N10-009 practice questions
CompTIA · N10-009 · 300 questions
Original practice questions for the CompTIA Network+ (V9) exam, covering every domain of the official exam objectives.
This course contains the use of artificial intelligence.
About the N10-009 exam
- Time allowed
- 1 hour 30 minutes
- Questions
- Maximum of 90
- Passing score
- 720 on a scale of 100-900
- Format
- Multiple-choice and performance-based questions, 90 minutes
Schedule this exam The certification this earns
Exam details published by the vendor, checked 6 November 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Networking Concepts (23%) · 69 questions
- A new desktop at a retail store boots with the address 169.254.18.42 and the mask 255.255.0.0. It can reach other 169.254 addresses on the same switch and nothing on the store's 10.6.0.0 network. What does that address indicate?
- An insurance office replaces a shared hub with a switch. Stations on the same VLAN still hear broadcasts together, but a known unicast frame is no longer repeated out of every port. Which decision is the switch making?
- A retail contact center must carry live agent audio. A late packet is useless, and pausing the stream to recover a lost one would be worse than a brief gap. Which transport behavior fits that requirement?
- A university wants a device that sits in the path between the dorms and the data center and drops a known exploit before it reaches a server. A device that only receives a mirrored copy and sends an alert would be too late. Which appliance matches the requirement?
- A data center carries most of its traffic between servers inside the building, and the design should put every access switch the same number of hops from every other access switch. Which architecture matches that goal?
- A contractor will pull network cable through the open space above a branch-office ceiling. That space returns air to the air handler and is not a closed metal conduit. Which cable belongs in that space?
- A retail chain wants checkout traffic to prefer each store's private circuit and guest wireless traffic to use the broadband circuit. The choice should follow one central policy as stores are added, without rewriting every router by hand. Which design fits?
- A firewall rule must allow encrypted command-line administration of a Linux server and must keep clear-text Telnet blocked. Which destination port should the allow rule use?
- A city clerk needs a hosted permitting application, will use it only through a browser, and must not patch either the operating system or the application. Which service model fits?
- A planner must pick an address that is inside the RFC 1918 private space and will not be used on the public internet. Which address qualifies?
- A web store automatically adds computing capacity on the morning of a sale and releases that capacity the same night. Which cloud property is this?
- A retail site runs three identical web servers and wants a device in front of them that spreads client sessions and stops sending new sessions to a server that fails its health check. Which device does that?
- Two buildings on a campus are 10 kilometers apart and need a fiber link at 10 gigabits. Which medium is the appropriate choice for that distance?
- A student is labeling a capture taken on an access port. The unit that includes the source and destination MAC addresses needs a name. Which name is correct for that unit?
- A campus DHCP server sits on the same VLAN as the clients and must receive their discovers and return offers. Which ports carry that exchange?
- A technician must plug a small duplex fiber connector into an SFP on a factory switch. Which connector is that small duplex form?
- A customer needs an isolated virtual network inside a public cloud, kept separate from other customers' networks. Which construct provides that isolation?
- A factory training video must reach many subscribed receivers, must not be delivered to every host on the subnet, and must not be copied once per viewer. Which delivery method fits?
- A 40-person office does not need a separate core tier and a separate distribution tier. Which design keeps an access layer and merges those two upper tiers?
- A campus lab needs addresses for 100 usable hosts and wants the smallest common prefix that still fits them. Which prefix should be assigned?
- Two data halls must extend the same VLAN across a layer-3 underlay between them. Which technology encapsulates the original layer-2 frame so that VLAN can cross the underlay?
- During a campus migration, each server must keep its IPv4 address and also run IPv6 on that same interface. Which approach is this?
- A library branch is installing a cable modem, and the coax lead ends in a threaded connector that screws onto the modem. Which connector is that?
- A factory database team wants a block device delivered over the storage network, so the server sees a disk as if it were local. Which design provides that?
- A library router chooses a next hop between two subnets by comparing the destination IP address with its routing table. Which layer makes that forwarding decision?
- A workstation in city hall loads a public website, and the packets leave the data center toward the internet. Which name describes that direction of traffic?
- A campus filter drops ping to a server, yet browsers on the same PCs still open that server with HTTPS. Ping does not use a TCP or UDP port. Which protocol is ping using?
- A school lab is sorting four IPv4 addresses before a multicast exercise. Which address is the IPv4 multicast address?
- Payroll stays in the company's own data center, and the public website runs in a public cloud. Which deployment model is that?
- Multicast routing updates must cross an IP network between two data halls. Encryption will be added as a separate IPsec layer, and the encapsulation itself must not encrypt. Which encapsulation fits?
- On a busy factory link, voice must be queued ahead of the nightly backup so the backup cannot starve the calls. Which feature does that?
- A student browser loads a school web page with HTTP, a protocol that sits at the top of the OSI model. Which layer is HTTP associated with on that model?
- Retail instances in a private cloud subnet have no public addresses. They must open outbound internet sessions and must not accept inbound connections from the internet. Which service provides that egress?
- A city-hall router decrements a field on every hop, discards the packet when the field reaches zero, and can send time exceeded. That same behavior lets traceroute map the path. Which field is it?
- On the OSI model this exam uses, a study item asks which layer is associated with data formatting and encryption. Which layer should the candidate name?
