CompTIA N10-009 Practice Test 8

Question 70

A network specialist investigates this evidence: A DNS service resolves short queries but large signed responses require reliable fallback and a firewall blocks TCP 53. Which underlying condition BEST explains the observed failure or requirement?

The requested service uses RDP rather than SSH.
DNS requires TCP 53 for some responses in addition to UDP 53.
SMB file sharing depends on TCP 445.
Time synchronization needs a reachable time source.

Explanation

Correct Answer

DNS requires TCP 53 for some responses in addition to UDP 53. Truncation and transfer scenarios can require TCP despite common UDP queries.

Incorrect Answers

The requested service uses RDP rather than SSH. That does not establish completion of the TCP three-way handshake.

SMB operates over a distinct file-service port.

TCP connections require an accepted SYN, SYN-ACK and ACK exchange before application requests. The missing change involves dNS requires TCP 53 for some responses in addition to UDP 53.

Question 71

A network team observes: A client broadcast seeking a lease never reaches a subnet's DHCP relay because the relay policy drops UDP server-client traffic. What is the MOST appropriate corrective action or technical decision?

Configure trap destinations and allow UDP 162 to the monitoring receiver.
Enforce HTTPS over TCP 443 with valid certificates and HSTS where suitable.
Permit DHCP relay flows for the appropriate server and client endpoints.
Permit supported SIP signaling on the configured 5060 or TLS 5061 path.

Explanation

Correct Answer

DHCP Discover and Offer use well-known UDP roles. Dhcp address assignment uses udp ports 67 and 68.

Incorrect Answers

Configuring trap destinations and allowing UDP 162 to the monitoring receiver would not permit DHCP relay flows for the appropriate server and client endpoints.

Enforcing HTTPS over TCP 443 with valid certificates and HSTS where suitable would not permit DHCP relay flows for the appropriate server and client endpoints.

Permitting supported SIP signaling on the configured 5060 or TLS 5061 path would not permit DHCP relay flows for the appropriate server and client endpoints.

Question 72

A network team addresses this situation: A client broadcast seeking a lease never reaches a subnet's DHCP relay because the relay policy drops UDP server-client traffic. After the corrective action, which test or result BEST verifies that the problem is resolved?

Generate an authorized test interface event and observe the trap.
Place a test call and inspect invitation and response exchanges.
Attempt plaintext access and verify redirect or rejection plus valid TLS.
Capture DHCP Discover and Offer crossing the relay.

Explanation

Correct Answer

DHCP assigns client network parameters through a supported lease exchange.

Incorrect Answers

Arrival at UDP 162 validates asynchronous notification. That check cannot demonstrate successful client IP addressing from the correct scope.

Correct INVITE and successful call setup verify signaling. That check cannot demonstrate successful client IP addressing from the correct scope.

Protocol behavior shows the protected path is required. That check cannot demonstrate successful client IP addressing from the correct scope.

Question 73

A network specialist investigates this evidence: A client broadcast seeking a lease never reaches a subnet's DHCP relay because the relay policy drops UDP server-client traffic. Which underlying condition BEST explains the observed failure or requirement?

DHCP address assignment uses UDP ports 67 and 68.
Unauthenticated plaintext web access is permitted for sensitive sessions.
Call setup signaling is separate from media transport.
Time synchronization needs a reachable time source.

Explanation

Correct Answer

DHCP address assignment uses UDP ports 67 and 68. DHCP Discover and Offer use well-known UDP roles.

Incorrect Answers

Unauthenticated plaintext web access is permitted for sensitive sessions. That does not establish successful client IP addressing from the correct scope.

Call setup signaling is separate from media transport. That does not establish successful client IP addressing from the correct scope.

TCP connections require an accepted SYN, SYN-ACK and ACK exchange before application requests. That does not establish successful client IP addressing from the correct scope.

Question 74

A network team observes: Administrators still use cleartext Telnet for router management on port 23. What is the MOST appropriate corrective action or technical decision?

