N10-009 — CompTIA Network+ (N10-009) Exam Quick Reference

Last revised: June 18, 2026

Compact exam-prep reference for CompTIA Network+ (N10-009): ports, subnetting, routing, switching, wireless, security, operations, and troubleshooting.

Quick Reference Scope

Use this independent Quick Reference for fast review before practicing CompTIA Network+ (N10-009) exam questions. Prioritize:

  • Ports and protocols: know default ports, TCP/UDP use, and secure alternatives.
  • Subnetting: identify network, broadcast, usable range, mask, and block size quickly.
  • Layered troubleshooting: map symptoms to OSI layers, then choose the best tool or command.
  • Infrastructure decisions: switch vs router vs firewall, VLAN vs subnet, IDS vs IPS, RADIUS vs TACACS+, WPA2 vs WPA3.
  • Operations: monitoring, logging, change control, backups, diagrams, baselines, and documentation.

OSI, Encapsulation, and Traffic Scope

OSI Layer Reference

LayerNamePDUCommon devices/functionsHigh-yield exam cues
7ApplicationDataDNS, DHCP, HTTP, SMTP, SNMP, SMBUser-facing network services; URLs, names, application errors
6PresentationDataTLS, encryption, compression, encodingCertificate, cipher, format, encoding, compression issues
5SessionDataSession setup/teardown, RPC, NetBIOS sessionAuthentication/session persistence issues
4TransportSegment/datagramTCP, UDP, ports, flow controlPort numbers, retransmissions, TCP handshake, UDP loss
3NetworkPacketIP, ICMP, routers, L3 switches, routingSubnets, default gateway, routing, TTL, fragmentation
2Data LinkFrameEthernet, Wi-Fi MAC, VLANs, STP, switchesMAC addresses, frames, VLAN tags, loops, duplex
1PhysicalBitsCabling, optics, RF, connectors, hubsLink lights, pinouts, attenuation, interference, damaged cable

Encapsulation and Addressing

ConceptAddress usedScopeCommon trap
MAC addressLayer 2 hardware addressLocal broadcast domain/VLANMAC changes at each routed hop
IP addressLayer 3 logical addressEnd-to-end across routed networksIP usually stays same across hops unless NAT occurs
TCP/UDP portLayer 4 service identifierHost application/processPort identifies the service, not the host
FrameL2 unitLocal segment/VLANFrames do not cross routers unchanged
PacketL3 unitRouted pathRouters forward packets based on routing table

Broadcast, Collision, and Failure Domains

Device/designBroadcast domain impactCollision domain impactNotes
HubOne shared broadcast domainOne shared collision domainLegacy; half-duplex behavior; collisions expected
SwitchSame VLAN is one broadcast domainEach switch port is separate collision domainFull-duplex eliminates normal collisions
VLANSeparates broadcast domains logicallyDepends on switch portsInter-VLAN traffic requires L3 routing
Router/L3 switchSeparates broadcast domainsSeparates L2 segmentsDefault gateway for hosts
FirewallSeparates and filters networksDepends on interfaces/zonesPolicy controls allowed traffic
Wireless APBridges WLAN to LANShared RF medium per channelContention/interference affects all clients

