N10-009 — CompTIA Network+ Cheat Sheet

Last revised: September 16, 2026

Cheat sheet: exam-prep reference for CompTIA Network+ (N10-009): ports, subnetting, routing, switching, wireless, security, operations, and troubleshooting.

Use the tables for a quick pre-exam check. Expand a topic’s notes for explanations, examples, and additional distinctions.

Scope and study context

Use this independent Cheat Sheet for fast review before practicing CompTIA Network+ (N10-009) exam questions. Prioritize:

  • Ports and protocols: know default ports, TCP/UDP use, and secure alternatives.
  • Subnetting: identify network, broadcast, usable range, mask, and block size quickly.
  • Layered troubleshooting: map symptoms to OSI layers, then choose the best tool or command.
  • Infrastructure decisions: switch vs router vs firewall, VLAN vs subnet, IDS vs IPS, RADIUS vs TACACS+, WPA2 vs WPA3.
  • Operations: monitoring, logging, change control, backups, diagrams, baselines, and documentation.

This page is IT Mastery review support. It is not affiliated with CompTIA. For final scope decisions, compare your study plan against the current official CompTIA Network+ (N10-009) exam objectives.

  1. Review the tables first. They condense the most testable decision points.
  2. Mark weak areas. Do not reread everything equally; target gaps.
  3. Use original practice questions. Apply the concepts in scenario format.
  4. Review explanations, not just scores. Network+ questions often test why one answer is better than another.
  5. Return to this page after misses. Treat missed questions as signals for focused topic drills.

OSI, Encapsulation, and Traffic Scope

OSI Layer Reference

LayerNamePDUCommon devices/functionsHigh-yield exam cues
7ApplicationDataDNS, DHCP, HTTP, SMTP, SNMP, SMBUser-facing network services; URLs, names, application errors
6PresentationDataTLS, encryption, compression, encodingCertificate, cipher, format, encoding, compression issues
5SessionDataSession setup/teardown, RPC, NetBIOS sessionAuthentication/session persistence issues
4TransportSegment/datagramTCP, UDP, ports, flow controlPort numbers, retransmissions, TCP handshake, UDP loss
3NetworkPacketIP, ICMP, routers, L3 switches, routingSubnets, default gateway, routing, TTL, fragmentation
2Data LinkFrameEthernet, Wi-Fi MAC, VLANs, STP, switchesMAC addresses, frames, VLAN tags, loops, duplex
1PhysicalBitsCabling, optics, RF, connectors, hubsLink lights, pinouts, attenuation, interference, damaged cable
Notes and examples

Encapsulation and Addressing

ConceptAddress usedScopeCommon trap
MAC addressLayer 2 hardware addressLocal broadcast domain/VLANMAC changes at each routed hop
IP addressLayer 3 logical addressEnd-to-end across routed networksIP usually stays same across hops unless NAT occurs
TCP/UDP portLayer 4 service identifierHost application/processPort identifies the service, not the host
FrameL2 unitLocal segment/VLANFrames do not cross routers unchanged
PacketL3 unitRouted pathRouters forward packets based on routing table

Broadcast, Collision, and Failure Domains

Device/designBroadcast domain impactCollision domain impactNotes
HubOne shared broadcast domainOne shared collision domainLegacy; half-duplex behavior; collisions expected
SwitchSame VLAN is one broadcast domainEach switch port is separate collision domainFull-duplex eliminates normal collisions
VLANSeparates broadcast domains logicallyDepends on switch portsInter-VLAN traffic requires L3 routing
Router/L3 switchSeparates broadcast domainsSeparates L2 segmentsDefault gateway for hosts
FirewallSeparates and filters networksDepends on interfaces/zonesPolicy controls allowed traffic
Wireless APBridges WLAN to LANShared RF medium per channelContention/interference affects all clients

Ports and Protocols

Default Port Reference

Protocol/servicePort(s)TransportPurposeExam traps
FTP data/control20/21TCPFile transferCredentials/data not encrypted; active/passive behavior matters
SSH22TCPSecure remote shellAlso used by SCP/SFTP
SFTP22TCPFile transfer over SSHNot the same as FTPS
Telnet23TCPRemote CLIInsecure plaintext
SMTP25TCPMail transfer server-to-serverSubmission often uses 587; encrypted variants differ
DNS53UDP/TCPName resolutionUDP common; TCP for zone transfers/large responses
DHCP server/client67/68UDPDynamic addressingClient uses 68, server uses 67; needs relay across routers
TFTP69UDPSimple file transferNo authentication; often boot/config transfer
HTTP80TCPWeb trafficPlaintext
Kerberos88TCP/UDPAuthentication ticketsTime synchronization is critical
POP3110TCPMail retrievalClient downloads mail; secure POP3 uses 995
NTP123UDPTime synchronizationCritical for logs, Kerberos, certificates
NetBIOS137-139TCP/UDPLegacy Windows name/session servicesOften replaced by SMB over 445
IMAP143TCPMail access/syncSecure IMAP uses 993
SNMP161UDPMonitoring queriesUse SNMPv3 for authentication/encryption
SNMP traps162UDPDevice-generated alertsTrap receiver listens here
LDAP389TCP/UDPDirectory queriesLDAPS uses 636
HTTPS443TCPHTTP over TLSCertificate/name/trust errors common
SMB/CIFS445TCPFile/print sharingCommon lateral movement target
Syslog514UDP/TCPLog forwardingTLS-secured syslog commonly uses 6514
SMTPS465TCPSMTP over TLS587 is common for submission with STARTTLS
SMTP submission587TCPAuthenticated mail submissionPreferred over unauthenticated relay
LDAPS636TCPLDAP over TLSCertificate trust matters
IMAPS993TCPIMAP over TLSSecure mail access
POP3S995TCPPOP3 over TLSSecure mail retrieval
Microsoft SQL Server1433TCPDatabase accessKnow as common application service port
RADIUS auth/accounting1812/1813UDPAAA for network accessCentralized auth; encrypts password, not full packet
MySQL/MariaDB3306TCPDatabase accessCommon server application port
RDP3389TCP/UDPRemote desktopSecure with VPN/MFA/restricted access
PostgreSQL5432TCPDatabase accessCommon server application port
SIP5060/5061TCP/UDPVoIP signaling5061 is TLS-secured SIP
Syslog over TLS6514TCPEncrypted log forwardingPrefer for sensitive logs
Notes and examples
TechnologyPort/protocolUseDistinction
IPsec AHIP protocol 51Integrity/authenticationDoes not encrypt payload
IPsec ESPIP protocol 50Encryption/integrityCommon IPsec payload protection
IKEUDP 500IPsec negotiationUsed before tunnel establishment
IPsec NAT-TUDP 4500IPsec through NATEncapsulates IPsec for NAT traversal
L2TPUDP 1701TunnelingOften paired with IPsec
OpenVPNOften UDP/TCP 1194SSL/TLS VPNPort can vary by configuration
HTTPS VPN portalTCP 443SSL/TLS remote accessOften firewall-friendly
TACACS+TCP 49Device administration AAAEncrypts full payload; separates auth/accounting/authorization
RADIUSUDP 1812/1813Network access AAACommon for 802.1X, VPN, Wi-Fi enterprise