Allow only approved RDP TCP 3389 via the controlled access gateway.
Disable Telnet and require authenticated SSH on TCP 22.
Permit supported SIP signaling on the configured 5060 or TLS 5061 path.
Allow SMB only on the explicitly approved internal host path.

Explanation

Correct Answer

Telnet exposes management credentials and commands in plaintext.

Incorrect Answers

Allowing only approved RDP TCP 3389 via the controlled access gateway would not address the need for disable Telnet and require authenticated SSH on TCP 22.

Permitting supported SIP signaling on the configured 5060 or TLS 5061 path would not address the need for disable Telnet and require authenticated SSH on TCP 22.

Allowing SMB only on the explicitly approved internal host path would not address the need for disable Telnet and require authenticated SSH on TCP 22.

Question 75

A network team addresses this situation: Administrators still use cleartext Telnet for router management on port 23. After the corrective action, which test or result BEST verifies that the problem is resolved?

Test RDP from approved management addresses and deny untrusted sources.
Compare clock offset before and after polling an authorized source.
Capture a management session and verify SSH negotiation without readable passwords.
Query a large signed record and verify a complete TCP retry.

Explanation

Correct Answer

Protected handshake and encrypted payload demonstrate secure CLI.

Incorrect Answers

Test RDP from approved management addresses and deny untrusted sources. It does not capture a management session and verify SSH negotiation without readable passwords.

Compare clock offset before and after polling an authorized source. It does not capture a management session and verify SSH negotiation without readable passwords.

TCP connections require an accepted SYN, SYN-ACK and ACK exchange before application requests. It does not capture a management session and verify SSH negotiation without readable passwords.

Question 76

A network specialist investigates this evidence: Administrators still use cleartext Telnet for router management on port 23. Which underlying condition BEST explains the observed failure or requirement?

The requested service uses RDP rather than SSH.
DNS requires TCP 53 for some responses in addition to UDP 53.
SMB file sharing depends on TCP 445.
Telnet exposes management credentials and commands in plaintext.

Explanation

Correct Answer

Telnet exposes management credentials and commands in plaintext. SSH encrypts interactive remote administration sessions.

Incorrect Answers

The requested service uses RDP rather than SSH. That does not establish telnet exposes management credentials and commands in plaintext.

TCP connections require an accepted SYN, SYN-ACK and ACK exchange before application requests. That does not establish telnet exposes management credentials and commands in plaintext.

SMB operates over a distinct file-service port. That does not establish telnet exposes management credentials and commands in plaintext.

Question 77

A network team observes: A file exchange uses classic FTP control on 21 and transfers credentials unencrypted over a partner link. What is the MOST appropriate corrective action or technical decision?

Use SFTP over SSH TCP 22 with approved host-key validation.
Allow SMB only on the explicitly approved internal host path.
Configure trap destinations and allow UDP 162 to the monitoring receiver.
Permit supported SIP signaling on the configured 5060 or TLS 5061 path.

Explanation

Correct Answer

SFTP uses SSH protection rather than FTP's separate data connections. Ftp lacks confidentiality for credentials and data by default.

Incorrect Answers

Allowing SMB only on the explicitly approved internal host path would not meet the need for sFTP over SSH TCP 22 with approved host-key validation. SFTP uses SSH protection rather than FTP's separate data connections.

Configuring trap destinations and allowing UDP 162 to the monitoring receiver would not meet the need for sFTP over SSH TCP 22 with approved host-key validation.

Permitting supported SIP signaling on the configured 5060 or TLS 5061 path would not meet the need for sFTP over SSH TCP 22 with approved host-key validation.

Question 78

A network team addresses this situation: A file exchange uses classic FTP control on 21 and transfers credentials unencrypted over a partner link. After the corrective action, which test or result BEST verifies that the problem is resolved?

