Domain 1: Networking Concepts
- The OSI model has 7 layers: Physical (1), Data Link (2), Network (3), Transport (4), Session (5), Presentation (6), and Application (7). Layer 3 (IP) handles logical addressing and routing; Layer 2 (MAC) handles local frame delivery; Layer 6 (Presentation) handles encryption, encoding, and format translation.
- TCP is connection-oriented and reliable, using a three-way handshake (SYN, SYN-ACK, ACK), sequence numbers, acknowledgements, retransmission, and a sliding window for flow control. UDP is connectionless, best-effort, has no flow control, and has lower overhead - preferred for VoIP, streaming, and DNS queries.
- Memorize well-known ports: FTP 20/21 (data/control), SSH/SFTP 22, Telnet 23, SMTP 25, DNS 53, DHCP 67/68, TFTP 69, HTTP 80, NTP 123, HTTPS 443, SNMP 161/162, RDP 3389, and SMB 445.
- DHCP leases addressing via the DORA process: Discover, Offer, Request, Acknowledge. A DHCP scope assigns IP address, subnet mask, default gateway, and DNS servers; DHCP relay (ip helper-address) forwards requests across subnets.
- DNS resolves hostnames to IP addresses. Record types: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), PTR (reverse lookup), TXT (SPF/DKIM), NS (name server), SOA (zone authority). DoH (DNS over HTTPS) and DoT (DNS over TLS) encrypt DNS queries.
- NAT lets many internal private hosts share public IPs. PAT (NAT overload) maps many hosts to one public IP using different source ports; static NAT is a fixed one-to-one private-to-public mapping.
- RFC 1918 private ranges: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. APIPA (169.254.0.0/16) is auto-assigned when DHCP fails; loopback is 127.0.0.0/8.
- A /30 (255.255.255.252) provides exactly 2 usable host addresses, ideal for point-to-point links. A /31 (RFC 3021) provides 2 usable addresses with no separate network/broadcast addresses, also for point-to-point.
- VLSM (Variable Length Subnet Masking) and CIDR let you size each subnet to its host count to minimize wasted addresses. A /26 block is 64 addresses, so .130 falls in the .128/26 subnet while .200 falls in the .192/26 subnet.
- IPv6 uses 128-bit addresses written as 8 hextets; compress with :: once for consecutive zero groups (2001:0db8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1). Its huge address space removes the need for NAT, favoring end-to-end addressing.
- IPv6 hosts can self-configure via SLAAC using Router Advertisements (no DHCP server required). Link-local addresses use the fe80::/10 prefix and are auto-generated on every IPv6 interface.
- The Transport layer multiplexes sessions using port numbers (0-65535): well-known 0-1023, registered 1024-49151, dynamic/ephemeral 49152-65535. Sockets combine an IP address and port.
- Common topologies: star/hub-and-spoke (central device), mesh (full redundancy), bus, ring, and hybrid. Modern data centers use spine-and-leaf (Clos) fabrics for predictable east-west latency.
- Jumbo frames (MTU up to ~9000 bytes) reduce per-packet overhead and CPU interrupts for large transfers but must be configured consistently end-to-end or fragmentation/black-holing occurs.
Domain 2: Network Implementation
- A Layer 2 switch forwards frames using destination MAC addresses stored in its CAM/MAC address table; an unknown destination is flooded out all ports. A router (Layer 3) forwards packets between different IP networks using the routing table and destination IP.
- VLANs logically segment one physical switch into multiple broadcast domains, improving security/policy separation and containing broadcast traffic. Inter-VLAN traffic requires a router or Layer 3 switch.
- A trunk port carries multiple VLANs with 802.1Q tags; an access port carries a single untagged VLAN. The native VLAN on a trunk is sent untagged - mismatched native VLANs cause connectivity and security issues.
- Example Cisco VLAN/access config: 'interface gi0/1', 'switchport mode access', 'switchport access vlan 20'. Trunk config: 'switchport mode trunk', 'switchport trunk allowed vlan 10,20'. Create a VLAN: 'vlan 50', 'name ENGINEERING'.
- A default static route is 'ip route 0.0.0.0 0.0.0.0 203.0.113.1' (next hop). OSPF example: 'router ospf 1', 'network 10.0.0.0 0.0.0.255 area 0'. Linux IP assignment: 'ip addr add 192.168.1.10/24 dev ens33'.