Ports and protocols to know cold

Protocol/servicePort or identifierTCP/UDPExam-use decision
FTP control/data21 / 20TCPLegacy file transfer; not encrypted
SSH / SFTP22TCPSecure remote CLI and secure file transfer
Telnet23TCPInsecure remote CLI
SMTP25TCPMail transfer between servers
DNS53UDP/TCPName resolution; TCP often for large replies/zone transfers
DHCP server/client67 / 68UDPAutomatic IP configuration
TFTP69UDPSimple file transfer, often network device images/configs
HTTP80TCPUnencrypted web
NTP123UDPTime synchronization
SNMP161 / 162UDPMonitoring and traps/informs
LDAP389TCP/UDPDirectory access
HTTPS443TCPEncrypted web
SMB445TCPWindows file/printer sharing
SMTPS / submission variants465 / 587TCPEncrypted or authenticated mail submission scenarios
LDAPS636TCPLDAP over TLS
IMAP / IMAPS143 / 993TCPMail retrieval, server-side mailbox
POP3 / POP3S110 / 995TCPMail retrieval, often download-oriented
RDP3389TCP/UDPRemote desktop
SIP5060 / 5061TCP/UDPVoIP signaling; 5061 commonly TLS
IPsec AHIP protocol 51N/AIntegrity/authentication, no payload encryption
IPsec ESPIP protocol 50N/AEncryption and/or integrity
IKE / NAT-T500 / 4500UDPIPsec negotiation and NAT traversal

Common trap: Port numbers alone rarely answer the whole question. Combine the port with the scenario: encryption requirement, file-transfer type, remote access method, or monitoring need.

IPv4, IPv6, and Subnetting

IPv4 Formulas

For a subnet with \(h\) host bits:

\[ \text{usable IPv4 hosts} = 2^{h} - 2 \]

For borrowed subnet bits \(b\):

\[ \text{number of subnets} = 2^{b} \]

For the interesting mask octet:

\[ \text{block size} = 256 - \text{mask octet} \]

Exceptions: /31 is commonly used for point-to-point links, and /32 identifies a single host route.

Private and Special IPv4 Ranges

RangePurposeExam cue
10.0.0.0/8Private RFC 1918Large internal networks
172.16.0.0/12Private RFC 1918172.16.0.0-172.31.255.255 only
192.168.0.0/16Private RFC 1918Home/small office common
127.0.0.0/8LoopbackTests local TCP/IP stack
169.254.0.0/16APIPA/link-localDHCP failure clue
224.0.0.0/4MulticastOne-to-many group traffic
255.255.255.255Limited broadcastLocal segment only
0.0.0.0Unspecified/defaultDefault route or unconfigured source

Common CIDR Reference

CIDRMaskTotal addressesUsable hostsIncrement
/8255.0.0.016,777,21616,777,2141 in 1st octet
/16255.255.0.065,53665,5341 in 2nd octet
/20255.255.240.04,0964,09416 in 3rd octet
/21255.255.248.02,0482,0468 in 3rd octet
/22255.255.252.01,0241,0224 in 3rd octet
/23255.255.254.05125102 in 3rd octet
/24255.255.255.02562541 in 3rd octet
/25255.255.255.128128126128 in 4th octet
/26255.255.255.192646264 in 4th octet
/27255.255.255.224323032 in 4th octet
/28255.255.255.240161416 in 4th octet
/29255.255.255.248868 in 4th octet
/30255.255.255.252424 in 4th octet
/31255.255.255.2542SpecialPoint-to-point use
/32255.255.255.25511 host routeSingle host

Fast Subnetting Process

  1. Convert prefix to dotted mask.
  2. Find the interesting octet: the octet that is not 0 or 255.
  3. Calculate block size: 256 minus the mask value in that octet.
  4. Count subnets in block-size increments.
  5. Network address is the lower boundary; broadcast is one less than next boundary.
  6. Usable range is network + 1 through broadcast - 1, except special /31 and /32 cases.

Example: 10.10.18.76/27

ItemValue
Mask255.255.255.224
Block size32
Subnet boundaries.0, .32, .64, .96, .128, .160, .192, .224
Network10.10.18.64
Broadcast10.10.18.95
Usable hosts10.10.18.65-10.10.18.94

IPv6 Cheat Sheet

IPv6 conceptReferenceExam cue
Address length128 bitsWritten in hexadecimal hextets
Compression:: replaces one run of zerosCan be used once per address
Loopback::1/128Local host test
Unspecified::/128No address assigned
Link-localfe80::/10Local link only; required for IPv6 operations
Unique localfc00::/7Private-like internal addressing
Global unicast2000::/3Routable IPv6 Internet space
Multicastff00::/8IPv6 has multicast, not broadcast
SLAACRouter AdvertisementsHost self-configures address
DHCPv6Stateful or stateless optionsCan provide addresses or options
NDPICMPv6-based neighbor discoveryReplaces ARP functions
Notes and examples

IPv4 ranges and special addresses

Range/typeAddress spaceWhat it means
Private class A-style10.0.0.0/8Internal use, not routed on the public Internet
Private class B-style172.16.0.0/12Internal use; range is 172.16.0.0–172.31.255.255
Private class C-style192.168.0.0/16Common small-network private space
APIPA/link-local169.254.0.0/16Client failed to obtain DHCP configuration
Loopback127.0.0.0/8Local host testing
Multicast224.0.0.0/4One-to-many delivery
Broadcast255.255.255.255Local broadcast
Default route0.0.0.0/0“Send unknown destinations here”

Subnetting formulas

\[ \text{Number of addresses} = 2^{(32 - \text{prefix length})} \]\[ \text{Traditional usable host addresses} = 2^{(32 - \text{prefix length})} - 2 \]

The “minus 2” accounts for the network and broadcast addresses in traditional IPv4 subnets. Be aware that point-to-point and special-use cases may be handled differently, but exam subnetting questions usually expect the traditional calculation unless the scenario says otherwise.

Fast IPv4 subnet table

CIDRMaskBlock size in last octetTotal addressesTraditional usable hosts
/24255.255.255.0256256254
/25255.255.255.128128128126
/26255.255.255.192646462
/27255.255.255.224323230
/28255.255.255.240161614
/29255.255.255.248886
/30255.255.255.252442

Subnetting decision method

When given an IPv4/CIDR address:

  1. Find the block size. For /26, the last-octet block size is 64.
  2. List subnet starts. 0, 64, 128, 192.
  3. Place the host IP. Example: 192.168.1.70/26 is in the 64–127 block.
  4. Identify network and broadcast. Network is .64; broadcast is .127.
  5. Identify usable range. .65 through .126.

Common trap: If asked for “number of subnets,” confirm the original network size. If asked for “number of hosts,” use the host bits in the final subnet.

