Prepare for CompTIA Network+ (N10-009) with free sample questions, a full-length diagnostic, topic drills, timed practice, networking concepts, implementation, operations, security, troubleshooting, PBQ-style topology reasoning, and detailed explanations in IT Mastery.
CompTIA Network+ (N10-009) validates practical networking judgment across concepts, implementation, operations, security, and troubleshooting. If you are searching for N10-009 sample questions, a practice test, mock exam, or simulator, this is the main IT Mastery page to start on web and continue on iOS or Android with the same IT Mastery account.
Start a practice session for CompTIA Network+ (N10-009) below, or open the full app in a new tab. For the best experience, open the full app in a new tab and navigate with swipes/gestures or the mouse wheel—just like on your phone or tablet.
Open Full App in a New TabA small set of questions is available for free preview. Subscribers can unlock full access by signing in with the same app-family account they use on web and mobile.
Prefer to practice on your phone or tablet? Download the IT Mastery – AWS, Azure, GCP & CompTIA exam prep app for iOS or IT Mastery app on Google Play (Android) and use the same IT Mastery account across web and mobile.
Free diagnostic: Try the 90-question CompTIA Network+ full-length practice exam before subscribing. Use it to separate misses around networking concepts, implementation, operations, security, troubleshooting, and PBQ-style topology reasoning.
Network+ questions usually reward the option that identifies the right layer, uses the right tool, and resolves the root cause instead of chasing symptoms.
| Domain | Weight |
|---|---|
| Networking Concepts | 23% |
| Network Implementation | 20% |
| Network Operations | 19% |
| Network Security | 14% |
| Network Troubleshooting | 24% |
Network+ questions usually reward isolation of the failing layer or service before remediation.
| Symptom signal | First check | Strong answer usually… | Weak answer usually… |
|---|---|---|---|
| One host cannot connect | Local link and IP path | Checks cable/Wi-Fi, NIC, IP, gateway, DNS, and ACL/firewall scope | Reboots core infrastructure first |
| Many users in one area fail | Segment, switch, VLAN, or AP scope | Checks common upstream device, VLAN, trunk, DHCP scope, or RF issue | Troubleshoots each endpoint separately |
| Name resolution fails but IP works | DNS | Tests DNS settings, records, resolver reachability, and cache | Replaces cabling or changes routing |
| Intermittent Wi-Fi occurs | RF and roaming conditions | Checks channel overlap, signal strength, interference, band, and AP placement | Adds random APs without survey logic |
| A cable fault is suspected | Medium and tool | Uses cable tester/TDR/OTDR based on copper or fiber need | Uses the wrong tool for the medium |
| Remote admin is exposed | Management-plane security | Restricts access through VPN/MFA/jump host/PAW and disables public management | Assumes SSH alone makes internet exposure safe |
| Domain | What the exam tests | What IT Mastery practice should force | Common trap |
|---|---|---|---|
| Networking Concepts | Whether ports, protocols, addressing, routing, switching, and wireless basics are usable | Identify layer and service quickly | Memorizing ports without symptoms |
| Network Implementation | Whether you can choose devices, cabling, wireless, VLANs, and topologies | Match design choice to requirement and constraint | Picking technology by name recognition |
| Network Operations | Whether monitoring, documentation, change, backup, and continuity are understood | Use operational evidence before changing the network | Treating operations as afterthought documentation |
| Network Security | Whether segmentation, access control, remote admin, and hardening are applied correctly | Protect the management plane and reduce exposure | Trusting encryption while ignoring access path |
| Network Troubleshooting | Whether you can isolate root cause from symptoms and command output | Follow layer/service scope before remediation | Chasing symptoms out of order |
| Timing | Practice focus | What to review after the set |
|---|---|---|
| Days 7-5 | One 90-question diagnostic plus drills in weak Network+ domains | Whether misses came from concepts, implementation, operations, security, troubleshooting, subnetting, or topology interpretation |
| Days 4-3 | Mixed command-output, topology, and troubleshooting scenarios | Whether you can identify the failing layer or service before selecting a fix |
| Days 2-1 | Light review of subnetting, ports, Wi-Fi, VLANs, DNS/DHCP, cable tools, and secure admin access | Only recurring traps; avoid cramming exotic protocols late |
| Exam day | Short warm-up if useful | Choose the answer that isolates root cause with the right tool and scope |
If you can score above 75% on several unseen mixed attempts and explain the network layer, service, or tool behind each miss, you are likely ready. Do not keep repeating familiar topology items until memory replaces troubleshooting discipline.
