CompTIA Network+ (N10-009) Practice Exam

What the CompTIA Network+ (N10-009) exam covers

• Networking Concepts157 questions
• Network Implementation137 questions
• Network Operations129 questions
• Network Security96 questions
• Network Troubleshooting163 questions

Free N10-009 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 682.

1. Question 1Networking Concepts

   At which OSI layer do IP addressing and routing operate?

   • ALayer 3 (Network)Correct
   • BLayer 2 (Data Link)
   • CLayer 4 (Transport)
   • DLayer 7 (Application)
   ✓ Correct answer: A

   The Network layer of the OSI model is responsible for logical addressing and path determination. IP (Internet Protocol) defines the IP addressing scheme that uniquely identifies hosts and networks, and routers use this information along with routing tables to make forwarding decisions. Layer 3 devices examine the destination IP address in each packet header to determine the best path to forward traffic across interconnected networks.

   Why the other options are wrong

   • BLayer 2 (Data Link) is incorrect because Layer 2 uses MAC addresses to forward frames within a single network segment, not IP addresses across different networks.
   • CLayer 4 (Transport) is incorrect because the Transport layer handles end-to-end communication using port numbers via TCP and UDP, not IP addressing or routing.
   • DLayer 7 (Application) is incorrect because the Application layer is where user-facing protocols like HTTP, DNS, and SMTP operate, not where IP addressing and routing functions reside.
2. Question 2Networking Concepts

   Which OSI layer is responsible for translating data formats, encryption, and character encoding such as ASCII or JPEG?

   • ASession (Layer 5)
   • BPresentation (Layer 6)Correct
   • CApplication (Layer 7)
   • DTransport (Layer 4)
   ✓ Correct answer: B

   Layer 6 acts as the translator for the network, converting application data into a standardized format and handling tasks like compression and encryption. This ensures data sent by one system can be read by another regardless of internal representation.

   Why the other options are wrong

   • AThe Session layer (Layer 5) establishes, manages, and terminates sessions between applications; it does not perform format translation.
   • CThe Application layer (Layer 7) provides network services directly to user applications, not data format translation.
   • DThe Transport layer (Layer 4) handles end-to-end delivery, segmentation, and flow control, not encoding or encryption translation.
3. Question 3Networking Concepts

   An administrator needs to query an on-premises directory service over an encrypted connection. Which port should the client target?

   • ATCP port 389
   • BTCP port 636Correct
   • CTCP port 88
   • DTCP port 445
   ✓ Correct answer: B

   LDAP (Lightweight Directory Access Protocol) is used to query directory services such as Active Directory. Plaintext LDAP queries use TCP port 389, but when the session is wrapped in TLS, known as LDAPS, the client connects to TCP port 636 instead, protecting credentials and directory data from being read in transit.

   Why the other options are wrong

   • ATCP port 389 is incorrect because that is standard unencrypted LDAP, not the encrypted LDAPS variant requested.
   • CTCP port 88 is incorrect because that is used by Kerberos for authentication ticketing, not directory queries.
   • DTCP port 445 is incorrect because that is used for SMB file and printer sharing, not directory lookups.
4. Question 4Network Implementation

   A router has learned a route to 10.5.0.0/16 from both OSPF and EIGRP. By default, which route will the router install in its routing table, and why?

   • AThe EIGRP route, because it has a lower administrative distanceCorrect
   • BThe OSPF route, because it has a lower administrative distance
   • CBoth routes, because the router will load-balance across the two protocols
   • DThe OSPF route, because OSPF always has a lower metric than EIGRP
   ✓ Correct answer: A

   When the same prefix is learned from multiple routing sources, a router uses administrative distance (AD) to choose the most trustworthy source before comparing metrics. Internal EIGRP has an AD of 90 while OSPF has an AD of 110, so the EIGRP route wins and is installed in the routing table. Metric is only compared between routes learned from the same protocol.

   Why the other options are wrong

   • BOSPF's administrative distance of 110 is higher (less preferred) than internal EIGRP's 90, so OSPF does not win.
   • CRouters do not load-balance across different routing protocols; AD selects a single source first.
   • DMetric is not compared across different protocols, and OSPF cost and EIGRP composite metric are not directly comparable; AD decides here.
5. Question 5Network Implementation

   A DHCP server is configured with a scope but clients on a remote subnet receive no addresses, while clients on the local subnet work. What should be configured on the router interface facing the remote subnet to forward the broadcast requests?

   • AAn IP helper address (DHCP relay)Correct
   • BA static default route
   • CProxy ARP
   • DAn access control list permitting UDP 53
   ✓ Correct answer: A

   DHCP discovery uses broadcasts, which routers do not forward between subnets by default. Configuring an IP helper address (DHCP relay) on the interface facing the clients converts the broadcast DHCP messages into unicast packets directed to the DHCP server on another subnet, allowing remote clients to obtain leases.

   Why the other options are wrong

   • BA static default route affects routing of forwarded packets but does not cause broadcast DHCP requests to be relayed.
   • CProxy ARP answers ARP requests on behalf of other hosts and does not relay DHCP broadcasts.
   • DUDP 53 is DNS; DHCP uses UDP 67/68, and an ACL would not perform relay forwarding.
6. Question 6Network Operations

   An operations team labels both ends of every patch cable and records the corresponding switch port and patch-panel position in a database. What is the primary operational benefit of this practice?

   • AFaster, less error-prone troubleshooting and moves/adds/changesCorrect
   • BHigher link throughput on the cable
   • CReduced electromagnetic interference on the cable
   • DAutomatic VLAN assignment for connected hosts
   ✓ Correct answer: A

   Accurate labeling lets technicians trace connections quickly, disconnect the right cable, and document changes reliably, lowering the risk of disrupting the wrong service. This is a foundational documentation practice in network operations. It improves accuracy and turnaround for day-to-day work and incidents.

