How should I use these Networking practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Networking questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Networking domain.

220-1201 · topic practice

Networking practice questions

Domain 2 (Networking) covers 23% of Core 1 220-1201: OSI and TCP/IP models, ports and protocols, IP addressing and subnetting, wireless standards and security, network types and hardware, plus CLI tools like ipconfig, ping, tracert, nslookup, netstat, and network troubleshooting methodology. Questions are scenario-based, asking you to diagnose connectivity failures or pick the correct configuration.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

7 questionsDomain: Networking

Practice 10 questions Browse domain →

What the exam tests

What to know about Networking

Diagnose network faults by layer: verify physical link, then IP configuration, then name resolution, then ports and services. The single most important skill is reading a scenario and choosing the correct command or setting, especially distinguishing DNS, DHCP, and wireless security problems.

TCP/IP ports and protocols such as DNS 53, DHCP 67/68, HTTP 80, HTTPS 443, SSH 22, RDP 3389

IPv4/IPv6 addressing, subnetting, private ranges, APIPA, and default gateway configuration

Wireless standards, channels, bands, and security: WPA2/WPA3, AES, pre-shared key versus enterprise

Command-line tools: ipconfig, ping, tracert, nslookup, netstat, and troubleshooting methodology

Watch out for

Common Networking exam traps

▸Confusing DNS failure with DHCP failure: name resolution fails but direct IP access works, so test with nslookup or ping by name.
▸Assuming a link light means working connectivity; a dead link light points to cable, NIC, or switch port, not software.
▸Mixing up WPA2-Personal (pre-shared key) with WPA2-Enterprise (RADIUS authentication) when a client wants easy employee access.

Practice set

Networking questions

7 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full wireless explanation →

A technician is configuring a small office wireless router for a client. The client wants the network to be as secure as possible while still allowing employees to connect easily with a pre-shared key. The router supports WPA2, WPA3, WPA, and WEP. Which security protocol should the technician select?

Trap 1: WPA2-PSK with AES

WPA2-PSK with AES is secure and widely supported, but it is not the most secure option available on this router. WPA3-Personal improves upon WPA2 by using Simultaneous Authentication of Equals (SAE), which provides stronger protection against offline dictionary attacks. Since the router supports WPA3, selecting WPA2 would leave the network less secure than possible.

Trap 2: WPA-PSK with TKIP

WPA-PSK with TKIP is an older security protocol that is deprecated due to vulnerabilities in TKIP. It is less secure than WPA2 and WPA3 and should not be used when stronger options are available. The scenario requires the most secure configuration, so WPA with TKIP is inappropriate.

Trap 3: WEP with 128-bit key

WEP is an outdated and insecure protocol that can be easily cracked. Even with a 128-bit key, it does not provide adequate security for a business network. The scenario calls for the most secure option, so WEP is clearly wrong. It should never be used when WPA2 or WPA3 is available.

Study all Networking common traps →

A
WPA2-PSK with AES
Why it fails: WPA2-PSK with AES is secure and widely supported, but it is not the most secure option available on this router. WPA3-Personal improves upon WPA2 by using Simultaneous Authentication of Equals (SAE), which provides stronger protection against offline dictionary attacks. Since the router supports WPA3, selecting WPA2 would leave the network less secure than possible.
B
WPA-PSK with TKIP
Why it fails: WPA-PSK with TKIP is an older security protocol that is deprecated due to vulnerabilities in TKIP. It is less secure than WPA2 and WPA3 and should not be used when stronger options are available. The scenario requires the most secure configuration, so WPA with TKIP is inappropriate.
C
WPA3-Personal
WPA3-Personal is the most secure option among those listed and is supported by the router. It uses SAE (Simultaneous Authentication of Equals) to provide forward secrecy and resistance to offline dictionary attacks, which WPA2-PSK lacks. It still allows easy connection with a pre-shared key, satisfying the client's requirement. Therefore, it is the best choice.
D
WEP with 128-bit key
Why it fails: WEP is an outdated and insecure protocol that can be easily cracked. Even with a 128-bit key, it does not provide adequate security for a business network. The scenario calls for the most secure option, so WEP is clearly wrong. It should never be used when WPA2 or WPA3 is available.