Ports and Protocols

Default Port Reference

Protocol/servicePort(s)TransportPurposeExam traps
FTP data/control20/21TCPFile transferCredentials/data not encrypted; active/passive behavior matters
SSH22TCPSecure remote shellAlso used by SCP/SFTP
SFTP22TCPFile transfer over SSHNot the same as FTPS
Telnet23TCPRemote CLIInsecure plaintext
SMTP25TCPMail transfer server-to-serverSubmission often uses 587; encrypted variants differ
DNS53UDP/TCPName resolutionUDP common; TCP for zone transfers/large responses
DHCP server/client67/68UDPDynamic addressingClient uses 68, server uses 67; needs relay across routers
TFTP69UDPSimple file transferNo authentication; often boot/config transfer
HTTP80TCPWeb trafficPlaintext
Kerberos88TCP/UDPAuthentication ticketsTime synchronization is critical
POP3110TCPMail retrievalClient downloads mail; secure POP3 uses 995
NTP123UDPTime synchronizationCritical for logs, Kerberos, certificates
NetBIOS137-139TCP/UDPLegacy Windows name/session servicesOften replaced by SMB over 445
IMAP143TCPMail access/syncSecure IMAP uses 993
SNMP161UDPMonitoring queriesUse SNMPv3 for authentication/encryption
SNMP traps162UDPDevice-generated alertsTrap receiver listens here
LDAP389TCP/UDPDirectory queriesLDAPS uses 636
HTTPS443TCPHTTP over TLSCertificate/name/trust errors common
SMB/CIFS445TCPFile/print sharingCommon lateral movement target
Syslog514UDP/TCPLog forwardingTLS-secured syslog commonly uses 6514
SMTPS465TCPSMTP over TLS587 is common for submission with STARTTLS
SMTP submission587TCPAuthenticated mail submissionPreferred over unauthenticated relay
LDAPS636TCPLDAP over TLSCertificate trust matters
IMAPS993TCPIMAP over TLSSecure mail access
POP3S995TCPPOP3 over TLSSecure mail retrieval
Microsoft SQL Server1433TCPDatabase accessKnow as common application service port
RADIUS auth/accounting1812/1813UDPAAA for network accessCentralized auth; encrypts password, not full packet
MySQL/MariaDB3306TCPDatabase accessCommon server application port
RDP3389TCP/UDPRemote desktopSecure with VPN/MFA/restricted access
PostgreSQL5432TCPDatabase accessCommon server application port
SIP5060/5061TCP/UDPVoIP signaling5061 is TLS-secured SIP
Syslog over TLS6514TCPEncrypted log forwardingPrefer for sensitive logs
TechnologyPort/protocolUseDistinction
IPsec AHIP protocol 51Integrity/authenticationDoes not encrypt payload
IPsec ESPIP protocol 50Encryption/integrityCommon IPsec payload protection
IKEUDP 500IPsec negotiationUsed before tunnel establishment
IPsec NAT-TUDP 4500IPsec through NATEncapsulates IPsec for NAT traversal
L2TPUDP 1701TunnelingOften paired with IPsec
OpenVPNOften UDP/TCP 1194SSL/TLS VPNPort can vary by configuration
HTTPS VPN portalTCP 443SSL/TLS remote accessOften firewall-friendly
TACACS+TCP 49Device administration AAAEncrypts full payload; separates auth/accounting/authorization
RADIUSUDP 1812/1813Network access AAACommon for 802.1X, VPN, Wi-Fi enterprise

IPv4, IPv6, and Subnetting

IPv4 Formulas

For a subnet with \(h\) host bits:

\[ \text{usable IPv4 hosts} = 2^{h} - 2 \]

For borrowed subnet bits \(b\):

\[ \text{number of subnets} = 2^{b} \]

For the interesting mask octet:

\[ \text{block size} = 256 - \text{mask octet} \]

Exceptions: /31 is commonly used for point-to-point links, and /32 identifies a single host route.

Private and Special IPv4 Ranges

RangePurposeExam cue
10.0.0.0/8Private RFC 1918Large internal networks
172.16.0.0/12Private RFC 1918172.16.0.0-172.31.255.255 only
192.168.0.0/16Private RFC 1918Home/small office common
127.0.0.0/8LoopbackTests local TCP/IP stack
169.254.0.0/16APIPA/link-localDHCP failure clue
224.0.0.0/4MulticastOne-to-many group traffic
255.255.255.255Limited broadcastLocal segment only
0.0.0.0Unspecified/defaultDefault route or unconfigured source

Common CIDR Reference

CIDRMaskTotal addressesUsable hostsIncrement
/8255.0.0.016,777,21616,777,2141 in 1st octet
/16255.255.0.065,53665,5341 in 2nd octet
/20255.255.240.04,0964,09416 in 3rd octet
/21255.255.248.02,0482,0468 in 3rd octet
/22255.255.252.01,0241,0224 in 3rd octet
/23255.255.254.05125102 in 3rd octet
/24255.255.255.02562541 in 3rd octet
/25255.255.255.128128126128 in 4th octet
/26255.255.255.192646264 in 4th octet
/27255.255.255.224323032 in 4th octet
/28255.255.255.240161416 in 4th octet
/29255.255.255.248868 in 4th octet
/30255.255.255.252424 in 4th octet
/31255.255.255.2542SpecialPoint-to-point use
/32255.255.255.25511 host routeSingle host

