N10-009 CompTIA Network+ Certification Exam Free Practice Exam Questions (2026 Updated)

NAT (Network Address Translation) helps hide internal IP addresses from external networks, adding a layer of security by preventing direct access to internal systems from the outside.

Autonomous access points operate independently without needing to communicate with a central wireless LAN controller. This is ideal for remote deployments.

From Andrew Ramdayal’s guide:

“Autonomous access points are stand-alone devices that manage their own configurations and operations. They do not require a WLC and are ideal for small or remote office deployments.”

The correct solution is a Content Delivery Network (CDN). A CDN caches web content (like images, videos, scripts) on distributed servers close to end users. This reduces latency, improves load times, and decreases the load on origin servers. For a business requiring high-speed access to media-rich content, a CDN is the most effective option.

B. SAN (Storage Area Network) is used for storage in a data center, not for distributing web content.

C. Firewall secures traffic but doesn’t accelerate content delivery.

D. Switches forward packets within a LAN, not globally distribute content.

By leveraging CDNs, businesses can handle large traffic volumes efficiently while improving user experience.

References (CompTIA Network+ N10-009):

Domain: Network Infrastructure — CDNs, caching, performance optimization.

BGP (Border Gateway Protocol) uses an Autonomous System (AS) number for its operations. An AS is a collection of IP networks and routers under the control of a single organization that presents a common routing policy to the Internet. BGP is used to exchange routing information between different ASes on the Internet, making it the only protocol among the listed options that uses an AS number.References: CompTIA Network+ study materials and RFC 4271.

Understanding Spanning Tree Protocol (STP):

STP is used to prevent network loops in Ethernet networks by creating a spanning tree that selectively blocks some redundant paths.

Default Priority Value:

Bridge Priority: STP uses bridge priority to determine which switch becomes the root bridge. The default bridge priority value for most switches is 32768.

Priority Range: The bridge priority can be set in increments of 4096, ranging from 0 to 61440.

Configuration and Verification:

When deploying a new switch, the network administrator can verify the bridge priority using commands such as show spanning-tree to ensure it is set to the default value of 32768.

Comparison with Other Values:

4096 and 8192: Lower than the default priority, indicating these would be manually configured for higher preference.

36684: A non-standard value, likely a result of specific configuration changes.

The switch with the lowest STP priority becomes the root bridge.In the given table, core-sw01 has the lowest priority value of 24576. Therefore, it will be elected as the root bridge in the Spanning Tree Protocol topology.

AnAccess Control List (ACL)configured on theedge firewallis the correct and most effective solution tofilter inbound traffic. The administrator can allow TCP port 443 (HTTPS) and deny all other traffic. This is a classic firewall configuration for securing public-facing servers.

The most likely cause of buffering issues when moving outdoors is signal degradation. Wireless signals weaken as they travel through obstacles such as walls, glass, and air, leading to weaker connections and reduced data rates.

Breakdown of Options:

A. Network congestion – While congestion can slow down network speeds, it affects all users, not just those moving outdoors.

B. Wireless interference – Interference is possible but is more likely caused by other wireless signals rather than outdoor movement.

C. Signal degradation – Correct answer. Wireless signals weaken with distance and obstacles such as walls, reducing performance.

D. Client disassociation – Disassociation occurs when clients lose connection to the AP, but the question states that users experience buffering, indicating they are still connected but with a weak signal.

Introduction to Administrative Distance

Administrative distance (AD) is a value used by routers to rank routes from different routing protocols. AD represents the trustworthiness of the source of the route. Lower AD values are more preferred. If a router has multiple routes to a destination from different sources, it will choose the route with the lowest AD.

Static Routes and Backup Routes

When a dynamic routing protocol is not used, static routes can be employed. Static routes are manually configured routes. To ensure a backup route, multiple static routes to the same destination can be configured with different AD values.

Configuring Static Routes with Administrative Distance

The primary route is configured with a lower AD value, making it the preferred route. The backup route is configured with a higher AD value. In the event of the primary route failure, the router will then use the backup route.

Example Configuration:

plaintext

Copy code

ip route 192.168.1.0 255.255.255.0 10.0.0.1 1

ip route 192.168.1.0 255.255.255.0 10.0.0.2 10

In the above example, 192.168.1.0/24 is the destination network.

