event Management) systems are used to aggregate and analyze log data from various sources, including firewalls, to detect potential security incidents and assist in regulatory compliance. The document explains:

“SIEM solutions aggregate and analyze log and event data from multiple devices, including firewalls, across different locations. They help in real-time monitoring, incident response, and ensuring compliance with security policies.”

To support 75 hosts per subnet, you must choose a subnet size that provides at least 75 usable IP addresses. In IPv4, usable hosts per subnet equals 2^(host bits) − 2 (subtracting network and broadcast). A /25 leaves 7 host bits (32–25 = 7), giving 2^7 − 2 = 128 − 2 = 126 usable hosts, which meets the requirement and is the smallest (most efficient) option listed that does so. A /26 leaves 6 host bits, giving 62 usable hosts, which is insufficient. A /27 gives 30 usable, and a /28 gives 14 usable, both far below 75. Network+ subnetting objectives emphasize selecting the smallest subnet that satisfies the host requirement to conserve address space while meeting growth and design constraints. Therefore, 192.168.13.0/25 is the most efficient option that accommodates at least 75 hosts per subnet.

The correct answer is STP (Shielded Twisted Pair). According to the CompTIA Network+ N10-009 objectives, environments with high levels of electromagnetic interference (EMI)—such as industrial warehouses with heavy machinery, motors, and electrical equipment—require additional protection at the physical layer to maintain signal integrity.

STP cabling includes shielding around the twisted copper pairs that helps block external electromagnetic signals from interfering with data transmission. This shielding significantly reduces crosstalk and EMI, making STP far more suitable than UTP (Unshielded Twisted Pair) in electrically noisy environments. UTP lacks this shielding and is more prone to signal degradation under such conditions.

While fiber-optic cabling (multimode or single-mode) is completely immune to EMI, it is typically not used to directly connect wireless APs in most enterprise deployments. Wireless access points commonly rely on copper Ethernet connections to support Power over Ethernet (PoE), which supplies both data and electrical power over the same cable. Fiber does not natively support PoE, making it impractical for directly powering APs without additional equipment.

The Network+ objectives emphasize selecting appropriate cabling based on environmental factors and operational requirements. In this scenario, STP provides the optimal balance of EMI resistance, Ethernet compatibility, and PoE support, making it the best choice for connecting APs in an industrial warehouse.

Port 22 is used for SFTP (Secure File Transfer Protocol) and SCP (Secure Copy Protocol), which encrypt file transfers using SSH (Secure Shell). This ensures data is transmitted securely over the network.

•Why not the other options?

•Port 69 (B) – TFTP (Trivial File Transfer Protocol): Transfers files but is not secure (no encryption).

•Port 80 (C) – HTTP: Used for web traffic, not for file transfer.

•Port 3389 (D) – RDP (Remote Desktop Protocol): Used for remote desktop access, not file transfer.

A warm site typically has a full infrastructure ready, but it lacks the most up-to-date data or is not immediately operational. It requires some configuration or data restoration to become fully functional.

=================

A golden configuration is a baseline configuration file that contains approved, standardized settings for network devices. The purpose is to ensure configuration consistency across the environment. This prevents misconfigurations, supports compliance with organizational or regulatory standards, and accelerates recovery if a device needs reconfiguration.

B. Reducing file size is not the goal of golden configs.

C. Golden configs can include security settings, but they are not inherently encrypted — they are simply a baseline template.

D. While configs can be backed up, golden configs are more about standardization, not device-specific backups.

By maintaining a golden configuration, administrators can quickly detect unauthorized changes (by comparing running configs against the golden file) and enforce consistency across devices. This improves network stability, reduces troubleshooting complexity, and enhances security posture.

References (CompTIA Network+ N10-009):

Domain: Network Operations — Configuration management, golden images/configurations.

The correct answer is IP address blocks because geofencing policies typically rely on public IP address ranges associated with specific geographic regions or countries. According to CompTIA Network+ (N10-009) security objectives, geofencing is a security control used to restrict or allow traffic based on geographic location. This is commonly implemented on firewalls, VPN concentrators, or security gateways by referencing databases that map IP address blocks to countries or regions.

When configuring geofencing, administrators create access control rules that permit or deny traffic from specific country-based IP ranges. This method is effective for limiting remote access to approved geographic locations and reducing exposure to international threat sources.

MAC filtering (Option A) is used within local networks and does not function over the internet for geographic control. Administrative distance (Option B) is a routing concept that determines route preference and has no relation to access control policies. Bluetooth beacon signals (Option C) are used for proximity-based services and indoor positioning, not for country-level remote access restrictions.

Therefore, leveraging IP address blocks is the correct approach for implementing geofencing controls.

EIGRP (Enhanced Interior Gateway Routing Protocol) has a default administrative distance (AD) value of 90 for internal routes. The administrative distance is used to rate the trustworthiness of routing information received from different routing protocols. EIGRP, developed by Cisco, has an AD of 90, which is lower than that of RIP (120) and OSPF (110), making it more preferred if multiple protocols provide a route to the same destination.References: CompTIA Network+ study materials.