Fast Subnetting Process

  1. Convert prefix to dotted mask.
  2. Find the interesting octet: the octet that is not 0 or 255.
  3. Calculate block size: 256 minus the mask value in that octet.
  4. Count subnets in block-size increments.
  5. Network address is the lower boundary; broadcast is one less than next boundary.
  6. Usable range is network + 1 through broadcast - 1, except special /31 and /32 cases.

Example: 10.10.18.76/27

ItemValue
Mask255.255.255.224
Block size32
Subnet boundaries.0, .32, .64, .96, .128, .160, .192, .224
Network10.10.18.64
Broadcast10.10.18.95
Usable hosts10.10.18.65-10.10.18.94

IPv6 Quick Reference

IPv6 conceptReferenceExam cue
Address length128 bitsWritten in hexadecimal hextets
Compression:: replaces one run of zerosCan be used once per address
Loopback::1/128Local host test
Unspecified::/128No address assigned
Link-localfe80::/10Local link only; required for IPv6 operations
Unique localfc00::/7Private-like internal addressing
Global unicast2000::/3Routable IPv6 Internet space
Multicastff00::/8IPv6 has multicast, not broadcast
SLAACRouter AdvertisementsHost self-configures address
DHCPv6Stateful or stateless optionsCan provide addresses or options
NDPICMPv6-based neighbor discoveryReplaces ARP functions

Switching, VLANs, and Ethernet

Layer 2 Feature Reference

FeaturePurposeChoose/use whenCommon trap
Access portCarries one VLAN untaggedEnd-user device, printer, access point management VLANWrong VLAN causes DHCP/gateway failure
Trunk portCarries multiple VLANs with tagsSwitch-to-switch, switch-to-router, switch-to-hypervisorAllowed VLAN list or native VLAN mismatch
802.1QVLAN tagging standardMark frames across trunksNative VLAN is typically untagged
Native VLANUntagged VLAN on trunkCompatibility/control-plane designMismatches can create leakage/security risk
Port securityLimits MACs on a switch portPrevent unauthorized device swapsCan shut down port after violation
STP/RSTPPrevents L2 loopsRedundant switch pathsBlocking port may look like unused link
BPDU GuardProtects edge portsShut down port receiving BPDUsUse on access/PortFast-style ports
LACPDynamic link aggregationIncrease bandwidth and redundancyBoth sides must be compatible/configured
Port mirroring/SPANCopy traffic to analyzerPacket capture/IDS sensorDoes not normally alter traffic flow
LLDP/CDPNeighbor discoveryMap connected devicesCDP is vendor-specific; LLDP is open standard
Jumbo framesLarger Ethernet framesStorage/backup/high-throughput networksMTU mismatch causes drops/fragmentation symptoms
QoSPrioritize trafficVoice/video/latency-sensitive appsQoS does not create bandwidth; it schedules traffic

STP Essentials

STP itemMeaning
Root bridgeCentral reference switch selected by lowest bridge ID
Bridge IDPriority plus MAC address
Root portBest path toward root bridge on non-root switch
Designated portForwarding port for a segment
Blocking/discardingPrevents loops by not forwarding user frames
Loop symptomBroadcast storm, MAC table flapping, high CPU, network-wide outage

Cabling, Media, and Connectors

Medium/componentUseExam cues
UTPGeneral copper EthernetSusceptible to EMI compared with shielded cable
STP/FTPShielded copperIndustrial/EMI-prone environments; grounding matters
Plenum-rated cableAir-handling spacesFire/smoke rating scenario
Riser-rated cableVertical building runsBetween floors/risers
CoaxialCable broadband/CCTV/legacyF-type, BNC depending on use
Multimode fiberShorter fiber runsLED/VCSEL, larger core, common in campus/datacenter
Single-mode fiberLonger fiber runsLaser, smaller core, WAN/long-distance
RJ45Twisted-pair Ethernet8P8C connector
LCFiber connectorSmall form factor, very common
SC/STFiber connectorsSC push-pull; ST twist-lock
MPO/MTPMulti-fiber connectorHigh-density fiber trunks
SFP/SFP+/QSFPModular transceiversMatch speed, fiber type, wavelength, connector
DACDirect attach copperShort datacenter interconnect
AOCActive optical cableShort optical interconnect with fixed optics