Mount the specified share from the approved client while outside hosts remain blocked.
Inspect the transfer service port and confirm encrypted SSH session establishment.
Capture DHCP Discover and Offer crossing the relay.
Generate an authorized test interface event and observe the trap.

Explanation

Correct Answer

Successful SFTP handshake proves the intended protocol.

Incorrect Answers

Mounting the restricted file share verifies SMB/NFS file permissions, not whether the partner transfer uses an encrypted SSH-based SFTP session.

DHCP assigns client network parameters through a supported lease exchange. It does not inspect the transfer service port and confirm encrypted SSH session establishment.

Arrival at UDP 162 validates asynchronous notification. It does not inspect the transfer service port and confirm encrypted SSH session establishment.

Question 79

A network specialist investigates this evidence: A file exchange uses classic FTP control on 21 and transfers credentials unencrypted over a partner link. Which underlying condition BEST explains the observed failure or requirement?

SMB file sharing depends on TCP 445.
DNS requires TCP 53 for some responses in addition to UDP 53.
FTP lacks confidentiality for credentials and data by default.
Call setup signaling is separate from media transport.

Explanation

Correct Answer

FTP lacks confidentiality for credentials and data by default. SFTP uses SSH protection rather than FTP's separate data connections.

Incorrect Answers

SMB operates over a distinct file-service port. That does not establish fTP lacks confidentiality for credentials and data by default.

TCP connections require an accepted SYN, SYN-ACK and ACK exchange before application requests. That does not establish fTP lacks confidentiality for credentials and data by default.

Call setup signaling is separate from media transport. That does not establish fTP lacks confidentiality for credentials and data by default.

Question 80

A network team observes: Workstations drift by minutes and fail time-sensitive logs while only a web proxy is being configured. What is the MOST appropriate corrective action or technical decision?

Permit supported SIP signaling on the configured 5060 or TLS 5061 path.
Allow SMB only on the explicitly approved internal host path.
Permit DHCP relay flows for the appropriate server and client endpoints.
Configure approved NTP sources and permit UDP 123 as required.

Explanation

Correct Answer

NTP exchanges network time to synchronize clocks. Time synchronization needs a reachable time source.

Incorrect Answers

Permitting supported SIP signaling on the configured 5060 or TLS 5061 path would not configure approved NTP sources and permit UDP 123 as required.

Allowing SMB only on the explicitly approved internal host path would not configure approved NTP sources and permit UDP 123 as required.

Permitting DHCP relay flows for the appropriate server and client endpoints would not configure approved NTP sources and permit UDP 123 as required.

CompTIA Network+ (N10-009) Practice Tests

CompTIA N10-009 Practice Test 6 - 10 Questions (Last Reviewed 08-Nov-2026)
CompTIA N10-009 Practice Test 7 - 10 Questions (Last Reviewed 07-Nov-2026)
CompTIA N10-009 Practice Test 8 - 10 Questions (Last Reviewed 06-Nov-2026)
CompTIA N10-009 Practice Test 9 - 10 Questions (Last Reviewed 05-Nov-2026)
CompTIA N10-009 Practice Test 10 - 10 Questions (Last Reviewed 04-Nov-2026)

Pass Your CompTIA N10-009 Exam Easy!

Question 70

Explanation

Correct Answer

Incorrect Answers

Question 71

Explanation

Correct Answer

Incorrect Answers

Question 72

Explanation

Correct Answer

Incorrect Answers

Question 73

Explanation

Correct Answer

Incorrect Answers

Question 74

Explanation

Correct Answer

Incorrect Answers

Question 75

Explanation

Correct Answer

Incorrect Answers

Question 76

Explanation

Correct Answer

Incorrect Answers

Question 77

Explanation

Correct Answer

Incorrect Answers

Question 78

Explanation

Correct Answer

Incorrect Answers

Question 79

Explanation

Correct Answer

Incorrect Answers

Question 80

Explanation

Correct Answer

Incorrect Answers

CompTIA Network+ (N10-009) Practice Tests