IPv6 essentials

IPv6 typeCommon prefix/exampleWhat to know
Global unicast2000::/3Publicly routable IPv6 space
Link-localfe80::/10Local segment only; required for many IPv6 functions
Unique localfc00::/7, commonly fd00::/8Private/internal-style addressing
Multicastff00::/8IPv6 uses multicast instead of broadcast
Loopback::1Local host
Unspecified::No address/unknown address
SLAACRouter Advertisement basedHost self-configures address information
DHCPv6Stateful or statelessCan assign addresses or provide options

Key IPv6 reminders:

  • IPv6 has no broadcast; it uses multicast.
  • A common LAN prefix size is /64.
  • Neighbor Discovery replaces many ARP-like IPv4 functions.
  • Link-local addresses matter for local communication and routing-adjacent functions.
  • Do not assume IPv6 means “no DHCP”; DHCPv6 may still be used.

Switching, VLANs, and Ethernet

Layer 2 Feature Reference

FeaturePurposeChoose/use whenCommon trap
Access portCarries one VLAN untaggedEnd-user device, printer, access point management VLANWrong VLAN causes DHCP/gateway failure
Trunk portCarries multiple VLANs with tagsSwitch-to-switch, switch-to-router, switch-to-hypervisorAllowed VLAN list or native VLAN mismatch
802.1QVLAN tagging standardMark frames across trunksNative VLAN is typically untagged
Native VLANUntagged VLAN on trunkCompatibility/control-plane designMismatches can create leakage/security risk
Port securityLimits MACs on a switch portPrevent unauthorized device swapsCan shut down port after violation
STP/RSTPPrevents L2 loopsRedundant switch pathsBlocking port may look like unused link
BPDU GuardProtects edge portsShut down port receiving BPDUsUse on access/PortFast-style ports
LACPDynamic link aggregationIncrease bandwidth and redundancyBoth sides must be compatible/configured
Port mirroring/SPANCopy traffic to analyzerPacket capture/IDS sensorDoes not normally alter traffic flow
LLDP/CDPNeighbor discoveryMap connected devicesCDP is vendor-specific; LLDP is open standard
Jumbo framesLarger Ethernet framesStorage/backup/high-throughput networksMTU mismatch causes drops/fragmentation symptoms
QoSPrioritize trafficVoice/video/latency-sensitive appsQoS does not create bandwidth; it schedules traffic
Notes and examples

STP Essentials

STP itemMeaning
Root bridgeCentral reference switch selected by lowest bridge ID
Bridge IDPriority plus MAC address
Root portBest path toward root bridge on non-root switch
Designated portForwarding port for a segment
Blocking/discardingPrevents loops by not forwarding user frames
Loop symptomBroadcast storm, MAC table flapping, high CPU, network-wide outage

Cabling, Media, and Connectors

Medium/componentUseExam cues
UTPGeneral copper EthernetSusceptible to EMI compared with shielded cable
STP/FTPShielded copperIndustrial/EMI-prone environments; grounding matters
Plenum-rated cableAir-handling spacesFire/smoke rating scenario
Riser-rated cableVertical building runsBetween floors/risers
CoaxialCable broadband/CCTV/legacyF-type, BNC depending on use
Multimode fiberShorter fiber runsLED/VCSEL, larger core, common in campus/datacenter
Single-mode fiberLonger fiber runsLaser, smaller core, WAN/long-distance
RJ45Twisted-pair Ethernet8P8C connector
LCFiber connectorSmall form factor, very common
SC/STFiber connectorsSC push-pull; ST twist-lock
MPO/MTPMulti-fiber connectorHigh-density fiber trunks
SFP/SFP+/QSFPModular transceiversMatch speed, fiber type, wavelength, connector
DACDirect attach copperShort datacenter interconnect
AOCActive optical cableShort optical interconnect with fixed optics

Ethernet and PoE

TopicKey point
Auto-negotiationSpeed/duplex negotiation; mismatch can cause errors and poor throughput
Full duplexSend and receive simultaneously; no normal collisions
Half duplexLegacy/shared media; collisions possible
Auto-MDI-XReduces need for crossover cables
PoESends power over Ethernet cabling
802.3af / 802.3at / 802.3btPoE standards with increasing power capability
Common PoE devicesAPs, VoIP phones, cameras, badge readers
PoE troubleshootingCheck power budget, cable pairs, switch support, device class, injector/midspan

Routing, NAT, WAN, and Remote Access

Routing Selection Reference

Routing type/protocolCategoryBest useExam cue
Connected routeAutomaticDirectly attached networksAppears when interface is up/up with IP
Static routeManualSmall/stable paths, specific overrideNo automatic convergence
Default routeStatic/dynamicUnknown destinations0.0.0.0/0 or ::/0
OSPFLink-state IGPEnterprise internal routingAreas, cost, fast convergence
EIGRPAdvanced distance-vector IGPVendor-specific enterprise routingFeasible successor terminology may appear
RIPDistance-vector IGPLegacy/simple networksHop-count metric; slower convergence
BGPPath-vector EGPInternet/ISP or large multi-domain routingAutonomous systems and policy-based routing
Notes and examples

NAT and Address Translation

NAT typeMappingUseTrap
Static NATOne private to one publicPublish internal service or fixed mappingConsumes one public address per host
Dynamic NATPrivate to pool of public IPsOutbound access from poolPool can be exhausted
PAT/NAT overloadMany private to one/few public IPs using portsTypical Internet edge NATPort translation differentiates sessions
Destination NAT/port forwardingPublic IP:port to internal host:portPublish selected serviceFirewall rule must also allow traffic

WAN and Connectivity Choices

TechnologyUse whenNotes
Leased lineDedicated predictable private connectivityHigher reliability/control than shared broadband
MPLSProvider-managed private WANLabel switching; often used for enterprise WANs
Broadband cable/DSL/fiberInternet access/backupShared service characteristics vary
Cellular/5GBackup, mobile, temporary sitesConsider signal, data plans, antennas
SatelliteRemote areasHigher latency; weather/line-of-sight concerns
SD-WANPolicy-based multi-link WANUses overlays, path selection, centralized control
VPN over InternetEncrypted private connectivityDepends on Internet path quality

VPN Decision Table

VPN typeBest fitCommon technologiesExam distinction
Site-to-siteConnect offices/networksIPsec tunnel modeUsually always-on between gateways
Remote-accessIndividual users to networkSSL/TLS VPN, IPsec client VPNUser authentication and endpoint posture matter
Clientless VPNBrowser-based app accessHTTPS portalLimited to supported applications
Split tunnelOnly corporate traffic via VPNRemote-access optimizationInternet traffic bypasses VPN; security tradeoff
Full tunnelAll traffic via VPNStronger central inspectionMore bandwidth/latency impact

Routing concepts

ConceptWhat to remember
Default gatewayHost’s route to non-local networks
Default routeRouter’s catch-all route, often 0.0.0.0/0 or ::/0
Static routeManually configured; predictable but less scalable
Dynamic routingRouters exchange reachability information
MetricProtocol-specific measure of path preference
Administrative preference/distanceUsed when multiple routing sources know the same destination
Longest prefix matchMore specific routes win over broader routes
NATTranslates addresses
PATMany internal hosts share one or more external addresses via ports

Routing protocol recognition

ProtocolType/useHigh-yield distinction
RIPDistance-vector IGPLegacy/simple; hop-count based
OSPFLink-state IGPCommon enterprise interior routing concept
EIGRPAdvanced distance-vector/hybrid styleOften seen in vendor-influenced environments
BGPPath-vector EGPInternet/large-scale interdomain routing

Common trap: If two routes match, the longest prefix is usually the first decision. A /28 route is more specific than a /24 route.