Ethernet and PoE

TopicKey point
Auto-negotiationSpeed/duplex negotiation; mismatch can cause errors and poor throughput
Full duplexSend and receive simultaneously; no normal collisions
Half duplexLegacy/shared media; collisions possible
Auto-MDI-XReduces need for crossover cables
PoESends power over Ethernet cabling
802.3af / 802.3at / 802.3btPoE standards with increasing power capability
Common PoE devicesAPs, VoIP phones, cameras, badge readers
PoE troubleshootingCheck power budget, cable pairs, switch support, device class, injector/midspan

Routing, NAT, WAN, and Remote Access

Routing Selection Reference

Routing type/protocolCategoryBest useExam cue
Connected routeAutomaticDirectly attached networksAppears when interface is up/up with IP
Static routeManualSmall/stable paths, specific overrideNo automatic convergence
Default routeStatic/dynamicUnknown destinations0.0.0.0/0 or ::/0
OSPFLink-state IGPEnterprise internal routingAreas, cost, fast convergence
EIGRPAdvanced distance-vector IGPVendor-specific enterprise routingFeasible successor terminology may appear
RIPDistance-vector IGPLegacy/simple networksHop-count metric; slower convergence
BGPPath-vector EGPInternet/ISP or large multi-domain routingAutonomous systems and policy-based routing

NAT and Address Translation

NAT typeMappingUseTrap
Static NATOne private to one publicPublish internal service or fixed mappingConsumes one public address per host
Dynamic NATPrivate to pool of public IPsOutbound access from poolPool can be exhausted
PAT/NAT overloadMany private to one/few public IPs using portsTypical Internet edge NATPort translation differentiates sessions
Destination NAT/port forwardingPublic IP:port to internal host:portPublish selected serviceFirewall rule must also allow traffic

WAN and Connectivity Choices

TechnologyUse whenNotes
Leased lineDedicated predictable private connectivityHigher reliability/control than shared broadband
MPLSProvider-managed private WANLabel switching; often used for enterprise WANs
Broadband cable/DSL/fiberInternet access/backupShared service characteristics vary
Cellular/5GBackup, mobile, temporary sitesConsider signal, data plans, antennas
SatelliteRemote areasHigher latency; weather/line-of-sight concerns
SD-WANPolicy-based multi-link WANUses overlays, path selection, centralized control
VPN over InternetEncrypted private connectivityDepends on Internet path quality

VPN Decision Table

VPN typeBest fitCommon technologiesExam distinction
Site-to-siteConnect offices/networksIPsec tunnel modeUsually always-on between gateways
Remote-accessIndividual users to networkSSL/TLS VPN, IPsec client VPNUser authentication and endpoint posture matter
Clientless VPNBrowser-based app accessHTTPS portalLimited to supported applications
Split tunnelOnly corporate traffic via VPNRemote-access optimizationInternet traffic bypasses VPN; security tradeoff
Full tunnelAll traffic via VPNStronger central inspectionMore bandwidth/latency impact

Wireless Networking

Wi-Fi Standards

StandardWi-Fi nameBandsKey exam cue
802.11aLegacy5 GHzOlder 5 GHz standard
802.11bLegacy2.4 GHzSlow legacy 2.4 GHz
802.11gLegacy2.4 GHzBackward compatibility with b
802.11nWi-Fi 42.4/5 GHzMIMO introduced broadly
802.11acWi-Fi 55 GHzWider channels, higher throughput
802.11axWi-Fi 6/6E2.4/5/6 GHzOFDMA, efficiency, dense environments
802.11beWi-Fi 72.4/5/6 GHzNewer high-throughput/low-latency generation

