CompTIA Network+ (N10-009) Practice Exam

What the CompTIA Network+ (N10-009) exam covers

• Networking Concepts104 questions
• Network Implementation113 questions
• Network Operations204 questions
• Network Security134 questions
• Network Troubleshooting103 questions

Free CompTIA Network+ (N10-009) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 658.

1. Question 1Networking Concepts

   At which OSI layer do IP addressing and routing operate?

   • ALayer 3 (Network)Correct
   • BLayer 2 (Data Link)
   • CLayer 4 (Transport)
   • DLayer 7 (Application)
   ✓ Correct answer: A

   The Network layer of the OSI model is responsible for logical addressing and path determination. IP (Internet Protocol) defines the IP addressing scheme that uniquely identifies hosts and networks, and routers use this information along with routing tables to make forwarding decisions. Layer 3 devices examine the destination IP address in each packet header to determine the best path to forward traffic across interconnected networks.

   Why the other options are wrong

   • BLayer 2 (Data Link) is incorrect because Layer 2 uses MAC addresses to forward frames within a single network segment, not IP addresses across different networks.
   • CLayer 4 (Transport) is incorrect because the Transport layer handles end-to-end communication using port numbers via TCP and UDP, not IP addressing or routing.
   • DLayer 7 (Application) is incorrect because the Application layer is where user-facing protocols like HTTP, DNS, and SMTP operate, not where IP addressing and routing functions reside.
2. Question 2Network OperationsSelect all that apply

   Which TWO actions help control cloud egress/bandwidth costs while improving content delivery performance? (Choose TWO)

   • AUse a CDN to cache and serve content closer to usersCorrect
   • BEnable compression/caching to reduce repeated data transferCorrect
   • CRoute all internal traffic through the public internet
   • DDisable all monitoring to save on tooling
   ✓ Correct answer: A, B

   A CDN (Content Delivery Network) caches static content (images, scripts, videos) at geographically distributed edge servers close to end users. When users request content, it is served from the nearest edge node rather than from the origin server, reducing latency and dramatically cutting egress bandwidth charges from the cloud origin. Enabling compression (gzip, Brotli) reduces the size of transferred data, and caching prevents repeated downloads of unchanged content - both directly reducing the volume of data transferred over paid WAN links.

   Why the other options are wrong

   • CRoute all internal traffic through the public internet is incorrect because routing all traffic through the public internet increases latency and egress costs by sending traffic over unpredictable paths rather than leveraging optimized private paths or CDN infrastructure.
   • DDisable all monitoring to save on tooling is incorrect because disabling monitoring eliminates the visibility needed to understand bandwidth consumption, detect anomalies, and optimize costs; without monitoring, it is impossible to identify which traffic is driving the highest egress charges.
3. Question 3Network Operations

   When designing QoS for a converged network carrying voice, video, and bulk data, which classification approach is the recommended best practice?

   • ATreat all traffic identically with best-effort delivery and no DSCP marking
   • BDrop voice traffic first during congestion to protect bulk data transfers
   • CMark and classify traffic as close to the source as possible, then trust those markings within the networkCorrect
   • DApply complex deep-packet classification only at the core for every packet
   ✓ Correct answer: C

   The recommended QoS best practice is to classify and mark traffic at the network edge, as close to the originating device as possible, using DSCP (Differentiated Services Code Point) markings appropriate to each traffic class. Once traffic is correctly marked at the access layer (or trust markings from known endpoints like IP phones), the rest of the network trusts and acts on these markings without re-classifying every packet at every hop. This approach reduces the processing burden on core and distribution switches while ensuring consistent treatment across all network devices.