- A thrift-store counter still uses a hub between the register and the wall. Every bit that arrives on one hub port is repeated out of the other ports, and the hub never reads a MAC address or an IP address. Which OSI layer is that behavior?
- A factory aggregation switch needs a transceiver for a 40-gigabit Ethernet port, and the port takes the larger four-lane optic form factor. Which part matches the port?
- A warehouse handheld answers a ping to 127.0.0.1 and still cannot reach any host on the floor. What did the successful ping prove?
- In a data-center row, cost is acceptable and no single link failure may isolate a switch, because every switch has a direct link to every other switch. Which topology is that?
- A label printer sits on the same user VLAN as the payroll PCs at city hall. The printer must not reach payroll merely because it shares that VLAN, and each request has to be checked. Which approach is that?
- Two switches in the same data-center rack need a short 10-gigabit copper link, and pulling fiber for that jump would be wasted. Which cable fits?
- A retail scheduling application runs in a public cloud where many customers share the provider's physical hosts and depend on the provider to isolate them from each other. Which cloud trait is that sharing?
- Payroll files at a county office still move with clear-text FTP on TCP 21. The transfer should change to the encrypted file service that uses the Secure Shell port. Which service and port replace FTP?
- Staff at a school must browse the internet through one system that authenticates them and logs every site they open. Which system does that job?
- A community college links two buildings with one dedicated wireless bridge and has no third site on that link. Which topology is the bridge?
- A retailer serves the same product images to shoppers far from its only data center. Which function places cached copies of those images closer to the shoppers?
- A community college lab asks which OSI layer opens, keeps, and closes the dialogue between two applications. Which layer owns that job?
- Two closets in a government building are 150 meters apart and the link must be fiber. The team wants the short-reach fiber type used inside buildings, not a long-haul type. Which medium fits?
- A university announces the same DNS resolver address in three cities, and routing sends each campus to the nearest copy. The address is not a multicast group and is not delivered to every host. Which method is this?
- A school lab needs a new IPv4 subnet with at least 50 usable hosts and with as little wasted address space as possible. Which prefix should the lab choose?
- A hospital team deploys its own patient-portal code. The cloud provider patches the operating system and the runtime, and the team does not manage virtual machines. Which service model is this?
- A credit union runs its branch firewall as a virtual machine on a host, not as a separate hardware appliance. Which concept describes that choice?
- A technician in a government closet needs the larger square push-pull fiber connector, not the small duplex connector used on an SFP. Which connector is that?
- A logistics company keeps switch configurations as versioned templates and uses automation to apply them, instead of typing each change by hand. Which practice is that?
- A payroll transfer between two clinics must be encrypted on the IPsec path, not merely checked for tampering. Which protocol provides that encryption?
- A campus instructor asks which headers wrap application data as it moves down the stack for transmission. Which sequence is the one this exam uses?
- A retail chain wants every store to reach the data center, and stores must not have direct circuits to each other. A link between every pair of sites costs too much. Which topology fits?
- A clinic edge router must not advertise an inside source address onto the public internet if that address is private. Which address is private and therefore needs translation first?
- A cloud web server allows inbound TCP 443, and the matching return traffic is allowed without a separate outbound rule. Which cloud control behaves that way?
- A large university has many buildings and wants separate access, distribution, and core layers so building switches do not all attach directly to the core. Which design is that?
- Many remote laptops at a law firm must terminate their encrypted tunnels on one device at headquarters. Which device is built for that job?
- A ranger station has no fiber, no copper path, and no usable cellular signal back to the agency. Which medium can still carry the link?
- Two firewalls at a bank must negotiate keys and security associations before encrypted payloads can flow. Which protocol performs that negotiation?
- Remote staff and small branches of an insurer need the same inspection, delivered from the cloud, without hauling every session back to one office firewall. Which approach fits?
- A university adds application capacity every year because enrollment keeps growing, and that capacity must stay in place. Which cloud property is this?
- A bank must move card data into its cloud provider without that traffic crossing the public internet, including inside a VPN. Which connection meets that constraint?
- A workstation must reach every other host on its own subnet at once, the way an address-resolution request does. Which delivery method is that?
- A retail store's only fiber circuit is down. A strong cellular signal is available, and the store wants a backup path that can use it. Which medium fits the backup?
- A lab's clients must stay IPv6-only, and they still need to reach one server that has only an IPv4 address. Which translation lets them?
Network Implementation (20%) · 60 questions
- After a new access switch is added, traffic between two floors starts taking a long path through that closet. All switches still use the default bridge priority, and the new switch has the lowest MAC address. Which change puts the core switch back in charge of the topology?
- A warehouse is placing three 2.4 GHz access points along one aisle, and each radio will use a 20 MHz channel. Which channel set keeps those three radios from overlapping one another?
- A retail closet goes dark the instant utility power drops, even though the rack's metered power strip still has spare outlets and contains no batteries. Which device is missing if the switches must stay up long enough to shut down cleanly?
- A library router holds an OSPF route for 10.40.0.0/16 and a static route for 10.40.8.0/24 toward the branch firewall. Which route forwards a packet destined for 10.40.8.20?
- A retail shop has one public IPv4 address, and dozens of laptops browse at the same time. The firewall rewrites each private source address to that public address and tracks a different source port for every session. Which translation is this?