NAT/PAT traps

SymptomPossible cause
Internal users reach Internet but inbound service failsMissing port forwarding/static NAT/firewall rule
One inside host works, others do notNAT pool exhaustion or rule mismatch
VPN traffic fails after NATNAT exemption or overlapping subnet issue
Application embeds IP addressesNAT may break application behavior

Wireless Networking

Wi-Fi Standards

StandardWi-Fi nameBandsKey exam cue
802.11aLegacy5 GHzOlder 5 GHz standard
802.11bLegacy2.4 GHzSlow legacy 2.4 GHz
802.11gLegacy2.4 GHzBackward compatibility with b
802.11nWi-Fi 42.4/5 GHzMIMO introduced broadly
802.11acWi-Fi 55 GHzWider channels, higher throughput
802.11axWi-Fi 6/6E2.4/5/6 GHzOFDMA, efficiency, dense environments
802.11beWi-Fi 72.4/5/6 GHzNewer high-throughput/low-latency generation
Notes and examples

Wireless Security

Security modeStatus/useExam cue
OpenNo encryptionUse only with captive portal/guest isolation if required
WEPDeprecated/insecureDo not choose except to identify legacy risk
WPALegacy improvement over WEPSuperseded by WPA2/WPA3
WPA2-PersonalPSK-basedShared passphrase; use AES/CCMP
WPA2-Enterprise802.1X/RADIUSPer-user or certificate-based authentication
WPA3-PersonalSAEStronger protection against offline PSK attacks
WPA3-EnterpriseEnterprise authenticationStronger enterprise wireless security
Captive portalWeb-based access acceptance/loginNot a replacement for encryption
MAC filteringAllows/blocks listed MACsWeak control; MACs can be spoofed

Wireless Design and Troubleshooting

Issue/design pointWhat to check
Channel overlapUse non-overlapping 2.4 GHz channels where applicable; prefer 5/6 GHz for capacity
InterferenceMicrowaves, Bluetooth, cordless devices, neighboring WLANs, industrial equipment
Low RSSIAP placement, antenna orientation, transmit power, obstacles
Poor SNRNoise floor and interference, not just signal strength
Roaming problemsAP density, power levels, controller settings, sticky clients
Hidden nodeClients cannot hear each other; causes contention/retransmissions
DFS events5 GHz radar detection can force channel changes
Guest WLANSeparate VLAN, firewall rules, captive portal, client isolation
Voice over Wi-FiQoS, roaming, low latency/jitter, adequate coverage
Antenna choiceOmnidirectional for broad coverage; directional for focused links

High-yield map for CompTIA Network+ (N10-009)

AreaWhat to be able to decide quickly
Network modelsWhich layer is involved, what device/protocol belongs there, and which tool verifies it
IP addressingIPv4 subnet size, default gateway logic, private/public ranges, IPv6 address types
SwitchingVLANs, trunks, STP, port security, MAC learning, link aggregation
RoutingStatic vs dynamic routing, default routes, NAT/PAT, route selection symptoms
WirelessBands, channels, interference, authentication, encryption, roaming, site-survey issues
Network servicesDHCP, DNS, NTP, SNMP, syslog, directory services, load balancing
InfrastructureCopper, fiber, transceivers, PoE, racks, power, environmental controls
Cloud and virtualizationVirtual switches, overlays, SDN, cloud networking, segmentation, elasticity
SecurityAAA, ACLs, firewalls, VPNs, segmentation, hardening, attacks, monitoring
OperationsChange control, documentation, baselines, monitoring, incident response, backups
TroubleshootingFollow a method, isolate layers, interpret symptoms, choose the best tool

Wi-Fi decision table

TopicWhat to know for N10-009 review
2.4 GHzLonger range, more interference, fewer non-overlapping channels
5 GHzMore channels, less crowded, shorter range than 2.4 GHz in many environments
6 GHzNewer band support; requires compatible clients/APs
Channel overlapCauses co-channel/adjacent-channel performance problems
RoamingClient decisions, AP placement, signal overlap, authentication speed
Band steeringEncourages capable clients to use preferred bands
MIMO/OFDMAEfficiency and throughput improvements in newer Wi-Fi generations
Captive portalWeb-based access acceptance/authentication
WPA2/WPA3-PersonalPre-shared key style access
WPA2/WPA3-Enterprise802.1X/RADIUS-based authentication
SSID hidingNot real security; do not rely on it

Wireless troubleshooting patterns

SymptomLikely area to investigate
Good signal, poor throughputInterference, channel congestion, client capability, oversubscription
Drops while movingRoaming design, AP placement, power levels
Cannot authenticateWrong PSK, certificate issue, RADIUS/802.1X problem
IoT device will not connectBand/security compatibility issue
Works near AP onlyAttenuation, antenna placement, transmit power, obstruction
Intermittent voice issuesJitter, roaming delay, QoS, RF congestion

Common trap: Strong signal is not the same as clean RF. Interference and channel design can make a “strong” Wi-Fi connection perform poorly.

CIA and AAA

ModelComponentsExam use
CIAConfidentiality, Integrity, AvailabilityClassify security goals
AAAAuthentication, Authorization, AccountingIdentify, permit, and log user/device actions
ControlBest-fit use
802.1XPort-based network access control
RADIUSCentralized authentication, common for network access
TACACS+Centralized device administration scenarios
MFAStronger identity proofing
RBACPermissions based on roles
Least privilegeMinimum required access
NACAssess/control devices before network access
PKI/certificatesTrust, encryption, device/user identity
Certificate revocationIdentify certificates that should no longer be trusted

Firewalls, ACLs, and segmentation

ControlKey distinction
Stateless ACLFilters mainly on packet attributes without session awareness
Stateful firewallTracks connection state
NGFWAdds application/user/content-aware features
WAFProtects web applications at application layer
DMZPlaces public-facing systems in a controlled segment
MicrosegmentationFine-grained internal segmentation
Zero trust conceptVerify explicitly; do not trust solely based on network location

Common trap: An ACL rule order matters. A broad deny placed above a specific allow can break expected traffic.

