2026年最新の実際に出るN10-009日本語問題集テストエンジン試験問題はここにある [Q408-Q432]

The correct answer is hub-and-spoke. In this design, the head office serves as the hub, and all satellite or branch offices (the spokes) connect directly to the hub using leased lines or VPNs. Communication between spokes typically passes through the hub, which centralizes connectivity and simplifies management.
A). Mesh involves every site connecting to every other site, which is more redundant but costly.
B). Point-to-point describes a single dedicated link between two sites, not a multi-site topology.
D). Star is often used in LAN switching, with all devices connecting to a central switch, but it’s not the WAN architecture typically used here.
Hub-and-spoke is a cost-effective WAN design, as fewer circuits are needed compared to full mesh. However, its main disadvantage is reliance on the hub site: if the hub goes down, inter-spoke communication fails.
References (CompTIA Network+ N10-009):
Domain: Networking Concepts – WAN topologies (hub-and-spoke, mesh, point-to-point).

Speed Mismatches: If NICs are set to different speeds (e.g., 100 Mbps on one side and 1 Gbps on the other), performance will degrade. Ensuring consistent speed settings between devices is crucial for optimal performance.
Load balancer settings (B): Applies to server load distribution, not endpoint speed.
Flow control settings (C): Can affect performance but is secondary to speed mismatches.
Infrastructure cabling grade (D): Relevant if the cables are unsuitable for gigabit speeds, but speed settings should be checked first.

サブインターフェースの紹介:
サブインターフェースは、単一の物理インターフェース上に作成される論理インターフェースです。サブインターフェースは、ルーターが単一の物理インターフェース上で複数のネットワークをサポートできるようにするために使用されます。
サブインターフェースの使用例:
サブインターフェイスは、VLAN が実装されているシナリオでよく使用されます。単一の物理 LAN ポートを持つルータには、それぞれ異なる VLAN に関連付けられた複数のサブインターフェイスを設定できます。

NTP (Network Time Protocol) synchronizes clocks across network devices, ensuring accurate timestamps in logs. This is critical for correlating events across different systems during investigations.
A). Syslog collects logs but relies on accurate timestamps already present.
B). SMTP is an email protocol, unrelated to time synchronization.
C). SNMP is for monitoring and management, not time.
References (CompTIA Network+ N10-009):
Domain: Network Operations – Time synchronization (NTP), log correlation, security operations.

DHCP snooping is a security feature on network switches that helps to prevent unauthorized (rogue) DHCP servers from assigning IP addresses to clients. By implementing DHCP snooping, the network administrator can restrict DHCP responses to authorized servers only, preventing unauthorized DHCP configurations, such as incorrect DNS IPs, from being assigned to clients.
This helps prevent man-in-the-middle attacks where malicious actors misconfigure DNS to redirect users to fraudulent sites.

PAT (Port Address Translation) allows multiple devices on a local network to share a single public IP address when accessing the internet. It translates the private IP addresses to a single public IP with different port numbers for each session. The document states:
“PAT (Port Address Translation) allows multiple devices on a LAN to share a single public IP address by assigning unique port numbers to each session, enabling internet connectivity for all devices.”

Verifying full system functionality occurs after implementing a fix. This step ensures the solution resolved the issue and that performance is back to expected levels. Comparing current throughput to baseline measurements is part of validation testing to confirm everything is within normal operational parameters.
A . Implement the solution applies the fix but does not confirm results.
C . Document findings happens at the end of troubleshooting.
D . Test the theory comes earlier, when trying to confirm the suspected cause.
Reference (CompTIA Network+ N10-009):
Domain: Network Troubleshooting – Troubleshooting methodology steps, baselines, verification testing.

The correct answer is Network bandwidth and utilization because latency issues with a SaaS (Software as a Service) application are most commonly related to network performance constraints, not local server hardware or virtualization settings. According to CompTIA Network+ (N10-009) troubleshooting objectives, technicians should evaluate bandwidth capacity, throughput, congestion, packet loss, and overall utilization when diagnosing performance issues affecting cloud-based applications.
Since SaaS applications are hosted externally by a service provider, the organization typically does not control the underlying server hardware or virtual machine configurations (Options A and D). Therefore, adjusting internal server specifications would not resolve user-side latency.
Option B, data-at-rest encryption, applies to stored data security and does not impact real-time application responsiveness.
High network utilization, insufficient bandwidth, QoS misconfiguration, or WAN congestion can significantly increase latency. Technicians should review network monitoring tools, check interface statistics, analyze traffic patterns, and verify Quality of Service (QoS) policies to ensure SaaS traffic is prioritized appropriately.
Thus, optimizing bandwidth and reducing network congestion is the most appropriate corrective action.