Full breakdown with real-world context →

Question 2easymultiple choice

Read the full DNS explanation →

A user reports that they cannot access any websites by typing domain names, but they can access websites by entering IP addresses directly. The technician suspects a DNS issue. Which command should the technician use first to verify the DNS server settings on the user's Windows 10 computer?

Trap 1: ping

ping is used to test connectivity to a specific host by sending ICMP echo requests. While you could ping a DNS server to see if it responds, it does not show the configured DNS server addresses. The issue is that domain names are not resolving, so the technician needs to see the DNS configuration, not just test reachability. Thus, ping alone is not the best first step.

Trap 2: netstat -an

netstat -an displays active connections and listening ports in numeric form. It does not show DNS server settings or help diagnose name resolution problems. While it can be useful for troubleshooting network connections, it is not relevant to verifying DNS configuration. Therefore, it is not the correct command for this scenario.

Trap 3: nslookup

nslookup is a tool for querying DNS servers to resolve domain names to IP addresses. While it can help diagnose DNS resolution issues, it does not display the DNS server settings configured on the computer. The technician first needs to verify which DNS servers are configured, so nslookup is not the initial command to use. It could be used later to test resolution.

Study all Networking common traps →

A
ipconfig /all
ipconfig /all displays the full TCP/IP configuration for all adapters, including the DNS servers that are configured. This allows the technician to verify whether the correct DNS server addresses are assigned via DHCP or manually. Since the user can access sites by IP but not by name, checking DNS settings is the logical first step, making this command appropriate.
B
ping
Why it fails: ping is used to test connectivity to a specific host by sending ICMP echo requests. While you could ping a DNS server to see if it responds, it does not show the configured DNS server addresses. The issue is that domain names are not resolving, so the technician needs to see the DNS configuration, not just test reachability. Thus, ping alone is not the best first step.
C
netstat -an
Why it fails: netstat -an displays active connections and listening ports in numeric form. It does not show DNS server settings or help diagnose name resolution problems. While it can be useful for troubleshooting network connections, it is not relevant to verifying DNS configuration. Therefore, it is not the correct command for this scenario.
D
nslookup
Why it fails: nslookup is a tool for querying DNS servers to resolve domain names to IP addresses. While it can help diagnose DNS resolution issues, it does not display the DNS server settings configured on the computer. The technician first needs to verify which DNS servers are configured, so nslookup is not the initial command to use. It could be used later to test resolution.

Full breakdown with real-world context →

Question 3mediummultiple choice

Read the full wireless explanation →

A small business wants to add a guest wireless network that allows visitors to access the internet but prevents them from reaching internal company resources. The existing network uses a single wireless router with a default configuration. Which of the following should a technician implement?

Trap 1: Change the default SSID and disable SSID broadcast to hide the…

Disabling SSID broadcast does not prevent access to internal resources; it only hides the network name. Determined users can still discover and connect to hidden networks. This approach also complicates legitimate guest access. It does not provide the required isolation from the corporate network.

Trap 2: Set up MAC filtering to allow only known guest devices on the…

MAC filtering restricts which devices can connect but does not isolate guests from internal resources. A guest device that is allowed via MAC filtering could still reach corporate systems. MAC addresses can also be spoofed. This option fails to provide the necessary network segmentation.

Trap 3: Enable WPA3-Personal on the guest SSID and place it on the same…

WPA3-Personal encrypts wireless traffic, but placing the guest SSID on the same VLAN as the corporate network still allows guests to reach internal resources. The goal is isolation, not just encryption. A separate VLAN or guest network feature is required to restrict access to internal systems. This option does not meet the requirement.

Study all Networking common traps →

A
Change the default SSID and disable SSID broadcast to hide the guest network.
Why it fails: Disabling SSID broadcast does not prevent access to internal resources; it only hides the network name. Determined users can still discover and connect to hidden networks. This approach also complicates legitimate guest access. It does not provide the required isolation from the corporate network.
B
Set up MAC filtering to allow only known guest devices on the wireless network.
Why it fails: MAC filtering restricts which devices can connect but does not isolate guests from internal resources. A guest device that is allowed via MAC filtering could still reach corporate systems. MAC addresses can also be spoofed. This option fails to provide the necessary network segmentation.
C
Configure a separate guest SSID and enable client isolation or a guest VLAN on the wireless router.
Creating a separate guest SSID with client isolation or a dedicated guest VLAN prevents guests from accessing internal company resources while still providing internet access. This is the standard method for guest network segmentation on a small business router. It meets both security and connectivity requirements without additional hardware.
D
Enable WPA3-Personal on the guest SSID and place it on the same VLAN as the corporate network.
Why it fails: WPA3-Personal encrypts wireless traffic, but placing the guest SSID on the same VLAN as the corporate network still allows guests to reach internal resources. The goal is isolation, not just encryption. A separate VLAN or guest network feature is required to restrict access to internal systems. This option does not meet the requirement.