   Why the other options are wrong

   • ABest-effort treatment with no marking forces latency-sensitive VoIP into the same queues as bulk downloads, producing choppy audio and degraded video during periods of congestion.
   • BVoice must be protected rather than sacrificed; it belongs in a strict-priority (LLQ) queue and should be dropped last, so dropping it first would completely defeat the purpose of deploying VoIP.
   • DReclassifying every packet with deep inspection at the high-speed core is resource-intensive, adds latency, and does not scale; classification should happen once at the edge, with the core trusting the markings.
4. Question 4Network OperationsSelect all that apply

   Which TWO are valid reasons to configure SNMP traps in addition to scheduled polling? (Choose TWO)

   • ATraps remove the need for a MIB on the device
   • BThe agent can notify the manager immediately when an event occurs, rather than waiting for the next pollCorrect
   • CTraps reduce the latency between an event and the alertCorrect
   • DTraps guarantee delivery because they use TCP with retransmission
   ✓ Correct answer: B, C

   Traps reduce the latency between an event and the alert. Scheduled SNMP polling collects metrics at fixed intervals (commonly every 5 minutes), meaning an event that occurs immediately after a poll cycle might not be detected for nearly 5 minutes. SNMP traps are event-driven: the moment a threshold is crossed or a significant state change occurs (such as a link failure), the agent immediately sends a trap to the manager on UDP 162, dramatically reducing the time from event occurrence to alert generation. Combining both approaches gives operators both timely alerting and regular trending data.

   Why the other options are wrong

   • ATraps remove the need for a MIB on the device is incorrect because MIBs define the objects and OIDs that are referenced in trap PDUs; traps still use MIB-defined object identifiers to describe the event and its variable bindings.
   • DTraps guarantee delivery because they use TCP with retransmission is incorrect because SNMP traps use UDP, which provides no delivery guarantee; SNMPv2c informs address this by requiring an acknowledgment from the manager, but standard traps are fire-and-forget.
5. Question 5Network Operations

   Log timestamps across routers, switches, and servers disagree by minutes, making incident correlation difficult. What should be implemented?

   • ASNMPv3 with authentication and encryption on all managed devices
   • BA centralized syslog server to collect logs from every device
   • CNTP to synchronize device clocks to a common time sourceCorrect
   • D802.1X port-based authentication on every switch access port
   ✓ Correct answer: C

   NTP (Network Time Protocol) synchronizes the real-time clocks of all network devices by organizing them into a hierarchical stratum model referenced to highly accurate atomic or GPS clocks. When routers, switches, and servers all synchronize to the same NTP hierarchy, their timestamps are aligned to within milliseconds of each other. This synchronization is essential for SIEM log correlation: events that occur simultaneously or in rapid sequence across devices will have accurately aligned timestamps, allowing analysts to reconstruct the true chronological order of an incident or verify compliance audit trails.

   Why the other options are wrong

   • ASNMPv3 adds authentication and encryption to management traffic; while valuable for security, it does not synchronize clocks, so timestamps would still disagree.
   • BA central syslog server aggregates log messages, but if the source clocks disagree the collected timestamps remain misaligned; it does not synchronize time.
   • D802.1X authenticates devices connecting to ports, providing access control; it performs no time synchronization and would not resolve timestamp discrepancies.
6. Question 6Networking ConceptsSelect all that apply

   Which TWO statements correctly describe characteristics of a Layer 3 switch? (Choose TWO)

   • AIt can route traffic between VLANs using internal routing logicCorrect
   • BIt makes forwarding decisions based on IP addresses in addition to MAC addressesCorrect
   • CIt operates strictly at the Data Link layer and cannot perform routing
   • DIt can only forward broadcast traffic and cannot maintain a MAC address table
   ✓ Correct answer: A, B

   A Layer 3 switch combines the high-speed hardware switching of a Layer 2 switch with routing capability, allowing it to perform inter-VLAN routing and make forwarding decisions using IP addresses. This eliminates the need for a separate router for routing between local VLANs.

