Free Network+ practice test
30 questions written for this page against the CompTIA Network+ N10-009 objectives, spread across the five domains the way the exam spreads them. Each one names the objective it tests. Pick your answer, then open the card to see the right one and why the others are wrong.
How the 30 questions are spread
- 1.0Networking Concepts7 questions, 23% of the exam
- 2.0Network Implementation6 questions, 20% of the exam
- 3.0Network Operations6 questions, 19% of the exam
- 4.0Network Security4 questions, 14% of the exam
- 5.0Network Troubleshooting7 questions, 24% of the exam
The questions
- Question 1Objective 1.1
A switch reads the destination MAC address on each frame and sends the frame out of the one port that leads to it. At which OSI layer is that decision made?
- ALayer 3, network
- BLayer 4, transport
- CLayer 2, data link
- DLayer 1, physical
Show answer and explanation
Correct answer: C. Layer 2, data link
Forwarding frames by MAC address is a Layer 2 job, which is what a switch does. Routers decide by IP address at Layer 3, Layer 4 deals with ports and segments, and Layer 1 is the signal on the wire.
- Question 2Objective 1.3
Servers in a private subnet of a cloud VPC need to download updates from the internet, but nothing on the internet should be able to start a connection to them. Which of these should the subnet's outbound traffic go through?
- AA load balancer in front of the servers
- BAn internet gateway, with a public IP on each server
- CA site-to-site VPN to the office
- DA NAT gateway
Show answer and explanation
Correct answer: D. A NAT gateway
A NAT gateway lets instances in a private subnet open outbound connections while refusing anything that starts from outside. Public IPs behind an internet gateway would make the servers reachable from the internet, a VPN joins two private networks, and a load balancer spreads inbound traffic, which is the opposite of what is asked.
- Question 3Objective 1.4
An administrator points every router and switch at a central log server. Which port and transport does Syslog use by default?
- AUDP 514
- BUDP 161
- CUDP 69
- DUDP 123
Show answer and explanation
Correct answer: A. UDP 514
Syslog listens on UDP 514. UDP 161 is SNMP (traps go to 162), UDP 123 is NTP, and UDP 69 is TFTP.
- Question 4Objective 1.5
A link between two buildings runs 800 meters and has to carry 10 Gbps. Which medium is the right choice?
- ARG-6 coaxial cable
- BOM3 multimode fiber
- CCat 6a twisted pair
- DSingle-mode fiber
Show answer and explanation
Correct answer: D. Single-mode fiber
Single-mode fiber carries 10 Gbps for kilometers (10GBASE-LR reaches 10 km). OM3 multimode tops out around 300 meters at 10 Gbps, Cat 6a stops at 100 meters, and RG-6 coax is built for cable TV and broadband service.
- Question 5Objective 1.6
In a data center, every top-of-rack switch has an uplink to every switch in an upper tier, and the upper-tier switches do not link to each other, so traffic between any two racks crosses the same number of switches. Which design is this?
- APoint to point
- BHub and spoke
- CThree-tier hierarchical
- DSpine and leaf
Show answer and explanation
Correct answer: D. Spine and leaf
In a spine and leaf design each leaf (top-of-rack) switch links to every spine switch, so traffic between racks always takes the same leaf, spine, leaf path. A three-tier design stacks access, distribution and core layers, hub and spoke sends every site through a center, and point to point is a single link between two ends.
- Question 6Objective 1.7
Which of these addresses falls inside an RFC 1918 private range?
- A192.169.10.5
- B169.254.10.5
- C172.20.10.5
- D172.32.10.5
Show answer and explanation
Correct answer: C. 172.20.10.5
The private ranges are 10.0.0.0/8, 172.16.0.0/12 (172.16 through 172.31) and 192.168.0.0/16, so 172.20.10.5 is private. 172.32 is just past the /12, 169.254 is APIPA link-local addressing rather than RFC 1918, and 192.169 is one past 192.168.
- Question 7Objective 1.8
Laptops on an IPv6-only network need to reach a web server that only has an IPv4 address. Which technology translates between the two?
- ADual stack
- BIPv6-in-IPv4 tunneling
- CNAT64
- DSLAAC
Show answer and explanation
Correct answer: C. NAT64
NAT64 translates IPv6 packets to IPv4 and back, usually alongside DNS64. Dual stack needs every host to run both protocols, which IPv6-only hosts do not, tunneling carries IPv6 across an IPv4 network without translating anything, and SLAAC only lets hosts build their own IPv6 addresses from the prefix a router advertises.
- Question 8Objective 2.1
A router has a route to 10.1.0.0/16 learned through OSPF and a static route to 10.1.5.0/24. A packet arrives for 10.1.5.20. Which route does the router use?
