N10-009 — Frequently Asked Questions

The new location likely has physical obstructions (walls, metal objects, or microwaves) causing signal interference or coverage gaps on the 2.4 GHz band. The 2.4 GHz band has a shorter range and is more susceptible to interference from common household and office devices (microwaves, Bluetooth, cordless phones). The administrator should perform a site survey, check for RF interference using a spectrum analyzer tool, and consider switching to the 5 GHz band for less congested channels.

Quality of Service (QoS) should be implemented first. QoS allows the network administrator to prioritize real-time traffic such as VoIP and videoconferencing over less time-sensitive data. By configuring QoS policies on the router or switch, videoconferencing traffic can be given higher priority, ensuring sufficient bandwidth and reducing latency and jitter. Checking physical signal strength is less relevant here since the issue is application-specific, not a physical layer problem.

UDP (User Datagram Protocol) is the connectionless transport layer protocol. Unlike TCP, UDP does not establish a handshake before sending data, does not guarantee delivery, does not ensure packets arrive in order, and does not provide retransmission of lost packets. This makes UDP faster and more suitable for real-time applications like VoIP, video streaming, DNS queries, and DHCP, where speed is more important than reliability.

The two best measures are: (1) Implement network segmentation using VLANs to isolate critical systems and limit lateral movement by attackers, and (2) Enable intrusion detection/prevention systems (IDS/IPS) to monitor and block malicious traffic in real time. These measures address both the structural weakness (flat network allowing easy spread) and the detection gap (no monitoring of malicious activity). Other good practices include patch management, employee training, and multi-factor authentication, but segmentation and IDS/IPS directly address breach containment and detection.

The next step is to check the Data Link layer (Layer 2) and Network layer (Layer 3). In the CompTIA troubleshooting methodology, the top-to-bottom approach means starting at the Physical layer and working upward through each OSI layer. After confirming the Physical layer is functioning (cables connected, lights on, correct cable type), the technician moves to Data Link (MAC addresses, VLANs, switches) and then Network layer (IP addressing, routing, subnetting). The methodology also includes a bottom-to-top approach and a divide-and-conquer approach as alternatives.

A /29 subnet mask (255.255.255.248) should be used. A /29 provides 8 total IP addresses, of which 6 are usable for hosts (8 total minus 1 network address and 1 broadcast address = 6 usable). A /28 would provide 14 usable addresses which is more than needed, and a /30 would only provide 2 usable addresses which is insufficient. The /29 is the most efficient choice that meets the requirement of exactly 6 usable IPs.

BGP (Border Gateway Protocol) is the routing protocol that uses Autonomous System numbers. BGP is an exterior gateway protocol (EGP) used to route traffic between different autonomous systems on the Internet. Each AS is assigned a unique AS number (1-65535 for 16-bit, or 0-4294967295 for 32-bit). BGP is responsible for routing decisions based on paths, network policies, and rule sets configured by network administrators. In contrast, OSPF and EIGRP are interior gateway protocols (IGPs) that operate within a single autonomous system.

Hybrid cloud best describes this deployment model. A hybrid cloud combines private cloud (internal infrastructure for employee access) and public cloud (external hosting for partner access) resources, allowing data and applications to be shared between them. This model provides the flexibility to keep sensitive internal data on private infrastructure while leveraging public cloud resources for broader accessibility. It differs from a pure public cloud (all resources externally hosted) or a pure private cloud (all resources internally hosted).

DNS resolution is failing. Since users can reach the server by IP address (confirming network connectivity is working), but not by domain name, the issue is with the Domain Name System. Possible causes include: incorrect DNS server configuration on the clients, DNS server being unreachable, stale DNS cache, or the A/AAAA record for the hostname not existing or being incorrect. The technician should verify the client's DNS server settings, flush the DNS cache, and check the DNS records for the hostname.

This describes a DNS poisoning (DNS spoofing) attack or a man-in-the-middle (MitM) attack. In DNS poisoning, an attacker corrupts the DNS cache so that a legitimate domain name resolves to the attacker's IP address. Users typing the correct URL are silently redirected to the malicious site. Other related attacks include phishing (social engineering via fake emails) and typosquatting (registering similar-looking domain names). To mitigate DNS poisoning, organizations should use DNSSEC (DNS Security Extensions) and regularly monitor DNS records for unauthorized changes.