   Why the other options are wrong

   • BLabeling has no effect on the electrical/optical throughput of a cable.
   • CLabels do not change shielding or interference characteristics of a cable.
   • DVLAN assignment is configured on the switch, not determined by physical labels.
7. Question 7Network Security

   A flood of traffic from many sources making a service unavailable is which type of attack?

   • AAn evil twin rogue-access-point wireless attack
   • BA SQL injection database code-injection attack
   • CA Distributed Denial of Service (DDoS) attackCorrect
   • DA phishing social-engineering credential attack
   ✓ Correct answer: C

   A DDoS (Distributed Denial of Service) attack uses many compromised systems (a botnet) to simultaneously flood a target service with traffic, overwhelming its capacity to respond to legitimate requests. Unlike a simple DoS attack from a single source, the distributed nature makes DDoS much harder to block because traffic originates from thousands of IP addresses worldwide. Attackers use volumetric floods (UDP/ICMP), protocol attacks (SYN flood, Ping of Death), or application-layer attacks (HTTP GET flood) to exhaust the target's bandwidth, processing capacity, or connection tables.

   Why the other options are wrong

   • AAn evil twin is a rogue access point impersonating a legitimate SSID to intercept wireless clients; it does not flood a service from many sources.
   • BSQL injection inserts malicious SQL into input fields to manipulate a database; it exploits input-validation flaws rather than flooding a service with traffic.
   • DPhishing uses deceptive emails or sites to trick users into revealing credentials; it does not flood network infrastructure to cause an outage.
8. Question 8Network Security

   A company allows employees to use personal smartphones for work and needs a policy that defines security requirements such as mandatory encryption and remote wipe. Which document addresses this?

   • ABYOD (Bring Your Own Device) policyCorrect
   • BService-level agreement (SLA)
   • CMemorandum of understanding (MOU)
   • DNon-disclosure agreement (NDA)
   ✓ Correct answer: A

   A Bring Your Own Device (BYOD) policy establishes the rules and security controls for personally owned devices accessing organizational resources, including requirements such as encryption, screen locks, mobile device management enrollment, and remote wipe capability. It balances employee flexibility with the organization's need to protect data. This is the document specifically aimed at personal-device usage.

   Why the other options are wrong

   • BAn SLA defines agreed service performance and availability metrics between a provider and customer, not personal-device security rules.
   • CAn MOU is a non-binding agreement outlining intentions between parties and does not specify device security controls.
   • DAn NDA protects confidential information from disclosure but does not define device-level security requirements like remote wipe.
9. Question 9Network Troubleshooting

   A user can resolve internal hostnames but cannot resolve any external/public domains. Internal resources work. What is the most likely cause?

   • AThe client is pointed at a public DNS resolver rather than the internal server
   • BThe client's default gateway is configured with the wrong IP address
   • CThe client's local HOSTS file only has entries for internal servers
   • DThe internal DNS server's forwarders or root hints to the internet are unreachableCorrect
   ✓ Correct answer: D

   When a client can resolve internal hostnames (such as server.corp.internal) but cannot resolve any public domains (such as google.com), the internal DNS server is functioning for its authoritative zones but failing to resolve external queries. Internal DNS servers that are not authoritative for public zones rely on forwarders (upstream DNS servers, typically ISP or public resolvers like 8.8.8.8) or root hints to recursively resolve external names. If the forwarders are misconfigured, the external DNS server is unreachable (blocked by a firewall), or root hints are incorrect, all external resolution fails while internal name resolution continues to work normally.

   Why the other options are wrong

   • AIf the client used a public resolver instead of the internal DNS server, it would fail to resolve internal hostnames; here internal resolution works, so the client is correctly pointed at the internal server.
   • BA wrong default gateway would break all off-subnet and internet connectivity, yet internal resources work and only external name resolution fails, indicating the gateway is fine.
   • CA HOSTS file with internal entries would not block external DNS queries; the client would still query DNS for public names, so this does not explain the selective external failure.
10. Question 10Network Troubleshooting

    A newly installed 130-meter Cat6 run between an IDF and a workstation passes a basic continuity test, but the link shows frequent CRC errors and drops under heavy traffic. Which tool would best confirm that the run exceeds the supported distance?

    • AA time-domain reflectometerCorrect
    • BA tone generator and probe kit
    • CA basic wiremap continuity tester
    • DAn optical time-domain reflectometer
    ✓ Correct answer: A

    A time-domain reflectometer sends a pulse down the copper pair and times the reflection to calculate exact length and locate impedance changes, which pinpoints an over-length run causing attenuation. A basic continuity tester only confirms pins connect end to end and cannot measure distance at all.

    Why the other options are wrong

    • BA tone generator and probe are used to trace which physical cable a jack corresponds to, not to measure its length.
    • CA basic wiremap tester verifies pin-to-pin continuity and wiring order but has no way to report the cable's actual length.
    • DAn OTDR is the fiber-optic equivalent of a TDR and is not designed to test copper twisted-pair cabling.

Who this CompTIA Network+ (N10-009) practice exam is for

This practice set is for anyone preparing for the CompTIA Network+ (N10-009) exam - from first-time candidates building a foundation to experienced IT Support practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this CompTIA Network+ (N10-009) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real CompTIA Network+ (N10-009) exam.

Related IT Support resources

• CompTIA Network+ (N10-009) study guideKey concepts
• IT Support practice examsAll IT Support
• Certification pathWhere this fits
• Best Security+ Practice Exams (2026)Comparison
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• CompTIA A+ Core 1 (220-1201) practice examRelated
• CompTIA A+ Core 2 (220-1202) practice examRelated

CompTIA Network+ (N10-009) practice exam FAQ