Use these child pages when you want focused IT Mastery practice before returning to mixed sets and timed mocks.
Need concept review first? Read the CompTIA Network+ N10-009 Cheat Sheet on Tech Exam Lexicon, then return here for timed mocks, topic drills, and full IT Mastery practice.
Topic: Domain 5: Network Troubleshooting
Which tool is specifically designed to locate a fault on a copper network cable and report the approximate distance to that fault?
Options:
Best answer: C
Explanation: The choice describing a time-domain reflectometer is correct because a TDR is designed for copper cabling and can both detect a fault and estimate its distance from the tester, which directly matches the requirement in the question.
Topic: Domain 3: Network Operations
A network administrator is creating a business continuity and disaster recovery plan for several switches, routers, and firewalls, as well as critical file shares. The goal is to ensure network configurations and data can be restored quickly after a failure. Which of the following actions should you AVOID including in this plan? (Select TWO.)
Options:
Correct answers: D and E
Explanation: The option that stores each device’s only configuration backup on its own local flash is unsafe because a device failure, fire, theft, or other site-wide disaster will likely destroy both the device and its local backup. Disaster recovery requires off-device, preferably offsite copies.
The option that relies on manual backups that administrators run only when they remember is also unsafe. Without a documented schedule and automation, backups will be inconsistent, frequently outdated, or entirely missing. This undermines recovery point objectives and makes it likely that you cannot restore the current configuration after a failure.
Topic: Domain 4: Network Security
Which of the following statements about secure remote administrative access is NOT correct?
Options:
Best answer: A
Explanation: The statement claiming that it is acceptable for administrators to manage devices directly over the public Internet from any device as long as SSH is used is incorrect. While SSH provides encryption, it does not address the risk of exposing management ports to the Internet or using unmanaged, potentially compromised devices. Best practice is to restrict management to private addresses behind a firewall, require VPN access (with MFA), and often route sessions through a hardened jump host or PAW.
Topic: Domain 2: Network Implementations
A 200-person company runs a latency-sensitive ERP system in its headquarters data room. A remote manufacturing plant must access the ERP reliably 24x7. Management is willing to pay more for a provider-managed service with QoS and an SLA that guarantees uptime and latency. Which of the following WAN proposals is the LEAST appropriate for this requirement and should NOT be selected?
Options:
Best answer: B
Explanation: The option that proposes using low-cost consumer broadband at both sites, with no SLA, as the sole WAN path for ERP is the least appropriate.
Consumer broadband is:
This directly contradicts the requirements for provider-managed QoS, predictable performance, and a formal SLA. As such, it is the clear anti-pattern and the only option that should not be selected.
Topic: Domain 2: Network Implementations
Which statement BEST describes single-mode fiber compared to multimode fiber in typical enterprise networks?
Options:
Best answer: A
Explanation: The option stating that single-mode fiber “supports much longer distances and higher potential bandwidth but uses a smaller core and usually requires more expensive optics” is correct because it captures the key trade-off: single-mode offers superior distance and bandwidth characteristics due to its small core and laser-based signaling, but this comes with increased optics cost compared to multimode.
Topic: Domain 3: Network Operations
A small healthcare clinic is deploying a new electronic health records (EHR) application that will store and transmit patient information across its wired and wireless LAN. Management states that the clinic must comply with data-protection regulations and be able to show auditors where regulated data flows and how it is protected on the network. Which of the following actions should the network technician take to BEST support this requirement?
Options:
Best answer: D
Explanation: The choice to create and maintain up-to-date network and data-flow diagrams directly addresses management’s request: it shows where patient data flows on the network and what security controls protect it. This aligns with common compliance expectations that organizations document data locations, flows, and protections, and is a core part of applying network policies and procedures for regulatory compliance.
