N10-009 — CompTIA Network+ Quick Review

Quick Review for CompTIA Network+ (N10-009): high-yield networking concepts, subnetting, services, security, operations, and troubleshooting before practice.

Quick Review purpose

This Quick Review is for candidates preparing for the real CompTIA Network+ (N10-009) exam. Use it to refresh high-yield concepts before moving into topic drills, mock exams, and detailed explanations.

This page is IT Mastery review support. It is not affiliated with CompTIA. For final scope decisions, compare your study plan against the current official CompTIA Network+ (N10-009) exam objectives.

How to use this before practice

  1. Review the tables first. They condense the most testable decision points.
  2. Mark weak areas. Do not reread everything equally; target gaps.
  3. Use original practice questions. Apply the concepts in scenario format.
  4. Review explanations, not just scores. Network+ questions often test why one answer is better than another.
  5. Return to this page after misses. Treat missed questions as signals for focused topic drills.

High-yield map for CompTIA Network+ (N10-009)

AreaWhat to be able to decide quickly
Network modelsWhich layer is involved, what device/protocol belongs there, and which tool verifies it
IP addressingIPv4 subnet size, default gateway logic, private/public ranges, IPv6 address types
SwitchingVLANs, trunks, STP, port security, MAC learning, link aggregation
RoutingStatic vs dynamic routing, default routes, NAT/PAT, route selection symptoms
WirelessBands, channels, interference, authentication, encryption, roaming, site-survey issues
Network servicesDHCP, DNS, NTP, SNMP, syslog, directory services, load balancing
InfrastructureCopper, fiber, transceivers, PoE, racks, power, environmental controls
Cloud and virtualizationVirtual switches, overlays, SDN, cloud networking, segmentation, elasticity
SecurityAAA, ACLs, firewalls, VPNs, segmentation, hardening, attacks, monitoring
OperationsChange control, documentation, baselines, monitoring, incident response, backups
TroubleshootingFollow a method, isolate layers, interpret symptoms, choose the best tool

Core network models

OSI layer quick decisions

LayerCommon itemsTypical symptomsUseful checks/tools
7 ApplicationDNS, HTTP/S, SMTP, SMB, SNMPApp fails but network path worksnslookup, dig, browser errors, app logs
6 PresentationEncryption, encoding, compressionTLS/certificate or format issuesCertificate inspection, TLS settings
5 SessionSession setup/teardownAuth/session timeout problemsLogs, connection tracking
4 TransportTCP/UDP, ports, segmentationPort blocked, TCP reset, UDP timeoutnetstat, ss, packet capture
3 NetworkIP, routing, ICMPWrong gateway, no route, subnet issueping, traceroute, route table
2 Data linkEthernet, MAC, VLAN, STPVLAN mismatch, loops, MAC issuesswitch MAC table, interface status
1 PhysicalCables, optics, RF, powerNo link light, CRC errors, weak signalcable tester, TDR/OTDR, link LEDs

Common trap: Do not jump to DNS for every “cannot reach server” issue. First decide whether the client has an IP, a gateway, name resolution, and a usable path.

TCP/IP model shortcut

TCP/IP layerOSI relationshipThink of it as
ApplicationOSI 5–7User-facing services and protocols
TransportOSI 4TCP/UDP ports and reliability
InternetOSI 3IP addressing and routing
Network accessOSI 1–2Frames, MAC, cabling, switching

Ports and protocols to know cold

Protocol/servicePort or identifierTCP/UDPExam-use decision
FTP control/data21 / 20TCPLegacy file transfer; not encrypted
SSH / SFTP22TCPSecure remote CLI and secure file transfer
Telnet23TCPInsecure remote CLI
SMTP25TCPMail transfer between servers
DNS53UDP/TCPName resolution; TCP often for large replies/zone transfers
DHCP server/client67 / 68UDPAutomatic IP configuration
TFTP69UDPSimple file transfer, often network device images/configs
HTTP80TCPUnencrypted web
NTP123UDPTime synchronization
SNMP161 / 162UDPMonitoring and traps/informs
LDAP389TCP/UDPDirectory access
HTTPS443TCPEncrypted web
SMB445TCPWindows file/printer sharing
SMTPS / submission variants465 / 587TCPEncrypted or authenticated mail submission scenarios
LDAPS636TCPLDAP over TLS
IMAP / IMAPS143 / 993TCPMail retrieval, server-side mailbox
POP3 / POP3S110 / 995TCPMail retrieval, often download-oriented
RDP3389TCP/UDPRemote desktop
SIP5060 / 5061TCP/UDPVoIP signaling; 5061 commonly TLS
IPsec AHIP protocol 51N/AIntegrity/authentication, no payload encryption
IPsec ESPIP protocol 50N/AEncryption and/or integrity
IKE / NAT-T500 / 4500UDPIPsec negotiation and NAT traversal

