PDF N10-009 Study Guide

A Security Information and Event Management (SIEM) system collects, correlates, and analyzes logs from multiple sources in real-time, providing enhanced visibility across multivendor environments.

Breakdown of Options:

A. SNMP – SNMP is used for network device monitoring, but it lacks real-time correlation across multiple vendors.

B. SIEM – Correct answer. SIEM aggregates, analyzes, and correlates logs from multiple sources, providing real-time visibility.

C. Nmap – Nmap is a network scanning tool used for mapping hosts and detecting open ports but does not provide log correlation.

D. Syslog – Syslog collects logs but does not correlate or analyze them in real-time.

Adding more access points can improve coverage, but it also increases the risk of co-channel interference if APs are configured on the same or overlapping channels. Channel overlap causes contention and interference, leading to retries, unstable performance, and symptoms that feel like frequent disconnect/reconnect events—especially in dense deployments. Network+ (N10-009) wireless troubleshooting objectives highlight proper channel planning (non-overlapping channels, appropriate channel width) as critical when increasing AP density. If adjacent APs are competing on the same channel (or overlapping channels in 2.4 GHz), clients may experience poor signal-to-noise ratios and repeated reassociations as they struggle to maintain a stable link.

Roaming misconfiguration can cause sticky clients or poor handoffs, but the classic problem introduced immediately after “adding more APs” is interference from bad channel design. Throughput capacity is about available bandwidth and airtime efficiency; it can make things slow, but it doesn’t inherently cause repeated disconnect/reconnect loops like interference does. Packet loss is a symptom that may occur due to interference, but the root cause in the options that best fits the scenario is channel overlap.

The correct answer is B. Active-passive approach. CompTIA Network+ N10-009 includes high availability and disaster recovery concepts such as failover, redundancy, and recovery strategies. An active-passive approach uses a primary production system, site, or service that actively handles traffic, while a secondary standby environment remains ready to take over if the primary environment fails. This design helps ensure data center services can be restored and made accessible quickly after a disaster because the standby environment is already planned and prepared for failover.

Backup and replication software is important for data protection, but backups alone do not guarantee that services will be quickly available. Restoring systems from backups may require significant time. Cloud computing can support disaster recovery, but it is a broad deployment model rather than a specific recovery strategy. Remote manual failover can restore services, but manual failover usually takes longer and increases the chance of administrative delay or error.

Because the question emphasizes quickly restored and accessible services after a disaster, an active-passive approach is the most appropriate option. It provides a standby recovery environment designed to assume operations when the active data center service becomes unavailable.

A proxy server can filter internet access by controlling which websites or services users can reach. It enforces content policies and can provide caching and monitoring.

A. A router directs traffic but doesn’t filter internet sites by itself.

B. A cloud gateway could also filter, but the most direct answer is proxy.

D. An IDS detects suspicious activity but doesn’t filter browsing access.

References (CompTIA Network+ N10-009):

Domain: Network Security — Proxy servers, filtering, access control.