Topic: Domain 4: Network Security
Which statement BEST describes the purpose of a demilitarized zone (DMZ) in an enterprise network?
Options:
Best answer: C
Explanation: The choice describing a “semi‑trusted network segment that isolates public‑facing services from the internal LAN” correctly defines a DMZ. It captures both the placement (between the internet and the internal network) and the purpose (limiting exposure and containing damage if public‑facing systems are compromised), which directly aligns with segmentation and layered security best practices.
Topic: Domain 5: Network Troubleshooting
A network administrator applies a scheduled firewall firmware upgrade during a 1-hour maintenance window. After the reboot, users in the finance VLAN experience intermittent loss of Internet access, and a quick check of the vendor site shows this firmware has a known bug with no immediate fix. There are 10 minutes left in the window, finance relies on continuous Internet access for payment processing, and the change record includes a tested rollback plan. Which action is the BEST next step?
Options:
Best answer: C
Explanation: Rolling back the firewall to the previous firmware version uses the documented rollback plan to return the device to a known-good state within the maintenance window. This minimizes downtime for a critical department, aligns with change-management best practices, and avoids running a version with a known, unfixed bug in production. It is exactly the type of situation where rollback is preferred over continued experimentation or risky workarounds.
Topic: Domain 1: Networking Fundamentals
A small office deploys a server that translates human‑readable hostnames (such as files.example.com) into IP addresses for client PCs on the LAN. Which protocol and default port combination should this service use?
Options:
Best answer: B
Explanation: The option that specifies DNS over UDP/TCP port 53 is correct because DNS is explicitly designed for resolving hostnames to IP addresses, exactly as described. Its well-known default port is 53, and it uses both UDP (for most queries) and TCP (for zone transfers and large responses) on that port.
Topic: Domain 5: Network Troubleshooting
A branch router (R1) connects a LAN and an ISP. Users can reach local servers but cannot access any Internet sites. The technician runs the following command on R1:
R1# show ip route
Codes: C - connected, S - static
C 10.10.10.0/24 is directly connected, Gig0/0
C 203.0.113.0/30 is directly connected, Gig0/1
The ISP router is connected to R1 on network 203.0.113.0/30. Which of the following actions should the technician AVOID? (Select TWO.)
Options:
ip route 0.0.0.0 0.0.0.0 203.0.113.1Correct answers: B and C
Explanation: Deleting the connected route to 203.0.113.0/30 would remove the WAN interface’s network from the routing table, effectively severing the link to the ISP. This guarantees that no Internet traffic can be forwarded.
Adding a default route that points to the LAN interface (Gig0/0) instead of toward the ISP’s next-hop causes non-local traffic to be sent back into the LAN. This can create routing loops or blackholing of packets and does not provide a valid path to the Internet. Both of these actions are unsafe and do not align with correct routing practices, so they are the actions that must be avoided.
Topic: Domain 4: Network Security
A company wants to secure its corporate WLAN so that each employee uses individual network credentials, and access can be revoked centrally when someone leaves. Security policy requires that Wi‑Fi authentication be tied to the existing directory service and that shared passphrases are not used. Which solution BEST meets these requirements?
Options:
Best answer: A
Explanation: Using WPA2/WPA3‑Enterprise with 802.1X and RADIUS makes the APs authenticators that pass EAP conversations from clients to a centralized RADIUS server. The RADIUS server authenticates users against the directory, enabling per‑user access control and straightforward revocation by disabling or changing the user’s account. This matches all stated requirements and implements 802.1X, RADIUS, and EAP in their intended roles for secure WLANs.
Topic: Domain 5: Network Troubleshooting
A technician is investigating intermittent Wi‑Fi drops for one user. On the WLAN controller, they pull the following snapshot of current 5 GHz clients:
| Client ID | RSSI (dBm) | SNR (dB) |
|---|---|---|
| LAPTOP-01 | -67 | 28 |
| PHONE-22 | -72 | 24 |
| TABLET-07 | -81 | 19 |
| LAPTOP-19 | -75 | 23 |
Assume that on this WLAN an SNR below 20dB usually leads to unstable connections, while SNR of 20dB or higher is generally acceptable.