Wireless Security

Security modeStatus/useExam cue
OpenNo encryptionUse only with captive portal/guest isolation if required
WEPDeprecated/insecureDo not choose except to identify legacy risk
WPALegacy improvement over WEPSuperseded by WPA2/WPA3
WPA2-PersonalPSK-basedShared passphrase; use AES/CCMP
WPA2-Enterprise802.1X/RADIUSPer-user or certificate-based authentication
WPA3-PersonalSAEStronger protection against offline PSK attacks
WPA3-EnterpriseEnterprise authenticationStronger enterprise wireless security
Captive portalWeb-based access acceptance/loginNot a replacement for encryption
MAC filteringAllows/blocks listed MACsWeak control; MACs can be spoofed

Wireless Design and Troubleshooting

Issue/design pointWhat to check
Channel overlapUse non-overlapping 2.4 GHz channels where applicable; prefer 5/6 GHz for capacity
InterferenceMicrowaves, Bluetooth, cordless devices, neighboring WLANs, industrial equipment
Low RSSIAP placement, antenna orientation, transmit power, obstacles
Poor SNRNoise floor and interference, not just signal strength
Roaming problemsAP density, power levels, controller settings, sticky clients
Hidden nodeClients cannot hear each other; causes contention/retransmissions
DFS events5 GHz radar detection can force channel changes
Guest WLANSeparate VLAN, firewall rules, captive portal, client isolation
Voice over Wi-FiQoS, roaming, low latency/jitter, adequate coverage
Antenna choiceOmnidirectional for broad coverage; directional for focused links

Core Network Services

DHCP

DHCP itemMeaning
DORADiscover, Offer, Request, Acknowledge
ScopePool of assignable addresses
ExclusionAddresses not handed out from a scope
ReservationSpecific IP for a client, usually by MAC/client identifier
LeaseTime-bound address assignment
OptionsGateway, DNS servers, domain name, NTP, PXE boot options
Relay/IP helperForwards DHCP across routers/VLANs
Failure clueAPIPA address, no default gateway, stale lease, wrong VLAN

DNS Records

RecordPurposeExample use
AName to IPv4host.example.com to IPv4
AAAAName to IPv6IPv6 host resolution
CNAMEAlias to canonical namewww alias to another name
MXMail exchangerDomain mail routing
NSAuthoritative name serverDelegation/zone authority
SOAStart of authorityZone metadata
PTRReverse lookupIP to name
TXTText metadataSPF, DKIM, DMARC, verification
SRVService locatorDirectory/VoIP/service discovery
CAACertificate authority authorizationLimits which CAs may issue certs
TTLCache lifetimeLong TTL slows propagation of changes

Infrastructure Services and Components

Service/componentPurposeChoose/check when
NTPTime syncAuthentication, logs, certificates, Kerberos failures
PKI/CACertificate issuance/trustTLS, VPN, 802.1X certificate authentication
Load balancerDistribute client requestsHigh availability, scale-out applications
Reverse proxyFront-end application publishingTLS offload, filtering, app routing
Forward proxyClient egress mediationURL filtering, caching, logging
DHCP snoopingValidates DHCP serversPrevent rogue DHCP
IPAMAddress managementAvoid overlaps, document allocations
Directory serviceIdentity sourceCentralized users/groups/devices
RADIUS/TACACS+AAANetwork access or device administration
CDNContent distributionReduce latency for static/global content

Security Controls and Threats

Control Selection Matrix

ControlPrimary functionChoose whenDo not confuse with
Stateless firewallFilters by packet fieldsSimple ACL-style filteringStateful session tracking
Stateful firewallTracks sessionsPerimeter/internal segmentationApplication-layer inspection by default
NGFWApp/user-aware filteringNeed app visibility, IPS, URL/category controlsBasic port-only firewall
WAFProtects web appsSQL injection/XSS-style web attacksNetwork firewall for all protocols
IDSDetects and alertsMonitoring without inline blockingIPS
IPSDetects and blocks inlineActive preventionPassive IDS
NACControls network admissionPosture checks, 802.1X, guest accessSimple switch port security
802.1XPort-based access controlEnterprise wired/wireless authPSK-only Wi-Fi
RADIUSAAA for accessVPN, Wi-Fi, switch authenticationTACACS+ device admin focus
TACACS+Device administration AAAGranular command authorizationRADIUS network access focus
SIEMLog correlation/alertingCentral security monitoringPacket analyzer
DLPPrevent data exfiltrationSensitive data controlsFirewall allow/deny only
VPNEncrypted tunnelRemote/site connectivity over untrusted networksVLAN segmentation
Zero trustContinuous verification/least privilegeIdentity-centric accessSingle product or simple VPN

