CompTIA Network+ (N10-009) Practice Exam

What the CompTIA Network+ (N10-009) exam covers

• Networking Concepts129 questions
• Network Implementation108 questions
• Network Operations100 questions
• Network Security87 questions
• Network Troubleshooting142 questions

Free N10-009 practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 566-question bank.

1. Question 1Networking Concepts

   At which OSI layer do IP addressing and routing operate?

   • ALayer 3 (Network)Correct
   • BLayer 2 (Data Link)
   • CLayer 4 (Transport)
   • DLayer 7 (Application)
   ✓ Correct answer: A

   The Network layer of the OSI model is responsible for logical addressing and path determination. IP (Internet Protocol) defines the IP addressing scheme that uniquely identifies hosts and networks, and routers use this information along with routing tables to make forwarding decisions. Layer 3 devices examine the destination IP address in each packet header to determine the best path to forward traffic across interconnected networks.

   Why the other options are wrong

   • BLayer 2 (Data Link) is incorrect because Layer 2 uses MAC addresses to forward frames within a single network segment, not IP addresses across different networks.
   • CLayer 4 (Transport) is incorrect because the Transport layer handles end-to-end communication using port numbers via TCP and UDP, not IP addressing or routing.
   • DLayer 7 (Application) is incorrect because the Application layer is where user-facing protocols like HTTP, DNS, and SMTP operate, not where IP addressing and routing functions reside.
2. Question 2Networking Concepts

   Which DNS record type specifies the mail server responsible for accepting email for a domain and includes a priority value?

   • ACNAME record
   • BMX recordCorrect
   • CTXT record
   • DPTR record
   ✓ Correct answer: B

   Mail Exchanger (MX) records direct email to the correct mail servers, and the priority (preference) value lets administrators define primary and backup servers, with lower values preferred. Sending servers query MX records to determine where to deliver mail.

   Why the other options are wrong

   • AA CNAME record creates an alias pointing one hostname to another canonical name; it does not designate mail servers.
   • CA TXT record holds arbitrary text such as SPF or DKIM data, not mail server routing with priorities.
   • DA PTR record provides reverse DNS, mapping an IP address back to a hostname, not mail routing.
3. Question 3Network Implementation

   Which routing concept lets a router prefer a less-expensive path by assigning a higher cost/metric to an expensive backup circuit so it is used only on failure?

   • Aroute metrics/administrative distance for path preferenceCorrect
   • BSplit horizon loop prevention in distance-vector routing
   • CMAC address aging timers in a switch CAM table
   • DDHCP scope options delivered to client hosts
   ✓ Correct answer: A

   Routing protocols use metrics (such as OSPF cost, EIGRP composite metric, or RIP hop count) to assign a numerical value to each path - the lower the metric, the more preferred the path. By assigning a higher cost or higher administrative distance to a backup circuit, a router will only install and use that route when the preferred lower-cost path fails. OSPF cost is calculated as reference bandwidth divided by interface bandwidth (100 Mbps / link speed), so a 100 Mbps MPLS link and a 10 Mbps backup DSL link receive very different costs, naturally preferring the MPLS path.

   Why the other options are wrong

   • BSplit horizon stops a router from re-advertising a route back out the interface it was learned on; it prevents loops but cannot make one path preferred over another.
   • CMAC aging timers control how long a switch keeps learned MAC-to-port entries; this Layer 2 function has nothing to do with routing path or circuit cost.
   • DDHCP scope options deliver settings like gateway and DNS to clients; they do not influence a router's path selection between circuits.
4. Question 4Network Implementation

   A branch office router has exactly one WAN uplink to the internet and no other reachable paths exist. Rather than running a dynamic routing protocol just to reach the internet, what should be configured on the router?

   • AA static default route pointing to the ISP next-hopCorrect
   • BAn OSPF area 0 adjacency formed with the ISP router
   • CAn EIGRP process matching the ISP's autonomous system
   • DA BGP peering session using the ISP's public AS number
   ✓ Correct answer: A

   When a router has only one path out of the network, a static default route (0.0.0.0/0 pointing at the ISP's next-hop) sends all unmatched traffic that way with no protocol overhead. Dynamic protocols like OSPF, EIGRP, or BGP exist to learn and adapt among multiple paths, which brings unnecessary complexity when there is only a single stub link.