VPNs and secure remote access

VPN typeTypical use
Site-to-site VPNConnect networks over an untrusted network
Client-to-site VPNRemote user access
IPsec VPNNetwork-layer tunnel/security
SSL/TLS VPNOften remote-access/browser or client-based
Split tunnelOnly selected traffic uses VPN
Full tunnelAll client traffic uses VPN

Common attacks and mitigations

Attack/problemWhat it targetsUseful mitigation
ARP poisoningLocal traffic redirectionDynamic ARP inspection, segmentation, monitoring
Rogue DHCPClient IP configurationDHCP snooping, port security
VLAN hoppingVLAN separationDisable unused trunks, set native VLAN carefully
MAC floodingSwitch CAM tablePort security
DNS poisoningName resolution trustSecure DNS practices, monitoring
DoS/DDoSAvailabilityRate limiting, upstream filtering, redundancy
Evil twin APWireless clientsWPA-Enterprise, user training, detection
Deauthentication attackWi-Fi availabilityModern protected management features where supported
Man-in-the-middleConfidentiality/integrityTLS, certificate validation, secure protocols
Credential attackIdentity systemsMFA, lockout policies, monitoring

Core Network Services

DHCP

DHCP itemMeaning
DORADiscover, Offer, Request, Acknowledge
ScopePool of assignable addresses
ExclusionAddresses not handed out from a scope
ReservationSpecific IP for a client, usually by MAC/client identifier
LeaseTime-bound address assignment
OptionsGateway, DNS servers, domain name, NTP, PXE boot options
Relay/IP helperForwards DHCP across routers/VLANs
Failure clueAPIPA address, no default gateway, stale lease, wrong VLAN
Notes and examples

DNS Records

RecordPurposeExample use
AName to IPv4host.example.com to IPv4
AAAAName to IPv6IPv6 host resolution
CNAMEAlias to canonical namewww alias to another name
MXMail exchangerDomain mail routing
NSAuthoritative name serverDelegation/zone authority
SOAStart of authorityZone metadata
PTRReverse lookupIP to name
TXTText metadataSPF, DKIM, DMARC, verification
SRVService locatorDirectory/VoIP/service discovery
CAACertificate authority authorizationLimits which CAs may issue certs
TTLCache lifetimeLong TTL slows propagation of changes

Infrastructure Services and Components

Service/componentPurposeChoose/check when
NTPTime syncAuthentication, logs, certificates, Kerberos failures
PKI/CACertificate issuance/trustTLS, VPN, 802.1X certificate authentication
Load balancerDistribute client requestsHigh availability, scale-out applications
Reverse proxyFront-end application publishingTLS offload, filtering, app routing
Forward proxyClient egress mediationURL filtering, caching, logging
DHCP snoopingValidates DHCP serversPrevent rogue DHCP
IPAMAddress managementAvoid overlaps, document allocations
Directory serviceIdentity sourceCentralized users/groups/devices
RADIUS/TACACS+AAANetwork access or device administration
CDNContent distributionReduce latency for static/global content

DHCP

DHCP commonly follows the DORA sequence:

  1. Discover
  2. Offer
  3. Request
  4. Acknowledge
DHCP issueWhat it suggests
169.254.x.x addressDHCP failure or unreachable DHCP server
Wrong subnet addressWrong VLAN, relay, or scope
Correct IP but wrong gatewayDHCP option issue
Some clients fail late in the dayScope exhaustion or lease behavior
Remote VLAN cannot get DHCPMissing/misconfigured DHCP relay/IP helper

DNS

DNS recordPurpose
AName to IPv4 address
AAAAName to IPv6 address
CNAMEAlias to canonical name
MXMail exchanger
NSAuthoritative name server
PTRReverse lookup
TXTText records; often verification and email security uses
SRVService location
DNS symptomLikely interpretation
Can ping IP but not nameDNS resolution issue
One record wrong, others fineZone/record problem, not general connectivity
Internal name resolves externallySplit-horizon or DNS search/path issue
Intermittent stale answersCaching/TTL issue
Reverse lookup failsPTR zone/record missing

Common trap: DNS failure can look like application failure. Test by IP address and name to separate path problems from name-resolution problems.

Monitoring and management services

ServiceUse
NTPTime sync; critical for logs, certificates, Kerberos-style auth, investigations
SNMPDevice monitoring; SNMPv3 adds stronger security features
SyslogCentralized log collection
NetFlow/IPFIX-style telemetryTraffic flow visibility
RADIUS/TACACS+Centralized AAA for network access/admin access
LDAP/LDAPSDirectory queries
NTP + logsMakes event timelines trustworthy

Security Controls and Threats

Control Selection Matrix

ControlPrimary functionChoose whenDo not confuse with
Stateless firewallFilters by packet fieldsSimple ACL-style filteringStateful session tracking
Stateful firewallTracks sessionsPerimeter/internal segmentationApplication-layer inspection by default
NGFWApp/user-aware filteringNeed app visibility, IPS, URL/category controlsBasic port-only firewall
WAFProtects web appsSQL injection/XSS-style web attacksNetwork firewall for all protocols
IDSDetects and alertsMonitoring without inline blockingIPS
IPSDetects and blocks inlineActive preventionPassive IDS
NACControls network admissionPosture checks, 802.1X, guest accessSimple switch port security
802.1XPort-based access controlEnterprise wired/wireless authPSK-only Wi-Fi
RADIUSAAA for accessVPN, Wi-Fi, switch authenticationTACACS+ device admin focus
TACACS+Device administration AAAGranular command authorizationRADIUS network access focus
SIEMLog correlation/alertingCentral security monitoringPacket analyzer
DLPPrevent data exfiltrationSensitive data controlsFirewall allow/deny only
VPNEncrypted tunnelRemote/site connectivity over untrusted networksVLAN segmentation
Zero trustContinuous verification/least privilegeIdentity-centric accessSingle product or simple VPN
Notes and examples

Network Attack and Mitigation Matrix

ThreatSymptom/goalMitigations
ARP poisoningMITM on local subnetDynamic ARP inspection, static entries for critical systems, segmentation
DNS poisoningWrong name resolutionDNSSEC where applicable, secure resolvers, monitor changes
Rogue DHCPWrong gateway/DNS, outagesDHCP snooping, authorized DHCP servers
VLAN hoppingAccess to unintended VLANDisable unused trunks, set native VLAN safely, explicit allowed VLANs
MAC spoofingBypass MAC-based controls802.1X, port security, monitoring
Evil twin APUsers connect to fake APWPA2/3-Enterprise, certificate validation, WIDS/WIPS
Deauthentication attackWireless disconnectsWPA3/management frame protection where supported, monitoring
DoS/DDoSService/resource exhaustionRate limiting, upstream filtering, redundancy, DDoS protection
Credential attackUnauthorized loginMFA, lockout/rate limits, strong auth, monitoring
On-path/MITMTraffic interceptionTLS, VPN, certificate validation, secure protocols
Malware/ransomwareLateral movement/data lossSegmentation, least privilege, backups, EDR, patching
Social engineeringUser compromiseTraining, MFA, verification procedures
MisconfigurationOutage or exposureChange control, review, backups, least privilege

Operations, Monitoring, and Resilience

Monitoring and Telemetry

Tool/protocolUseBest for
SNMP pollingQuery device counters/statusInterface utilization, errors, CPU, memory
SNMP trapsDevice sends alertLink down, threshold events
SyslogCentral log collectionDevice events, authentication, config changes
NetFlow/sFlow/IPFIXTraffic flow metadataTop talkers, protocols, conversations
Packet captureFull packet inspectionProtocol analysis, retransmissions, handshake failures
Synthetic monitoringSimulated transactionsUser-experience checks
BaselinesNormal performance referenceIdentifying abnormal latency/utilization
SIEMCorrelation and security alertingMulti-source security events
Notes and examples

Metrics to Recognize

MetricMeaningCommon cause when abnormal
LatencyDelayDistance, congestion, queuing, poor path
JitterVariation in delayCongestion, unstable wireless/WAN
Packet lossDropped packetsCongestion, errors, bad cable, RF issues
ThroughputActual achieved data rateBottleneck, duplex mismatch, shaping
BandwidthTheoretical/available capacityNot the same as throughput
Errors/CRCFrame corruptionCabling, optics, duplex, EMI
DiscardsDropped by device queue/policyCongestion, QoS, buffer pressure
UtilizationLink/device usageSaturation, backups, malware, top talkers

