CompTIA · Free Practice Questions · Last reviewed May 2026
30real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
23% of exam · 6 sample questions below
A network administrator is troubleshooting a connectivity issue and suspects the problem is related to the physical cabling. At which layer of the OSI model should the administrator begin their investigation?
Transport layer
Data Link layer
Physical layer
The Physical layer (Layer 1) is fundamentally responsible for the raw bit stream transmission over the physical medium, defining the electrical, mechanical, and procedural specifications for transmitting data signals. Therefore, issues such as faulty cables, damaged connectors, incorrect cable types, or signal degradation due to attenuation or electromagnetic interference directly manifest as problems at this foundational layer, preventing any higher-layer communication from occurring reliably or at all.
Network layer
A network technician is explaining the concept of encapsulation to a junior technician. At which OSI layer does a packet get encapsulated with a source and destination IP address?
Layer 2
Layer 3
The Network layer (Layer 3) is precisely where the IP header is added to the Transport layer segment or datagram, creating an IP packet. This header contains the crucial source and destination IP addresses, enabling logical addressing across disparate networks. This encapsulation is fundamental for routing decisions, allowing data to traverse multiple routers and reach its ultimate destination beyond the local network segment.
Layer 4
Layer 1
A network engineer is designing a new IPv6 addressing scheme. The company has been assigned a /48 prefix and needs to support up to 250 subnets. Which subnet size should be used to minimize waste while meeting the requirement?
/52
/56
A /48 global routing prefix is typically assigned to an organization. To create 250 subnets, additional bits beyond the /48 must be used for subnetting. A /56 prefix length means 8 bits are available for subnetting (56 - 48 = 8). This yields 2^8, or 256, possible subnets, which perfectly accommodates the requirement for 250 subnets with minimal address space waste.
/64
/60
A network technician is explaining the difference between a hub and a switch to a junior technician. Which statement correctly describes a key difference between these devices?
A hub operates at Layer 2, while a switch operates at Layer 1.
A hub sends frames out all ports except the incoming port; a switch sends frames only to the port with the matching MAC address.
A hub is a Layer 1 device that simply regenerates electrical signals, broadcasting incoming data frames to all connected ports except the one from which the frame originated, without any intelligence. In contrast, a switch is a Layer 2 device that intelligently learns the MAC addresses of connected devices and stores them in its MAC address table. When a switch receives a frame, it examines the destination MAC address and forwards the frame only to the specific port associated with that MAC address, significantly reducing unnecessary network traffic and improving efficiency.
A hub uses MAC addresses to make forwarding decisions, while a switch uses IP addresses.
A hub creates a separate collision domain for each port, while a switch creates a single collision domain.
A network engineer needs to connect two network segments that use different physical media: one segment uses copper Ethernet and the other uses fiber optic. The device must forward frames based on MAC addresses and must not perform any routing. Which device should the engineer choose?
Layer 3 switch
Media converter
Bridge
A bridge operates at Layer 2 (Data Link Layer) of the OSI model, intelligently forwarding data frames based on destination MAC addresses. It learns MAC addresses by inspecting incoming frames and builds a forwarding table. Crucially, a bridge can connect two network segments that utilize different physical media types or signaling methods, effectively extending a single logical network while segmenting collision domains without performing any Layer 3 routing.
Router
A network engineer is troubleshooting a communication issue between two hosts. The engineer determines that the data is being segmented at the source and reassembled at the destination, but the segments are arriving out of order. Which OSI layer is responsible for sequencing the segments?
A) Physical layer
B) Data Link layer
C) Network layer
D) Transport layer
The Transport layer, notably through protocols like TCP, is directly responsible for segmenting application data into smaller units, assigning unique sequence numbers to each segment. This crucial sequencing allows the receiving host to correctly reassemble the data stream in its original order, even if segments arrive out of sequence due to network conditions. It also facilitates reliable delivery, acknowledging received segments and requesting retransmission of any missing ones, ensuring data integrity from source to destination.
Want more Networking Concepts practice?