East-West traffic refers to network traffic that flows between servers within the same data center or between virtual machines on the same or adjacent hosts. This is in contrast to North-South traffic, which flows between external clients and the data center servers. East-West traffic is typically associated with server-to-server communications such as database queries, replication, and microservice calls. As data centers adopt virtualization and microservices, East-West traffic has grown significantly, requiring solutions like software-defined networking (SDN) and network segmentation to manage security and performance.

X.509 certificates are most commonly associated with SSL/TLS (Secure Sockets Layer / Transport Layer Security). X.509 is the standard format for public key certificates used to authenticate the identity of websites, servers, and clients during TLS handshakes. When a browser connects to a website over HTTPS, the server presents its X.509 certificate, which contains the server's public key, identity information, and a digital signature from a trusted Certificate Authority (CA). X.509 certificates are also used in VPNs, email encryption (S/MIME), and code signing.

A static backup route (also called a floating static route) should be configured. A floating static route has a higher administrative distance than the primary static route, so it remains inactive under normal conditions. When the primary route fails (e.g., the interface goes down), the router automatically uses the floating static route as a backup. The administrative distance is set higher than the default (1 for static routes), typically between 2-254, to ensure it is only used when the primary route is unavailable.

SSL VPN (Secure Sockets Layer VPN), also known as TLS VPN, uses web browser-based connections with TLS encryption. Unlike IPsec VPNs that require dedicated client software and configure routing tables, SSL VPNs operate at Layer 7 (Application layer) and only require a modern web browser. This makes them ideal for remote access scenarios where users need secure access to specific web applications without installing additional software. SSL VPNs typically provide either full tunnel (all traffic routed through VPN) or split tunnel (only corporate traffic through VPN) configurations.

A cold site should be implemented. A cold site is a basic facility with power, cooling, and physical security but no pre-configured hardware, software, or data. It has the lowest ongoing cost but the longest recovery time (typically 24-72 hours), making it suitable for non-critical applications where downtime is acceptable. In contrast, a warm site has some pre-configured equipment and data (recovery in hours), and a hot site has fully mirrored real-time infrastructure (near-zero RTO). For non-critical apps with a 24-hour recovery window, a cold site provides the best cost-to-recovery ratio.

This is a VLAN hopping attack, specifically the double-tagging variant. In a double-tagging VLAN hop, the attacker sends frames with two 802.1Q tags: the outer tag matches the native VLAN of the trunk port, and the inner tag matches the target VLAN. The switch strips the outer tag at the trunk boundary and forwards the frame with the inner tag still intact, potentially allowing access to a different VLAN. Mitigation includes disabling trunking on access ports, changing the native VLAN to an unused VLAN, and implementing port security features like DHCP snooping and dynamic ARP inspection.

Port 587 (SUBMISSION) is the IANA-recommended port for secure email submission from email clients to mail servers. Unlike port 25 (SMTP, used for server-to-server relay) and port 465 (SMTPS, deprecated but still used), port 587 requires STARTTLS to upgrade the connection to an encrypted TLS session. This port enforces authentication before allowing email submission, making it the standard for modern email clients like Outlook, Thunderbird, and Apple Mail when configured with TLS encryption.

Split-tunnel VPN allows only traffic destined for the corporate network to traverse the encrypted VPN tunnel, while all other internet traffic (web browsing, streaming, etc.) is routed directly through the user's local internet connection. The key advantage is reduced bandwidth consumption on the corporate VPN gateway and internet link, since only internal resources require the VPN tunnel. This improves performance for both the user (faster internet access) and the organization (less load on VPN appliances), while still maintaining security for sensitive corporate resources.

An AAAA (quad-A) record maps a hostname to an IPv6 address. Just as an A record maps a domain name to an IPv4 address, the AAAA record performs the same function for IPv6 addresses, which are 128 bits long (compared to 32 bits for IPv4). For example, an AAAA record for 'www.example.com' might point to '2001:0db8:85a3:0000:0000:8a2e:0370:7334'. Both A and AAAA records can coexist for the same hostname to support dual-stack IPv4/IPv6 deployments.

802.1X port-based Network Access Control (NAC) should be implemented. 802.1X provides an authentication framework that requires users and devices to authenticate before being granted access to the network. When a device connects to a wall port, the switch port remains in an unauthorized state (blocking all traffic except 802.1X EAPOL frames) until the device provides valid credentials through an authentication server (typically RADIUS). This prevents unauthorized devices from accessing network resources even if they have physical access to Ethernet outlets. Complementary measures include disabling unused ports, implementing MAC address filtering, and using VLAN assignment based on device type.