[Dec 21, 2025] N10-009 Exam Dumps – CompTIA Practice Test Questions [Q192-Q210]

Single Sign-On (SSO) enables a user to access multiple resources or applications with one set of credentials, improving usability and security. The document confirms:
“Single Sign-On (SSO) allows a user to authenticate once and gain access to multiple resources or applications without needing to log in again for each. It streamlines the login process and improves security by reducing the number of passwords that need to be managed.”

Content filtering can be used to block or restrict access to websites and services that facilitate torrenting and other prohibited activities. By implementing content filtering, the company can comply with the ISP’s cease-and-desist order and prevent users from accessing torrent sites and engaging in prohibited activities.

Port 22 is used for SFTP (Secure File Transfer Protocol) and SCP (Secure Copy Protocol), which encrypt file transfers using SSH (Secure Shell). This ensures data is transmitted securely over the network.
*Why not the other options?
*Port 69 (B) – TFTP (Trivial File Transfer Protocol): Transfers files but is not secure (no encryption).
*Port 80 (C) – HTTP: Used for web traffic, not for file transfer.
*Port 3389 (D) – RDP (Remote Desktop Protocol): Used for remote desktop access, not file transfer.

See the step by step complete solution below.
Explanation:
Devices in both buildings should be able to access the Internet.
Security insists that all Internet traffic be inspected before entering the network.
Desktops should not see traffic destined for other devices.
Here is the corrected layout with explanation:
Building A:
Switch: Correctly placed to connect all desktops.
Firewall: Correctly placed to inspect all incoming and outgoing traffic.
Building B:
Switch: Not needed. Instead, place a Wireless Access Point (WAP) to provide wireless connectivity for laptops and mobile devices.
Between Buildings:
Wireless Range Extender: Correctly placed to provide connectivity between the buildings wirelessly.
Connection to the Internet:
Router: Correctly placed to connect to the Internet and route traffic between the buildings and the Internet.
Firewall: The firewall should be placed between the router and the internal network to inspect all traffic before it enters the network.
Corrected Setup:
Top-left (Building A): Switch
Bottom-left (Building A): Firewall (inspect traffic before it enters the network) Top-middle (Internet connection): Router Bottom-middle (between buildings): Wireless Range Extender Top-right (Building B): Wireless Access Point (WAP) In this corrected setup, the WAP in Building B will connect wirelessly to the Wireless Range Extender, which is connected to the Router. The Router is connected to the Firewall to ensure all traffic is inspected before it enters the network.
Configuration for Wireless Range Extender:
SSID: CORP
Security Settings: WPA2 or WPA2 – Enterprise
Key or Passphrase: [Enter a strong passphrase]
Mode: [Set based on your network plan]
Channel: [Set based on your network plan]
Speed: Auto
Duplex: Auto
With these settings, both buildings will have secure access to the Internet, and all traffic will be inspected by the firewall before entering the network. Desktops and other devices will not see traffic intended for others, maintaining the required security and privacy.