Practice this domain20% of exam · 6 sample questions below
A network engineer needs to segment a single physical switch into multiple broadcast domains to improve security and reduce traffic. Which technology should be implemented?
Spanning Tree Protocol (STP)
Virtual LAN (VLAN)
A Virtual LAN (VLAN) is a logical grouping of network devices that allows a single physical switch to be segmented into multiple distinct broadcast domains. By assigning specific switch ports or even hosts to different VLANs, broadcast traffic originating within one VLAN is strictly confined to only the devices belonging to that same VLAN. This effectively isolates network segments, significantly improving security, reducing unnecessary network traffic, and enhancing network performance without requiring additional physical switches.
VLAN Trunking Protocol (VTP)
Access Control List (ACL)
A router receives a packet destined for 10.0.0.15. It has the following routes in the routing table: 10.0.0.0/8 via 192.168.1.1, 10.0.0.0/16 via 192.168.2.1, 0.0.0.0/0 via 192.168.3.1. Which route will be used?
Default route (0.0.0.0/0)
10.0.0.0/16 via 192.168.2.1
Routers prioritize routes based on the longest prefix match principle. The destination IP address 10.0.0.15 falls squarely within the 10.0.0.0/16 network because the first 16 bits of the destination IP match the network address. Since this route offers a more specific match (16 bits) compared to other available routes, it will be selected by the router to forward the packet towards the next hop, 192.168.2.1.
10.0.0.0/8 via 192.168.1.1
None; the packet is dropped
A company has just installed a new fiber optic connection between two buildings 2 km apart. The connection is using multimode fiber. However, the signal is too weak at the receiving end. What is the most likely cause?
Attenuation due to distance
Multimode fiber, commonly used for shorter distances within buildings, experiences significant signal loss, known as attenuation, over extended runs. Its larger core allows for multiple light paths, leading to modal dispersion which limits effective transmission distance, especially at higher data rates. A 2 km link far exceeds the typical maximum reach for multimode fiber, which is often less than 550 meters for 10 Gigabit Ethernet, resulting in substantial signal degradation. This distance limitation directly causes the observed signal weakening.
Electromagnetic interference
Incorrect termination
Crosstalk
A small office uses a wireless router that provides both wired and wireless connectivity. The router's LAN IP is 192.168.1.1. A new printer with a static IP of 192.168.1.50 cannot be reached from a laptop obtaining an IP via DHCP. The laptop's IP is 192.168.1.100. Which of the following is the most likely cause?
The printer is on a different VLAN
The subnet mask is incorrect
If the printer is configured with a static subnet mask that is not /24 (e.g., /28 or /25), it will calculate that the laptop's IP is outside its local subnet. It will then try to send traffic to the default gateway instead of directly to the laptop, and if the gateway does not forward it (or the printer's gateway is wrong), communication fails.
The default gateway is misconfigured
The DHCP scope is exhausted
A network administrator adds a new server to VLAN 20. The switch port is configured as an access port in VLAN 20, and the server has a correct static IP address in that subnet. However, the server cannot communicate with other devices in the same VLAN. The VLAN exists on the switch and other devices in VLAN 20 are working. What is the most likely cause of this issue?
The switch port is configured as a trunk port instead of an access port
A server typically sends standard untagged Ethernet frames, as it is generally unaware of VLAN tagging. If the switch port connected to this server is mistakenly configured as a trunk port, it will expect incoming frames to be 802.1Q tagged with a specific VLAN ID. Since the server's frames arrive untagged, the switch will not correctly associate them with VLAN 20, effectively dropping them or placing them in a default native VLAN, thereby preventing communication within VLAN 20. This misconfiguration is a very common cause of connectivity failure for end devices.
VLAN 20 is not allowed on the trunk to the router
The server does not have a default gateway configured
The port is administratively down
A network administrator has just connected a new access switch to the core switch via a trunk port. The administrator configured the trunk port on both switches with the same allowed VLAN list. However, hosts on VLAN 10 connected to the new access switch cannot communicate with hosts on VLAN 10 on the core switch. The trunk is operational and shows up/up. What is the most likely cause?