Network Attack and Mitigation Matrix

ThreatSymptom/goalMitigations
ARP poisoningMITM on local subnetDynamic ARP inspection, static entries for critical systems, segmentation
DNS poisoningWrong name resolutionDNSSEC where applicable, secure resolvers, monitor changes
Rogue DHCPWrong gateway/DNS, outagesDHCP snooping, authorized DHCP servers
VLAN hoppingAccess to unintended VLANDisable unused trunks, set native VLAN safely, explicit allowed VLANs
MAC spoofingBypass MAC-based controls802.1X, port security, monitoring
Evil twin APUsers connect to fake APWPA2/3-Enterprise, certificate validation, WIDS/WIPS
Deauthentication attackWireless disconnectsWPA3/management frame protection where supported, monitoring
DoS/DDoSService/resource exhaustionRate limiting, upstream filtering, redundancy, DDoS protection
Credential attackUnauthorized loginMFA, lockout/rate limits, strong auth, monitoring
On-path/MITMTraffic interceptionTLS, VPN, certificate validation, secure protocols
Malware/ransomwareLateral movement/data lossSegmentation, least privilege, backups, EDR, patching
Social engineeringUser compromiseTraining, MFA, verification procedures
MisconfigurationOutage or exposureChange control, review, backups, least privilege

Operations, Monitoring, and Resilience

Monitoring and Telemetry

Tool/protocolUseBest for
SNMP pollingQuery device counters/statusInterface utilization, errors, CPU, memory
SNMP trapsDevice sends alertLink down, threshold events
SyslogCentral log collectionDevice events, authentication, config changes
NetFlow/sFlow/IPFIXTraffic flow metadataTop talkers, protocols, conversations
Packet captureFull packet inspectionProtocol analysis, retransmissions, handshake failures
Synthetic monitoringSimulated transactionsUser-experience checks
BaselinesNormal performance referenceIdentifying abnormal latency/utilization
SIEMCorrelation and security alertingMulti-source security events

Metrics to Recognize

MetricMeaningCommon cause when abnormal
LatencyDelayDistance, congestion, queuing, poor path
JitterVariation in delayCongestion, unstable wireless/WAN
Packet lossDropped packetsCongestion, errors, bad cable, RF issues
ThroughputActual achieved data rateBottleneck, duplex mismatch, shaping
BandwidthTheoretical/available capacityNot the same as throughput
Errors/CRCFrame corruptionCabling, optics, duplex, EMI
DiscardsDropped by device queue/policyCongestion, QoS, buffer pressure
UtilizationLink/device usageSaturation, backups, malware, top talkers

Physical and Diagnostic Tools

ToolUse
Cable testerWiremap, opens, shorts, split pairs
CertifierValidates cable category/performance
Toner/probeLocate cable runs
Loopback plugTest interface transmit/receive
TDRLocate copper cable faults by distance
OTDRLocate fiber faults/loss events
Light meter/sourceMeasure fiber optical power/loss
Spectrum analyzerRF interference analysis
Wi-Fi analyzerSSIDs, channels, signal strength
MultimeterElectrical checks
Network tapPassive traffic capture
Console cableOut-of-band device management

Documentation and Change Control

ItemWhy it matters
Logical diagramSubnets, VLANs, routing, firewall zones
Physical diagramCabling, racks, ports, circuits
IP address managementPrevent overlaps and stale allocations
Rack elevationSpace, power, cabling planning
Asset inventoryLifecycle, support, ownership
Configuration backupFast rollback/recovery
Standard operating procedureRepeatable operations
Change requestRisk, approval, rollback, communication
Maintenance windowLimits user impact
Post-change validationConfirms intended result and no regressions