- AThe /24, because the longest prefix match wins
- BThe OSPF route, because dynamic routes are trusted more
- CThe /16, because it covers the whole network
- DBoth routes, with packets shared between them
Show answer and explanation
Correct answer: A. The /24, because the longest prefix match wins
A router always picks the most specific matching prefix first, so the /24 wins. Administrative distance only decides between routes to the same prefix, and a static route (distance 1) would beat OSPF (110) there anyway.
- Question 9Objective 2.1
Two routers share one virtual IP address that hosts use as their default gateway, and either router can take over if the other fails. What provides this?
- ALink aggregation with LACP
- BA first hop redundancy protocol
- CPort mirroring on both routers
- DSpanning Tree Protocol
Show answer and explanation
Correct answer: B. A first hop redundancy protocol
A first hop redundancy protocol (VRRP or HSRP, for example) gives a pair of routers a shared virtual IP, so the gateway survives one router failing. LACP bundles links between two devices, spanning tree prevents switching loops, and port mirroring copies traffic for analysis.
- Question 10Objective 2.2
One cable between two switches has to carry traffic for VLANs 10, 20 and 30. How should the port on each end be set up?
- AAs an 802.1Q trunk
- BAs an access port in VLAN 1
- CAs a SPAN destination port
- DAs an access port in VLAN 10
Show answer and explanation
Correct answer: A. As an 802.1Q trunk
A trunk adds an 802.1Q tag with the VLAN ID to each frame (only the native VLAN crosses untagged), so one link carries all three. An access port belongs to a single VLAN, and a SPAN destination receives mirrored copies of traffic rather than carrying it between switches.
- Question 11Objective 2.2
A storage network moves large blocks of data, and the admin wants fewer, larger frames to cut per-frame overhead. Which change should the admin make on the switches and hosts?
- ARaise the MTU for jumbo frames
- BEnable port mirroring on the uplinks
- CSet every port to half duplex
- DPut the hosts in a voice VLAN
Show answer and explanation
Correct answer: A. Raise the MTU for jumbo frames
Jumbo frames raise the MTU above the standard 1500 bytes (commonly to 9000), so each frame carries more data. The MTU has to match end to end. A voice VLAN prioritizes phones, half duplex slows a link down, and mirroring only copies traffic.
- Question 12Objective 2.3
Three access points next to each other use the 2.4 GHz band in the United States. Which channels keep them from overlapping?
- A1, 6 and 11
- B1, 2 and 3
- C36, 40 and 44
- D6, 7 and 8
Show answer and explanation
Correct answer: A. 1, 6 and 11
A 2.4 GHz channel is about 22 MHz wide while channel centers sit only 5 MHz apart, so channels that do not overlap must be five numbers apart, and in the US (channels 1 through 11) only 1, 6 and 11 manage that. Channels 36, 40 and 44 are in the 5 GHz band, and neighboring channel numbers overlap heavily.
- Question 13Objective 2.4
What does a power distribution unit (PDU) do in a network rack?
- AHolds the room humidity in a safe range
- BKeeps equipment running from a battery during an outage
- CTerminates the fiber runs that come into the rack
- DShares one power feed among the devices in the rack
Show answer and explanation
Correct answer: D. Shares one power feed among the devices in the rack
A PDU is the rack power strip: it takes one feed and gives each device an outlet, and many can meter the load. The battery that rides through an outage is a UPS, fiber ends on a fiber distribution panel, and humidity is the HVAC system's job.
- Question 14Objective 3.1
Before upgrading a switch, an admin wants the approved, known-good configuration to compare against and roll back to. What is that configuration called?
- AThe rack diagram
- BThe golden configuration
- CThe service-level agreement
- DThe physical network diagram
Show answer and explanation
Correct answer: B. The golden configuration
The golden (baseline) configuration is the approved version a device should match, which makes it the reference for audits and the target for a rollback. A rack diagram shows where hardware sits, an SLA sets service commitments, and a physical diagram maps cabling and devices.
- Question 15Objective 3.2
A monitoring server should hear about a downed interface the moment it happens, instead of finding out at the next poll. Which messages should the devices be set up to send?
- ASNMP traps
- BSNMP Get responses
- CMirrored port traffic
- DNetFlow records
Show answer and explanation
Correct answer: A. SNMP traps
An SNMP trap is a message the device sends on its own when an event happens, to UDP 162 on the manager. Get responses only answer the manager's polls, NetFlow describes traffic flows, and port mirroring copies packets to an analyzer.
- Question 16Objective 3.3
A business decides it can lose no more than 15 minutes of transactions in a disaster. Which metric is that?