Common trap: Port numbers alone rarely answer the whole question. Combine the port with the scenario: encryption requirement, file-transfer type, remote access method, or monitoring need.

IPv4 addressing and subnetting

IPv4 ranges and special addresses

Range/typeAddress spaceWhat it means
Private class A-style10.0.0.0/8Internal use, not routed on the public Internet
Private class B-style172.16.0.0/12Internal use; range is 172.16.0.0–172.31.255.255
Private class C-style192.168.0.0/16Common small-network private space
APIPA/link-local169.254.0.0/16Client failed to obtain DHCP configuration
Loopback127.0.0.0/8Local host testing
Multicast224.0.0.0/4One-to-many delivery
Broadcast255.255.255.255Local broadcast
Default route0.0.0.0/0“Send unknown destinations here”

Subnetting formulas

\[ \text{Number of addresses} = 2^{(32 - \text{prefix length})} \]\[ \text{Traditional usable host addresses} = 2^{(32 - \text{prefix length})} - 2 \]

The “minus 2” accounts for the network and broadcast addresses in traditional IPv4 subnets. Be aware that point-to-point and special-use cases may be handled differently, but exam subnetting questions usually expect the traditional calculation unless the scenario says otherwise.

Fast IPv4 subnet table

CIDRMaskBlock size in last octetTotal addressesTraditional usable hosts
/24255.255.255.0256256254
/25255.255.255.128128128126
/26255.255.255.192646462
/27255.255.255.224323230
/28255.255.255.240161614
/29255.255.255.248886
/30255.255.255.252442

Subnetting decision method

When given an IPv4/CIDR address:

  1. Find the block size. For /26, the last-octet block size is 64.
  2. List subnet starts. 0, 64, 128, 192.
  3. Place the host IP. Example: 192.168.1.70/26 is in the 64–127 block.
  4. Identify network and broadcast. Network is .64; broadcast is .127.
  5. Identify usable range. .65 through .126.

Common trap: If asked for “number of subnets,” confirm the original network size. If asked for “number of hosts,” use the host bits in the final subnet.

IPv6 essentials

IPv6 typeCommon prefix/exampleWhat to know
Global unicast2000::/3Publicly routable IPv6 space
Link-localfe80::/10Local segment only; required for many IPv6 functions
Unique localfc00::/7, commonly fd00::/8Private/internal-style addressing
Multicastff00::/8IPv6 uses multicast instead of broadcast
Loopback::1Local host
Unspecified::No address/unknown address
SLAACRouter Advertisement basedHost self-configures address information
DHCPv6Stateful or statelessCan assign addresses or provide options

Key IPv6 reminders:

  • IPv6 has no broadcast; it uses multicast.
  • A common LAN prefix size is /64.
  • Neighbor Discovery replaces many ARP-like IPv4 functions.
  • Link-local addresses matter for local communication and routing-adjacent functions.
  • Do not assume IPv6 means “no DHCP”; DHCPv6 may still be used.

Switching review

Switch behavior

ConceptWhat it doesCommon exam angle
MAC address tableMaps MAC addresses to switch portsUnknown unicast flooding vs learned forwarding
Access portCarries one VLAN for an endpointUser placed in wrong VLAN
Trunk portCarries multiple VLANsMissing allowed VLAN or native VLAN mismatch
802.1QVLAN tagging standardTagged frames across trunks
Native VLANUntagged VLAN on trunkSecurity and mismatch issues
STPPrevents Layer 2 loopsBlocked port may be normal, not broken
Port securityRestricts MAC addressesProtects against unauthorized devices
Port mirroring/SPANCopies traffic to analyzerPacket capture/IDS troubleshooting
LACPBundles links dynamicallyRequires matching settings on both sides

VLAN decision points

ScenarioLikely issue
User gets IP from wrong subnetWrong access VLAN or DHCP scope mapping
Host can reach same VLAN but not other VLANsMissing/incorrect default gateway or inter-VLAN routing
Some VLANs work across trunk but others do notAllowed VLAN list or trunk configuration problem
Trunk forms but untagged traffic behaves oddlyNative VLAN mismatch
Broadcast storm or unstable MAC tableLayer 2 loop; STP problem

Common trap: VLANs are Layer 2 segmentation. To communicate between VLANs, you need Layer 3 routing.

