CompTIA N10-009 Practice Test 47

Question 460

A network specialist investigates this evidence: Inbound email for a new domain fails because its DNS zone contains only A records for its website. Which underlying condition BEST explains the observed failure or requirement?

The resolver is not checking DNSSEC chain-of-trust signatures.
The alias is manually configured with stale separate addresses.
The hostname lacks the proper IPv6 DNS resource record.
The mail domain lacks an appropriate MX destination.

Explanation

Correct Answer

The mail domain lacks an appropriate MX destination. MX controls mail routing independently of a web host A record.

Incorrect Answers

DNS resolution maps hostnames to records and can fail independently of packet forwarding. That does not establish the mail domain lacks an appropriate MX destination.

The alias is manually configured with stale separate addresses. That does not establish the mail domain lacks an appropriate MX destination.

DNS resolution maps hostnames to records and can fail independently of packet forwarding. The missing change involves the mail domain lacks an appropriate MX destination.

Question 461

A network team observes: A marketing alias should follow a web application's canonical host without duplicating an address record. What is the MOST appropriate corrective action or technical decision?

Create a suitable CNAME alias where record-set restrictions permit.
Publish the correct AAAA record for the target IPv6 address.
Publish valid MX records pointing to the intended mail exchangers.
Exclude all approved static addresses from the assignable DHCP range.

Explanation

Correct Answer

CNAME aliases a DNS name to another canonical name. The alias is manually configured with stale separate addresses.

Incorrect Answers

Publishing the correct AAAA record for the target IPv6 address would not create a suitable CNAME alias where record-set restrictions permit.

Publishing valid MX records pointing to the intended mail exchangers would not create a suitable CNAME alias where record-set restrictions permit.

Excluding all approved static addresses from the assignable DHCP range would not create a suitable CNAME alias where record-set restrictions permit.

Question 462

A network team addresses this situation: A marketing alias should follow a web application's canonical host without duplicating an address record. After the corrective action, which test or result BEST verifies that the problem is resolved?

Query the authoritative name and connect using the returned AAAA address.
Query alias chain and test its resolved endpoint after the canonical address changes.
Query MX from an external resolver and deliver a test message.
Capture RA packets and verify a global IPv6 address and default router.

Explanation

Correct Answer

Query alias chain and test its resolved endpoint after the canonical address changes.

Incorrect Answers

Answer and connection verify IPv6 name resolution. That check cannot demonstrate query alias chain and test its resolved endpoint after the canonical address changes.

MX response and mail receipt validate routing. That check cannot demonstrate query alias chain and test its resolved endpoint after the canonical address changes.

Communication between different IP subnets requires a routed interface or gateway rather than Layer 2 bridging alone. Verification of this result involves query alias chain and test its resolved endpoint after the canonical address changes.

Question 463

A network team observes: A security log enrichment tool cannot map a known internal server IP back to its hostname. What is the MOST appropriate corrective action or technical decision?

Publish valid MX records pointing to the intended mail exchangers.
Publish the correct AAAA record for the target IPv6 address.
Maintain appropriate PTR entries in the reverse DNS zone.
Configure a trusted DNS-over-HTTPS endpoint and enforce client resolution policy.

Explanation

Correct Answer

PTR maps addresses to names for reverse queries. The reverse zone lacks a correct ptr mapping.

Incorrect Answers

Publishing valid MX records pointing to the intended mail exchangers would not maintain appropriate PTR entries in the reverse DNS zone.

Publishing the correct AAAA record for the target IPv6 address would not maintain appropriate PTR entries in the reverse DNS zone.

The reverse zone lacks a correct ptr mapping.

Question 464

A network team addresses this situation: A security log enrichment tool cannot map a known internal server IP back to its hostname. After the corrective action, which test or result BEST verifies that the problem is resolved?

Query MX from an external resolver and deliver a test message.
Send a deliberately invalid-signature test and confirm validation failure.
Query alias chain and test its resolved endpoint after the canonical address changes.
Perform a reverse lookup for the server's IP.

Explanation

Correct Answer

Perform a reverse lookup for the server's IP.

Incorrect Answers

MX response and mail receipt validate routing. That check cannot demonstrate perform a reverse lookup for the server's IP.

Rejection of bogus data demonstrates integrity verification. That check cannot demonstrate perform a reverse lookup for the server's IP.

Query alias chain and test its resolved endpoint after the canonical address changes. That check cannot demonstrate perform a reverse lookup for the server's IP.

Question 465

A network specialist investigates this evidence: A security log enrichment tool cannot map a known internal server IP back to its hostname. Which underlying condition BEST explains the observed failure or requirement?

The reverse zone lacks a correct PTR mapping.
Resolver transport is not using the mandated encrypted protocol.
DNS cache has a valid but stale record.
The hostname lacks the proper IPv6 DNS resource record.

Explanation

Correct Answer

The reverse zone lacks a correct PTR mapping. PTR maps addresses to names for reverse queries.

Incorrect Answers

DNS resolution maps hostnames to records and can fail independently of packet forwarding. That does not establish the reverse zone lacks a correct PTR mapping.

DNS resolution maps hostnames to records and can fail independently of packet forwarding. The missing change involves the reverse zone lacks a correct PTR mapping.

DNS resolution maps hostnames to records and can fail independently of packet forwarding. The missing change involves the reverse zone lacks a correct PTR mapping. The observed condition is a network specialist investigates this evidence: A security log enrichment tool cannot map a known internal server IP back to its hostname.

Question 466

A network team observes: A recursive resolver accepts tampered DNS data despite a signed authoritative zone. What is the MOST appropriate corrective action or technical decision?

Publish valid MX records pointing to the intended mail exchangers.
Enable validating DNSSEC resolution and maintain trust anchors appropriately.
Configure a trusted DNS-over-HTTPS endpoint and enforce client resolution policy.
Publish the correct AAAA record for the target IPv6 address.