- PoE delivers electrical power to devices (APs, IP phones, cameras) over the Ethernet cable. 802.3af provides ~15.4W, 802.3at (PoE+) ~30W, and 802.3bt (PoE++) up to ~90-100W at the port.
- Single-mode fiber (SMF) carries one light path over long distances (km); multimode fiber (MMF) carries multiple paths over shorter distances. Fiber is immune to EMI/RFI, unlike copper.
- Copper categories: Cat5e (1 Gbps to 100m), Cat6 (10 Gbps to ~55m, 1 Gbps to 100m), Cat6a (10 Gbps to 100m), Cat7/Cat8 for higher data center speeds. Multigigabit Ethernet (NBASE-T / 802.3bz) runs 2.5/5 Gbps over existing Cat5e/Cat6.
- Link aggregation (LACP, 802.3ad) bundles multiple physical links into one logical Layer 2 interface for bandwidth and redundancy; all member links must match speed and duplex. Cisco config: 'channel-group 1 mode active'.
- ECMP (Equal-Cost Multi-Path) load-balances across multiple routed Layer 3 paths without extending a broadcast domain - distinct from LACP which works at Layer 2.
- 802.11 Wi-Fi standards: 802.11n (Wi-Fi 4, 2.4/5 GHz), 802.11ac (Wi-Fi 5, 5 GHz), 802.11ax (Wi-Fi 6/6E, adds 6 GHz). In the 2.4 GHz band use only non-overlapping channels 1, 6, and 11 to avoid co-channel interference.
- Switch stacking and MLAG (multi-chassis link aggregation) let multiple switches act as one logical device, allowing aggregated links to span chassis and eliminating STP-blocked uplinks.
- Three-tier hierarchical design uses core, distribution, and access layers. A collapsed-core (two-tier) design merges core and distribution to reduce cost for small/medium networks; a separate core improves scalability for large networks.
- Spanning Tree Protocol (STP/RSTP, 802.1w) prevents Layer 2 loops by blocking redundant paths. PortFast speeds up access-port convergence; BPDU Guard protects against rogue switches on access ports.
Domain 3: Network Operations
- The default gateway is the router interface IP on the host's local subnet; the host sends all off-subnet traffic to it. Verify with the host's routing table and a ping to the gateway.
- SNMP monitors and manages devices: the NMS polls agents with GET on UDP 161 to read MIB values (interface utilization, errors, CPU, memory); agents push trap alerts to the manager on UDP 162. SNMPv3 adds authentication, integrity, and encryption.
- QoS classifies and prioritizes traffic to control bandwidth, latency, jitter, and loss. VoIP is marked DSCP EF (Expedited Forwarding, value 46) and placed in a priority/Low-Latency Queue (LLQ) so it meets strict latency needs.
- Traffic shaping buffers and smooths bursts to a defined rate (delays excess); traffic policing drops or remarks traffic exceeding the rate. Shaping flattens peaks; policing enforces hard limits.
- High availability eliminates single points of failure: first-hop redundancy (HSRP/VRRP/GLBP) provides a shared virtual gateway IP for failover, plus redundant links/paths (with STP or link aggregation) and backup power (UPS/generator).
- Dynamic routing protocols (OSPF, EIGRP, BGP, RIP) automatically adapt to topology changes and failures. Path selection uses administrative distance (which protocol to trust) then the protocol metric (cost/hop count).
- Route summarization/aggregation reduces routing-table entries advertised between areas/domains and hides route flapping of a specific subnet, improving overall stability.
- IPAM (IP Address Management) tracks and allocates IP address space along with related DHCP scopes and DNS zones/records, preventing overlap and conflicts.
- Accurate documentation - network diagrams, IP/VLAN schemes, port maps, and cable labels - speeds troubleshooting and change management by showing the real topology and connections.
- A performance baseline captures normal utilization, latency, and error rates so anomalies are recognizable. Capacity planning provisions links to actual measured demand plus headroom rather than over-provisioning blindly.
- Load balancing spreads client requests across multiple servers to improve performance and availability; methods include round-robin, least-connections, and weighted. Health checks remove failed servers from the pool.