   Why the other options are wrong

   • BOSPF builds adjacencies to exchange routes across multiple paths; a single-uplink stub network gains nothing from that overhead.
   • CEIGRP is a dynamic interior protocol meant for networks with multiple redundant paths, not a single fixed uplink to an ISP.
   • DBGP peering is used for exchanging internet routing policy between autonomous systems, which is unnecessary for one default path out.
5. Question 5Network Security

   An attacker sets up a rogue access point that advertises the same SSID as a legitimate corporate network to trick users into connecting. What is this attack called?

   • AEvil twinCorrect
   • BDeauthentication flood
   • CWPS PIN attack
   • DBluejacking
   ✓ Correct answer: A

   An evil twin is a malicious access point configured with the same SSID (and often the same look) as a trusted network so that clients automatically associate with it. Once connected, the attacker can intercept traffic, harvest credentials, or perform on-path attacks. Defenses include mutual authentication (802.1X with certificate validation) and wireless intrusion prevention systems that detect rogue APs.

   Why the other options are wrong

   • BA deauthentication flood forcibly disconnects clients by spoofing deauth frames; it does not involve impersonating an SSID.
   • CA WPS PIN attack brute-forces the eight-digit WPS setup PIN to recover the passphrase, not to clone an SSID.
   • DBluejacking sends unsolicited messages over Bluetooth and is unrelated to Wi-Fi SSID impersonation.
6. Question 6Network Troubleshooting

   A trunk between two switches passes VLAN 10 fine, but hosts in VLAN 20 cannot communicate across the trunk. What is the most likely cause?

   • AThe trunk's native (untagged) VLAN differs between the two switches
   • BSpanning tree is blocking that trunk port to prevent a loop
   • CVLAN 20 is not allowed on the trunk (pruned) or is missing on one switchCorrect
   • DThe uplink SFPs negotiated 1 Gbps instead of the expected 10 Gbps
   ✓ Correct answer: C

   For a VLAN to pass traffic across an 802.1Q trunk, two conditions must be met: the VLAN must be listed in the trunk's allowed VLAN list on both ends of the trunk, and the VLAN must exist in the VLAN database on both switches. If VLAN 20 is missing from the allowed list (either explicitly pruned or never added), the switch drops tagged frames for VLAN 20 on that trunk port. Similarly, if VLAN 20 exists on the source switch but not in the VLAN database of the destination switch, the destination switch discards the frames even if the trunk port allows them.

   Why the other options are wrong

   • AA native (untagged) VLAN mismatch affects only untagged traffic and raises STP/CDP warnings; it would not selectively block tagged VLAN 20 while tagged VLAN 10 still passes.
   • BSpanning tree blocks a port only to break a loop, which means another path exists; even with per-VLAN spanning tree blocking VLAN 20 on this trunk, VLAN 20 would forward over the other path, so it would not lose connectivity completely.
   • DA speed negotiation issue reduces link bandwidth but does not filter which VLANs are carried; VLAN membership on the trunk is independent of link speed.
7. Question 7Network Implementation

   A wireless deployment on 2.4 GHz suffers poor performance despite strong signal everywhere. What is the likeliest cause?

   • AOverlapping channels causing neighbouring access points to contendCorrect
   • BTransmit power set too low across the deployment
   • CToo few VLANs mapped to the wireless network
   • DThe access points using the same SSID name
   ✓ Correct answer: A

   The band has only three non-overlapping channels in most regulatory domains, 1, 6 and 11, so a deployment using anything else, or reusing a channel on adjacent access points, has radios waiting for each other rather than transmitting. Raising power makes it worse by widening the overlap. Planning the channel reuse pattern, reducing power, and moving clients to 5 GHz where possible are what actually recover the capacity.

   Why the other options are wrong

   • BSignal is already strong; more power increases overlap.
   • CVLAN count does not affect airtime.
   • DA shared SSID is normal and intended for roaming.
8. Question 8Network Implementation

   A network engineer is specifying APs for a new office and needs the Wi-Fi generation that adds 4096-QAM (4K QAM) and multi-link operation, with support for 320 MHz channels in the 6 GHz band. Which generation should be specified?