- ARecovery time objective (RTO)
- BMean time between failures (MTBF)
- CMean time to repair (MTTR)
- DRecovery point objective (RPO)
Show answer and explanation
Correct answer: D. Recovery point objective (RPO)
The RPO is how much data, measured in time, the business can afford to lose, which sets how often backups or replication run. The RTO is how long the recovery can take, MTTR is the average repair time, and MTBF is the average time a device runs between failures.
- Question 17Objective 3.4
Computers on a branch subnet cannot get addresses because the DHCP server sits on a different subnet. Which feature should the branch router run?
- AA longer DHCP lease time
- BA DHCP reservation per client
- CA DHCP exclusion range
- DA DHCP relay (IP helper)
Show answer and explanation
Correct answer: D. A DHCP relay (IP helper)
DHCP discovers are broadcasts and routers do not forward broadcasts, so the router has to relay them to the server as unicast. Reservations, lease times and exclusions all assume the request is already reaching the server.
- Question 18Objective 3.4
Which DNS record type returns the IPv6 address for a host name?
- APTR
- BMX
- CAAAA
- DA
Show answer and explanation
Correct answer: C. AAAA
An AAAA record maps a name to an IPv6 address. An A record does the same for IPv4, a PTR record maps an address back to a name for reverse lookups, and an MX record names a domain's mail servers.
- Question 19Objective 3.5
Remote staff connect over a client VPN, but the company wants their ordinary web browsing to go straight to the internet instead of through the tunnel. Which VPN setting does that?
- ASite-to-site tunnel
- BClientless VPN
- CFull tunnel
- DSplit tunnel
Show answer and explanation
Correct answer: D. Split tunnel
A split tunnel sends only traffic for company networks through the VPN and lets the rest use the local internet connection. A full tunnel sends everything through the company, site-to-site joins two networks, and a clientless VPN runs in the browser without an installed client.
- Question 20Objective 4.1
Network devices should check admin logins against a central server, with the full packet body encrypted rather than just the password, and authentication, authorization and accounting handled separately. Which protocol fits?
- ARADIUS
- BLDAP
- CTACACS+
- DSAML
Show answer and explanation
Correct answer: C. TACACS+
TACACS+ encrypts the entire payload and keeps authentication, authorization and accounting apart, which is why it is the usual choice for device administration. RADIUS encrypts only the password and combines authentication with authorization, LDAP is a directory protocol, and SAML is for web single sign-on.
- Question 21Objective 4.2
An attacker on the LAN sends forged ARP replies so that traffic meant for the default gateway reaches the attacker's machine first. Which attack is this?
- AVLAN hopping
- BMAC flooding
- CDNS poisoning
- DARP poisoning
Show answer and explanation
Correct answer: D. ARP poisoning
ARP poisoning ties the attacker's MAC address to the gateway's IP in the victims' ARP caches, putting the attacker on the path. MAC flooding overflows a switch's MAC table, VLAN hopping reaches another VLAN through trunking tricks, and DNS poisoning corrupts name lookups.
- Question 22Objective 4.2
Employees in the parking lot connect to a wireless network with the company's exact SSID, but it belongs to an attacker capturing their traffic. What is it?
- ATailgating
- BA honeypot
- CA rogue DHCP server
- DAn evil twin
Show answer and explanation
Correct answer: D. An evil twin
An evil twin is an access point that copies a real network's SSID to lure clients onto it. A rogue DHCP server hands out bad addressing, a honeypot is a decoy the defenders run, and tailgating is following someone through a secured door.
- Question 23Objective 4.3
A conference room jack should work for one specific laptop and shut itself down if any other device is plugged in. Which feature does this?
- AA screened subnet for the room
- BPort security with a sticky MAC
- CURL filtering on the firewall
- DContent filtering on the proxy
Show answer and explanation
Correct answer: B. Port security with a sticky MAC
Port security learns the allowed MAC address (sticky) and can shut the port down when a different one appears. URL and content filtering decide what websites people can reach, and a screened subnet (DMZ) holds public-facing servers.
- Question 24Objective 5.1
A technician has tested a theory and confirmed the cause of an outage. Which step of the CompTIA troubleshooting methodology follows?
- AEstablish a plan of action to fix it
- BVerify full system functionality
- CDocument the findings and lessons learned
- DQuestion users to identify the symptoms
Show answer and explanation
Correct answer: A. Establish a plan of action to fix it
The steps run: identify the problem, establish a theory, test the theory, establish a plan of action, implement or escalate, verify full functionality, then document. With the cause confirmed, the next step is the plan, including what the fix might affect.
- Question 25Objective 5.2
A switch interface shows a rising count of CRC errors, and its cable runs along a bank of fluorescent light fixtures. Which cause fits best?