Full breakdown with real-world context →

Question 4easymultiple choice

Read the full Networking explanation →

A user reports that their workstation cannot connect to any network resources. The technician notices the network cable is plugged into the wall jack and the NIC, but the link light is off. Which of the following should the technician check FIRST?

Trap 1: The IP address configuration on the workstation.

The IP address configuration is irrelevant when the link light is off. A missing or incorrect IP address would not cause the physical link light to turn off. The link light indicates physical layer connectivity. Checking IP configuration first wastes time because the problem is clearly at a lower layer.

Trap 2: The firewall rules on the workstation.

Firewall rules control traffic flow but do not affect the physical link light. A firewall misconfiguration would not cause the NIC link light to go dark. The absence of a link light points to a physical connection problem. Firewall settings are irrelevant until the physical link is established.

Trap 3: The DNS server settings in the operating system.

DNS settings affect name resolution, not physical link status. If the link light is off, the workstation has no network connectivity at all, so DNS is not the immediate concern. Checking DNS would be premature and would not restore the physical link. The issue must be resolved at Layer 1 first.

Study all Networking common traps →

A
The IP address configuration on the workstation.
Why it fails: The IP address configuration is irrelevant when the link light is off. A missing or incorrect IP address would not cause the physical link light to turn off. The link light indicates physical layer connectivity. Checking IP configuration first wastes time because the problem is clearly at a lower layer.
B
The firewall rules on the workstation.
Why it fails: Firewall rules control traffic flow but do not affect the physical link light. A firewall misconfiguration would not cause the NIC link light to go dark. The absence of a link light points to a physical connection problem. Firewall settings are irrelevant until the physical link is established.
C
The DNS server settings in the operating system.
Why it fails: DNS settings affect name resolution, not physical link status. If the link light is off, the workstation has no network connectivity at all, so DNS is not the immediate concern. Checking DNS would be premature and would not restore the physical link. The issue must be resolved at Layer 1 first.
D
The patch cable and wall jack for physical damage or loose connection.
The link light being off indicates a physical layer issue. The first step is to verify the cable is securely connected and undamaged, and that the wall jack is active. This is the most likely cause and the quickest to check. Reseating or replacing the cable often resolves the problem.

Full breakdown with real-world context →

Question 5hardmultiple choice

Open the full VLAN trunking answer →

A company has a network with multiple VLANs. Users on VLAN 10 need to access a server on VLAN 20, but they cannot. The technician verifies that the switch ports are correctly assigned and the server is reachable from other VLANs. Which of the following is the MOST likely cause?

Trap 1: The default gateway on VLAN 10 is misconfigured.

If the default gateway were misconfigured, users on VLAN 10 would not be able to reach any remote network, not just VLAN 20. The scenario states that other VLANs can reach the server, so the gateway on those VLANs is correct. The issue is specific to VLAN 10 to VLAN 20 communication, which points to inter-VLAN routing or ACLs.

Trap 2: The subnet mask on the server is incorrect.

An incorrect subnet mask on the server would affect communication with multiple subnets, not just VLAN 10. Since other VLANs can reach the server, the server's subnet mask is likely correct. The problem is isolated to VLAN 10, so the server configuration is not the primary suspect. The issue lies in the path between VLAN 10 and VLAN 20.

Trap 3: The DNS server is not resolving the server's hostname for VLAN 10…

DNS resolution issues would prevent access by hostname, but users could still reach the server by IP address. The scenario does not specify whether access is by name or IP. Moreover, DNS problems would affect all VLANs equally, not just VLAN 10. The inability to reach the server at all suggests a routing or firewall issue.