- Branch/WAN optimization techniques include WAN optimization with data deduplication, local caching/proxy of frequently accessed content, a CDN to serve content closer to users, compression/caching, and local internet breakout (split tunneling at the branch).
- NFV (Network Functions Virtualization) runs network functions (routers, firewalls, load balancers) as software on standard servers. SDN separates the control plane from the data plane for centralized, programmable management.
- NTP synchronizes device clocks (UDP 123) - critical for accurate logs, certificates, and authentication. Syslog (UDP 514) centralizes log collection; severity levels run 0 (emergency) to 7 (debug).
Domain 4: Network Security
- A firewall enforces an allow/deny rule set on traffic between zones based on source/destination IP, protocol, port, and connection state. Stateful firewalls track TCP session state and permit return traffic; an implicit deny-all sits at the end of rule lists.
- A next-generation firewall (NGFW) adds application awareness, integrated IPS, and deep packet inspection (DPI). A UTM appliance consolidates firewall, IPS, antivirus, content filtering, and VPN into one device.
- IDS detects and alerts on malicious traffic out-of-band; IPS sits inline and can actively block. Both use signature-based and anomaly/behavior-based detection.
- A VPN creates an encrypted tunnel over an untrusted network. Site-to-site VPNs (typically IPsec) connect whole networks/locations; remote-access VPNs connect individual users. SSL/TLS VPNs can offer clientless access to published applications.
- IPsec provides confidentiality, integrity, and authentication using AH and ESP, operating in transport or tunnel mode; IKE negotiates the security association and keys.
- 802.1X is port-based network access control: a supplicant authenticates to an authenticator (switch/AP) which checks credentials against a RADIUS server before opening the port. EAP carries the authentication.
- NAC (Network Access Control) admits only authenticated, compliant devices (correct patches, AV, configuration), often quarantining noncompliant hosts to a remediation VLAN.
- Network segmentation and microsegmentation limit lateral movement by isolating zones; a DMZ hosts public-facing services between an external and internal firewall.
- Zero Trust assumes no implicit trust based on network location - every request is authenticated and authorized, paired with microsegmentation and least-privilege, per-workload policies.
- Switchport hardening: 'switchport port-security' with 'switchport port-security maximum 1' limits MAC addresses per port. Disable unused ports, use BPDU Guard, and assign unused ports to an unused VLAN.
- Standard ACL example: 'access-list 10 permit 10.1.1.0 0.0.0.255' (note inverse/wildcard mask), applied with 'ip access-group' on an interface ('ip access-group 101 in'). Standard ACLs filter by source only; extended ACLs filter by source, destination, protocol, and port.
- Harden remote management: enforce SSHv2 ('ip ssh version 2') and restrict VTY lines to SSH only ('transport input ssh'); disable Telnet. Generate a key/cert with 'openssl genrsa -out server.key 2048'.
- A DDoS attack floods a target from many compromised hosts (a botnet), harder to block than a single-source DoS. Mitigations include rate limiting, upstream scrubbing services, and blackholing. SSL/TLS offload centralizes encryption to free back-end servers.
Domain 5: Network Troubleshooting
- Follow the CompTIA 7-step methodology in order: 1) Identify the problem (gather info), 2) Establish a theory of probable cause, 3) Test the theory, 4) Establish a plan of action, 5) Implement the solution, 6) Verify full functionality and apply preventive measures, 7) Document findings, actions, and outcomes.
- ping uses ICMP Echo to test Layer 3 reachability, loss, and round-trip time. traceroute (Unix)/tracert (Windows) maps each hop by incrementing TTL and reading ICMP Time Exceeded replies; pathping/mtr combine both to show per-hop loss.
- nslookup and dig query DNS - target a specific server and request record types (e.g., 'dig @8.8.8.8 example.com MX') to verify name resolution. ipconfig /all (Windows) and ip addr (Linux) show host addressing.
- Renew DHCP on Linux with 'dhclient -r eth0 && dhclient eth0' (Windows: ipconfig /release then /renew). A host stuck on a 169.254.x.x APIPA address indicates the DHCP server is unreachable.
- A packet analyzer (Wireshark/tcpdump) captures and inspects frames to confirm exactly where traffic is dropped, see retransmissions, and validate protocol behavior. Flow logs and NetFlow show traffic volumes per conversation.
