N10-009 CompTIA Network+ Certification Exam Free Practice Exam Questions (2026 Updated)

When working with fiber optic cables, one common issue is that the transmit (TX) and receive (RX) fibers might be reversed. The first step in troubleshooting should be to reverse the fibers at one end to ensure they are correctly aligned (TX to RX and RX to TX). This is a simple and quick step to rule out a common issue before moving on to more complex troubleshooting.References: CompTIA Network+ study materials.

LDAP over SSL (LDAPS) uses port 636 to provide secure, encrypted authentication for directory services.

Breakdown of Options:

A. SMTP (Simple Mail Transfer Protocol) – Uses port 25, not 636.

B. Syslog – Uses port 514 (UDP), not 636.

C. TFTP (Trivial File Transfer Protocol) – Uses port 69 (UDP), not 636.

D. LDAPS (Lightweight Directory Access Protocol Secure) – ✅ Correct answer. Uses port 636 for secure directory authentication.

When extending a network beyond the primary equipment location, additional access/distribution switches are typically placed in an IDF (Intermediate Distribution Frame). Network+ (N10-009) infrastructure objectives differentiate between the MDF and IDF: the MDF is the main, central wiring/equipment location (often where core switches, routers, WAN demarcation, and main cross-connects reside). As a building grows or spans multiple floors/areas, an IDF is used as a secondary wiring closet to reduce cable runs, provide local switching, and aggregate user access connections back to the MDF using backbone cabling (often fiber). This supports scalability, cable management, and performance by keeping horizontal runs within recommended distance limits.

VPC (Virtual Private Cloud) is a cloud networking construct, not a physical wiring location. VXLAN is an overlay tunneling technology used in virtualized/data center networks, not where you physically install switches. The question specifically references extending the network beyond the primary equipment location, which is a classic use case for deploying an IDF to host additional switches closer to endpoint areas while uplinking back to the MDF.

The correct answer is Documenting findings, outcomes, and lessons learned because proper documentation and closure are the final steps in the ticket management and troubleshooting process. According to CompTIA Network+ (N10-009) objectives under network operations and troubleshooting methodology, once an issue is resolved, technicians must verify full system functionality, implement preventive measures if needed, and document the entire process before closing the ticket.

Documentation ensures that all relevant information—such as the root cause, corrective actions taken, configuration changes made, and lessons learned—is recorded for future reference. This supports knowledge base updates, trend analysis, compliance requirements, and improved response times for similar incidents.

Escalation (Option A) occurs earlier if the issue cannot be resolved at the current support tier. Establishing an action plan (Option D) is part of the remediation phase, not the final step. Functional and non-functional testing (Option B) occurs during verification before closure.

Therefore, comprehensive documentation and formal ticket closure represent the final step in the ticket management lifecycle.

A Site-to-site VPN (Virtual Private Network) is the most cost-effective solution for establishing a persistent, secure connection between two facilities. It uses the public internet to create an encrypted tunnel, leveraging existing internet connections without requiring expensive dedicated infrastructure. This makes it ideal for organizations looking to securely connect remote sites while minimizing costs.

Why not GRE tunnel? Generic Routing Encapsulation (GRE) tunnels encapsulate traffic but do not provide encryption natively, requiring additional protocols (e.g., IPsec) for security. This adds complexity and is less cost-effective than a site-to-site VPN, which integrates encryption.

Why not VXLAN? Virtual Extensible LAN (VXLAN) is used for overlay networks in data centers to extend Layer 2 networks, not for secure site-to-site connectivity.

Why not Dedicated line? A dedicated line (e.g., leased line or MPLS) provides high reliability but is significantly more expensive due to the need for dedicated infrastructure.

At the transport layer, connectionless communication is typically handled using the User Datagram Protocol (UDP), which transmits data in units called datagrams. Unlike TCP, UDP does not establish a connection before sending data and does not guarantee delivery, making datagrams the correct term for the transmission format in this context. References: CompTIA Network+ Exam Objectives and official study guides.

Out-of-band (OOB) management refers to using a dedicated management network that is physically separate from the regular data network. This management network uses a different set of IP addresses to ensure that management traffic is isolated from user data traffic, providing a secure way to manage network devices even if the main network is down or compromised.References: CompTIA Network+ study materials. ​

Definition of GDPR:

General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy for all individuals within the European Union and the European Economic Area. It also addresses the transfer of personal data outside the EU and EEA areas.

Scope and Objectives:

GDPR aims to give individuals control over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU.

It enforces rules about data protection, requiring companies to protect the personal data and privacy of EU citizens for transactions that occur within EU member states.

Comparison with Other Options:

SCADA (Supervisory Control and Data Acquisition): Refers to control systems used in industrial and infrastructure processes, not related to personal data protection.

SAML (Security Assertion Markup Language): A standard for exchanging authentication and authorization data between parties, not specifically for personal data protection.

PCI DSS (Payment Card Industry Data Security Standard): A set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information maintain a secure environment, not specific to personal data protection in Europe.

Key Provisions:

GDPR includes provisions for data processing, data subject rights, obligations of data controllers and processors, and penalties for non-compliance.

The correct answer is Ad hoc because it allows wireless devices to communicate directly with one another without requiring a centralized access point or additional infrastructure. According to CompTIA Network+ (N10-009) objectives under wireless networking concepts, an ad hoc network (also known as an Independent Basic Service Set, or IBSS) enables peer-to-peer wireless communication.