Based on the SNR values only, which client is MOST likely experiencing wireless connectivity issues?
Options:
Best answer: B
Explanation: The client TABLET-07 has an SNR of 19dB, which is the only value below the 20dB stability threshold specified in the stem. Because the question tells you to make the decision based on SNR values only, TABLET-07 stands out as the only client whose signal quality is likely too low for stable performance, making it the correct choice.
Topic: Domain 3: Network Operations
A small company has a single edge firewall, one internet circuit, and a flat LAN. The IT team recently created business continuity and disaster recovery documentation but has never practiced using it. Management wants to validate the plan, identify gaps, and improve team coordination without risking downtime in production. Which activity would BEST meet these goals?
Options:
Best answer: D
Explanation: The option to hold a structured tabletop exercise where stakeholders talk through a scripted outage scenario directly uses a recognized BC/DR validation method. It:
This aligns exactly with the stated goals: validate the plan, find weaknesses, and improve coordination while avoiding impact to the live network.
Topic: Domain 4: Network Security
A small company currently uses a basic edge router that only performs NAT and simple stateful packet filtering based on IP addresses and TCP/UDP ports. Management wants to continue allowing normal web and SaaS access but block social media and peer-to-peer applications that often run over ports 80 and 443. Which solution is the BEST way to meet these requirements without adding unnecessary complexity?
Options:
Best answer: B
Explanation: The choice to replace the edge router with a next-generation firewall that performs stateful inspection and application-aware filtering directly addresses both needs:
This is exactly what NGFWs are designed to do: filter traffic by application, user, and category in addition to IP and port.
Topic: Domain 5: Network Troubleshooting
Which statement BEST describes asymmetric routing in an IP network?
Options:
Best answer: C
Explanation: The choice describing traffic from a source to a destination taking a different path than the return traffic precisely matches the definition of asymmetric routing. It focuses on the fact that the forward and reverse paths between the same endpoints are not symmetric, which is the key concept tested when identifying asymmetric routing issues in routing tables and path traces.
Topic: Domain 4: Network Security
Which of the following statements about AAA (authentication, authorization, and accounting) is NOT correct?
Options:
Best answer: A
Explanation: The statement claiming that authorization is responsible for verifying usernames and passwords is incorrect because it mis-assigns the roles within AAA. Credential verification during login is the function of authentication. Authorization only applies after a user has been authenticated, to decide which actions and resources are permitted. This confusion between “proving identity” (authentication) and “granting permissions” (authorization) is exactly what the question is testing.
Topic: Domain 4: Network Security
A network administrator is deploying a new corporate Wi‑Fi network. Security policy requires each employee to authenticate with their own directory credentials, and the APs must validate users against a central RADIUS server. Which wireless security configuration should the administrator implement to meet this requirement?
Options:
Best answer: B
Explanation: Configuring the SSID with WPA2-Enterprise using 802.1X and a RADIUS server is correct because this is the wireless security mode specifically built for enterprise environments. It supports per-user credentials, integrates with centralized AAA systems via RADIUS, and allows policies based on user identity rather than a shared key. It directly satisfies the requirement for authentication against a central RADIUS server using individual directory logins.
Topic: Domain 1: Networking Fundamentals
Which TWO statements about Simple Network Management Protocol (SNMP) are correct? (Select TWO.)
Options:
Correct answers: C and E
Explanation: The statement that SNMP allows a central monitoring system to query routers and switches for status information is correct because this describes the basic poll/response model of SNMP: a manager reads MIB values from agents to see interface counters, CPU use, and similar metrics.
The statement that SNMP traps let devices send unsolicited alerts to a management station is also correct. Traps (or notifications) are one of SNMP’s key features, enabling near real-time alerts when important events occur without waiting for the next polling cycle.
Topic: Domain 3: Network Operations
Which of the following statements about logical diagrams, physical diagrams, and IP address plans is NOT correct?
Options:
Best answer: C
Explanation: The statement claiming that an IP address plan is concerned only with static server IPs and normally excludes DHCP scopes is incorrect because a proper IP plan must cover the entire address space for each subnet. That includes dynamic client ranges, DHCP scopes, and any reservations, alongside static server and infrastructure addresses. Without this, technicians cannot easily see how many addresses are available, where conflicts may occur, or how addressing is organized across VLANs and sites.