- Two access switches trunk several VLANs, but devices on the untagged VLAN can reach the wrong subnet whenever traffic crosses the trunk. Tagged VLANs on the same trunk behave normally. Which trunk setting is mismatched?
- A stub branch office has one router and one path to headquarters. The staff do not want a routing protocol running on that single link. Which design fits the office?
- Two distribution switches have two parallel cables between them. The designer wants both cables forwarding and wants traffic to survive if one cable is unplugged. Which feature should be configured on the pair?
- Hosts on a factory LAN use 10.8.8.1 as their gateway. That address is not a physical interface on either router. When router A is powered off, router B starts answering for 10.8.8.1 and the hosts keep working. Which feature is this?
- A school keeps the service entrance, the core router, and the main patch field in the basement. Each floor has a smaller locked closet that patches only that floor back to the basement. What is the floor closet?
- Five access points in a warehouse advertise one network name so phones can roam the aisles. Each radio still has its own MAC address. Which identifier stays the same as a phone walks, and which one changes?
- A small office has no RADIUS server and wants wireless encryption whose personal-mode handshake replaces the older shared-passphrase handshake. Which security mode fits?
- Servers in a data hall send jumbo frames, while a switch in the middle of the path still allows only the standard 1500-byte payload. Large copies fail, and 200-byte pings succeed. Which change fixes the copies?
- A long narrow warehouse aisle needs the radio energy aimed along the aisle rather than sprayed into a nearby office. Which choice fits that coverage goal?
- A PDU meter on a data-center rack shows the circuit already near its rated load, and a project wants to add a chassis to that rack. What is the correct conclusion?
- A winter closet at city hall is so dry that technicians get static shocks whenever they touch a switch. Which condition explains the shocks?
- A university needs a dynamic routing protocol that floods link-state advertisements and computes a shortest-path tree. Which protocol does that?
- A branch-office phone and a PC share one wall jack. The phone's frames are tagged into the voice network, and the PC stays untagged on the data network. Which switch feature creates that split?
- A hotel front-desk printer link shows late collisions and input errors. One switch port is locked to 100 full and the printer is set to auto. Which change matches the two ends?
- A school wants visitors to see a sign-in page before they reach the internet, and those visitors must not join the staff VLAN. Which design fits?
- A warehouse wants forty access points to receive one configuration and to coordinate roaming from a controller. Which design fits?
- Two warehouse switches must carry several VLANs across one uplink, with each VLAN identified by a tag. Which method does that?
- A factory and its parts supplier must exchange routes between their separate autonomous systems. Which protocol is built for that exchange?
- A factory router has one LAN port that must act as the gateway for three VLANs. The switch trunks all three VLANs to that port. How should the router be configured?
- A campus access point operating on 5 GHz leaves its channel as soon as it detects radar. Which behavior is that?
- A library wants dual-band clients encouraged onto 5 GHz so the crowded 2.4 GHz band stays usable for devices that need it. Which feature does that?
- A campus wants an advanced distance-vector routing protocol that can keep a backup feasible successor ready for a fast cutover. Which protocol is that?
- A retail mail server must always appear on one dedicated public address that maps to exactly one private address. Which translation is that?
- On a warehouse switch running classic spanning tree, which port state is the one that actually forwards user frames?
- A data-center switch is labeled port-side intake, so it pulls cool air in through the port face. Which way should that face be installed?
- A library switch has no VLAN 40 yet, and a new catalog PC must be an access port in VLAN 40. What has to happen on the switch before that assignment will stick?
- Scanners in a warehouse should use the layer-3 switch as their gateway for VLAN 20. The gateway address must be configured on a virtual interface that belongs to VLAN 20 on that switch. Which interface is that?
- A data-center router learns the same server prefix by OSPF on two paths. One path has a lower OSPF cost than the other. Which path does OSPF place in the routing table?
- A retail edge router should send unknown internet destinations to the ISP and should not learn a route for every public prefix. Which route does that job?
- Horizontal cables in a school should be installed so a closet switch can be replaced with short patch cords and nobody has to re-terminate the cable inside the wall. Where should those runs land?
- A campus must revoke one departing student without changing a passphrase that every other student still uses. A RADIUS server is already available. Which wireless authentication fits?
- A new OSPF area on a campus was connected only to area 2. Routers in the new area cannot complete inter-area routing. Which change follows the OSPF design rule?
- Campus users sit on VLAN 20, and the building uplink still has to have a native VLAN. Which native VLAN setting keeps untagged frames out of the user VLAN?
- A wall jack in a warehouse office feeds one PC. The switch port should accept only that PC's untagged user VLAN and should refuse tagged frames from the user. How should the port be set?
- A hotel branch router shows two routes for the same 10.4.0.0/16 prefix. The static route lists administrative distance 1 and the OSPF route lists 110. Which route is installed?
- On a non-root access switch in a factory, one forwarding port is that switch's best path toward the root bridge. Which spanning-tree role is that port?
- Two student laptops in a campus lounge pass files straight to each other, and no access point takes part in the exchange. Which wireless arrangement is that?
- Two neighboring warehouse access points both use 80 MHz channels in the 5 GHz band, and clients between them show high retries. SSIDs and security already match. Which change addresses the overlap?
- One distribution switch is set to bundle two uplinks with LACP. The peer switch leaves those ports as separate access ports, and no bundle forms. What must change?
- A data room in a courthouse must have fire suppression that will not soak the switches and routers if it discharges. Which choice fits the equipment?