10.0.0.1 is the next-hop IP address for the primary route with an AD of 1.

10.0.0.2 is the next-hop IP address for the backup route with an AD of 10.

Verification:

After configuration, use the show ip route command to verify that the primary route is in use and the backup route is listed as a candidate for use if the primary route fails.

The key difference is that an Intrusion Prevention System (IPS) is installed in line with network traffic, allowing it to actively block threats. In contrast, an Intrusion Detection System (IDS) only monitors and alerts without actively blocking traffic.

Breakdown of Options:

A. An IPS needs to be installed in line with traffic and an IDS does not. ✅ Correct answer. IPS actively prevents threats, while IDS only detects them.

B. An IPS is signature-based and an IDS is not. – False, both can use signature-based detection.

C. An IPS is less susceptible to false positives than an IDS. – False, both can produce false positives, depending on configurations.

D. An IPS requires less administrative overhead than an IDS. – False, IPS requires more administrative effort due to real-time blocking decisions.

Multitenancy is a cloud computing architecture where a single instance of software serves multiple customers or tenants. Each tenant ' s data is isolated and remains invisible to other tenants. Hosting a company application in the cloud to be available for both internal and third-party users fits this concept, as it allows shared resources and infrastructure while maintaining data separation and security. References: CompTIA Network+ Exam Objectives and official study guides.

Single-mode fiber is best suited for long-distance communication, often exceeding 10 km (6.2 miles). It ' s immune to EMI and offers high bandwidth — making it the ideal choice for connecting buildings across a city.

Coaxial (A) and Twinaxial (B) are used for shorter distances and specific use cases (e.g., storage or legacy systems).

Cat 5 (D) is limited to 100 meters and is not suitable for city-level interconnects.

✅ For long-distance, high-speed, and reliable communication between buildings, Single-mode fiber is the professional choice.

SSH (Secure Shell) is a cryptographic network protocol that enables secure remote management and operation of network devices, including routers and switches. SSH encrypts traffic, making it more secure than alternatives like Telnet, which sends data in plaintext. The document states:

“SSH (Secure Shell) is the recommended protocol for secure, interactive remote management of network devices. It provides a secure channel over an unsecured network by encrypting the traffic between the administrator’s workstation and the managed device.”

The issue is that no root bridge has been identified. In STP, a root bridge is necessary to manage redundant paths and avoid loops in the network. Without a root bridge, all switches will assume they can forward traffic, causing a network loop and connectivity problems.

=================

A screenshot of a computer AI-generated content may be incorrect.

A screenshot of a computer AI-generated content may be incorrect.

A screenshot of a computer AI-generated content may be incorrect.

TCP port 443 is reserved for HTTPS (Hypertext Transfer Protocol Secure), which uses TLS encryption to secure web traffic. It is the standard port for encrypted web communications.

A. Telnet uses TCP port 23.

B. SMTP commonly uses TCP ports 25, 465, or 587.

D. SNMP typically uses UDP ports 161 (queries) and 162 (traps).

References (CompTIA Network+ N10-009):

Domain: Network Standards, Protocols, and Implementations — Common ports and services.

If a ping to 10.0.100.19 is unreachable, the most likely issue is that users are on the wrong subnet and cannot communicate with the server.

Breakdown of Options:

A. The users are on the wrong subnet. ✅ Correct answer. If users are on a different subnet without proper routing, they won ' t reach the server.

B. The DHCP server renewed the lease. – Would change the client’s IP, but the server’s static IP should remain unchanged.

C. The IP address was not reserved. – DHCP reservations matter for dynamic IPs, but RDP servers typically have static IPs.

D. The hostname was changed. – Would affect DNS resolution, but pinging the IP directly would still work.

Network segmentation involves dividing a network into smaller segments or subnets. This is particularly important when integrating OT (Operational Technology) devices to ensure that these devices are isolated from other parts of the network. Segmentation helps protect the OT devices from potential threats and minimizes the impact of any security incidents. It also helps manage traffic and improves overall network performance.References: CompTIA Network+ study materials.

The correct answer is Test the theory, which aligns directly with the CompTIA Network+ N10-009 troubleshooting methodology. According to the official troubleshooting steps, once a problem has been identified and relevant information gathered, the next step is to establish a theory of probable cause and then test that theory to determine whether it is valid.

