CompTIA Network+
CompTIA Network+ N10-009 Practice Questions (Free)
The CompTIA Network+ (N10-009) exam covers five domains and has up to 90 questions in 90 minutes.
The passing score is 720 out of 900 (about 72%). Below are 20 free practice questions —
four per domain — with full explanations on every answer, including why the wrong options are wrong.
Exam overview: Network+ N10-009 · Up to 90 questions · 90 minutes ·
Passing score: 720/900 · Domains: Networking Fundamentals (23%), Network Implementations (19%),
Network Operations (17%), Network Security (20%), Network Troubleshooting (21%)
Domain 1: Networking Fundamentals
Question 1
Which OSI layer is responsible for logical addressing and routing packets between different networks?
✓ C is correct. Layer 3 (Network) handles logical IP addressing and routing between networks. Layer 2 handles MAC addressing within a single network segment. Layer 4 handles end-to-end communication and port numbers. Layer 1 is the physical medium.
Question 2
A host is assigned the IP address 192.168.10.50/26. What is the broadcast address of this subnet?
✓ A/B is correct. A /26 mask gives 64 addresses per subnet. The subnets are .0–.63, .64–.127, .128–.191, .192–.255. The host .50 falls in the .0–.63 subnet. Broadcast is the last address: 192.168.10.63.
Question 3
Which protocol provides automatic IP address assignment and also delivers subnet mask, default gateway, and DNS server information to clients?
✓ B is correct. DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses and delivers subnet mask, gateway, and DNS info. DNS resolves names to IPs. SNMP monitors network devices. ARP resolves IP addresses to MAC addresses on a local segment.
Question 4
A technician needs to connect two switches using a link that will carry traffic for multiple VLANs simultaneously. Which port configuration should be used?
✓ B is correct. A trunk port carries tagged traffic for multiple VLANs using 802.1Q tagging. An access port carries untagged traffic for a single VLAN. Native VLAN is a concept within trunking (untagged VLAN on a trunk). A mirrored port copies traffic for monitoring.
Domain 2: Network Implementations
Question 5
Which wireless standard operates exclusively in the 5 GHz band, supports up to 3.5 Gbps, and uses MU-MIMO?
✓ C is correct. 802.11ac (Wi-Fi 5) operates only at 5 GHz, supports up to 3.5 Gbps, and introduced MU-MIMO (multiple users). 802.11n uses both 2.4 and 5 GHz. 802.11ax (Wi-Fi 6) operates at both bands and adds OFDMA. 802.11g is 2.4 GHz only at 54 Mbps.
Question 6
A network uses OSPF as its routing protocol. Which metric does OSPF use to determine the best path?
✓ C is correct. OSPF uses cost, which is calculated as reference bandwidth ÷ interface bandwidth. Lower cost = preferred path. Hop count is used by RIP. Bandwidth and delay together are used by EIGRP. Administrative distance compares different routing protocols, not paths within one protocol.
Question 7
Which cable type uses light to transmit data and is immune to electromagnetic interference?
✓ A is correct. Fiber optic transmits data as light pulses through glass or plastic strands, making it immune to EMI and capable of very long runs. UTP and STP copper cables are susceptible to EMI to varying degrees. Coaxial is also copper and can experience EMI.
Question 8
A company wants to allow remote workers to securely access internal resources over the internet. Which technology is BEST suited for this?
✓ C is correct. A VPN (Virtual Private Network) creates an encrypted tunnel over the internet, allowing remote users to securely access internal resources. NAT translates IP addresses. VLANs segment local network traffic. STP prevents switching loops and has nothing to do with remote access.
Domain 3: Network Operations
Question 9
A technician wants to test connectivity to a remote host and also see the round-trip time for each hop along the path. Which tool should be used?
✓ B is correct. traceroute (Linux/Mac) or tracert (Windows) shows each hop to the destination with round-trip times, useful for identifying where latency or packet loss occurs. ping only tests end-to-end connectivity. netstat shows active connections. nslookup resolves DNS names.
Question 10
Which backup type only copies files that have changed since the last full backup and does NOT reset the archive bit?
✓ C is correct. Incremental backups copy only files changed since the last backup (full or incremental) and reset the archive bit after. Differential backups copy all changes since the last full backup and do NOT reset the archive bit — making them grow larger each day. Full backups copy everything.
Question 11
A network administrator wants to monitor bandwidth usage across all interfaces of a core router in real time. Which protocol is BEST suited for this?