Routing review

Routing concepts

ConceptWhat to remember
Default gatewayHost’s route to non-local networks
Default routeRouter’s catch-all route, often 0.0.0.0/0 or ::/0
Static routeManually configured; predictable but less scalable
Dynamic routingRouters exchange reachability information
MetricProtocol-specific measure of path preference
Administrative preference/distanceUsed when multiple routing sources know the same destination
Longest prefix matchMore specific routes win over broader routes
NATTranslates addresses
PATMany internal hosts share one or more external addresses via ports

Routing protocol recognition

ProtocolType/useHigh-yield distinction
RIPDistance-vector IGPLegacy/simple; hop-count based
OSPFLink-state IGPCommon enterprise interior routing concept
EIGRPAdvanced distance-vector/hybrid styleOften seen in vendor-influenced environments
BGPPath-vector EGPInternet/large-scale interdomain routing

Common trap: If two routes match, the longest prefix is usually the first decision. A /28 route is more specific than a /24 route.

NAT/PAT traps

SymptomPossible cause
Internal users reach Internet but inbound service failsMissing port forwarding/static NAT/firewall rule
One inside host works, others do notNAT pool exhaustion or rule mismatch
VPN traffic fails after NATNAT exemption or overlapping subnet issue
Application embeds IP addressesNAT may break application behavior

Wireless networking

Wi-Fi decision table

TopicWhat to know for N10-009 review
2.4 GHzLonger range, more interference, fewer non-overlapping channels
5 GHzMore channels, less crowded, shorter range than 2.4 GHz in many environments
6 GHzNewer band support; requires compatible clients/APs
Channel overlapCauses co-channel/adjacent-channel performance problems
RoamingClient decisions, AP placement, signal overlap, authentication speed
Band steeringEncourages capable clients to use preferred bands
MIMO/OFDMAEfficiency and throughput improvements in newer Wi-Fi generations
Captive portalWeb-based access acceptance/authentication
WPA2/WPA3-PersonalPre-shared key style access
WPA2/WPA3-Enterprise802.1X/RADIUS-based authentication
SSID hidingNot real security; do not rely on it

Wireless troubleshooting patterns

SymptomLikely area to investigate
Good signal, poor throughputInterference, channel congestion, client capability, oversubscription
Drops while movingRoaming design, AP placement, power levels
Cannot authenticateWrong PSK, certificate issue, RADIUS/802.1X problem
IoT device will not connectBand/security compatibility issue
Works near AP onlyAttenuation, antenna placement, transmit power, obstruction
Intermittent voice issuesJitter, roaming delay, QoS, RF congestion

Common trap: Strong signal is not the same as clean RF. Interference and channel design can make a “strong” Wi-Fi connection perform poorly.

Network services

DHCP

DHCP commonly follows the DORA sequence:

  1. Discover
  2. Offer
  3. Request
  4. Acknowledge
DHCP issueWhat it suggests
169.254.x.x addressDHCP failure or unreachable DHCP server
Wrong subnet addressWrong VLAN, relay, or scope
Correct IP but wrong gatewayDHCP option issue
Some clients fail late in the dayScope exhaustion or lease behavior
Remote VLAN cannot get DHCPMissing/misconfigured DHCP relay/IP helper

DNS

DNS recordPurpose
AName to IPv4 address
AAAAName to IPv6 address
CNAMEAlias to canonical name
MXMail exchanger
NSAuthoritative name server
PTRReverse lookup
TXTText records; often verification and email security uses
SRVService location
DNS symptomLikely interpretation
Can ping IP but not nameDNS resolution issue
One record wrong, others fineZone/record problem, not general connectivity
Internal name resolves externallySplit-horizon or DNS search/path issue
Intermittent stale answersCaching/TTL issue
Reverse lookup failsPTR zone/record missing

Common trap: DNS failure can look like application failure. Test by IP address and name to separate path problems from name-resolution problems.