Resilience Terms

TermMeaning
High availabilityDesign to reduce downtime
Fault toleranceContinue operating after component failure
RedundancyExtra components/paths
Load balancingDistribute work across resources
ClusteringMultiple systems act together
FHRPFirst-hop gateway redundancy concept
BackupCopy for recovery
RPOMaximum acceptable data loss window
RTOMaximum acceptable recovery time
MTBFAverage time between failures
MTTRAverage time to repair/restore
UPSShort-term battery power
GeneratorLonger-duration backup power

Troubleshooting Method and Commands

Practical Troubleshooting Flow

StepActionExam focus
1Identify the problemGather symptoms, question users, identify scope
2Establish a theoryStart with likely/simple causes
3Test the theoryConfirm or revise; do not randomly change many things
4Establish a planConsider impact, approval, rollback
5Implement the solutionApply fix during appropriate window if needed
6Verify functionalityConfirm service works and preventive controls are in place
7Document findingsRecord cause, fix, changes, lessons learned

Command Reference

Command/toolPlatformUse
ipconfig /allWindowsIP, mask, gateway, DNS, DHCP lease, MAC
ipconfig /release / ipconfig /renewWindowsRenew DHCP lease
ipconfig /flushdnsWindowsClear DNS resolver cache
pingWindows/Linux/macOSBasic reachability and latency
tracertWindowsPath to destination
tracerouteLinux/macOSPath to destination
pathpingWindowsPath plus packet loss over time
nslookupWindows/Linux/macOSDNS queries
digLinux/macOSDetailed DNS queries
arp -aWindows/LinuxARP cache
route printWindowsRouting table
ip routeLinuxRouting table
ip addrLinuxInterface addresses
ss / netstatLinux/Windows variesListening ports and sessions
tcpdumpLinux/macOSPacket capture CLI
WiresharkGUIPacket analysis
nmapCross-platformPort scanning/service discovery
netcat / ncLinux/macOSTest TCP/UDP connectivity
ethtoolLinuxInterface speed/duplex/link details
mtrLinux/macOSContinuous traceroute-style diagnostics

Compact Command Snippets

ipconfig /all
ipconfig /release
ipconfig /renew
ipconfig /flushdns
nslookup www.example.com
tracert 8.8.8.8
route print
arp -a

ip addr
ip route
dig example.com A
dig example.com MX
ping -c 4 8.8.8.8
traceroute 8.8.8.8
ss -tulpen
sudo tcpdump -i eth0 host 10.0.0.5

Symptom-to-Layer Troubleshooting

SymptomLikely layer(s)First checks
No link light1Cable, patch panel, transceiver, port disabled, power
Link up, no IP2/3/7VLAN, DHCP scope, DHCP relay, APIPA, switch port
Can ping IP, not name7DNS server, record, suffix, cache, firewall to DNS
Can reach local subnet only3Default gateway, mask, route, ACL
One VLAN cannot reach another2/3/4Trunk allowed VLANs, SVI/router subinterface, ACL/firewall
Intermittent slow network1/2/3Errors, duplex mismatch, congestion, loops, RF interference
High latency to remote site3/4WAN utilization, routing path, QoS, provider issue
VoIP choppy2/3/4Jitter, loss, QoS, VLAN, WAN congestion
Web app fails but ping works4/7TCP port, TLS certificate, proxy, app service
Duplicate IP warning3Static overlap, DHCP reservation/scope issue
Users get wrong gateway/DNS2/3/7Rogue DHCP, wrong VLAN, DHCP options
Wireless users disconnect1/2Signal, interference, roaming, channel, authentication
Certificate warning6/7Expired cert, wrong name, untrusted CA, time skew
File share inaccessible4/7SMB port 445, permissions, name resolution, firewall