✓ A is correct. SNMP (Simple Network Management Protocol) is used to monitor and manage network devices, including collecting interface statistics like bandwidth utilization. Syslog collects log messages. SMTP handles email. ICMP is used for ping and error reporting, not performance monitoring.
Question 12
What is the purpose of a DNS record type MX?
✓ C is correct. MX (Mail Exchanger) records direct email to the correct mail server for a domain. AAAA records map hostnames to IPv6. PTR records map IPs to hostnames (reverse DNS). CNAME records create aliases. A records map hostnames to IPv4 addresses.
Domain 4: Network Security
Question 13
An attacker intercepts communication between two hosts and relays messages between them without either party knowing. What type of attack is this?
✓ B is correct. A man-in-the-middle (MitM) attack involves an attacker secretly intercepting and potentially altering communications between two parties. ARP poisoning and DNS hijacking are common methods used to achieve a MitM position, but they are techniques, not the attack type itself. DoS disrupts availability.
Question 14
Which firewall type inspects packets based on state information — tracking the connection from handshake to teardown?
✓ B is correct. A stateful inspection firewall tracks the state of active connections and makes decisions based on context (e.g., is this packet part of an established session?). Packet filter firewalls only inspect individual packets without connection context. Application-layer firewalls inspect content at Layer 7. NAT translates addresses.
Question 15
A user receives an email that appears to be from their bank, asking them to click a link and verify their account credentials. What type of attack is this?
✓ A is correct. Phishing uses deceptive emails to trick users into revealing credentials or clicking malicious links. Vishing is the same attack via voice/phone calls. Smishing is via SMS. Whaling is a targeted phishing attack aimed specifically at executives or high-value individuals.
Question 16
Which authentication method requires users to provide something they know AND something they have?
✓ B is correct. MFA combines two or more authentication factors: something you know (password), something you have (authenticator app, hardware token), or something you are (biometric). Biometrics alone is single-factor. SSO is about using one set of credentials across multiple systems, not multiple factors.
Domain 5: Network Troubleshooting
Question 17
A user can ping their default gateway but cannot reach any external websites. DNS resolution also fails. Which is the MOST likely cause?
✓ C is correct. If a user can reach their gateway (local connectivity works) but cannot reach external sites or resolve DNS, the issue is beyond the gateway — likely at the ISP or WAN connection. A faulty NIC would prevent even local connectivity. DHCP failure would result in no IP address at all. Incorrect subnet mask would prevent gateway communication.
Question 18
Which tool would a technician use to identify which specific wire pair in a UTP cable is broken?
✓ A is correct. A cable tester or TDR (Time Domain Reflectometer) tests each wire pair in a UTP cable and can pinpoint breaks or faults. A multimeter measures voltage/resistance but doesn't map individual pairs. A toner probe locates a cable's physical path. A Wi-Fi analyzer is for wireless signals.
Question 19
Users on one VLAN can no longer communicate with users on a different VLAN after a switch configuration change. What is the MOST likely cause?
✓ B is correct. VLANs are isolated by design — traffic between them requires a router or Layer 3 switch performing inter-VLAN routing. If a config change removed or broke that routing (e.g., removed a routed interface or SVI), inter-VLAN communication stops. STP blocking would affect all traffic, not just cross-VLAN. MAC table overflow causes flooding, not blocking.
Question 20
A newly installed gigabit switch port shows a speed of 100 Mbps even though both the switch and the connected device support 1 Gbps. What is the MOST likely cause?
✓ A is correct. When autonegotiation fails or one side is hardcoded to 100 Mbps, the link will negotiate down to 100 Mbps. This is a very common real-world issue. Cable length beyond spec could cause errors, but not a clean speed reduction. VLANs affect what traffic is allowed, not link speed. STP blocking would prevent traffic entirely.
Ready for 250 more?
aprencert has 270 Network+ questions across all 5 domains — free to start, with explanations on every answer.
Start practicing free →Network+ Exam Quick Reference
| Domain | Weight | ~Questions |
|---|---|---|
| 1. Networking Fundamentals | 23% | 21 |
| 2. Network Implementations | 19% | 17 |
| 3. Network Operations | 17% | 15 |
| 4. Network Security | 20% | 18 |
| 5. Network Troubleshooting | 21% | 19 |
Study tip: Network+ troubleshooting questions (Domain 5) have the highest weight and are scenario-based.
Practice working through the OSI model from Layer 1 up when diagnosing problems —
it's the most reliable method and the one examiners expect you to demonstrate.
Want the full 270-question bank? Create a free account on aprencert — no credit card required. The free tier lets you try 20 questions on any track. The Pro plan (€9/month or €69/year) unlocks everything.