Explanation

Correct Answer

DNSSEC verifies signed DNS responses against a trust chain. The resolver is not checking dnssec chain-of-trust signatures.

Incorrect Answers

Publishing valid MX records pointing to the intended mail exchangers would not enable validating DNSSEC resolution and maintain trust anchors appropriately.

The resolver is not checking dnssec chain-of-trust signatures.

Publishing the correct AAAA record for the target IPv6 address would not enable validating DNSSEC resolution and maintain trust anchors appropriately.

Question 467

A network team addresses this situation: A recursive resolver accepts tampered DNS data despite a signed authoritative zone. After the corrective action, which test or result BEST verifies that the problem is resolved?

Query MX from an external resolver and deliver a test message.
Query the authoritative name and connect using the returned AAAA address.
Send a deliberately invalid-signature test and confirm validation failure.
Perform a reverse lookup for the server's IP.

Explanation

Correct Answer

Rejection of bogus data demonstrates integrity verification.

Incorrect Answers

MX response and mail receipt validate routing. That check cannot demonstrate send a deliberately invalid-signature test and confirm validation failure.

Answer and connection verify IPv6 name resolution. That check cannot demonstrate send a deliberately invalid-signature test and confirm validation failure.

Perform a reverse lookup for the server's IP. That check cannot demonstrate send a deliberately invalid-signature test and confirm validation failure.

Question 468

A network specialist investigates this evidence: A recursive resolver accepts tampered DNS data despite a signed authoritative zone. Which underlying condition BEST explains the observed failure or requirement?

The mail domain lacks an appropriate MX destination.
DNS cache has a valid but stale record.
The hostname lacks the proper IPv6 DNS resource record.
The resolver is not checking DNSSEC chain-of-trust signatures.

Explanation

Correct Answer

The resolver is not checking DNSSEC chain-of-trust signatures. DNSSEC verifies signed DNS responses against a trust chain.

Incorrect Answers

The mail domain lacks an appropriate MX destination. That does not establish correct hostname resolution for the destination.

DNS resolution maps hostnames to records and can fail independently of packet forwarding. The missing change involves the resolver is not checking DNSSEC chain-of-trust signatures.

DNS resolution maps hostnames to records and can fail independently of packet forwarding. The missing change involves the resolver is not checking DNSSEC chain-of-trust signatures. The observed condition is a network specialist investigates this evidence: A recursive resolver accepts tampered DNS data despite a signed authoritative zone.

Question 469

A network team observes: A managed client sends plaintext DNS queries on UDP 53 despite a policy requiring encrypted resolver transport. What is the MOST appropriate corrective action or technical decision?

Configure a trusted DNS-over-HTTPS endpoint and enforce client resolution policy.
Publish the correct AAAA record for the target IPv6 address.
Enable validating DNSSEC resolution and maintain trust anchors appropriately.
Expand or reclaim authorized scope capacity after checking subnet sizing.

Explanation

Correct Answer

Resolver transport is not using the mandated encrypted protocol.

Incorrect Answers

AAAA records map names to IPv6 destinations. DoH carries DNS messages within HTTPS.

DNSSEC verifies signed DNS responses against a trust chain. DoH carries DNS messages within HTTPS.

An exhausted lease pool cannot serve new clients. DoH carries DNS messages within HTTPS.

Question 470

A network team addresses this situation: A managed client sends plaintext DNS queries on UDP 53 despite a policy requiring encrypted resolver transport. After the corrective action, which test or result BEST verifies that the problem is resolved?

Query the authoritative name and connect using the returned AAAA address.
Capture DNS requests and confirm encrypted HTTPS to the approved resolver.
Send a deliberately invalid-signature test and confirm validation failure.
Perform a reverse lookup for the server's IP.

Explanation

Correct Answer

Observed endpoint and lack of plaintext queries prove DoH use.

Incorrect Answers

Answer and connection verify IPv6 name resolution. Verification of this result involves capturing DNS requests and confirm encrypted HTTPS to the approved resolver.

Rejection of bogus data demonstrates integrity verification. Verification of this result involves capturing DNS requests and confirm encrypted HTTPS to the approved resolver.

Perform a reverse lookup for the server's IP. That check cannot demonstrate correct hostname resolution for the destination.

CompTIA Network+ (N10-009) Practice Tests

CompTIA N10-009 Practice Test 45 - 10 Questions (Last Reviewed 30-Sep-2026)
CompTIA N10-009 Practice Test 46 - 10 Questions (Last Reviewed 29-Sep-2026)
CompTIA N10-009 Practice Test 47 - 10 Questions (Last Reviewed 28-Sep-2026)
CompTIA N10-009 Practice Test 48 - 10 Questions (Last Reviewed 27-Sep-2026)
CompTIA N10-009 Practice Test 49 - 10 Questions (Last Reviewed 26-Sep-2026)

Pass Your CompTIA N10-009 Exam Easy!

Question 460

Explanation

Correct Answer

Incorrect Answers

Question 461

Explanation

Correct Answer

Incorrect Answers

Question 462

Explanation

Correct Answer

Incorrect Answers

Question 463

Explanation

Correct Answer

Incorrect Answers

Question 464

Explanation

Correct Answer

Incorrect Answers

Question 465

Explanation

Correct Answer

Incorrect Answers

Question 466

Explanation

Correct Answer

Incorrect Answers

Question 467

Explanation

Correct Answer

Incorrect Answers

Question 468

Explanation

Correct Answer

Incorrect Answers

Question 469

Explanation

Correct Answer

Incorrect Answers

Question 470

Explanation

Correct Answer

Incorrect Answers

CompTIA Network+ (N10-009) Practice Tests