Cloud, Virtualization, and Modern Network Architectures

ConceptWhat it doesExam distinction
IaaSVirtual machines, networks, storageCustomer manages OS and above
PaaSManaged runtime/platformLess OS/network control
SaaSComplete application serviceVendor manages most stack
Public cloudShared provider infrastructureElastic, provider-managed physical layer
Private cloudDedicated organization-controlled cloudMore control/customization
Hybrid cloudMix of on-prem and cloudConnectivity, identity, routing matter
VPC/VNetIsolated virtual networkCloud equivalent of logical network boundary
Security groupInstance/NIC-level filtering conceptOften stateful in cloud platforms
Network ACLSubnet-level filtering conceptOften stateless in cloud platforms
Virtual router/gatewayRoutes between networksCloud/on-prem connectivity
Load balancerDistributes traffic to targetsLayer 4 or Layer 7 behavior
SDNSoftware-defined control planeCentralized programmability
NFVNetwork functions as softwareVirtual firewalls/routers/load balancers
Overlay networkLogical network over physical underlayVXLAN/encapsulation concepts
Spine-leafDatacenter topologyPredictable east-west traffic paths
North-south trafficClient/server into or out of datacenter/cloudPerimeter/security inspection
East-west trafficServer-to-server internal trafficSegmentation/microsegmentation

High-Yield Distinctions and Common Traps

DistinctionRemember
TCP vs UDPTCP is connection-oriented with acknowledgments; UDP is connectionless and lower overhead
DNS over UDP vs TCPUDP is common; TCP is used for zone transfers and large responses
DHCP portsServer UDP 67, client UDP 68
SFTP vs FTPSSFTP uses SSH on 22; FTPS is FTP secured with TLS
SSH vs TelnetSSH encrypted; Telnet plaintext
HTTPS vs TLSHTTPS is HTTP over TLS; TLS can protect many protocols
IDS vs IPSIDS alerts; IPS blocks inline
Stateful firewall vs ACLStateful tracks sessions; ACL filters mainly by defined packet criteria
VLAN vs subnetVLAN is Layer 2 segmentation; subnet is Layer 3 addressing
Switch vs routerSwitch forwards frames by MAC; router forwards packets by IP
Same subnet communicationDoes not require default gateway
Inter-subnet communicationRequires router/L3 switch/default gateway
APIPA vs private IPAPIPA 169.254.0.0/16 implies local auto-addressing, often DHCP failure
Loopback vs default route127.0.0.1 tests local stack; 0.0.0.0/0 is default route
NAT vs firewallNAT translates addresses; firewall permits/denies traffic
Proxy vs firewallProxy intermediates application requests; firewall controls traffic flow
RADIUS vs TACACS+RADIUS common for access; TACACS+ common for device admin and command authorization
WPA2-Personal vs EnterprisePersonal uses shared passphrase; Enterprise uses 802.1X/RADIUS
Bandwidth vs latencyBandwidth is capacity; latency is delay
Jitter vs packet lossJitter is delay variation; loss is missing packets
MTU issue vs bandwidth issueMTU causes fragmentation/black-hole symptoms; bandwidth causes saturation
STP blocking vs failed linkSTP may intentionally block a redundant path
Native VLAN mismatchCan cause leakage or unexpected untagged traffic behavior
Duplex mismatchLink works but has errors, collisions, and poor throughput
DHCP relayRequired when clients and DHCP server are separated by routers
DNS failure vs connectivity failureIf IP works but names fail, troubleshoot DNS
Certificate failure vs network failureNetwork may be fine while TLS trust/name/date validation fails

Final Review Checklist

  • Memorize common ports, especially secure vs insecure protocol pairs.
  • Practice subnetting until network/broadcast/usable range can be found without hesitation.
  • For any scenario, identify the OSI layer before choosing a tool or fix.
  • Know when to segment with VLANs, subnets, ACLs, firewalls, and NAC.
  • Review wireless bands, security modes, interference, and roaming symptoms.
  • Tie monitoring tools to evidence: SNMP counters, syslog events, flow data, and packet captures.
  • Apply the troubleshooting method in order, including verification and documentation.

Next step: use this Quick Reference as a checklist while completing timed CompTIA Network+ (N10-009) practice questions, then revisit any row that explains a missed decision point.

Scenario Guide
Networking Fundamentals
Browse Certification Practice Tests by Exam Family