In this scenario, the engineer has already completed the problem identification phase by confirming that all users are experiencing latency and correlating the issue with the installation of a new switch. The engineer has also formed a theory: that a network loop caused by the lower bridge ID of the new switch may be impacting Spanning Tree Protocol (STP), resulting in congestion and latency. Because this theory has already been developed, the next logical and required step is to test the theory—for example, by reviewing STP states, temporarily disabling ports, or adjusting bridge priorities.

Implementing a solution would be premature without validating the theory, and verifying full system functionality occurs only after a fix has been applied. The Network+ objectives stress following a structured methodology to avoid unnecessary changes and minimize network disruption. Testing the theory ensures accuracy before corrective action is taken, reducing risk and downtime.

The option that most directly secures sensitive information on the network is data-in-transit encryption. This ensures that data packets are unreadable to attackers who intercept them while moving across the network. Protocols such as TLS, HTTPS, IPsec, and SSH protect confidentiality and integrity of sensitive information.

B. Principle of least privilege (PoLP) secures access control but does not directly protect data in motion.

C. Role-based access control (RBAC) enforces permissions but again does not secure the data while transmitted.

D. Multifactor authentication (MFA) strengthens identity verification but does not directly protect the data itself once transmitted.

Thus, while all options contribute to overall security, encryption of data-in-transit most directly addresses protection of sensitive information on the network.

References (CompTIA Network+ N10-009):

Domain: Network Security — Encryption methods, confidentiality, data-in-transit protection.

A split-tunnel VPN allows some traffic to be routed through the VPN while other traffic goes directly to the internet. This setup offers several advantages, with a primary one being cost-effectiveness due to cloud-based traffic not consuming company bandwidth.

Bandwidth Utilization: Split-tunnel VPNs reduce the amount of traffic passing through the company ' s network, freeing up bandwidth for other uses.

Performance: By allowing internet-bound traffic to bypass the VPN, it can reduce latency and improve the performance for users accessing cloud services directly.

Cost Savings: Reduced load on the company ' s VPN infrastructure can lead to lower costs in terms of both hardware and bandwidth.

Network References:

CompTIA Network+ N10-007 Official Certification Guide: Covers VPN types, including split-tunnel configurations and their advantages.

Cisco Networking Academy: Discusses VPN technologies and the benefits of split-tunneling.

Network+ Certification All-in-One Exam Guide: Provides detailed information on VPN setups, including the cost-effectiveness of split-tunnel VPNs.

By allowing cloud-based traffic to flow outside the company’s network, a split-tunnel VPN optimizes resource usage and enhances the overall network performance without incurring extra costs for bandwidth.

Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time. If leadership states “no more than eight hours of data loss,” they are describing how far back the organization is willing to roll data after an outage or disaster—meaning backups, replication, snapshots, or journaling must ensure recoverable data is no older than eight hours. In Network+ terms, this is a core availability and resiliency planning concept: you choose an RPO based on business impact, then implement backup frequency/replication strategy to meet it. By contrast, Recovery Time Objective (RTO) is about how quickly services must be restored (downtime duration), not how much data can be lost. MTTR (Mean Time to Repair/Recover) is an operational reliability metric describing typical time to restore a system, and MTBF (Mean Time Between Failures) indicates expected time between failures—neither directly states acceptable data loss. Therefore, the metric matching “eight hours of data loss” is RPO.

VLANs (Virtual Local Area Networks) segment network traffic by department, allowing ACLs (Access Control Lists) to be applied based on VLAN membership, improving security and resource isolation.

Breakdown of Options:

A. VLAN – Correct answer. VLANs enable logical network segmentation, allowing ACLs per department.

B. DHCP – Assigns IP addresses but does not control access.

C. VPN – Provides remote access, not segmentation within a network.

D. STP – Prevents switching loops, not related to ACL implementation.

When a network administrator installs a new Network Interface Card (NIC) and users are unable to reach the server, one of the common issues is the use of an incorrect cable type. Network cables must match the specifications required by the NIC and the network infrastructure (e.g., Cat5e, Cat6 for Ethernet).

NIC Compatibility: The new NIC might require a specific type of cable to function properly. Using a cable not rated for the NIC ' s required speeds or capabilities can result in connectivity issues.

Cable Standards: Different NICs and network devices might need different cabling standards (straight-through vs. crossover cables, or specific fiber optic types).