Study all Networking common traps →

A
The router or Layer 3 switch is not configured to route between VLAN 10 and VLAN 20.
Inter-VLAN routing must be explicitly configured on a router or Layer 3 switch. If routing between VLAN 10 and VLAN 20 is not enabled, traffic cannot pass between them. The fact that other VLANs can reach the server suggests that routing works for those VLANs but not for VLAN 10. This is the most likely cause.
B
The default gateway on VLAN 10 is misconfigured.
Why it fails: If the default gateway were misconfigured, users on VLAN 10 would not be able to reach any remote network, not just VLAN 20. The scenario states that other VLANs can reach the server, so the gateway on those VLANs is correct. The issue is specific to VLAN 10 to VLAN 20 communication, which points to inter-VLAN routing or ACLs.
C
The subnet mask on the server is incorrect.
Why it fails: An incorrect subnet mask on the server would affect communication with multiple subnets, not just VLAN 10. Since other VLANs can reach the server, the server's subnet mask is likely correct. The problem is isolated to VLAN 10, so the server configuration is not the primary suspect. The issue lies in the path between VLAN 10 and VLAN 20.
D
The DNS server is not resolving the server's hostname for VLAN 10 clients.
Why it fails: DNS resolution issues would prevent access by hostname, but users could still reach the server by IP address. The scenario does not specify whether access is by name or IP. Moreover, DNS problems would affect all VLANs equally, not just VLAN 10. The inability to reach the server at all suggests a routing or firewall issue.

Full breakdown with real-world context →

Question 6mediummulti select

Read the full wireless explanation →

A technician is configuring a wireless access point for a small office. The office needs to support both older laptops that only support 2.4 GHz and newer devices that support 5 GHz. The technician wants to ensure optimal performance and compatibility. Which two of the following should the technician configure? (Choose two.)

Trap 1: Disable SSID broadcast on both bands to improve security.

Disabling SSID broadcast does not improve security and can cause connection issues for legitimate users. It also does not help with performance or compatibility. The requirement is to support both older and newer devices, so hiding the SSID would complicate connections. This is not a recommended practice for this scenario.

Trap 2: Set the access point to use WEP encryption for backward…

WEP is outdated and insecure; it should never be used. Older devices that only support 2.4 GHz may still support WPA2 or WPA3, so WEP is unnecessary. Using WEP would compromise network security. It does not contribute to optimal performance or compatibility.

Trap 3: Configure the 5 GHz band to use channel 36 at 80 MHz width.

While 80 MHz width can increase throughput, it also increases the chance of interference and may not be supported by all devices. In a small office with potential neighboring networks, using 80 MHz on 5 GHz can cause co-channel interference. The question asks for optimal performance and compatibility; wider channels are not always optimal. This is not a required configuration.

Study all Networking common traps →

A
Disable SSID broadcast on both bands to improve security.
Why it fails: Disabling SSID broadcast does not improve security and can cause connection issues for legitimate users. It also does not help with performance or compatibility. The requirement is to support both older and newer devices, so hiding the SSID would complicate connections. This is not a recommended practice for this scenario.
B
Set the 2.4 GHz band to use channel 1, 6, or 11.
In the 2.4 GHz spectrum, channels 1, 6, and 11 are the only non-overlapping channels. Using one of these minimizes interference from neighboring networks. This is a best practice for 2.4 GHz Wi-Fi deployment. It ensures stable performance for older devices.
C
Set the access point to use WEP encryption for backward compatibility.
Why it fails: WEP is outdated and insecure; it should never be used. Older devices that only support 2.4 GHz may still support WPA2 or WPA3, so WEP is unnecessary. Using WEP would compromise network security. It does not contribute to optimal performance or compatibility.
D
Configure the 5 GHz band to use channel 36 at 80 MHz width.
Why it fails: While 80 MHz width can increase throughput, it also increases the chance of interference and may not be supported by all devices. In a small office with potential neighboring networks, using 80 MHz on 5 GHz can cause co-channel interference. The question asks for optimal performance and compatibility; wider channels are not always optimal. This is not a required configuration.
E
Enable both 2.4 GHz and 5 GHz bands on the access point.
Enabling both bands ensures that older 2.4 GHz-only devices can connect while newer 5 GHz-capable devices can use the less congested 5 GHz band for better performance. This provides compatibility and optimal throughput. It is a standard practice in mixed-device environments to dual-band operation.

Full breakdown with real-world context →

Question 7mediummultiple choice

Review the full subnetting walkthrough →

A technician is troubleshooting a workstation that can access local network resources but cannot reach any websites on the internet. The technician runs ipconfig and sees the IP address, subnet mask, and default gateway are correct. Which of the following should the technician check NEXT?