   Why the other options are wrong

   • COperating strictly at Layer 2 with no routing describes a basic Layer 2 switch, not a Layer 3 switch.
   • DAll switches maintain a MAC address table and forward more than just broadcasts, so this is incorrect.
7. Question 7Network Implementation

   A Cisco switch port that should connect to a single PC is unexpectedly learning dozens of MAC addresses, suggesting an unauthorized hub or rogue switch was attached. Which feature limits the number of MACs allowed on the port and can shut it down on violation?

   • APort securityCorrect
   • BDHCP snooping
   • CDynamic ARP inspection
   • DVLAN pruning
   ✓ Correct answer: A

   Port security lets an administrator set a maximum number of MAC addresses per port and define a violation action (protect, restrict, or shutdown). When more MACs than allowed appear - as with an unauthorized hub - the configured action triggers, often err-disabling the port. This directly addresses the rogue-device scenario.

   Why the other options are wrong

   • BDHCP snooping validates DHCP messages to block rogue DHCP servers; it does not limit MAC counts per port.
   • CDynamic ARP inspection blocks spoofed ARP based on the DHCP snooping table, not the number of MACs.
   • DVLAN pruning limits which VLANs traverse a trunk and is unrelated to MAC-address counting on access ports.
8. Question 8Network Operations

   A monitoring system is configured to send a notification only when an interface stays down for more than 60 seconds, rather than alerting on every brief flap. What is the primary purpose of this delay/threshold?

   • ATo increase SNMP polling frequency
   • BTo reduce false-positive alerts and alert fatigueCorrect
   • CTo improve routing metric calculation
   • DTo synchronize device clocks
   ✓ Correct answer: B

   Requiring a condition to persist before alerting filters out momentary flaps and other transient blips that self-resolve. This cuts down noisy notifications so staff focus on genuine, sustained problems, directly addressing alert fatigue. It does not change polling rates, routing math, or time sync.

   Why the other options are wrong

   • AA notification threshold does not alter how often the system polls devices.
   • CRouting metrics are computed by routing protocols, independent of monitoring alert thresholds.
   • DClock synchronization is handled by NTP, not by alert hold-down timers.
9. Question 9Network Operations

   A monitoring system raises a warning when interface utilization exceeds 80% and a critical alert at 95%. What is the configured 80% value an example of?

   • AAn alerting thresholdCorrect
   • BA routing metric
   • CAn administrative distance
   • DA DHCP lease time
   ✓ Correct answer: A

   Thresholds define the values at which a monitoring platform generates warnings or critical alerts so operators are notified before problems become severe. Tiered thresholds (warning then critical) help prioritize response. Routing metrics, administrative distance, and DHCP lease times are unrelated configuration values from other domains of operation.

   Why the other options are wrong

   • BA routing metric expresses path cost for route selection, not a monitoring alert trigger.
   • CAdministrative distance ranks the trustworthiness of routing sources, unrelated to utilization alerts.
   • DA DHCP lease time governs how long an address assignment is valid, not when a utilization alert fires.
10. Question 10Network Security

    A security policy requires that critical firmware updates be checked against the vendor's published hash before installation. Which security goal does verifying this hash primarily ensure?

    • AConfidentiality
    • BAvailability
    • CIntegrityCorrect
    • DNon-repudiation
    ✓ Correct answer: C

    A cryptographic hash produces a fixed-length fingerprint; if the recomputed hash matches the vendor's value, the file has not been modified or corrupted in transit. This protects integrity, which is one pillar of the CIA triad.

    Why the other options are wrong

    • AConfidentiality is about preventing unauthorized disclosure, which hashing alone does not provide since the file is not encrypted.
    • BAvailability concerns keeping systems accessible, which a hash comparison does not address.
    • DNon-repudiation requires a digital signature tying an identity to the action; a plain hash does not prove who created it.

Related Security resources

• CompTIA Network+ (N10-009) study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• (ISC)² CISSP practice examRelated
• (ISC)² Certified in Cybersecurity (CC) practice examRelated
• CompTIA Security+ SY0-701 practice examRelated

CompTIA Network+ (N10-009) practice exam FAQ