- A retail closet's switches are logging thermal alarms. The room is hot and the intake air is above the vendor's operating range. Humidity is normal and the UPS is idle. Which condition is the fault?
- A warehouse has power in every aisle and no Ethernet drop for most aisles. Access points must backhaul by radio through neighboring access points to the wired network. Which design fits?
- A campus edge learns internal routes from OSPF, which uses administrative distance 110 on this router. A backup static route for the same prefix uses distance 200 and should be used only if the OSPF route disappears. What is that static route?
- A square hotel lobby needs wireless coverage in every direction around one ceiling access point. Which antenna fits that room?
- A PC on a campus access port waits through listening and learning before it can request a DHCP lease. The port connects only to that PC. Which change fits?
- Two routers at a clinic share a virtual gateway address. After a failure the backup held that address. When the preferred router returned, the virtual address moved back to it. Which feature did that?
- Empty gaps in a data-center rack let hot exhaust curl around into the switch intakes. Which install practice closes those gaps?
- A hotel SSID is enabled only on the 6 GHz band. A laptop that has only 2.4 GHz and 5 GHz radios cannot join it. Which limitation explains that?
- Laptops in a library must associate to an access point that is connected to the wired network. They must not talk only to each other. Which wireless mode is this?
- A cafe has one access point, no wireless controller, and no second access point to relay through. Which access-point mode fits?
- Two routers in a store share a virtual gateway address. DHCP gives clients router A's physical address. When A fails, clients do not follow router B. Which change fixes the handoff?
- Campus wall ports already forward immediately for PCs. A switch plugged into one of those jacks must be kept out of spanning tree. Which control should be added on those ports?
- Handheld scanners at a warehouse cannot use WPA3, and the site has no RADIUS server. The wireless link still needs a passphrase. Which security choice fits?
- A campus is turning up a new copper uplink between two switches. Which setting avoids a duplex mismatch on that link?
- Guest laptops at a hotel must reach the internet and must not reach each other. Which wireless control enforces that separation?
Network Operations (19%) · 57 questions
- A data center polls its switches with SNMP version 2c, and a capture on the management VLAN shows the community string in clear text. Which change removes that clear-text string and adds both authentication and encryption to the polls?
- Hotel desk phones on a new voice VLAN broadcast for an address, but the only DHCP server sits on a server VLAN two hops away. The router between them is not turning that broadcast into a directed request. A scope for the voice subnet already exists on the server. Which feature must be added on that router?
- Purchasing can no longer order this firewall model, and the vendor will keep publishing security fixes for it through next June. Which life-cycle description is accurate today?
- A storm knocks down routing between a library and its branch, and the branch switches stop answering their management addresses. Staff can still open those switch consoles through a console server reached over a separate cellular line. Which management path is the cellular console server?
- A school technician must find which patch-panel port and which switch port connect to a classroom wall jack labeled B-14, without unplugging working cables to test them. Which record answers that directly?
- A retail chain can lose no more than 15 minutes of sales transactions, and stores can sell on paper for up to four hours while systems return. Which target is the 15-minute figure?
- Data-center administrators must open SSH to one hardened host first, and only that host may open SSH onward to the servers. Direct SSH from the internet is closed. Which design is this?
- A network owner needs a week-long record of which internal addresses talked to which internet addresses and roughly how many bytes moved. Storing every frame, including payloads, is more than the storage budget allows. Which monitoring data fits?
- A library website resolves for IPv4 clients and fails for a test client that has only IPv6. The name has an address record and no IPv6 address record. Which record should be added?
- A university requires a second location that already holds current copies of student records and can take over registration with only a short cutover. Cost is acceptable. Which recovery site matches?
- A school enabled DNSSEC and told students that a coffee-shop network can no longer see which names their laptops look up. Which statement about that belief is accurate?
- A library technician wants to tighten a production firewall rule tonight. Policy requires an approved, scheduled change record before any production edit. What should the technician do?
- A library mail server's outbound messages are refused because its public address has no reverse DNS. Which change addresses that refusal?
- A campus badge printer must keep the same address every day and must still learn its DNS server and default gateway from DHCP. Which configuration does both?
- An IDS in a research lab must see a copy of one server's traffic without sitting inline. The switch can copy that server's frames to the sensor port. Which feature should be used?
- A switch model a warehouse plans to buy averages a long time between failures. Which figure states that property?
- A retail switch was edited by hand and no longer matches the approved baseline stored in change control. What should operations do with that drift?
- Security requires that a remote laptop's internet traffic and its corporate traffic both pass through headquarters for inspection. Which VPN design meets that requirement?
- A library cannot order a security incident because the firewall log and the server log disagree by several minutes. Which change puts those clocks on one timeline?
- Library staff sit in a conference room, talk through a flood scenario, and do not move or fail over any system. Which exercise is that?
- Every Monday at 2 a.m. a campus uplink reaches about 90 percent utilization, matching the backup window already recorded in last month's baseline. How should operations treat that spike?
- Two office technicians assigned the same address to two new servers because each copied an old spreadsheet. Which practice stops the next duplicate?
- Before any campus access point is mounted, the wireless team walks each floor and records signal levels at the classrooms. Which record is that walk producing?
- A factory switch no longer answers SSH or its web page because its management address is gone. A serial console on the switch still responds. How should the technician get in?