- A duplex/speed mismatch (one side full-duplex, other half-duplex) causes late collisions, CRC/FCS errors, and slow throughput - check interface counters on both ends and prefer matching fixed settings or auto on both.
- Throughput far below link speed despite low loss often indicates a small TCP window relative to the bandwidth-delay product; jitter is variation in packet delay that degrades VoIP/video.
- MTU mismatch (e.g., inconsistent jumbo frames) causes fragmentation or silent black-holing when Don't Fragment is set - configure MTU consistently end-to-end and test with ping using a set packet size and DF bit.
- Duplicate IP addresses show up as an ARP table mapping one IP to two different MAC addresses over time, causing intermittent connectivity. A subnet mask mismatch makes a host misjudge what is local versus remote.
- Interface input drops/discards mean the interface is receiving more traffic than it can process or forward, causing buffer overruns; runts, giants, and CRC errors point to physical/cabling or duplex problems.
- Wireless issues: excessive retransmissions from a low signal-to-noise ratio (high noise floor), co-channel/adjacent-channel interference, and overlapping channels degrade performance - survey and reassign channels (1/6/11 on 2.4 GHz).
- Intermittent failures after a failover are commonly caused by asymmetric routing breaking stateful firewall sessions when traffic shifts paths. Missing intermediate hops in traceroute often mean routers are configured not to send ICMP TTL-exceeded replies.
- When an application can't connect, review the firewall/ACL rule set against the app's documented required ports/flows, then use a packet capture or flow logs to confirm where traffic is being dropped.
- A cable run exceeding the 100m copper Ethernet limit, or a damaged cable, causes attenuation and errors - use a cable tester/TDR for length and continuity, and a tone generator to trace runs. If a syslog collector gets no logs, verify UDP/514 is not blocked by a firewall/ACL.
CompTIA Network+ (N10-009) exam tips
- Master subnetting cold - practice converting between CIDR, dotted-decimal masks, host counts, and network/broadcast addresses until you can do it in your head, since the exam includes multiple subnetting and address-range questions plus performance-based items.
- Memorize the well-known ports and protocols table (FTP 20/21, SSH 22, DNS 53, DHCP 67/68, HTTP 80, HTTPS 443, SNMP 161/162, RDP 3389) and the OSI layers in order - these are high-frequency, easy points.
- Learn the 7-step troubleshooting methodology in exact order; questions ask which step comes next, and the first step is always to identify the problem (never to implement a fix or escalate first).
- For performance-based questions, practice reading device configs and topology diagrams - know basic Cisco/Linux commands for VLANs, trunks, access ports, static routes, ACLs, and port security.
- Watch for 'BEST' and 'MOST likely' wording: eliminate clearly wrong answers, then choose the option that directly matches the scenario's symptoms (e.g., duplex mismatch for CRC errors, MTU mismatch for jumbo-frame black-holing).
Study guide FAQ
What is the passing score and format of the N10-009 exam?
You need 720 on a scaled range of 100-900. The exam has up to roughly 90 questions - a mix of multiple-choice (single and multiple response) and performance-based items - and you get 90 minutes to complete it.
How is N10-009 different from the older N10-008 version?
N10-009 refreshes content around modern infrastructure: more emphasis on Zero Trust and SASE/SSE security models, software-defined and cloud networking, infrastructure-as-code automation concepts, and updated wireless (Wi-Fi 6/6E). The five domain areas remain similar, but coverage of legacy topics is reduced in favor of current technologies.
Do I need prior certifications or experience before taking Network+?
There are no mandatory prerequisites. CompTIA recommends having CompTIA A+ (or equivalent knowledge) and about 9-12 months of hands-on networking experience, but anyone can sit the exam. It is commonly taken after A+ and before Security+.
How much subnetting and command-line knowledge do I really need?
Subnetting is essential - expect several questions requiring you to calculate subnets, host ranges, and masks quickly, including with VLSM/CIDR. You also need to recognize and interpret basic switch/router CLI configuration (VLANs, trunks, routes, ACLs, port security) and core troubleshooting commands like ping, traceroute, ipconfig/ip, nslookup/dig, and dhclient.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- CompTIA Network+ (N10-009) certification pagelink and content verified 8 September 2026Exam code N10-009. Recommended, not required: "CompTIA A+ certification, with 9 to 12 months of hands-on experience in a junior network administrator or network support technician role".