CompTIAAssociate levelN10-009Page 3 of 4

N10-009 exam dumps: questions 201 to 300 of 329

Page 3 of the free N10-009 question bank for the Network+ exam. Questions 201 to 300 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated June 2026

Start timed practice exam Questions 201 to 300

Free N10-009 practice questions

Questions 201 to 205 of 329

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

N10-009 Question 201

Single answerConfiguration management: Production configuration, Backup configuration, Baseline/golden configuration

A network administrator is preparing to replace a failed access switch at a remote branch office. The original switch was configured with the company's standard VLANs, trunk settings, management IP scheme, SSH settings, and port security policies. The administrator wants the replacement to be deployed quickly while minimizing configuration drift from company standards. Which action is the BEST way to accomplish this?

A
Restore the most recent backup of the failed switch's running configuration to the new switch and verify hardware-specific settings before putting it into production
B
Apply the current baseline/golden configuration template to the new switch without reviewing site-specific settings
C
Use the new switch's factory default configuration, then allow users to report connectivity issues so settings can be adjusted as needed
D
Copy only the production VLAN database from another branch switch because VLAN information is sufficient for most access-layer deployments

Show answer and explanation

Correct answer: A

Explanation

The best answer is to restore the most recent backup of the failed switch's production configuration, because this most accurately returns the branch to its previous operational state with minimal downtime. In configuration management, a production configuration is the active configuration currently used by a device in the live environment. A backup configuration is a saved copy used for recovery after failure or misconfiguration. A baseline or golden configuration is the organization's approved standard template used to ensure consistency and compliance across deployments. Best practice is to maintain current configuration backups, use golden configurations to define standards, and validate any restored configuration against hardware differences before moving the device into production. Vendor documentation from major switch manufacturers commonly recommends backing up startup/running configurations regularly and reviewing restored configurations when replacing hardware, especially if model, software version, or interface layout differs.

A. Correct.
Correct. Restoring the most recent backup configuration from the failed production switch is the best choice when replacing a like-for-like device at a specific site. It preserves the production configuration actually in use, including local interface assignments, management addressing, trunk settings, and security controls. The administrator should still verify hardware-specific items such as interface numbering, licensing differences, stacking members, or model-dependent commands before deployment. This approach is faster than rebuilding from scratch and reduces the risk of missing site-specific settings.
B. Incorrect.
Incorrect. A baseline or golden configuration is intended as a standardized starting point for compliant deployments, not necessarily a complete replacement for a site's production configuration. Using it without reviewing site-specific requirements could omit branch-specific management IP addresses, uplink port assignments, voice VLANs, or local security policies. A golden configuration is useful for standardization, but in a replacement scenario, the backed-up production configuration is usually more appropriate.
C. Incorrect.
Incorrect. Deploying a switch with factory defaults and troubleshooting reactively is poor operational practice. It increases downtime, introduces inconsistent settings, and can leave management access and security features unconfigured. This option reflects a common misconception that access switches can be safely configured after users begin reporting problems, but production devices should be restored in a controlled manner.
D. Incorrect.
Incorrect. VLAN information alone is not enough to restore an access switch to service. The switch also needs interface mode settings, trunk allowed VLANs, management configuration, remote access settings, STP-related settings, port security, and possibly QoS or authentication settings. Copying only VLAN data from another branch also risks introducing incorrect site-specific values.

N10-009 Question 202

Single answer3.2 Given a scenario, use network monitoring technologies.

A network administrator is troubleshooting intermittent slowness reported by users in a branch office. The issue affects multiple applications at random times during the day, and basic connectivity tests show no outages. The administrator wants to identify which hosts and applications are consuming the most bandwidth on the WAN link without capturing full packet payloads. Which monitoring technology should the administrator use?

A
Configure NetFlow on the branch router and analyze the exported flow records
B
Enable port mirroring on the switch and review traffic counters only
C
Use SNMP polling to check whether the router interface is up or down
D
Run a continuous ICMP ping from a workstation to the data center gateway

Show answer and explanation

Correct answer: A

Explanation

Flow-based monitoring technologies such as NetFlow, IPFIX, and sFlow are commonly used to analyze bandwidth consumption, top talkers, and application usage patterns while avoiding the storage and privacy concerns of full packet capture. In this scenario, the administrator needs visibility into who is using the WAN link and for what type of traffic, not just whether the circuit is operational. SNMP is valuable for baseline monitoring of utilization and interface health, and ICMP is useful for reachability and latency testing, but neither provides per-flow usage data. Port mirroring is more appropriate when deep packet inspection with a protocol analyzer is required. Vendor and industry documentation for Cisco NetFlow and IETF IPFIX describe exporting metadata about traffic flows for performance monitoring, accounting, and capacity planning, which aligns directly with the requirement in this scenario.