   • AWi-Fi 6E (802.11ax)
   • BWi-Fi 5 (802.11ac)
   • CWi-Fi 7 (802.11be)Correct
   • DWi-Fi 4 (802.11n)
   ✓ Correct answer: C

   The Wi-Fi Alliance lists 320 MHz channels in the 6 GHz band, multi-link operation, and 4K QAM among the features of Wi-Fi CERTIFIED 7, the generation built on the IEEE 802.11be amendment. Its 4K QAM mode achieves about 20% higher transmission rates than the 1024-QAM of Wi-Fi 6. Wi-Fi 6 and 6E (802.11ax) brought OFDMA and extended Wi-Fi into the 6 GHz band, but they top out at 1024-QAM and do not use multi-link operation.

   Why the other options are wrong

   • AWi-Fi 6E (802.11ax) added the 6 GHz band, but its highest modulation is 1024-QAM and it does not include multi-link operation or 320 MHz channels.
   • BWi-Fi 5 (802.11ac) predates both 6 GHz operation and 4096-QAM.
   • DWi-Fi 4 (802.11n) operates in the 2.4 GHz and 5 GHz bands and predates 6 GHz operation, multi-link operation, and 4096-QAM.
9. Question 9Network Operations

   A vendor announces end of support (EOS) for a switch model that a company still runs in 40 wiring closets. What is the main operational risk of keeping those switches in service after that date?

   • AVulnerabilities found after that date will get no vendor fixesCorrect
   • BThe switches can no longer be monitored with SNMP
   • CThe configuration can no longer be backed up to a server
   • DThe switches stop forwarding traffic when the vendor's support ends
   ✓ Correct answer: A

   End of support is the life-cycle milestone after which the vendor no longer provides support, including patches and bug fixes. The hardware keeps running and forwarding, so the risk is not an immediate outage but growing exposure: every newly published vulnerability affecting that software has no vendor fix. Life-cycle management uses end-of-support dates to plan replacements before that exposure grows.

   Why the other options are wrong

   • BSNMP keeps working with the existing software; the problem is that new flaws in that software, SNMP included, will not be fixed.
   • CCopying the configuration off the switch uses features already in the installed software, which keep working after support ends.
   • DReaching end of support does not change how the hardware forwards traffic; the switches keep working, only without vendor fixes.
10. Question 10Network Troubleshooting

    Large file transfers between two data centers with an 80 ms round-trip time reach only a small fraction of a 1 Gbps link's capacity, even though the link is not congested and shows no loss. Which TCP characteristic most likely limits throughput?

    • AThe three-way handshake at the start of each connection
    • BNagle's algorithm on the sending host
    • CA receive window smaller than the bandwidth-delay productCorrect
    • DThe checksum calculated for each segment
    ✓ Correct answer: C

    The bandwidth-delay product is the amount of data the path can hold: 1 Gbps x 80 ms = 80 Mb, about 10 MB. Without window scaling the TCP header can advertise at most 64 KiB, which allows only about 6.5 Mbps over an 80 ms round trip, however fast the link is. The window scale option defined in RFC 7323 lets hosts advertise larger windows, so tuning receive buffers to the bandwidth-delay product restores throughput.

    Why the other options are wrong

    • AThe handshake adds one round trip when the connection opens; it does not limit the rate of a long transfer once data is flowing.
    • BNagle's algorithm holds back small segments while earlier data is unacknowledged; a bulk transfer sends full-sized segments, so it is not what caps throughput here.
    • DThe checksum only detects corrupted segments; computing it adds negligible delay and does not limit how much data can be in flight.

Who this CompTIA Network+ (N10-009) practice exam is for

This practice set is for anyone preparing for the CompTIA Network+ (N10-009) exam - from first-time candidates building a foundation to experienced IT Support practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this CompTIA Network+ (N10-009) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real CompTIA Network+ (N10-009) exam.

Related IT Support resources

• CompTIA Network+ (N10-009) study guideKey concepts
• IT Support practice examsAll IT Support
• Certification pathWhere this fits
• Best Security+ Practice Exams (2026)Comparison
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• CompTIA A+ Core 1 (220-1201) practice examRelated
• CompTIA A+ Core 2 (220-1202) practice examRelated

CompTIA Network+ (N10-009) practice exam FAQ