To configure the wireless range extender for security, follow these steps:
SSID (Service Set Identifier):
Ensure the SSID is set to “CORP” as shown in the exhibit.
Security Settings:
WPA2 or WPA2 – Enterprise: Choose one of these options for stronger security. WPA2-Enterprise provides more robust security with centralized authentication, which is ideal for a corporate environment.
Key or Passphrase:
If you select WPA2, enter a strong passphrase in the “Key or Passphrase” field.
If you select WPA2 – Enterprise, you will need to configure additional settings for authentication servers, such as RADIUS, which is not shown in the exhibit.
Wireless Mode and Channel:
Set the appropriate mode and channel based on your network design and the environment to avoid interference. These settings are not specified in the exhibit, so set them according to your network plan.
Wired Speed and Duplex:
Set the speed to “Auto” unless you have specific requirements for 100 or 1000 Mbps.
Set the duplex to “Auto” unless you need to specify half or full duplex based on your network equipment.
Save Configuration:
After making the necessary changes, click the “Save” button to apply the settings.
Here is how the configuration should look after adjustments:
SSID: CORP
Security Settings: WPA2 or WPA2 – Enterprise
Key or Passphrase: [Enter a strong passphrase]
Mode: [Set based on your network plan]
Channel: [Set based on your network plan]
Speed: Auto
Duplex: Auto
Once these settings are configured, your wireless range extender will provide secure connectivity for devices in both buildings.
Firewall setting to to ensure complete compliance with the requirements and best security practices, consider the following adjustments and additions:
DNS Rule: This rule allows DNS traffic from the internal network to any destination, which is fine.
HTTPS Outbound: This rule allows HTTPS traffic from the internal network (assuming 192.169.0.1/24 is a typo and should be 192.168.0.1/24) to any destination, which is also good for secure web browsing.
Management: This rule allows SSH access to the firewall for management purposes, which is necessary for administrative tasks.
HTTPS Inbound: This rule denies inbound HTTPS traffic to the internal network, which is good unless you have a web server that needs to be accessible from the internet.
HTTP Inbound: This rule denies inbound HTTP traffic to the internal network, which is correct for security purposes.
Suggested Additional Settings:
Permit General Outbound Traffic: Allow general outbound traffic for web access, email, etc.
Block All Other Traffic: Ensure that all other traffic is blocked to prevent unauthorized access.
Firewall Configuration Adjustments:
Correct the Network Typo:
Ensure that the subnet 192.169.0.1/24 is corrected to 192.168.0.1/24.
Permit General Outbound Traffic:
Rule Name: General Outbound
Source: 192.168.0.1/24
Destination: ANY
Service: ANY
Action: PERMIT
Deny All Other Traffic:
Rule Name: Block All
Source: ANY
Destination: ANY
Service: ANY
Action: DENY
Here is how your updated firewall settings should look:
Rule Name
Source
Destination
Service
Action
DNS Rule
192.168.0.1/24
ANY
DNS
PERMIT
HTTPS Outbound
192.168.0.1/24
ANY
HTTPS
PERMIT
Management
ANY
192.168.0.1/24
SSH
PERMIT
HTTPS Inbound
ANY
192.168.0.1/24
HTTPS
DENY
HTTP Inbound
ANY
192.168.0.1/24
HTTP
DENY
General Outbound
192.168.0.1/24
ANY
ANY
PERMIT
Block All
ANY
ANY
ANY
DENY
These settings ensure that:
Internal devices can access DNS and HTTPS services externally.
Management access via SSH is permitted.
Inbound HTTP and HTTPS traffic is denied unless otherwise specified.
General outbound traffic is allowed.
All other traffic is blocked by default, ensuring a secure environment.
Make sure to save the settings after making these adjustments.

When a DHCP server is installed and not enough IP addresses are provisioned, users may start experiencing network outages once the available IP addresses are exhausted. DHCP servers assign IP addresses to devices on the network, and if the pool of addresses is too small, new devices or those renewing their lease may fail to obtain an IP address, resulting in network connectivity issues.References:CompTIA Network+ study materials.

Introduction to Troubleshooting Methodology:
Network troubleshooting involves a systematic approach to identifying and resolving network issues. The CompTIA Network+ certification emphasizes a structured troubleshooting methodology.
Troubleshooting Steps:
Identify the problem: Gather information, identify symptoms, and question users.
Establish a theory of probable cause: Consider possible reasons for the issue.
Test the theory to determine cause: Validate the theory with tests.
Establish a plan of action to resolve the problem and implement the solution: Create and execute a resolution plan.
Verify functionality and implement preventive measures: Ensure the solution works and prevent recurrence.
Verifying Functionality:
After implementing a solution, verifying functionality ensures that the problem is fully resolved. This involves testing the network to confirm that it operates correctly.
Checking through each level of the OSI model helps to ensure that all potential issues at different layers (physical, data link, network, transport, session, presentation, and application) are addressed.
Explanation of the Options:
A . Establish a theory: This step involves hypothesizing possible causes, not verifying functionality.
B . Implement the solution: This step involves executing the resolution plan.
C . Create a plan of action: This step involves planning the resolution, not verification.
D . Verify functionality: This step involves comprehensive checks, including OSI model layers, to ensure the issue is fully resolved.
Conclusion:
Verifying functionality is a critical step in the troubleshooting process, ensuring that the network operates correctly after a solution is implemented. It involves thorough testing across all OSI model layers.
Reference:
CompTIA Network+ guide explaining the troubleshooting methodology and the importance of verifying functionality (see page Ref 9fBasic Configuration Commands).