- Remote office staff say video meetings are slow because every internet flow hairpins through headquarters. Security has approved local breakout for internet video, while corporate applications must stay in the tunnel. Which change fits?
- A traveler on a cafe's open wireless network can see that a person at the next table is reading the laptop's DNS queries. The laptop should send those queries inside HTTPS. Which feature does that?
- School laptops build IPv6 addresses from the prefix inside a router advertisement, and no DHCPv6 server exists. Which method is forming those addresses?
- A warehouse is sending a closet switch out of the building for good. Staff must wipe its configuration, remove it from inventory and monitoring, and revoke its device account. Which process is that?
- City hall already sends firewall, VPN gateway, and server logs to a collector. The team now needs those logs correlated, with one alert when they form an incident. Which system adds that?
- City payroll must be usable again within 8 hours after an outage. Losing one hour of payroll data is a separate limit. Which target is the 8-hour figure?
- A data-center monitoring platform should pull interface counters from the switches through their API instead of scraping each switch web page. Which approach is that?
- Both of a university's data centers serve live students at the same time, and either center can keep serving if the other one stops. Which availability design is that?
- City-hall PCs receive a DHCP address in the correct subnet and a correct mask, and they have no default gateway and no DNS server. The scope options are blank. Which change supplies what is missing?
- The hotel front desk should learn that an uplink went down immediately, not at the next five-minute poll of the switch. Which message provides that immediate notice?
- A city-hall access switch has failed, and the vendor will replace it under warranty only if the serial number and the warranty date are on file. Which record holds those facts?
- A monitoring station needs the catalog of objects a factory switch can report through SNMP. Which set of definitions is that catalog?
- A school facilities lead wants a drawing of subnets, router hops, and which VLAN sits behind which gateway. Cable paths and rack elevations already exist. Which drawing answers that request?
- Factory engineers manage the switches through a management VLAN that rides the production network. When production routing fails, management fails with it. Which management path is that?
- Overnight a warehouse switch's running configuration gained a VLAN that the approved baseline does not contain. Interfaces stayed up and utilization looked normal. Which monitoring type caught that?
- The library's primary DNS server is powered off. Clients still receive authoritative answers for the library zone from the server that received a copy of the zone by zone transfer. Which server is answering?
- A factory DHCP scope covers 10.8.8.0/24. The gateway 10.8.8.1 and two printers are static inside that range. A laptop is later leased 10.8.8.1 and the gateway disappears. Which setting should have prevented that lease?
- A county records office can wait several days after a disaster and must spend as little as possible. It can rent space and power, and it would buy equipment only after the disaster. Which site type fits?
- One lab PC at a university resolves the portal name to a lab address. DNS on the university resolver returns the production address. That PC has the lab address in its hosts file. Why does only that PC differ?
- An engineer must set the same VLAN description on 40 campus switches, in a way that can be repeated next semester. Which management method fits that job?
- The operations desk sees a warehouse switch stop answering polls. The dashboard marks it down. Nobody compared its configuration, and utilization is blank because it cannot be reached. Which monitoring reported that?
- A retail office lost its internet circuit for part of a day and wants the uptime the provider committed to, plus the credit if that commitment was missed. Which record answers that?
- A university standby site already has servers installed. Data must be restored from backup after a disaster. The university can wait several hours and cannot wait days to buy equipment. Which site is this?
- Two hospital buildings need their internal subnets to reach each other through an encrypted tunnel. The routers will bring the tunnel up, and staff must not launch a VPN client. Which VPN fits?
- A contractor at an agency may use only a browser to reach one published application and must not install a VPN client. Which access method fits?
- A technician in a hospital closet needs to know which rack unit holds the firewall. Cable paths and IP subnets are already documented. Which drawing answers that?
- A campus team tracks the average time required to repair a failed access switch and restore service. Which measure is that average?
- A new switch in a retail closet is passing traffic, and the monitoring platform does not list it until a scan of the management subnet finds it. Which monitoring function is that scan?
- Senders cannot deliver mail to a university domain. Public DNS for that domain has address records and no mail-exchanger record. Which record should be added?
- A retail chain allows production switch updates only during an approved maintenance window. A critical patch is ready at noon, outside that window. What should the engineer do?
- A city wants proof that operators can move service to the spare site and move it back. They will perform the move, not only discuss it. Which exercise is this?
- A hospital runs live electronic records in one data center. A second data center has the systems ready and does not serve users until the first site fails. Which pattern is this?
- A factory switch failed and will not boot. The replacement must be rebuilt from a copy of the configuration that was stored somewhere other than that switch. Which practice makes the rebuild possible?
Network Security (14%) · 42 questions
- Guests at a hotel join a wireless name that matches the front desk's posted network, but the access point is not on the hotel controller and it presents its own sign-in page. Which attack is this?
- A law office wants each wall port to forward no user traffic until the attached laptop authenticates with a user certificate against the office RADIUS server. Which control provides that?
- Remote payroll clerks at a retail chain sign in with a password and then type a six-digit code from an authenticator app on a phone they carry. Which control does that second step add?
- An attacker on a campus switch's native VLAN sends a frame that carries two VLAN tags. The first switch strips the outer tag, and the inner tag delivers the frame into another VLAN. Which attack is this?
- At an office building, a person without a badge follows an employee through a door that locks after each badge read, pretending to carry boxes. The employee holds the door. Which attack is this?