- AA spanning tree change
- BInterference on the cable
- CA wrong VLAN on the port
- DAn exhausted DHCP scope
Show answer and explanation
Correct answer: B. Interference on the cable
CRC errors mean frames arrived damaged, and electromagnetic interference from lights and motors is a classic cause on copper runs. DHCP, VLAN and spanning tree problems stop traffic or misdirect it, but they do not corrupt the frames on the wire.
- Question 26Objective 5.2
New PoE cameras plugged into a switch get no power, while the cameras connected earlier still work. The ports show no errors. What is the likely cause?
- AThe cameras need jumbo frames turned on
- BThe switch is out of PoE power budget
- CSpanning tree is blocking the new ports
- DThe new ports are in the wrong VLAN
Show answer and explanation
Correct answer: B. The switch is out of PoE power budget
A PoE switch has a total power budget, and once the earlier devices use it up, new ones get nothing. Jumbo frames, VLANs and spanning tree all shape how traffic moves, and none of them decides whether a port supplies power.
- Question 27Objective 5.3
A workstation can reach every device on its own subnet but nothing on any other subnet. Its IP address and subnet mask are correct. What should be checked first?
- AIts DHCP lease time
- BIts DNS server address
- CIts default gateway
- DIts NIC duplex setting
Show answer and explanation
Correct answer: C. Its default gateway
Traffic for another subnet goes to the default gateway, so a missing or wrong gateway leaves the local subnet working and everything else unreachable. A DNS problem would break name lookups while addresses still worked, and the lease time and duplex setting would not block only remote traffic.
- Question 28Objective 5.3
Newly connected laptops come up with 169.254.x.x addresses, while machines that were already on the network keep working. Why are only the new laptops affected?
- AThe laptops have duplicate MAC addresses
- BThe default gateway address is wrong
- CThe DNS server has stopped answering
- DThe DHCP scope has run out of addresses
Show answer and explanation
Correct answer: D. The DHCP scope has run out of addresses
A 169.254.x.x address is APIPA: the client asked DHCP and got no answer. Existing machines still hold their leases, so an exhausted address pool hits only the new ones. DNS and gateway problems do not stop a client getting an address.
- Question 29Objective 5.4
Calls over the WAN sound choppy even though bandwidth use is low, and tests show packets arriving at uneven intervals. Which problem do the tests point to?
- AJitter
- BLow throughput
- CAttenuation
- DBottlenecking
Show answer and explanation
Correct answer: A. Jitter
Jitter is variation in packet delay, and voice and video suffer from it first. Throughput and bottlenecks are about how much traffic gets through, which is fine here, and attenuation is signal loss over distance on a cable.
- Question 30Objective 5.5
A technician needs to find which patch panel port a wall jack is wired to, and none of the cables are labeled. Which tool fits?
- AA protocol analyzer
- BA Wi-Fi analyzer
- CA visual fault locator
- DA toner and probe
Show answer and explanation
Correct answer: D. A toner and probe
A toner puts a signal on the cable at the jack and the probe finds it at the panel. A Wi-Fi analyzer surveys wireless signal, a visual fault locator shines light down fiber to find breaks, and a protocol analyzer captures traffic.
Count your right answers. 24 of 30 is 80 percent, the bar every quiz in NetPlus Mastery asks for before the next objective opens. The real exam is scored from 100 to 900 with 720 to pass, so a scaled score is not a straight percentage.
Questions about the practice test
Is this Network+ practice test free?
Yes. All 30 questions, the answers and the explanations are on this page, and you don't need an account to use them. In NetPlus Mastery, Domain 1 is free as well.How many questions are on the Network+ N10-009 exam?
Up to 90, in 90 minutes, a mix of multiple choice and performance-based questions. It's scored from 100 to 900, and you pass at 720.How is this practice test weighted?
The same way as the exam: 7 on Networking Concepts (23%), 6 on Network Implementation (20%), 6 on Network Operations (19%), 4 on Network Security (14%) and 7 on Network Troubleshooting (24%).Are these real Network+ exam questions?
No. CompTIA keeps its exam questions secret, and anyone selling the real ones is selling a dump that breaks the exam rules. Every question here was written for this page against the published N10-009 objectives, and each one names the objective it tests.Where can I get more Network+ practice questions?
NetPlus Mastery has a question bank for every N10-009 objective, performance-based questions among them, plus a timed 90-question mock exam. Domain 1 is free with an account, and a 90-Day Pass or Lifetime opens the rest.
Keep going objective by objective
NetPlus Mastery has a lesson and a question bank for every N10-009 objective, performance-based questions, a timed 90-question mock exam and spaced review. Domain 1 is free.
Keep studying: subnetting practice, the ports list, PBQ practice, and the full course.
Original practice questions aligned to the CompTIA Network+ N10-009 objectives. CompTIA and Network+ are trademarks of CompTIA, used here for identification only.