This type of network is ideal for temporary or quick setups where only a small number of devices need to connect. In an ad hoc configuration, each device connects directly to others, making it simple and fast to deploy without requiring switches, routers, or wireless access points.

Spine and leaf (Option B) is a data center architecture designed for high scalability and redundancy, not small wireless setups. Point-to-point (Option C) refers to a direct connection between two devices only, which would not support five devices efficiently. Mesh (Option D) allows multiple nodes to interconnect and provide redundancy, but it is more complex and typically requires compatible infrastructure devices.

Therefore, for a quick setup with five wireless devices, an ad hoc network is the most appropriate choice.

Understanding Subnetting:

Original Network: 192.168.1.0/24 has a subnet mask of 255.255.255.0, which allows for 256 IP addresses (including network and broadcast addresses).

Objective: Divide this network into two equal subnets.

Calculating Subnet Mask:

New Subnet Mask: To divide 192.168.1.0/24 into two equal halves, we need to borrow one bit from the host portion of the address, changing the subnet mask to 255.255.255.128 (/25).

Subnet Breakdown:

First Subnet: 192.168.1.0/25 (192.168.1.0 - 192.168.1.127)

Second Subnet: 192.168.1.128/25 (192.168.1.128 - 192.168.1.255)

Verification:

Each subnet now has 128 IP addresses (126 usable IP addresses, excluding the network and broadcast addresses).

Comparison with Other Options:

255.255.0.0 (/16): Provides a much larger network, not dividing the original /24 network.

255.255.254.0 (/23): Also creates a larger subnet, encompassing more than the original /24 network.

255.255.255.0 (/24): Maintains the original subnet size, not dividing it.

A cable tester is a tool that can help identify issues with the physical cabling, such as breaks or improper terminations, which may prevent the access point from reaching the internet.

=================

A screenshot of a computer screen AI-generated content may be incorrect.

Comprehensive and Detailed Explanation (aligned to N10-009):

A broadcast message is delivered to all nodes in a broadcast domain (e.g., ARP requests).

A. Unicast is one-to-one.

C. Multicast is one-to-many but only to subscribed members.

D. Anycast is one-to-one-of-many, sending to the nearest node.

References (CompTIA Network+ N10-009):

Domain: Networking Concepts — Traffic types: unicast, multicast, broadcast, anycast.

The correct answer is IP address blocks because geofencing policies typically rely on public IP address ranges associated with specific geographic regions or countries. According to CompTIA Network+ (N10-009) security objectives, geofencing is a security control used to restrict or allow traffic based on geographic location. This is commonly implemented on firewalls, VPN concentrators, or security gateways by referencing databases that map IP address blocks to countries or regions.

When configuring geofencing, administrators create access control rules that permit or deny traffic from specific country-based IP ranges. This method is effective for limiting remote access to approved geographic locations and reducing exposure to international threat sources.

MAC filtering (Option A) is used within local networks and does not function over the internet for geographic control. Administrative distance (Option B) is a routing concept that determines route preference and has no relation to access control policies. Bluetooth beacon signals (Option C) are used for proximity-based services and indoor positioning, not for country-level remote access restrictions.

Therefore, leveraging IP address blocks is the correct approach for implementing geofencing controls.

When an organization moves its DNS servers to new IP addresses, the NS (Name Server) records must be updated. The NS record defines which DNS servers are authoritative for a domain. Ifthese records still point to the old IP addresses, clients will continue to query the outdated servers, leading to connectivity issues.

Breakdown of Options:

A. AAAA – This record maps a domain name to an IPv6 address. Since the issue is with DNS resolution, not IP versioning, this is incorrect.

B. CNAME – A CNAME (Canonical Name) record is used for domain aliasing, not for defining authoritative name servers.

C. MX – Mail Exchange (MX) records direct email traffic to the correct mail server, which does not impact general website accessibility.

D. NS – Correct answer. NS records must be updated to reflect the new authoritative DNS servers.

A rogue DHCP server occurs when an unauthorized or misconfigured DHCP server assigns incorrect IP addresses, default gateways, or DNS settings to clients.

•In this scenario:

•The user can ping the gateway, meaning local network communication is working.

•However, they cannot access network resources, which suggests incorrect IP configuration (likely due to a rogue DHCP server assigning the wrong gateway or DNS).

•Why not the other options?

•VLAN hopping (A): This is an attack that exploits VLAN configurations to gain access to unauthorized VLANs. It would not typically cause multiple users to lose network access.

•Distributed DoS (C): A DDoS attack floods a network or service with traffic, but this issue is more likely misconfigured IP settings than an actual attack.

•Evil twin (D): This refers to a fraudulent Wi-Fi network mimicking a legitimate one. Since the users are on a wired network (ipconfig output checked), this is not applicable.

Site-to-Site VPN: A site-to-site VPN is used to securely connect two networks, such as a company's headquarters and a branch location, over the internet. This type of VPN creates a secure tunnel for data transmission, ensuring confidentiality and integrity.

Split-tunnel VPN (A): Allows some traffic to bypass the VPN tunnel, which may not secure all communications.

Clientless VPN (B): Used for individual users to access the network without VPN client software.

Full-tunnel VPN (C): Typically used for individual user traffic rather than connecting two networks.