A speed tester helps verify available throughput and whether bandwidth constraints are preventing successful data synchronization.
Ping helps validate basic end-to-end connectivity quality by revealing latency and packet loss that can disrupt a sync process even when an initial connection succeeds.

Link aggregation combines multiple physical links into one logical connection, increasing available throughput without replacing switch hardware.

The correct answer is Autonomous system path because BGP (Border Gateway Protocol) prevents routing loops by using the AS_PATH attribute. According to CompTIA Network+ (N10-009) objectives under routing protocols, BGP is a path vector protocol used to exchange routing information between autonomous systems (AS) on the internet.
When a BGP router advertises a route, it includes its autonomous system number (ASN) in the AS_PATH attribute. As the route passes through additional autonomous systems, each AS appends its own ASN to the path. If a BGP router receives a route advertisement that already contains its own ASN in the AS_PATH list, it recognizes this as a loop and rejects the route. This mechanism effectively prevents routing loops across large-scale networks such as the internet.
Option B (Peer autonomous system) refers to neighboring BGP routers but does not describe the loop prevention mechanism. Option C (Autonomous system length) relates to path selection metrics, as shorter AS_PATH lengths are generally preferred, but this is not the loop avoidance function itself. Option D (Public autonomous system) is not a loop prevention mechanism.
Therefore, BGP uses the AS_PATH attribute for loop avoidance.

When extending a network beyond the primary equipment location, additional access/distribution switches are typically placed in an IDF (Intermediate Distribution Frame). Network+ (N10-009) infrastructure objectives differentiate between the MDF and IDF: the MDF is the main, central wiring/equipment location (often where core switches, routers, WAN demarcation, and main cross-connects reside). As a building grows or spans multiple floors/areas, an IDF is used as a secondary wiring closet to reduce cable runs, provide local switching, and aggregate user access connections back to the MDF using backbone cabling (often fiber). This supports scalability, cable management, and performance by keeping horizontal runs within recommended distance limits.
VPC (Virtual Private Cloud) is a cloud networking construct, not a physical wiring location. VXLAN is an overlay tunneling technology used in virtualized/data center networks, not where you physically install switches. The question specifically references extending the network beyond the primary equipment location, which is a classic use case for deploying an IDF to host additional switches closer to endpoint areas while uplinking back to the MDF.

このシナリオでは、ユーザーが TLS を使用して Web ブラウザ経由で企業 VPN に接続し、内部システムにアクセスする方法について説明します。この設定は、「クライアントレス」VPN として最もよく説明されます。クライアントレス VPN では、ユーザーのデバイスに VPN クライアントをインストールする必要はなく、代わりに標準の Web ブラウザを使用して接続を確立します。この方法は、追加のソフトウェアをインストールすることなく、Web インターフェイスを介してアプリケーションへの安全なリモート アクセスを提供する場合に特に便利です。

IPsec (インターネット プロトコル セキュリティ) は、サイト間接続を提供する最も安全な方法です。データの整合性、認証、暗号化などの堅牢なセキュリティ サービスが提供され、ネットワーク経由で送信されるデータが傍受や改ざんから保護されます。他のオプションとは異なり、IPsec はネットワーク層で動作し、IP ネットワークを通過するすべてのトラフィックを保護できるため、サイト間 VPN にとって最も包括的で安全な選択肢となります。

If users are unable to connect to the terminal server using the IP address 10.0.100.19 and receive an “unreachable” error when pinging it, the most likely cause is that the IP address was not reserved in the DHCP server. When an IP address is not reserved, it is possible that the address was assigned to another device, causing the terminal server’s IP address to change without proper communication or update to the users.
To resolve this issue, the technician should ensure that the IP address 10.0.100.19 is reserved in the DHCP server or manually configure a static IP on the terminal server.

Smishing (SMS phishing) occurs when attackers send fraudulent text messages pretending to be a trusted source, tricking the victim into giving up sensitive credentials. Since this came via text message, it qualifies as smishing.
A . DNS poisoning corrupts name resolution.
B . ARP spoofing manipulates MAC-to-IP mappings.
C . Vishing is phishing via voice calls, not text.
Reference (CompTIA Network+ N10-009):

VLANホッピングにより、攻撃者はスイッチを偽装してトランクリンクをネゴシエートすることで、許可なく別のVLANにトラフィックを送信できます。これにより、攻撃者は通常はアクセスできないVLANにも侵入できます。
* A. MAC フラッディングはスイッチの動作を妨害しますが、VLAN を越えることはありません。
* B. DNS ポイズニングにより名前解決が破壊されます。
* D. ARP スプーフィングはローカル トラフィックを再ルーティングしますが、VLAN トラバーサルは許可しません。
参考資料（CompTIA Network+ N10-009）：
* ドメイン: ネットワーク セキュリティ – VLAN 攻撃、不正な横方向の移動。

A CNAME record is a type of DNS record that maps a hostname to another hostname. This is useful when you want to use a different hostname for a server than its actual IP address.
In this case, the technician is setting up DNS records on local servers for the company’s cloud DNS to enable access by hostname. This means that the users will be able to access the servers by their hostnames, instead of their IP addresses.
To do this, the technician needs to create a CNAME record for each server. The CNAME record will point the hostname to the server’s IP address.