Anevil twinis arogue Wi-Fi access pointthat mimics a legitimate network. Attackers use it tointercept and manipulate traffic, making it anon-path (formerly MITM) attackopportunity.
Breakdown of Options:
* A. Phishing- Tries tosteal credentialsthrough fake emails/websites but doesnot intercept network traffic.
* B. Dumpster diving- Involvesphysical security breaches,not network interception.
* C. Evil twin-#Correct answer.A rogueWi-Fi AP impersonates a real network, allowingtraffic interception.
* D. Tailgating- Involvesphysical access security,not network interception.

Comprehensive and Detailed Explanation (paraphrased, aligned to N10-009):
A proxy server (specifically a caching HTTP/HTTPS proxy) stores frequently accessed web objects and serves them locally to clients, reducing external bandwidth consumption and improving response times.
* B. Load balancer distributes traffic across servers but does not inherently cache internet content.
* C. Open relay is a misconfigured mail server that permits unauthorized relaying-this is a security issue, not a caching solution.
* D. Code repository (e.g., for source control) isn’t related to web content caching.
References (CompTIA Network+ N10-009):
* Domain: Network Standards, Protocols, and Implementations – Application-layer services (HTTP
/HTTPS), proxies and caching behavior, performance optimization.

PKI: X.509 certificates are a fundamental component of PKI, used to manage encryption keys and authenticate users and devices.
Digital Certificates: They are used to establish secure communications over networks, such as SSL/TLS for websites and secure email communication.
Authentication and Encryption: X.509 certificates provide the means to securely exchange keys and verify identities in various applications, ensuring data integrity and confidentiality.
Network Reference:
CompTIA Network+ N10-007 Official Certification Guide: Covers PKI and the role of X.509 certificates in network security.
Cisco Networking Academy: Provides training on PKI, certificates, and secure communications.
Network+ Certification All-in-One Exam Guide: Explains PKI, X.509 certificates, and their applications in securing network communications.

Comprehensive and Detailed Explanation (paraphrased, aligned to N10-009):
SSH provides secure, scriptable remote access used by automation/orchestration tools (e.g., leveraging CLI, NETCONF over SSH, or Ansible modules) to push configurations at scale.
* A. RDP is primarily for Windows GUI sessions and is not commonly used for network device automation.
* B. Telnet can be scripted but is insecure (plaintext); modern best practice is to use SSH.
* D. GUI access is typically manual and not ideal for scalable, repeatable automation.
References (CompTIA Network+ N10-009):
* Domain: Network Operations – Configuration management, automation/orchestration, secure management protocols (SSH vs. Telnet), change at scale.

When multiple redundant links exist between switches, Spanning Tree Protocol (STP) is required to prevent switching loops. STP blocks redundant paths but can allow aggregation if configured with protocols like LACP.
* B. SVIs provide Layer 3 interfaces, not loop prevention.
* C. Native VLAN defines the untagged VLAN but does not manage loops.
* D. FHRP (VRRP, HSRP, GLBP) provides gateway redundancy, not switch uplink management.
References (CompTIA Network+ N10-009):
* Domain: Network Infrastructure – STP, redundancy, loop prevention.

A recovery point objective (RPO) is the maximum length of time permitted that data can be restored from, which may or may not mean data loss. It is the age of the files or data in backup storage required to resume normal operations if a computer system or network failure occurs.

Quality of Service (QoS)is crucial for real-time services like video conferencing. It prioritizes voice and video packets over less critical traffic (like file downloads), reducing latency, jitter, and packet loss.
* B. Network signalmay apply to wireless, but it’s not specific to video issues.
* C. Time to live (TTL)affects packet lifespan, not performance or quality.
* D. Load balancingmanages traffic across multiple paths but doesn’t prioritize real-time traffic like QoS does.
#Reference:
CompTIA Network+ N10-009 Official Objectives: 3.6 – Explain the characteristics of network topologies and types.