Physical and Diagnostic Tools

ToolUse
Cable testerWiremap, opens, shorts, split pairs
CertifierValidates cable category/performance
Toner/probeLocate cable runs
Loopback plugTest interface transmit/receive
TDRLocate copper cable faults by distance
OTDRLocate fiber faults/loss events
Light meter/sourceMeasure fiber optical power/loss
Spectrum analyzerRF interference analysis
Wi-Fi analyzerSSIDs, channels, signal strength
MultimeterElectrical checks
Network tapPassive traffic capture
Console cableOut-of-band device management

Documentation and Change Control

ItemWhy it matters
Logical diagramSubnets, VLANs, routing, firewall zones
Physical diagramCabling, racks, ports, circuits
IP address managementPrevent overlaps and stale allocations
Rack elevationSpace, power, cabling planning
Asset inventoryLifecycle, support, ownership
Configuration backupFast rollback/recovery
Standard operating procedureRepeatable operations
Change requestRisk, approval, rollback, communication
Maintenance windowLimits user impact
Post-change validationConfirms intended result and no regressions

Resilience Terms

TermMeaning
High availabilityDesign to reduce downtime
Fault toleranceContinue operating after component failure
RedundancyExtra components/paths
Load balancingDistribute work across resources
ClusteringMultiple systems act together
FHRPFirst-hop gateway redundancy concept
BackupCopy for recovery
RPOMaximum acceptable data loss window
RTOMaximum acceptable recovery time
MTBFAverage time between failures
MTTRAverage time to repair/restore
UPSShort-term battery power
GeneratorLonger-duration backup power

Troubleshooting Method and Commands

Practical Troubleshooting Flow

StepActionExam focus
1Identify the problemGather symptoms, question users, identify scope
2Establish a theoryStart with likely/simple causes
3Test the theoryConfirm or revise; do not randomly change many things
4Establish a planConsider impact, approval, rollback
5Implement the solutionApply fix during appropriate window if needed
6Verify functionalityConfirm service works and preventive controls are in place
7Document findingsRecord cause, fix, changes, lessons learned
Notes and examples

Command Reference

Command/toolPlatformUse
ipconfig /allWindowsIP, mask, gateway, DNS, DHCP lease, MAC
ipconfig /release / ipconfig /renewWindowsRenew DHCP lease
ipconfig /flushdnsWindowsClear DNS resolver cache
pingWindows/Linux/macOSBasic reachability and latency
tracertWindowsPath to destination
tracerouteLinux/macOSPath to destination
pathpingWindowsPath plus packet loss over time
nslookupWindows/Linux/macOSDNS queries
digLinux/macOSDetailed DNS queries
arp -aWindows/LinuxARP cache
route printWindowsRouting table
ip routeLinuxRouting table
ip addrLinuxInterface addresses
ss / netstatLinux/Windows variesListening ports and sessions
tcpdumpLinux/macOSPacket capture CLI
WiresharkGUIPacket analysis
nmapCross-platformPort scanning/service discovery
netcat / ncLinux/macOSTest TCP/UDP connectivity
ethtoolLinuxInterface speed/duplex/link details
mtrLinux/macOSContinuous traceroute-style diagnostics

Compact Command Snippets

ipconfig /all
ipconfig /release
ipconfig /renew
ipconfig /flushdns
nslookup www.example.com
tracert 8.8.8.8
route print
arp -a

ip addr
ip route
dig example.com A
dig example.com MX
ping -c 4 8.8.8.8
traceroute 8.8.8.8
ss -tulpen
sudo tcpdump -i eth0 host 10.0.0.5

Symptom-to-Layer Troubleshooting

SymptomLikely layer(s)First checks
No link light1Cable, patch panel, transceiver, port disabled, power
Link up, no IP2/3/7VLAN, DHCP scope, DHCP relay, APIPA, switch port
Can ping IP, not name7DNS server, record, suffix, cache, firewall to DNS
Can reach local subnet only3Default gateway, mask, route, ACL
One VLAN cannot reach another2/3/4Trunk allowed VLANs, SVI/router subinterface, ACL/firewall
Intermittent slow network1/2/3Errors, duplex mismatch, congestion, loops, RF interference
High latency to remote site3/4WAN utilization, routing path, QoS, provider issue
VoIP choppy2/3/4Jitter, loss, QoS, VLAN, WAN congestion
Web app fails but ping works4/7TCP port, TLS certificate, proxy, app service
Duplicate IP warning3Static overlap, DHCP reservation/scope issue
Users get wrong gateway/DNS2/3/7Rogue DHCP, wrong VLAN, DHCP options
Wireless users disconnect1/2Signal, interference, roaming, channel, authentication
Certificate warning6/7Expired cert, wrong name, untrusted CA, time skew
File share inaccessible4/7SMB port 445, permissions, name resolution, firewall

Cloud, Virtualization, and Modern Network Architectures

ConceptWhat it doesExam distinction
IaaSVirtual machines, networks, storageCustomer manages OS and above
PaaSManaged runtime/platformLess OS/network control
SaaSComplete application serviceVendor manages most stack
Public cloudShared provider infrastructureElastic, provider-managed physical layer
Private cloudDedicated organization-controlled cloudMore control/customization
Hybrid cloudMix of on-prem and cloudConnectivity, identity, routing matter
VPC/VNetIsolated virtual networkCloud equivalent of logical network boundary
Security groupInstance/NIC-level filtering conceptOften stateful in cloud platforms
Network ACLSubnet-level filtering conceptOften stateless in cloud platforms
Virtual router/gatewayRoutes between networksCloud/on-prem connectivity
Load balancerDistributes traffic to targetsLayer 4 or Layer 7 behavior
SDNSoftware-defined control planeCentralized programmability
NFVNetwork functions as softwareVirtual firewalls/routers/load balancers
Overlay networkLogical network over physical underlayVXLAN/encapsulation concepts
Spine-leafDatacenter topologyPredictable east-west traffic paths
North-south trafficClient/server into or out of datacenter/cloudPerimeter/security inspection
East-west trafficServer-to-server internal trafficSegmentation/microsegmentation
Notes and examples

Cloud, virtualization, and modern networking

ConceptWhat to remember
Virtual switchSoftware switching between VMs/hosts/networks
Virtual router/firewallNetwork function implemented in software
SDNSeparates/centralizes control logic from forwarding behavior
Control planeMakes forwarding decisions
Data planeForwards packets
Management planeConfiguration, monitoring, administration
OverlayVirtual network built on top of another network
UnderlayPhysical/logical network carrying overlay traffic
East-west trafficServer-to-server/internal traffic
North-south trafficClient-to-server or external-internal traffic
Cloud subnetLogical segmentation in cloud network
Security groupInstance/interface-level filtering concept
Network ACLSubnet/network-level filtering concept
ElasticityResources scale with demand
High availabilityDesign to reduce single points of failure

Common trap: In cloud scenarios, “the firewall” may exist at several layers: instance host firewall, security group, subnet ACL, cloud route table, network virtual appliance, and on-prem firewall.