See the solution in Explanation.
Explanation:
To validate routing between networks hosting Workstation A and File Server 2, follow these steps:
* Review Routing Tables:
* Check the routing tables of Router A, Router B, and Router C to identify any missing routes.
* Identify Missing Routes:
* Ensure that each router has routes to the networks on which Workstation A and File Server 2 are located.
* Add Static Routes:
* If a route is missing, add a static route to the relevant destination network via the correct interface.
* Routing Table:
Gateway of last resort is 0.0.0.0 to network 0.0.0.0
S* 0.0.0.0/0 is directly connected, GigabitEthernet3
10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
C 10.0.4.0/22 is directly connected, GigabitEthernet2
C 10.0.6.0/24 is directly connected, GigabitEthernet2
L 10.0.6.1/32 is directly connected, GigabitEthernet2
172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C 172.16.27.0/30 is directly connected, GigabitEthernet3
L 172.16.27.1/32 is directly connected, GigabitEthernet3
* Routing Table:
Gateway of last resort is 0.0.0.0 to network 0.0.0.0
S* 0.0.0.0/0 is directly connected, GigabitEthernet1
10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
C 10.0.0.0/22 is directly connected, GigabitEthernet1
L 10.0.0.1/32 is directly connected, GigabitEthernet1
172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C 172.16.27.4/30 is directly connected, GigabitEthernet1
L 172.16.27.5/32 is directly connected, GigabitEthernet1
* Routing Table:
10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
S 10.0.0.0/22 [1/0] via GigabitEthernet1
S 10.0.4.0/22 [1/0] via GigabitEthernet2
172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C 172.16.27.0/30 is directly connected, GigabitEthernet2
L 172.16.27.2/32 is directly connected, GigabitEthernet2
C 172.16.27.4/30 is directly connected, GigabitEthernet1
L 172.16.27.6/32 is directly connected, GigabitEthernet1
* Install Static Route to 10.0.0.0/22 via 172.16.27.1 (assuming Router C’s IP is 172.16.27.1):
Destination Prefix: 10.0.0.0
Destination Prefix Mask: 255.255.252.0
Interface: GigabitEthernet3
* Install Static Route to 10.0.4.0/22 via 172.16.27.5 (assuming Router C’s IP is 172.16.27.5):
Destination Prefix: 10.0.4.0
Destination Prefix Mask: 255.255.252.0
Interface: GigabitEthernet1
* Install Static Route to 10.0.6.0/24 via 172.16.27.2 (assuming Router A’s IP is 172.16.27.2):
Destination Prefix: 10.0.6.0
Destination Prefix Mask: 255.255.255.0
Interface: GigabitEthernet2
Install Static Route to 10.0.0.0/22 via 172.16.27.1 (assuming Router B’s IP is 172.16.27.1):
Destination Prefix: 10.0.0.0
Destination Prefix Mask: 255.255.252.0
Interface: GigabitEthernet1
Summary of Static Routes:
* Router A:
* ip route 10.0.0.0 255.255.252.0 GigabitEthernet3
* Router B:
* ip route 10.0.4.0 255.255.252.0 GigabitEthernet1
* Router C:
* ip route 10.0.6.0 255.255.255.0 GigabitEthernet2
* ip route 10.0.0.0 255.255.252.0 GigabitEthernet1
These configurations ensure that each router knows the correct paths to reach Workstation A and File Server
2, resolving the connectivity issue.

Comprehensive and Detailed Explanation (paraphrased, aligned to N10-009):
A proxy server (specifically a caching HTTP/HTTPS proxy) stores frequently accessed web objects and serves them locally to clients, reducing external bandwidth consumption and improving response times.
B). Load balancer distributes traffic across servers but does not inherently cache internet content.
C). Open relay is a misconfigured mail server that permits unauthorized relaying-this is a security issue, not a caching solution.
D). Code repository (e.g., for source control) isn’t related to web content caching.
References (CompTIA Network+ N10-009):
Domain: Network Standards, Protocols, and Implementations – Application-layer services (HTTP/HTTPS), proxies and caching behavior, performance optimization.

After implementing a solution, the next immediate step is to verify full system functionality. This involves testing the system to ensure that the solution has resolved the issue and that all components are working as expected. This step ensures that the solution has addressed the problem effectively before moving on to documenting actions or reviewing lessons learned.