A. Correct.
Correct. NetFlow and similar flow-based monitoring technologies summarize conversations by source/destination IP, ports, protocol, interface, and byte/packet counts. This allows the administrator to identify top talkers and high-bandwidth applications on the WAN link without collecting full packet payloads. This is the most appropriate choice when the goal is traffic visibility and usage analysis with lower overhead than full packet capture.
B. Incorrect.
Incorrect. Port mirroring can be useful when sending traffic to a packet analyzer, but reviewing switch traffic counters alone will not identify application-level bandwidth consumers across the WAN. In addition, port mirroring typically supports packet capture workflows rather than summarized usage reporting. The scenario specifically calls for identifying hosts and applications without capturing full payloads, which makes flow monitoring a better fit.
C. Incorrect.
Incorrect. SNMP polling is useful for monitoring interface utilization, errors, discards, device health, and operational status. However, checking only whether an interface is up or down does not reveal which hosts or applications are responsible for congestion. A candidate might choose this because SNMP is a monitoring technology, but it does not provide the needed traffic flow detail by itself.
D. Incorrect.
Incorrect. Continuous ping can help detect latency, jitter, and packet loss trends between two points, but it does not identify which internal hosts or application flows are consuming bandwidth. This is a common troubleshooting step, but it is not the best monitoring technology for analyzing WAN usage patterns.

N10-009 Question 203

Single answer3.2 Given a scenario, use network monitoring technologies.

A network administrator is troubleshooting intermittent slowness reported by users in a branch office. The WAN link is not saturated according to interface bandwidth graphs, but users say file transfers to the data center sometimes pause for several seconds. The administrator needs to identify which conversations and applications are consuming bandwidth during the affected periods without capturing every packet. Which monitoring technology should the administrator use?

A
NetFlow
B
Syslog
C
SNMP
D
Packet broker
E
Port mirroring

Show answer and explanation

Correct answer: A

Explanation

The best answer is NetFlow because the requirement is to identify which conversations and applications are consuming bandwidth during intermittent performance issues without performing full packet capture. Flow-monitoring technologies such as NetFlow and similar implementations (for example, IPFIX or sFlow in some environments) are widely used to identify top talkers, protocols, and traffic patterns while using much less storage and processing than packet capture. By contrast, SNMP is best for device and interface statistics, syslog is best for event logging, and port mirroring is typically used when a packet analyzer needs full traffic visibility. This aligns with common vendor and industry best practices: use SNMP for health and utilization baselines, syslog for operational events, and flow technologies for traffic analysis and capacity troubleshooting.

A. Correct.
Correct. NetFlow is designed to summarize traffic flows by source/destination, ports, protocol, and volume, allowing an administrator to identify top talkers and application usage without storing full packet captures. This makes it well suited for investigating intermittent bandwidth consumption and conversation-level analysis on WAN links.
B. Incorrect.
Incorrect. Syslog collects event and log messages from network devices and servers, such as interface state changes, authentication events, or routing issues. While useful for correlating faults and events, it does not provide conversation-level traffic accounting needed to determine which hosts or applications are using bandwidth during slow periods.
C. Incorrect.
Incorrect. SNMP is commonly used for polling interface counters, errors, CPU, memory, and device health metrics. In this scenario, SNMP-style bandwidth graphs have already shown that the link is not saturated. Standard SNMP monitoring does not typically provide the detailed flow visibility needed to identify specific applications or host conversations causing pauses.
D. Incorrect.
Incorrect. A packet broker aggregates, filters, and forwards traffic copies to monitoring tools, but it is not itself the primary monitoring technology for identifying top conversations in this scenario. It is an infrastructure component that supports tools such as packet analyzers or IDS platforms.
E. Incorrect.
Incorrect. Port mirroring can copy packets to an analyzer for deep inspection, but the scenario specifically says the administrator wants to avoid capturing every packet. Port mirroring is useful when full packet analysis is required, but flow-based monitoring is a more efficient fit for identifying bandwidth-consuming conversations over time.

N10-009 Question 204

Single answerMethods: SNMP (Traps, Management information base (MIB), Versions (v2c, v3), Community strings, Authentication)

A network administrator is deploying centralized monitoring for branch-office routers across an untrusted WAN. The monitoring platform must receive immediate alerts when an interface goes down, and the security team has required that management traffic use authentication and encryption. During testing, the administrator can poll basic device statistics, but link-down alerts are not arriving at the monitoring server. Which action should the administrator take NEXT to meet the requirements and resolve the alerting issue?

A
Configure SNMPv3 notifications on the routers to send traps to the monitoring server with the correct user and authentication/privacy settings
B
Change the routers to SNMPv2c and configure a read-write community string so traps can be encrypted
C
Update the MIB files on the routers so the devices can authenticate to the monitoring server before sending traps
D
Enable NetFlow export on the routers because interface-down events are delivered through flow records instead of SNMP traps

Show answer and explanation

Correct answer: A

Explanation

This question tests the candidate's ability to distinguish among SNMP polling, traps, MIB usage, and version/security capabilities in a realistic monitoring deployment. Immediate event-driven alerts are handled by SNMP traps (or informs), not by periodic polling alone. Because the requirement includes both authentication and encryption over an untrusted WAN, SNMPv3 is the correct choice; SNMPv1 and SNMPv2c rely on community strings and do not provide cryptographic security. The MIB is important for understanding and decoding monitored data, but it does not provide authentication or trigger alert transmission. In practice, best practice is to use SNMPv3 with authPriv when confidentiality is required, configure the NMS as the trap receiver, and ensure the proper user/security parameters match on both ends. These behaviors align with standard SNMP operational guidance and common vendor documentation for secure network monitoring.