A) VLAN 10 has not been created on the new access switch
If VLAN 10 has not been explicitly created and activated within the new access switch's VLAN database, the switch will not recognize or process frames tagged with VLAN 10. Even if the trunk port is configured to permit VLAN 10, the switch will drop incoming frames for an unknown VLAN ID, effectively preventing traffic flow. A switch must have a local understanding of a VLAN to forward frames associated with it, regardless of trunk allowance.
B) Native VLAN mismatch on the trunk
C) Trunk encapsulation mismatch (ISL vs 802.1Q)
D) STP is blocking the VLAN 10 traffic on the trunk
Want more Network Implementation practice?
Practice this domainA network operations center uses SNMP to monitor device health. An administrator needs to retrieve the current CPU utilization from a router. Which SNMP operation is most appropriate?
GET
The GET operation is fundamental for network monitoring as it allows an SNMP manager to actively query an agent for the current value of a specific managed object. When a Network Operations Center (NOC) needs to check device health, such as CPU utilization or interface status, the manager sends a GET request to the device's SNMP agent. The agent then retrieves the requested data from its Management Information Base (MIB) and returns it in a GET-RESPONSE message, providing real-time insight into the device's operational state.
SET
TRAP
INFORM
A network administrator needs to ensure that network device configurations are automatically backed up to a central server. Which protocol is commonly used for secure file transfer of configurations?
TFTP
FTP
SFTP
SFTP, or SSH File Transfer Protocol, provides robust security for automated network device configuration backups by leveraging the underlying SSH protocol. It encrypts both data and authentication credentials, preventing eavesdropping and ensuring data integrity during transfer. This secure channel is crucial for protecting sensitive network configurations from unauthorized access and tampering, making it the ideal choice for automated, secure transfers.
HTTP
An NOC technician observes that the CPU usage on a core switch has been consistently above 90% for the past hour. Which SNMP operation should the technician use to monitor the CPU load over time with minimal network overhead?
SNMP GET
SNMP GETNEXT
SNMP WALK
SNMP TRAP
SNMP traps are unsolicited messages from the agent to the NMS when certain events occur (e.g., CPU threshold exceeded). They reduce overhead because the NMS does not need to poll; the agent sends data only when necessary.
A network administrator is preparing to upgrade the firmware on a critical router. Which document should the administrator consult to understand the steps required to minimize downtime and ensure a successful upgrade?
SLA
Change management plan
The change management plan documents the process for making changes to the network, including risk assessment, detailed steps, testing, approval, and rollback procedures. It is the appropriate resource to ensure a methodical and safe upgrade.
Network diagram
Baseline performance report
An NOC technician receives an alert that latency on a critical WAN link has increased significantly. The technician needs to analyze the latency trend over the past week to identify patterns. Which approach is the most efficient for gathering this historical data?
Use SNMP traps to alert on each latency spike
Use SNMP polling with a suitable MIB to collect latency metrics at regular intervals
SNMP (Simple Network Management Protocol) polling involves a management station periodically querying network devices for specific data points defined in a Management Information Base (MIB). For latency, an appropriate MIB object (e.g., RTT or interface statistics that can infer latency) would be queried at regular intervals. This systematic collection allows for the creation of historical trends, baseline establishment, and long-term performance analysis, making it ideal for monitoring critical network latency over time.
Run a continuous ping test and manually log timestamps
Use traceroute to identify each hop and measure latency per hop
A network administrator wants to be alerted immediately when any interface on a core router goes down. The administrator has already configured SNMP community strings. Which additional configuration is necessary to receive these alerts?
A) Configure the router to send SNMP traps to the NMS
Configuring a router to send SNMP traps to the Network Management System (NMS) is the correct method for receiving immediate alerts. SNMP traps are unsolicited notification messages sent by the network device (agent) to the NMS (manager) when a significant event, such as an interface going down, occurs. This push-based mechanism ensures real-time notification without requiring the NMS to constantly poll the device, making it highly efficient for critical event monitoring.
B) Perform an SNMP walk of the interface OIDs
C) Use SNMP get to retrieve interface status periodically
D) Configure SNMP set to change interface parameters
Want more Network Operations practice?