High-Yield Distinctions and Common Traps

DistinctionRemember
TCP vs UDPTCP is connection-oriented with acknowledgments; UDP is connectionless and lower overhead
DNS over UDP vs TCPUDP is common; TCP is used for zone transfers and large responses
DHCP portsServer UDP 67, client UDP 68
SFTP vs FTPSSFTP uses SSH on 22; FTPS is FTP secured with TLS
SSH vs TelnetSSH encrypted; Telnet plaintext
HTTPS vs TLSHTTPS is HTTP over TLS; TLS can protect many protocols
IDS vs IPSIDS alerts; IPS blocks inline
Stateful firewall vs ACLStateful tracks sessions; ACL filters mainly by defined packet criteria
VLAN vs subnetVLAN is Layer 2 segmentation; subnet is Layer 3 addressing
Switch vs routerSwitch forwards frames by MAC; router forwards packets by IP
Same subnet communicationDoes not require default gateway
Inter-subnet communicationRequires router/L3 switch/default gateway
APIPA vs private IPAPIPA 169.254.0.0/16 implies local auto-addressing, often DHCP failure
Loopback vs default route127.0.0.1 tests local stack; 0.0.0.0/0 is default route
NAT vs firewallNAT translates addresses; firewall permits/denies traffic
Proxy vs firewallProxy intermediates application requests; firewall controls traffic flow
RADIUS vs TACACS+RADIUS common for access; TACACS+ common for device admin and command authorization
WPA2-Personal vs EnterprisePersonal uses shared passphrase; Enterprise uses 802.1X/RADIUS
Bandwidth vs latencyBandwidth is capacity; latency is delay
Jitter vs packet lossJitter is delay variation; loss is missing packets
MTU issue vs bandwidth issueMTU causes fragmentation/black-hole symptoms; bandwidth causes saturation
STP blocking vs failed linkSTP may intentionally block a redundant path
Native VLAN mismatchCan cause leakage or unexpected untagged traffic behavior
Duplex mismatchLink works but has errors, collisions, and poor throughput
DHCP relayRequired when clients and DHCP server are separated by routers
DNS failure vs connectivity failureIf IP works but names fail, troubleshoot DNS
Certificate failure vs network failureNetwork may be fine while TLS trust/name/date validation fails

Final Review Checklist

  • Memorize common ports, especially secure vs insecure protocol pairs.
  • Practice subnetting until network/broadcast/usable range can be found without hesitation.
  • For any scenario, identify the OSI layer before choosing a tool or fix.
  • Know when to segment with VLANs, subnets, ACLs, firewalls, and NAC.
  • Review wireless bands, security modes, interference, and roaming symptoms.
  • Tie monitoring tools to evidence: SNMP counters, syslog events, flow data, and packet captures.
  • Apply the troubleshooting method in order, including verification and documentation.

Next step: use this Cheat Sheet as a checklist while completing timed CompTIA Network+ (N10-009) practice questions, then revisit any row that explains a missed decision point.

Core network models

OSI layer quick decisions

LayerCommon itemsTypical symptomsUseful checks/tools
7 ApplicationDNS, HTTP/S, SMTP, SMB, SNMPApp fails but network path worksnslookup, dig, browser errors, app logs
6 PresentationEncryption, encoding, compressionTLS/certificate or format issuesCertificate inspection, TLS settings
5 SessionSession setup/teardownAuth/session timeout problemsLogs, connection tracking
4 TransportTCP/UDP, ports, segmentationPort blocked, TCP reset, UDP timeoutnetstat, ss, packet capture
3 NetworkIP, routing, ICMPWrong gateway, no route, subnet issueping, traceroute, route table
2 Data linkEthernet, MAC, VLAN, STPVLAN mismatch, loops, MAC issuesswitch MAC table, interface status
1 PhysicalCables, optics, RF, powerNo link light, CRC errors, weak signalcable tester, TDR/OTDR, link LEDs
Notes and examples

Common trap: Do not jump to DNS for every “cannot reach server” issue. First decide whether the client has an IP, a gateway, name resolution, and a usable path.

TCP/IP model shortcut

TCP/IP layerOSI relationshipThink of it as
ApplicationOSI 5–7User-facing services and protocols
TransportOSI 4TCP/UDP ports and reliability
InternetOSI 3IP addressing and routing
Network accessOSI 1–2Frames, MAC, cabling, switching

Switching review

Switch behavior

ConceptWhat it doesCommon exam angle
MAC address tableMaps MAC addresses to switch portsUnknown unicast flooding vs learned forwarding
Access portCarries one VLAN for an endpointUser placed in wrong VLAN
Trunk portCarries multiple VLANsMissing allowed VLAN or native VLAN mismatch
802.1QVLAN tagging standardTagged frames across trunks
Native VLANUntagged VLAN on trunkSecurity and mismatch issues
STPPrevents Layer 2 loopsBlocked port may be normal, not broken
Port securityRestricts MAC addressesProtects against unauthorized devices
Port mirroring/SPANCopies traffic to analyzerPacket capture/IDS troubleshooting
LACPBundles links dynamicallyRequires matching settings on both sides
Notes and examples

VLAN decision points

ScenarioLikely issue
User gets IP from wrong subnetWrong access VLAN or DHCP scope mapping
Host can reach same VLAN but not other VLANsMissing/incorrect default gateway or inter-VLAN routing
Some VLANs work across trunk but others do notAllowed VLAN list or trunk configuration problem
Trunk forms but untagged traffic behaves oddlyNative VLAN mismatch
Broadcast storm or unstable MAC tableLayer 2 loop; STP problem

Common trap: VLANs are Layer 2 segmentation. To communicate between VLANs, you need Layer 3 routing.

Cables, media, and physical infrastructure

Copper and fiber

MediumUse caseKey review point
UTP EthernetCommon endpoint cablingSusceptible to EMI compared with shielded options
STP EthernetHigher-interference environmentsShielding must be handled correctly
Plenum-rated cableAir-handling spacesFire/smoke safety requirement scenario
Riser-rated cableVertical runs between floorsBuilding-cabling scenario
Single-mode fiberLonger distanceSmaller core, laser-based optics
Multimode fiberShorter distanceCommon within buildings/data centers
CoaxialCable broadband/legacyKnow connector/context clues
Notes and examples

Connectors and transceivers

ItemRecognition
RJ45Twisted-pair Ethernet connector
LCSmall fiber connector, common in modern equipment
SCSquare push-pull fiber connector
STBayonet-style fiber connector
MPO/MTPMulti-fiber connector, high-density links
SFPModular transceiver form factor
SFP+Common for 10 Gb-class links
QSFP familyHigher-density/higher-throughput transceiver family

Physical troubleshooting tools

ToolBest use
Cable testerWiremap, opens, shorts, miswires
Cable certifierValidates cable performance against standards
Toner/probeTrace copper cable paths
TDRLocate copper cable faults by distance
OTDRLocate fiber faults by distance
Loopback plugTest port/interface transmit-receive path
Light meterFiber signal level testing
Punchdown toolTerminate copper cabling
CrimperAttach modular connectors

Common trap: A link light does not prove the cable is certified for the required speed or quality. Intermittent errors may require better testing.