Trap 1: The physical cable connection to the wall jack.

A physical cable issue would prevent all network access, including local resources. Since the workstation can access local resources, the physical connection is working. The problem is specific to internet access, which points to a logical configuration issue like DNS or routing.

Trap 2: The DHCP lease expiration time.

The DHCP lease expiration would not cause a selective inability to reach the internet while local resources remain accessible. If the lease expired, the workstation would likely have no IP address or a self-assigned APIPA address. The ipconfig output shows correct IP configuration, so DHCP is not the issue.

Trap 3: The MAC address of the NIC.

The MAC address is a hardware identifier and does not affect the ability to reach the internet. If local resources are accessible, the NIC is functioning. Checking the MAC address would not resolve the issue. The problem is at a higher layer, likely DNS or firewall.

Study all Networking common traps →

A
The physical cable connection to the wall jack.
Why it fails: A physical cable issue would prevent all network access, including local resources. Since the workstation can access local resources, the physical connection is working. The problem is specific to internet access, which points to a logical configuration issue like DNS or routing.
B
The DHCP lease expiration time.
Why it fails: The DHCP lease expiration would not cause a selective inability to reach the internet while local resources remain accessible. If the lease expired, the workstation would likely have no IP address or a self-assigned APIPA address. The ipconfig output shows correct IP configuration, so DHCP is not the issue.
C
The DNS server settings.
If the workstation can reach local resources but not internet websites, the issue is likely name resolution. The IP configuration is correct, so the next step is to verify DNS server settings. Incorrect DNS would prevent resolving domain names to IP addresses, causing web access to fail while local resources (accessed by IP or local name) still work.
D
The MAC address of the NIC.
Why it fails: The MAC address is a hardware identifier and does not affect the ability to reach the internet. If local resources are accessible, the NIC is functioning. Checking the MAC address would not resolve the issue. The problem is at a higher layer, likely DNS or firewall.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Networking sessions

Start a Networking only practice session

Every question in these sessions is drawn from the Networking domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Networking questions →Mixed 220-1201 session

Frequently asked questions

What does the 220-1201 exam test about Networking?: Diagnose network faults by layer: verify physical link, then IP configuration, then name resolution, then ports and services. The single most important skill is reading a scenario and choosing the correct command or setting, especially distinguishing DNS, DHCP, and wireless security problems.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Networking questions in a focused session?: Yes — the session launcher on this page draws every question from the Networking domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 220-1201 topics?: Use the topic links above to move to related areas, or go back to the 220-1201 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the 220-1201 exam covers. They are not copied from any real exam or dump site.

Networking only

10 questions 20 questions 30 questions 50 questions

Mixed 220-1201 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All 220-1201 questions Networking domain overview 220-1201 exam guide

Exam traps to avoid

▸Confusing DNS failure with DHCP failure: name resolution fails but direct IP access works, so test with nslookup or ping by name.
▸Assuming a link light means working connectivity; a dead link light points to cable, NIC, or switch port, not software.
▸Mixing up WPA2-Personal (pre-shared key) with WPA2-Enterprise (RADIUS authentication) when a client wants easy employee access.

Networking practice questions

What to know about Networking

Common Networking exam traps

Networking questions

A user reports that they cannot access any websites by typing domain names, but they can access websites by entering IP addresses directly. The technician suspects a DNS issue. Which command should the technician use first to verify the DNS server settings on the user's Windows 10 computer?

A small business wants to add a guest wireless network that allows visitors to access the internet but prevents them from reaching internal company resources. The existing network uses a single wireless router with a default configuration. Which of the following should a technician implement?

A user reports that their workstation cannot connect to any network resources. The technician notices the network cable is plugged into the wall jack and the NIC, but the link light is off. Which of the following should the technician check FIRST?

A company has a network with multiple VLANs. Users on VLAN 10 need to access a server on VLAN 20, but they cannot. The technician verifies that the switch ports are correctly assigned and the server is reachable from other VLANs. Which of the following is the MOST likely cause?

A technician is troubleshooting a workstation that can access local network resources but cannot reach any websites on the internet. The technician runs ipconfig and sees the IP address, subnet mask, and default gateway are correct. Which of the following should the technician check NEXT?

Track your progress over time

Start a Networking only practice session

Related 220-1201 topic practice pages

Mobile Devices practice questions