Practice this domainA security analyst notices that an attacker is sending crafted packets with overlapping IP fragments to a target server, causing the server to crash. Which type of attack is described?
Teardrop attack
The Teardrop attack is a denial-of-service (DoS) attack that exploits vulnerabilities in the reassembly of fragmented IP packets. Attackers send crafted IP fragments with overlapping or oversized offset fields, causing the target system to crash or reboot when it attempts to reconstruct the malformed datagram. This manipulation of IP fragmentation logic prevents proper packet processing and disrupts network services, directly matching the description of an attacker sending crafted packets.
Smurf attack
Ping flood
SYN flood
A company wants to implement network access control that requires users to authenticate before gaining access to the network. The NAC solution uses a policy that checks for antivirus updates and OS patches. Which component enforces the policy?
Supplicant
Authenticator
The authenticator (e.g., a switch) enforces the policy by controlling the port state based on the authentication result.
Authentication server
Policy server
A security auditor is reviewing firewall logs and notices repeated login attempts from a single external IP address to the company's SSH server. Which type of attack is likely occurring?
Brute force attack
A brute force attack involves systematically trying numerous combinations of usernames and passwords to gain unauthorized access to a system or service, such as SSH. The firewall logs showing repeated login attempts from a single IP address are a definitive indicator of such an attack, as the attacker is attempting to guess credentials through exhaustive trial and error. This pattern aims to eventually find a valid credential pair rather than exploiting a vulnerability.
Man-in-the-middle attack
ARP poisoning
DDoS attack
A network administrator wants to prevent unauthorized devices from connecting to the company's Ethernet ports. The company uses a centralized authentication server. Which IEEE standard should be implemented?
802.1X
IEEE 802.1X is a port-based network access control standard designed to prevent unauthorized devices from connecting to a wired or wireless LAN. It enforces authentication before granting network access by using the Extensible Authentication Protocol (EAP) between a supplicant (the client device), an authenticator (typically a switch or access point), and an authentication server (usually RADIUS). This process ensures that only authenticated and authorized users or devices can access network resources, effectively securing the physical access layer.
802.11i
802.3af
802.1Q
A security analyst notices that a web server is receiving a large number of ICMP echo reply packets from many different external hosts. The server did not send any echo requests. Which type of attack is most likely occurring?
Smurf attack
A Smurf attack is a distributed denial-of-service (DDoS) attack that leverages an IP broadcast network to amplify traffic. The attacker sends ICMP echo requests (pings) to an IP broadcast address, spoofing the source IP to be that of the victim web server. All hosts on the broadcast network then reply to the spoofed source IP, flooding the victim with a massive volume of ICMP echo replies from numerous sources, overwhelming its network resources. This results in the web server receiving a flood of ICMP traffic from many different machines.
Ping flood
ICMP tunneling
Fraggle attack
A company wants to ensure that only authorized employee computers can connect to the wired network. Each computer must be authenticated before it is granted access to the network. Which technology is designed to provide this port-based authentication?
802.1X
802.1X is a port-based Network Access Control (NAC) protocol that provides authentication for devices attempting to connect to a network, whether wired or wireless. It acts as a gatekeeper, requiring devices to successfully authenticate with an authentication server (like RADIUS) using credentials or certificates *before* granting any network access. This ensures only authorized employee computers can connect by validating their identity at the network edge.
WPA2
MAC filtering
VPN
Want more Network Security practice?
Practice this domain24% of exam · 6 sample questions below
A user reports intermittent connectivity on a laptop that moves between floors. The signal strength fluctuates. Which tool would best help identify signal interference and dead zones?
Cable tester
Multimeter
Spectrum analyzer
This tool is crucial for diagnosing intermittent wireless connectivity issues, especially when a device moves between locations. A spectrum analyzer graphically displays the strength of radio frequency (RF) signals across different frequencies, allowing technicians to identify sources of interference (e.g., other Wi-Fi networks, microwave ovens, cordless phones) or areas with poor signal coverage. By observing the RF environment, it can pinpoint why a laptop experiences drops as it changes location, making it the most appropriate tool for this scenario.