- Workstations at a branch suddenly send their internet traffic to a laptop. A capture shows repeated gratuitous ARP replies binding the gateway's IP address to the laptop's MAC address. Which attack is that?
- A retail chain wants every cashier to receive the same point-of-sale rights without an administrator editing dozens of permissions on each new account. Which control does that job?
- A city-hall lobby has a wall jack that no device is supposed to use. A visitor who plugs in should not get a link light. Which hardening step matches that requirement directly?
- A contractor at a shipping depot needs a VPN sign-in and read access to one shipment share for two weeks. The admin is about to add the contractor to the domain administrators group because that group can already reach the share. Which principle does that choice violate?
- A retail employee receives an email that looks like the payroll vendor and is asked to type a network password into a lookalike site. Which attack is that?
- An office firewall permits only the office subnet to reach the servers and contains no explicit deny rule. Guest traffic matches no rule and is dropped. Which behavior drops it?
- An internal web tool at a factory presents a certificate the server signed itself, and browsers warn even though the session is encrypted. Which change removes the warning without giving up encryption?
- A retail payroll spreadsheet was mailed to the wrong distribution list. The file was not altered, and the mail server stayed up. Which principle of the CIA triad was harmed?
- A laptop on a retail user VLAN answers DHCP discovers from other clients and offers its own address as the default gateway. Which problem is present?
- A public web server for city hall must be reachable from the internet and must not sit on the internal LAN with the staff computers. Where should the server be placed?
- A retail file download finishes, yet bytes in the file were changed by a compromised router that forwarded the transfer. Which attack fits?
- A retail website is knocked offline by traffic from thousands of compromised cameras at once. No data on the site was changed. Which attack is this?
- People who are not staff can walk into an unlocked school closet and plug a laptop into a switch. Which control addresses that?
- A hotel booking site stores names and email addresses of European Union residents and stores no payment card data. Which framework should the design be checked against?
- A hotel lobby access point permits only listed MAC addresses. An attacker clones an allowed address and joins the network. Which statement fits?
- A city-hall employee signs in once at an identity provider, and a cloud permitting application accepts the signed assertion without asking for a second password. Which technology carries that assertion?
- A warehouse wireless passphrase was posted on the break-room wall, and the contractor who knew that passphrase has left the job. Which action is proper key management?
- In a retail back office, a person in the next chair watches a cashier type a password into the register and then uses that password. Which attack is the watching?
- A city library must stop patrons from opening betting.example and must leave other entertainment sites available. Which control matches that narrow block?
- A factory's machine network must not share a VLAN with guest laptops that visitors bring onto the wireless network. Which design matches that requirement?
- An office VPN asks for a code from an authenticator app that changes every 30 seconds, so a code someone copied from the screen stops working at the next change. Which factor is that code?
- A hotel VPN appliance is missing several published security fixes and is still exposed to the internet. Which security term describes that unpatched appliance?
- Staff at a hotel are sent to the wrong address when they use the real name of the booking site. The resolver's cache holds a forged record for that name. Which attack is this?
- A visitor on a campus access port sends frames with a new source MAC address until the switch MAC table is full. Legitimate frames then leave every port. Which attack is this?
- A clinic wall jack should accept one computer. A second laptop, plugged in through a small switch on that jack, must not get on the network. There is no RADIUS server. Which control fits?
- A stolen office laptop's disk was readable when it was attached to another machine. The VPN had encrypted the laptop's traffic only while the laptop was online. Which control was missing?
- A campus bookstore stores and processes payment card numbers on its point-of-sale systems. Which framework applies to that card data?
- A city office wants each laptop to log on to the wireless network with an account checked by a central server. Device command authorization is a later project. Which service should the access points use for that logon?
- Staff at a city hall sign in once and then open email and the file portal with no second password prompt. Which access method is that?
- Someone plugged an unauthorized access point into a conference-room jack at a factory. It advertises its own network name, not the factory's name. Which attack is this?
- A payroll file on a city server is encrypted on disk. Analysts download it across the network in the clear, and a capture shows the contents. Which control is missing?
- A new firewall at a warehouse still has the vendor's default admin password and is about to be placed on the network. Which hardening step fits before it goes into production?
- A clinic downloads an installer and the file's hash no longer matches the hash the vendor published. The server is up, and the installer was never a secret. Which security goal failed?
- Network engineers at a retailer must authenticate to the routers, and the router must authorize each configuration command. Which service fits that device administration?
- Printed network diagrams, with addresses and device names, are found in the trash behind a county office. Which attack gathered them?
- A school wants to block the whole social-media category and still allow other categories of websites. Which control fits?
- A security team places one decoy host on a lab network. It holds no real data and exists to log whoever attacks it. Which control is that host?
Network Troubleshooting (24%) · 72 questions
- A new fiber run between two campus buildings shows link-down on both switches. The transceivers match. A visual fault locator injected at the near transceiver's transmit position is visible at the far transceiver's transmit position. Which fault does that pattern indicate?
- A warehouse handheld scanner reaches the print server on its own subnet by IP address, but IP packets to the inventory host on a different subnet never arrive. The scanner's address and prefix match the VLAN on its switch port. Which misconfiguration on the scanner explains the failure?
- A branch PC pings its default gateway, and the gateway can ping the data-center server, but the PC's ping to that server dies somewhere in between. Which tool shows the last router that still answers along the path?