Topic: Domain 1: Networking Fundamentals
A help desk technician is troubleshooting a user’s laptop that cannot send email through the corporate SMTP server. The user can successfully browse internal and external websites, and the technician can ping smtp.example.com by hostname with no packet loss. A senior administrator advises, “Use the TCP/IP model to focus on the right layer first instead of randomly changing settings.” Which next step BEST follows this guidance?
Options:
Best answer: B
Explanation: Verifying the email client’s SMTP server name, port, and encryption/authentication settings focuses directly on the application layer, where SMTP operates in the TCP/IP model. Because lower-layer tests (web access and ping by hostname) already succeed, the models indicate that the problem is isolated to the application itself or its configuration, making this the best next step.
Topic: Domain 1: Networking Fundamentals
Which of the following statements about modern wireless security methods is NOT correct?
Options:
Best answer: B
Explanation: The statement claiming that “WPA3 networks commonly use TKIP encryption to maintain compatibility with older devices and are therefore recommended over WPA2” is incorrect.
WPA3 requires modern, strong encryption suites based on AES, such as CCMP or GCMP. TKIP is a legacy cipher associated with older WPA/WPA2 configurations and is considered insecure. It is not permitted with WPA3 and should not be recommended for any modern deployment. Compatibility with older devices is sometimes handled through transitional or mixed WPA2/WPA3 modes, but those still must avoid TKIP to remain secure and standards-compliant.
Topic: Domain 1: Networking Fundamentals
Which statement BEST describes a clientless VPN solution for remote access?
Options:
Best answer: A
Explanation: The option that describes secure remote access through a standard web browser using SSL/TLS without installing a dedicated VPN client matches the definition of a clientless VPN. It correctly highlights the browser-based nature and the use of SSL/TLS instead of a separate VPN client application.
Topic: Domain 3: Network Operations
A network technician receives a call from a coworker who cannot log in to the corporate VPN from home. The coworker asks the technician to share the technician’s own VPN username and password so they can finish urgent work. According to standard security policies and best practices, which of the following technician responses would be INCORRECT?
Options:
Best answer: B
Explanation: The choice to share the technician’s VPN credentials “this one time” is incorrect because it violates several core security principles:
Even under time pressure or business urgency, the technician is required to uphold policy and not share credentials. That makes this response the clearly unsafe and incorrect option.
Topic: Domain 3: Network Operations
A small company has a single edge firewall and a few managed switches connecting about 80 users on one LAN. Currently, administrators make configuration changes directly on devices during business hours with no formal review, documentation, or backups. Twice in the last month, a firewall rule change caused an outage that took an hour to diagnose and manually undo.
Management wants to:
Which of the following change approaches would BEST meet these goals?
Options:
Best answer: D
Explanation: The choice that introduces a formal change management process with change tickets, risk/impact analysis, documented approvals, scheduled maintenance windows, and pre-change backups plus a defined rollback plan is best because it incorporates all the core elements of structured change control.
This aligns precisely with the scenario’s goals and with common change management best practices for network operations.
Use this map after the sample questions to connect individual items to the Network+ design, implementation, security, operations, and troubleshooting decisions these practice samples test.
flowchart LR
S1["Connectivity or design requirement"] --> S2
S2["Identify layer service or topology"] --> S3
S3["Check addressing switching routing and wireless evidence"] --> S4
S4["Apply security and segmentation controls"] --> S5
S5["Monitor performance and availability"] --> S6
S6["Document fix or design tradeoff"]
| Cue | What to remember |
|---|---|
| Layer thinking | Classify whether a symptom is physical, data link, network, transport, DNS, DHCP, routing, or application. |
| Addressing | Know IPv4, IPv6, subnetting, gateways, VLANs, NAT, and common ports. |
| Wireless | Review channels, interference, encryption, roaming, and authentication. |
| Security | Use segmentation, ACLs, firewalls, VPNs, NAC, and monitoring. |
| Troubleshooting | Use evidence from LEDs, cables, ARP, DNS, routes, logs, packet captures, and baselines. |