Network devices and architecture

Device/conceptFunction
HubLegacy multiport repeater; shared collision domain
SwitchLayer 2 forwarding based on MAC addresses
Multilayer switchSwitching plus Layer 3 routing features
RouterConnects IP networks
FirewallEnforces traffic policy
IDSDetects suspicious activity
IPSCan block/prevent suspicious activity
Load balancerDistributes client traffic across back-end services
ProxyIntermediates client requests
VPN concentratorTerminates VPN tunnels
Wireless LAN controllerCentralizes AP management
Access pointProvides wireless network access
Modem/ONTProvider handoff for certain WAN services
Notes and examples

Architecture terms

TermMeaning
LANLocal network
WANWide area connectivity
WLANWireless LAN
PANPersonal area network
MANMetropolitan area network
CANCampus area network
SANStorage area network
DMZSegmented zone for externally accessible services
SOHOSmall office/home office
Data centerCentralized compute/network/storage facility
Spine-leafData center switching design focused on predictable east-west traffic
Three-tierAccess, distribution, core design model

Network operations

Documentation and change control

ItemWhy it matters
Network diagramsFaster troubleshooting and impact analysis
IP address managementPrevents duplicate IPs and undocumented subnets
Rack diagramsSpeeds physical work
Cable labelsReduces outage risk during moves/changes
BaselinesShows what “normal” looks like
Standard operating proceduresMakes operations repeatable
Change requestDocuments proposed work and risk
Backout planDefines how to recover if change fails
Maintenance windowReduces production impact
Post-change validationConfirms the change achieved its goal
Notes and examples

Common trap: In scenario questions, the best technical action may not be the best operational action if change approval, risk, or documentation is missing.

Monitoring, logs, and baselines

Data sourceWhat it helps answer
Interface countersErrors, drops, utilization
SyslogEvent history and device messages
SNMP pollingDevice health and metrics
Flow dataWho is talking to whom, and how much
Packet captureExact packet behavior
Wireless controller logsRoaming/auth/RF issues
Authentication logsLogin failures and access events
Environmental sensorsTemperature, humidity, power issues

Power and environment

TopicReview point
UPSShort-term power continuity and graceful shutdown
GeneratorLonger-term backup power
PDUPower distribution in racks
Redundant power suppliesDevice-level resilience
HVACTemperature control
Hot/cold aislesData center airflow management
Grounding/bondingElectrical safety and signal integrity
Fire suppressionProtects facility while limiting equipment damage

Troubleshooting methodology

Use a structured approach instead of guessing.

    flowchart TD
	    A[Identify the problem] --> B[Establish a theory]
	    B --> C[Test the theory]
	    C -->|Theory confirmed| D[Plan the fix]
	    C -->|Theory not confirmed| B
	    D --> E[Implement or escalate]
	    E --> F[Verify full functionality]
	    F --> G[Document findings and changes]
Notes and examples

Symptom-to-layer shortcuts

SymptomStart with
No link lightLayer 1: cable, port, power, transceiver
Link up but no DHCP addressVLAN, DHCP server, relay, scope
IP address present but no off-subnet accessDefault gateway, mask, routing
Can ping IP but not hostnameDNS
One application fails, others workPort, service, firewall, application
Intermittent slownessErrors, duplex, congestion, RF, CPU/memory
Only remote users affectedVPN, WAN, DNS split tunnel, authentication
Only one VLAN affectedSVI/router interface, ACL, DHCP scope, trunk
New change caused outageRollback/backout plan, compare change record
High latency but no packet lossCongestion, routing path, QoS, WAN
Packet loss under loadSaturation, errors, drops, policing
VoIP choppyJitter, latency, packet loss, QoS, duplex/RF

Command and tool recognition

Tool/commandUse
pingBasic reachability and latency
traceroute / tracertPath and hop behavior
ipconfig / ifconfig / ipLocal IP configuration
nslookup / digDNS testing
arpLocal IP-to-MAC cache
route / netstat -rRouting table
netstat / ssListening ports and sessions
tcpdump / WiresharkPacket capture/analysis
nmapPort scanning and service discovery
Cable testerPhysical copper validation
OTDRFiber fault location
Spectrum analyzerRF interference analysis

Common trap: ping failure does not always mean the host is down. ICMP may be blocked while TCP/UDP services still work.

Scenario decision rules

If a client cannot reach the Internet

Check in this order:

  1. Link status and Wi-Fi association.
  2. IP address, subnet mask/prefix, gateway, DNS.
  3. APIPA or duplicate IP indicators.
  4. Ping gateway.
  5. Ping known external IP.
  6. Resolve external hostname.
  7. Check firewall/proxy/VPN policy.
  8. Compare with another client in the same VLAN.

If a server is unreachable by name

TestInterpretation
Ping by IP succeedsPath works; investigate DNS/application
Ping by IP failsInvestigate network path, firewall, host status
DNS resolves wrong IPDNS record/cache issue
DNS resolves correctly but app failsPort, service, TLS, firewall, app issue
Works internally but not externallyNAT, public DNS, firewall, DMZ routing
Notes and examples

If a VLAN change breaks access

Check:

  • Access port VLAN assignment.
  • Trunk allowed VLANs.
  • Native VLAN mismatch.
  • Inter-VLAN routing interface/SVI.
  • DHCP scope and relay.
  • ACL/firewall rules.
  • Endpoint cached address or lease.

If wireless performance is poor

  • Band and channel utilization.
  • Co-channel and adjacent-channel interference.
  • AP placement and power levels.
  • Client density and capabilities.
  • Roaming behavior.
  • Authentication delays.
  • QoS for voice/video.
  • Non-Wi-Fi interference sources.

Common candidate mistakes

MistakeBetter approach
Memorizing ports without use casesTie each port to service, security, and troubleshooting clues
Treating every failure as DNSFirst separate link, IP, routing, DNS, and application
Forgetting the default gatewayOff-subnet communication depends on it
Confusing VLANs with subnetsVLANs are Layer 2; subnets are Layer 3
Assuming strong Wi-Fi signal means good performanceConsider interference, channel overlap, and congestion
Ignoring rule orderFirewall/ACL order can change the result
Skipping documentation/change controlOperations questions often reward process discipline
Overlooking time syncBad time breaks logs, certificates, and authentication
Miscounting subnet hostsUse host bits and subtract network/broadcast for traditional IPv4
Picking the most advanced tool firstChoose the simplest tool that proves or disproves the theory

What to drill after this Cheat Sheet

Use IT Mastery practice to convert recognition into exam-speed decision-making. Prioritize:

  1. Subnetting topic drills until you can identify network, broadcast, and usable range quickly.
  2. Ports and protocol drills with scenario wording, not just flashcards.
  3. Troubleshooting questions that force layer isolation.
  4. Wireless scenarios involving interference, authentication, and roaming.
  5. Security controls where multiple answers are plausible.
  6. Mock exams only after targeted topic drills expose fewer gaps.

The best next step is to move into a CompTIA Network+ (N10-009) question bank with original practice questions and detailed explanations, then use missed questions to choose your next focused review topic.

Put the review into practice

Study Plan
Browse Certification Practice Tests