- A cashier PC at a retail store shows link lights and leases 10.30.20.25 with gateway 10.30.20.1, which answers. The point-of-sale servers are on 10.30.10.0/24, and the wall port was supposed to be that sales VLAN. Which cause fits the lease the PC actually received?
- Phones at a call center play a stretch of clear audio and then a burst of clipped words. One-way delay stays near 40 milliseconds and packet loss stays near zero. Which impairment matches that pattern?
- A print-shop switch shows CRC errors climbing on one access port. The cable for that port is tied tightly along a fluorescent ballast, and moving the cable away makes the counter stop climbing. Which physical problem was the ballast causing?
- Users on a trading floor say the internal market feed stutters. The switch uplink to the feed server shows output drops climbing and utilization pinned at the interface rate. Ping loss appears only while the drops are climbing. Which problem does that pair of symptoms indicate?
- A teacher reports that the classroom display is off the network. The technician has not asked what changed this morning, what the symptom looks like, or whether any neighboring room is affected. Which step comes next?
- A server team knows a database server's MAC address and needs the access-switch port where that server is patched, without tracing cables. Which switch display answers it?
- A cable tester on a new city-hall desk run reports split pairs and high crosstalk, and gigabit will not link. The run is about 20 meters, and the pairs were untwisted and punched onto the jack. Which fault fits those results?
- Two packing stations in a warehouse take turns losing the network. Both claim the address 10.4.4.25, and the switch ARP behavior shows that address flipping between two different MAC addresses. Which fault is this?
- A new ceiling access point never powers on. Its data sheet requires 20 watts at the access point, and the switch port only offers IEEE 802.3af. Which limitation explains the dark access point?
- A technician suspects a single patch cord because one desk has no link and the switch port works with a laptop and a different cord. No cable test has been done yet. Which methodology step comes next?
- A factory branch router can ping every internal subnet listed in its routing table and cannot reach any internet address. The table contains no 0.0.0.0/0 entry. Which omission explains the internet failure?
- A hotel front-desk PC pings the reservation server by IP address and fails when the same test uses the server's name. Which tool should test the name lookup next?
- A warehouse host is addressed 10.1.1.10 with mask 255.0.0.0. It sends an ARP for 10.2.2.2 instead of forwarding that packet to its gateway. The mask should be 255.255.255.0. Why does it ARP?
- Two neighboring 2.4 GHz access points in a library use channels 1 and 2 at 20 MHz, and users near both see high retries. Which change addresses that overlap?
- A copper run to a hotel guest room measures 120 meters, and gigabit Ethernet will not stay up. The standard Ethernet channel is 100 meters. Which fault fits that measurement?
- Replication between a city agency and a site on another continent shows a steady 180-millisecond delay and almost no loss. Transfers feel slow, and loss counters stay near zero. Which impairment is this?
- A school technician theorized that a classroom cord was bad. A tester shows the cord is good, and the link is still down. Which methodology step comes next?
- An unlabeled copper drop in a school closet must be identified at the patch panel without guessing which port it uses. Which tool pair does that job?
- A warehouse switch shows CRC and input errors climbing on one uplink while the conveyor PCs are busy. Which display reports those counters for that interface?
- Two wall jacks in a school lab were patched together with a cable. Utilization on every port spikes, MAC addresses flap between ports, and spanning tree is turned off on that switch. Which fault explains it?
- A factory voice call on a rolling cart drops each time the cart moves from one access point to the next. The second radio uses a different security mode, and the two cells barely overlap. Which fault fits?
- A data-center server sends frames larger than the switch port allows. The switch counts giants, while small frames pass cleanly. Which fault matches those counters?
- At a retail store the fix is already in place, the user confirms the application works, and preventive steps have been noted. Which methodology step should the technician complete now?
- A factory switch port shut itself off after a port-security violation. Nobody had configured the port as administratively shut down. Which state is the port in, and what restores service?
- An office server answers on the admin VLAN. The office subnet has a correct route toward it, yet traceroute from an office PC stops at the firewall, and that firewall has an ACL. Which cause fits?
- A factory fiber link stays down. One end has a multimode 850 nm optic and the other end has a single-mode 1310 nm optic. Which fault is this?
- A ping from a branch office to headquarters shows about 20 percent loss, and file copies collapse under retransmissions. Delay stays modest. Which impairment is this?
- A branch hotel can reach every internal subnet in its routing table, and the internet fails. The default route is present and points at a next hop that is down. Which repair fits?
- A warehouse PC can ping its gateway and cannot ping a file server across the building. Which step should the technician take next?
- A campus technician injects a red light into a fiber, and the light shines out at a sharp bend in the tray. Which tool is in use?
- A certification tester reports near-end crosstalk failures on a short hotel run. The installer untwisted several centimeters of each pair at the jack. Which cause fits?
- Existing hotel phones keep their addresses. New phones come up with 169.254 addresses, and the DHCP scope shows zero free addresses. Which cause fits?
- Student PCs on VLAN 10 can reach each other on one campus switch, and the same VLAN dies at the uplink. The trunk's allowed list includes only VLAN 1. Which change restores VLAN 10 across that trunk?
- A library PC still reaches other hosts on its own floor, but its internet traffic is arriving at a laptop. On the PC, the gateway address is paired with a MAC that is not the router's. Which display already shows that pairing?