^p
Explanation:
Definition of a Rogue DHCP Server:
A rogue DHCP server is an unauthorized DHCP server on a network, which can assign IP addresses to devices without proper control, leading to IP address conflicts.
Impact of a Rogue DHCP Server:
IP Address Conflicts: Multiple devices may receive the same IP address from different DHCP servers, causing network connectivity issues.
Network Disruption: Devices may be assigned incorrect network configuration settings, disrupting network services and connectivity.
Comparison with Other Attacks:
DNS poisoning: Alters DNS records to redirect traffic to malicious sites, but does not cause IP address conflicts.
Social engineering: Involves manipulating individuals to gain unauthorized access or information, not directly related to IP address conflicts.
Denial-of-service (DoS): Floods a network or service with excessive traffic to disrupt operations, but does not cause duplicate IP addresses.
Prevention and Detection:
Implement network access control measures to prevent unauthorized devices from acting as DHCP servers.
Use DHCP snooping on switches to allow DHCP responses only from authorized DHCP servers.
Reference:
CompTIA Network+ study materials on network security threats and mitigation techniques.

* Understanding Subnetting:
* The subnet mask 255.255.255.240 (or /28) indicates that each subnet has 16 IP addresses (14 usable addresses, 1 network address, and 1 broadcast address).
* Calculating the Subnet Range:
* Subnet Calculation: For the IP address 10.0.0.95 with a /28 subnet mask:
* Network address: 10.0.0.80
* Usable IP range: 10.0.0.81 to 10.0.0.94
* Broadcast address: 10.0.0.95
* Router Interface Configuration:
* Broadcast Address Issue: The IP address 10.0.0.95 is the broadcast address for the subnet
10.0.0.80/28. Configuring a router interface with the broadcast address will cause routing issues as it is not a valid host address.
* Comparison with Other Options:
* The web server is in a different subnet: The web server (10.0.0.81) is within the same subnet range (10.0.0.80/28).
* The IP address space is a class A network: While 10.0.0.0 is a Class A network, this does not explain the routing issue caused by the broadcast address.
* The subnet is in a private address space: The private address space designation (RFC 1918) does not impact the routing issue related to the broadcast address configuration.
* Resolution:
* Reconfigure the router interface with a valid host IP address within the usable range, such as
10.0.0.94.

A toner and probe tool, also known as a tone generator and probe, is used to trace and identify individual cables within a bundle or to locate the termination points of cables in wiring closets and patch panels. It generates a tone that can be picked up by the probe, helping technicians quickly and accurately identify and label wall plates and wiring. This is the best tool for identifying proper wiring in the Intermediate Distribution Frame (IDF). References: CompTIA Network+ Exam Objectives and official study guides.

To ensure that only assigned devices can connect to a switch, the network administrator should enable port security. Port security restricts port access based on MAC addresses, allowing only pre- configured devices to connect to the network. This helps prevent unauthorized devices from gaining access to the network. Other options like configuring ACLs, implementing a captive portal, or disabling unnecessary services serve different security purposes and do not directly restrict physical port access based on device identity.

TCP port 443 is reserved for HTTPS (Hypertext Transfer Protocol Secure), which uses TLS encryption to secure web traffic. It is the standard port for encrypted web communications.
* A. Telnet uses TCP port 23.
* B. SMTP commonly uses TCP ports 25, 465, or 587.
* D. SNMP typically uses UDP ports 161 (queries) and 162 (traps).
References (CompTIA Network+ N10-009):
* Domain: Network Standards, Protocols, and Implementations – Common ports and services.

Using a /30 subnet mask is the most efficient way to conserve IP space for a point-to-point connection between two routers. A /30 subnet provides four IP addresses, two of which can be assigned to the router interfaces, one for the network address, and one for the broadcast address. This makes it ideal for point-to-point links where only two usable IP addresses are needed.
Reference: CompTIA Network+ study materials and subnetting principles.