A. Correct.
Correct. The scenario requires immediate alerts, which are best handled with SNMP traps/notifications rather than relying only on polling. Because the security requirement specifies authentication and encryption across an untrusted WAN, SNMPv3 is the appropriate version. The administrator should configure the routers to send traps to the monitoring server using the correct SNMPv3 security parameters, including the user, authentication method, and privacy (encryption) settings. Polling can work separately, but traps must be explicitly configured and directed to the manager.
B. Incorrect.
Incorrect. SNMPv2c uses community strings, but those community strings are essentially shared clear-text credentials and do not provide encryption or strong authentication. A read-write community string would also be unnecessarily risky for monitoring. This option reflects a common misconception that community strings provide secure authentication and that SNMPv2c traps can be encrypted; they cannot.
C. Incorrect.
Incorrect. MIB files define the structure and meaning of managed objects so that the management station can interpret OIDs and values. Updating a MIB does not enable authentication between devices and a monitoring server, nor does it by itself make a router send traps. This distractor targets the misconception that the MIB is an authentication or connectivity mechanism rather than a database/schema for SNMP-managed objects.
D. Incorrect.
Incorrect. NetFlow is used for traffic-flow analysis, accounting, and visibility into conversations and bandwidth usage. It does not replace SNMP traps for standard interface link-up/link-down event notifications. While NetFlow may complement monitoring, it does not solve the immediate problem of authenticated, encrypted alert delivery for interface status changes.

N10-009 Question 205

Single answerMethods: SNMP (Traps, Management information base (MIB), Versions (v2c, v3), Community strings, Authentication)

A network administrator is deploying a new monitoring platform to manage core switches across multiple sites. The company requires encrypted management traffic and per-user authentication for SNMP queries. The administrator also wants the switches to send immediate notifications to the monitoring server when an interface goes down. Which configuration should the administrator implement to meet these requirements?

A
Configure SNMPv2c with a complex read-write community string and enable traps to the monitoring server
B
Configure SNMPv3 with authentication and privacy, create user-based credentials, and enable traps or informs to the monitoring server
C
Configure SNMPv1 with a read-only community string and poll the MIB more frequently instead of using traps
D
Configure SNMPv3 without privacy, use a shared community string for all devices, and rely on periodic polling only

Show answer and explanation

Correct answer: B

Explanation

The best answer is to use SNMPv3 with authentication and privacy enabled, along with event notifications such as traps or informs. In practical network operations, this is the preferred approach when security requirements include confidentiality and stronger access control. SNMPv1 and SNMPv2c rely on community strings, which function like shared passwords but are not encrypted. SNMPv3 introduces the User-based Security Model (USM), supporting authentication and privacy features that are commonly described as auth and priv. The Management Information Base (MIB) defines the objects that can be queried or monitored, such as interface status counters, but polling MIB objects alone does not provide the fastest possible notification of failures. Traps and informs are used to send asynchronous alerts from the agent to the manager when key events occur. This aligns with common vendor documentation and IETF SNMPv3 best practices, which recommend SNMPv3 over earlier versions when security is a concern.

A. Incorrect.
Incorrect. SNMPv2c uses community strings for access control, but community strings are sent in clear text and do not provide encryption or per-user authentication. While traps can be enabled in SNMPv2c, this option does not satisfy the company's requirement for encrypted management traffic and stronger authentication.
B. Correct.
Correct. SNMPv3 is the version designed to provide improved security through user-based authentication and optional encryption, commonly referred to as authentication and privacy. This aligns with the requirement for per-user authentication and encrypted management traffic. Enabling traps or informs allows devices to send immediate event notifications, such as interface-down events, to the monitoring server instead of waiting for the next polling interval.
C. Incorrect.
Incorrect. SNMPv1 is outdated and lacks the security features required in this scenario. A read-only community string may reduce risk compared to read-write access, but it still does not provide encryption or modern authentication. Polling the MIB more frequently can help detect issues sooner, but it does not replace the value of event-driven notifications like traps for immediate alerting.
D. Incorrect.
Incorrect. SNMPv3 without privacy can provide authentication, but it does not encrypt traffic. In addition, SNMPv3 does not use community strings; it uses user-based security. Relying only on periodic polling also fails to meet the requirement for immediate notifications when an interface goes down.

Timed practice exam

Take a N10-009 practice test under exam conditions

90 questions in 90 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

N10-009 practice questions 201 to 300 of 329

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 4 pages of up to 100 questions.

More CompTIA exam dumps

All CompTIA exams

220-1101471 questions

CompTIA A+ Core 1 exam dumps

A+ Core 1

220-1102828 questions

CompTIA A+ Core 2 exam dumps

A+ Core 2

SY0-701490 questions

CompTIA Security+ exam dumps

Security+