- A campus uses switches from several vendors. Which neighbor-discovery protocol will show the next switch's name and the port this switch is attached to?
- At the far hallway of a warehouse, laptops show a very low wireless signal, the channel has no overlap with neighboring networks, and sessions keep dropping. Which problem fits those readings?
- A retail user reports that the Wi-Fi is down and, separately, that a receipt printer is jammed. Nothing in the report links the two complaints. Which approach follows the troubleshooting method?
- Two application tiers in a data center have 10-gigabit server interfaces. The link between the tiers is 1 gigabit, that link sits at its line rate, and the server interfaces stay mostly idle. Where is the bottleneck?
- Phones on a new hotel VLAN come up with 169.254 addresses. Phones on the older VLANs still receive leases from the same DHCP server, the new scope still has free addresses, and the new router interface has no DHCP helper. Which fault is this?
- A copper run beside large factory motors shows noise on the pairs. The path cannot be moved, and the installed cable is unshielded. Which replacement addresses the noise?
- A technician at a warehouse must see whether a TCP SYN sent to the file server comes back as a SYN-ACK. Which tool shows that exchange on the wire?
- A school lab PC shows no link light. Nobody has checked the patch cord, the wall jack, or the switch port yet. Where should troubleshooting start?
- A warehouse access point is dark. The technician needs the switch's remaining PoE budget and whether that access port is actually supplying power. Which display answers both?
- Clinic PCs on VLAN 30 can ping their gateway. PCs on VLAN 40 have addresses but cannot ping the VLAN 40 gateway, and that switch virtual interface is shut down. Traffic between the VLANs fails. Which fault is this?
- A retail chain's core router has every branch prefix in its routing table except one store. There is no default route to hide the gap. That store is unreachable, and every other store works. Which fault fits?
- A new hotel desk run is 40 meters of Category 5e. The PC negotiates 1 gigabit, but a 10GBASE-T interface on that same run never establishes a 10-gigabit link. Which limitation explains it?
- A retail switch port is down, and the configuration shows an administrator shut that port on purpose. Which status is this?
- A clinic PC loads no web pages by name, yet a ping to the web server's IP address and a ping to the local gateway both succeed. The link light is on. Where should troubleshooting start?
- A data-center fiber link between two switches drops every few minutes. Both ends use matching single-mode optics. Receive power is below the optic's threshold, and one connector is dirty. Which cause fits?
- A data-center switch port shows the runt counter climbing and the giant counter staying at zero. The frames are smaller than the 64-byte Ethernet minimum. Which condition is this?
- A factory technician confirmed a theory on a lab switch: a bad uplink setting is the cause. Production has not been changed. Which methodology step comes next?
- A hotel internet circuit is sold as 500 megabits per second of capacity. During a busy evening, a successful file transfer measures about 180 megabits per second. Which term names that measured 180?
- A school will not accept a new copper run until length, wiremap, and crosstalk have been measured and passed. Which tool produces that acceptance test?
- Hotel guests in the lobby report slow Wi-Fi. The technician needs the nearby network names, the channels they use, and the signal level at that spot. Which tool shows that?
- A help desk technician at a school needs the access VLAN assigned to one switch port. Which display answers that?
- Clients on every VLAN served by one campus DHCP server receive 169.254 addresses. Each scope still has many free addresses, and the relays are configured. The server process is stopped. Which fault is this?
- Every PC in a retail VLAN received the same DHCP gateway, and that gateway address is not inside the PCs' subnet. The PCs ping each other and cannot ping the gateway. Which fault is this?
- Another access point on a school switch does not power up. The port supports PoE, the access point's draw is within what one port can supply, and the switch reports less PoE budget remaining than the access point needs. Which limit is this?
- A warehouse change that should fix the uplink was just applied on the production switch. The user has not retried the application. Which methodology step comes next?
- On a hospital floor the signal level from the access point is strong, the noise floor is also high, and clients show high retries. Neighboring radios are not on overlapping channels. Which problem is this?
- Clinic laptops are forced off an access point every few minutes. The log shows the access point sending disassociation frames. Signal is strong and channels do not overlap. Which condition is this?
- A library application fails, and the technician is logged in on the server. The technician needs to see whether the application is listening on its TCP port. Which display answers that?
- A library PC cannot reach the catalog. The technician needs the address, mask, and gateway that PC is actually using. Which display answers that?
- A hotel suspects the internet circuit is delivering less than the contracted rate. From a front-desk PC, which test measures the throughput the PC actually gets?
- A school technician has confirmed that a firewall rule is dropping the lab. The technician is not allowed to edit the firewall. Which methodology step fits?
- One member of a data-center port-channel is suspended, and its allowed VLAN list does not match the port-channel. The other member is forwarding. Which state explains the suspended member?
- A branch prefix is unreachable, and the engineer needs to see whether that prefix is installed in the edge router. Which display answers the question?
- A technician's laptop must learn whether TCP 443 is open on a clinic server. The technician cannot log in to the server. Which tool fits?
- A sensor must see a copy of the traffic on a data-center link. The switch cannot be configured for a mirror session. Which tool still provides the copy?
These questions are original practice material and are NOT actual exam questions or brain-dump content. CompTIA and related marks are trademarks of their respective owners. This material is not affiliated with, endorsed by, or sponsored by CompTIA.