Connection Types: Ensuring that the cable connectors are appropriate for the NIC ports (e.g., RJ45 for Ethernet, LC connectors for fiber optics).

Network References:

CompTIA Network+ N10-007 Official Certification Guide: Discusses network cabling standards and NIC specifications.

Cisco Networking Academy: Provides insights into cabling and NIC configurations for optimal network performance.

Network+ Certification All-in-One Exam Guide: Offers comprehensive details on troubleshooting network connectivity issues, including cabling problems.

Introduction to Subinterfaces:

Subinterfaces are logical interfaces created on a single physical interface. They are used to enable a router to support multiple networks on a single physical interface.

Use Case for Subinterfaces:

Subinterfaces are commonly used in scenarios where VLANs are implemented. A router with a single physical LAN port can be configured with multiple subinterfaces, each associated with a different VLAN.

This setup allows the router to route traffic between different VLANs.

Example Configuration:

Consider a router with a single physical interface GigabitEthernet0/0 and two VLANs, 10 and 20.

interface GigabitEthernet0/0.10

encapsulation dot1Q 10

ip address 192.168.10.1 255.255.255.0

!

interface GigabitEthernet0/0.20

encapsulation dot1Q 20

ip address 192.168.20.1 255.255.255.0

The encapsulation dot1Q command specifies the VLAN ID.

Explanation of the Options:

A. A router with only one available LAN port: This is correct. Subinterfaces allow a single physical interface to manage multiple networks, making it essential for routers with limited physical interfaces.

B. A firewall performing deep packet inspection: Firewalls can use subinterfaces, but it is not a requirement for deep packet inspection.

C. A hub utilizing jumbo frames: Hubs do not use subinterfaces as they operate at Layer 1 and do not manage IP addressing.

D. A switch using Spanning Tree Protocol: STP is a protocol for preventing loops in a network and does not require subinterfaces.

Conclusion:

Subinterfaces provide a practical solution for routing between multiple VLANs on a router with limited physical interfaces. They allow network administrators to optimize the use of available hardware resources efficiently.

NetFlow (and similar flow technologies like IPFIX/sFlow in concept) is used to collect traffic-flow metadata such as source/destination IPs, ports, protocols, interfaces, and byte/packet counts over time. In Network+ (N10-009) operations and monitoring objectives, flow data is ideal for identifying top talkers and top destinations across the network on a given day because it provides summarized, queryable information at scale without capturing every packet payload. An administrator can review reports to determine which destination IPs/hosts consumed the most bandwidth, which applications were most active, and what time ranges saw spikes—perfect for historical analysis.

SNMP is great for polling device counters (interface utilization, errors, CPU) but it does not natively tell you the “top destination” by conversation/flow without additional flow awareness. Packet capture can reveal exact conversations and payloads, but it is heavy, localized, and not efficient for infrastructure-wide daily top-destination reporting. traceroute maps the path to a destination and helps isolate routing/path issues; it does not provide usage statistics. Therefore, NetFlow is the best fit.

===========

In a data center that uses hot aisle/cold aisle ventilation, equipment is typically installed so that cool air enters from the cold aisle (front) and hot air is exhausted to the hot aisle (rear). This configuration maximizes cooling efficiency.

A UPS (Uninterruptible Power Supply) provides backup power to devices during a power outage, allowing for continuous operation and protecting against sudden shutdowns that could cause data loss or equipment damage. The document confirms:

“A UPS (Uninterruptible Power Supply) is essential for maintaining power to critical devices during an outage, protecting data and ensuring continuous operation until power is restored or a safe shutdown can be performed.”

The correct appliance is a router, which is specifically designed to interconnect multiple networks and forward packets based on IP addresses. Routers operate at Layer 3 (Network layer) of the OSI model and make intelligent forwarding decisions to ensure data reaches the correct destination network.

A. Firewall can also forward traffic, but its primary function is security, not routing efficiency.

C. Layer 2 switches connect devices within the same LAN but do not forward packets between different networks without routing capability.

D. Load balancers distribute traffic among servers but are not general-purpose routers.

Modern enterprise routers are optimized to minimize latency by using fast switching and hardware acceleration, making them ideal for interconnecting logical networks securely and efficiently.

References (CompTIA Network+ N10-009):

Domain: Network Infrastructure — Routers, Layer 3 devices, inter-network communication.