Protocol analyzer
A user reports that they cannot access the internet, but they can access local resources on the same subnet. The network administrator pings the default gateway and gets a response. Which tool should be used next to trace the path to an external website?
netstat
traceroute
Traceroute (or `tracert` on Windows) is the ideal tool for diagnosing connectivity issues beyond the local network, such as the inability to reach the internet while local resources are accessible. It works by sending packets with incrementally increasing Time-to-Live (TTL) values, causing each successive router along the path to return an ICMP "Time Exceeded" message. This process maps the entire route to the destination, clearly identifying the specific hop where packets stop forwarding or time out, thereby pinpointing the exact point of failure in the internet path.
nslookup
arp
After replacing a faulty switch, several users in the same VLAN report that they cannot communicate with the server that is on a different subnet. The switch is connected to the router via a trunk port. Which command should the administrator run on the router to verify that the VLAN is allowed on the trunk?
show vlan
show interfaces trunk
The `show interfaces trunk` command is indispensable for diagnosing inter-switch connectivity issues affecting specific VLANs. It provides a comprehensive overview of all trunking interfaces on the switch, detailing their operational status, encapsulation type (e.g., IEEE 802.1Q), and, critically, the list of VLANs explicitly allowed to traverse each trunk link. If the VLAN where users are experiencing problems is not included in the allowed list on the trunk connecting the new switch to the network, traffic for that VLAN will be dropped, preventing communication.
show mac address-table
show ip route
A user calls the help desk stating that they cannot access any network resources. The technician asks the user to run ipconfig and the output shows an IP address of 169.254.15.20 with a subnet mask of 255.255.0.0. Which of the following is the most likely cause?
The DNS server is not responding
The DHCP server is unreachable
When a client device fails to locate or communicate with a DHCP server, it cannot obtain a valid IP address, subnet mask, or default gateway from the network. In such scenarios, Windows operating systems automatically fall back to Automatic Private IP Addressing (APIPA), assigning itself an IP address in the 169.254.0.0/16 range. This link-local address prevents the device from communicating with any network resources beyond its immediate segment, directly causing the inability to access 'any' network services.
The default gateway is misconfigured
There is a duplicate IP address on the network
A network technician is troubleshooting intermittent internet access for a single user. The user’s workstation can ping the default gateway consistently, but web pages fail to load intermittently. Which of the following should the technician check NEXT?
A) DNS server configuration
If the configured DNS server is intermittently unavailable, overloaded, or providing inconsistent responses, name resolution requests for domain names will sometimes succeed and sometimes fail. This directly impacts web browsing, as browsers rely on DNS to translate URLs into IP addresses, leading to intermittent page loading issues. However, direct IP-based connectivity, such as pinging a known IP address or the default gateway, would remain unaffected, precisely matching the described symptoms.
B) DHCP lease time
C) Switch port speed and duplex settings
D) Firewall rules blocking ICMP
A user at a branch office reports that they cannot connect to a file server at the main office. The branch office connects to the main office via a site-to-site VPN, and the VPN tunnel shows as active. The user can ping the main office's default gateway but not the file server. Which of the following should the technician check NEXT?
A) Check the routing tables on the branch router
Correct. The branch router may not have a route to the file server's subnet, or the main office router may not have a route back to the branch subnet. Verifying routing tables on both ends is essential.
B) Check the DNS resolution for the file server
C) Check the VPN encryption settings
D) Check the file server's antivirus software
Want more Network Troubleshooting practice?
Practice this domainThe N10-009 exam has 90 questions and must be completed in 90 minutes. The passing score is 720/1000.
Multiple-choice and performance-based questions covering network infrastructure, IP addressing, switching, routing, security, operations, and troubleshooting. Some questions are performance-based (PBQs), asking you to complete tasks in a simulated environment.
The exam covers 5 domains: Networking Concepts, Network Implementation, Network Operations, Network Security, Network Troubleshooting. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official CompTIA N10-009 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.