Monitoring and management services

ServiceUse
NTPTime sync; critical for logs, certificates, Kerberos-style auth, investigations
SNMPDevice monitoring; SNMPv3 adds stronger security features
SyslogCentralized log collection
NetFlow/IPFIX-style telemetryTraffic flow visibility
RADIUS/TACACS+Centralized AAA for network access/admin access
LDAP/LDAPSDirectory queries
NTP + logsMakes event timelines trustworthy

Cables, media, and physical infrastructure

Copper and fiber

MediumUse caseKey review point
UTP EthernetCommon endpoint cablingSusceptible to EMI compared with shielded options
STP EthernetHigher-interference environmentsShielding must be handled correctly
Plenum-rated cableAir-handling spacesFire/smoke safety requirement scenario
Riser-rated cableVertical runs between floorsBuilding-cabling scenario
Single-mode fiberLonger distanceSmaller core, laser-based optics
Multimode fiberShorter distanceCommon within buildings/data centers
CoaxialCable broadband/legacyKnow connector/context clues

Connectors and transceivers

ItemRecognition
RJ45Twisted-pair Ethernet connector
LCSmall fiber connector, common in modern equipment
SCSquare push-pull fiber connector
STBayonet-style fiber connector
MPO/MTPMulti-fiber connector, high-density links
SFPModular transceiver form factor
SFP+Common for 10 Gb-class links
QSFP familyHigher-density/higher-throughput transceiver family

Physical troubleshooting tools

ToolBest use
Cable testerWiremap, opens, shorts, miswires
Cable certifierValidates cable performance against standards
Toner/probeTrace copper cable paths
TDRLocate copper cable faults by distance
OTDRLocate fiber faults by distance
Loopback plugTest port/interface transmit-receive path
Light meterFiber signal level testing
Punchdown toolTerminate copper cabling
CrimperAttach modular connectors

Common trap: A link light does not prove the cable is certified for the required speed or quality. Intermittent errors may require better testing.

Network devices and architecture

Device/conceptFunction
HubLegacy multiport repeater; shared collision domain
SwitchLayer 2 forwarding based on MAC addresses
Multilayer switchSwitching plus Layer 3 routing features
RouterConnects IP networks
FirewallEnforces traffic policy
IDSDetects suspicious activity
IPSCan block/prevent suspicious activity
Load balancerDistributes client traffic across back-end services
ProxyIntermediates client requests
VPN concentratorTerminates VPN tunnels
Wireless LAN controllerCentralizes AP management
Access pointProvides wireless network access
Modem/ONTProvider handoff for certain WAN services

Architecture terms

TermMeaning
LANLocal network
WANWide area connectivity
WLANWireless LAN
PANPersonal area network
MANMetropolitan area network
CANCampus area network
SANStorage area network
DMZSegmented zone for externally accessible services
SOHOSmall office/home office
Data centerCentralized compute/network/storage facility
Spine-leafData center switching design focused on predictable east-west traffic
Three-tierAccess, distribution, core design model

Cloud, virtualization, and modern networking

ConceptWhat to remember
Virtual switchSoftware switching between VMs/hosts/networks
Virtual router/firewallNetwork function implemented in software
SDNSeparates/centralizes control logic from forwarding behavior
Control planeMakes forwarding decisions
Data planeForwards packets
Management planeConfiguration, monitoring, administration
OverlayVirtual network built on top of another network
UnderlayPhysical/logical network carrying overlay traffic
East-west trafficServer-to-server/internal traffic
North-south trafficClient-to-server or external-internal traffic
Cloud subnetLogical segmentation in cloud network
Security groupInstance/interface-level filtering concept
Network ACLSubnet/network-level filtering concept
ElasticityResources scale with demand
High availabilityDesign to reduce single points of failure

Common trap: In cloud scenarios, “the firewall” may exist at several layers: instance host firewall, security group, subnet ACL, cloud route table, network virtual appliance, and on-prem firewall.

Security review

CIA and AAA

ModelComponentsExam use
CIAConfidentiality, Integrity, AvailabilityClassify security goals
AAAAuthentication, Authorization, AccountingIdentify, permit, and log user/device actions
ControlBest-fit use
802.1XPort-based network access control
RADIUSCentralized authentication, common for network access
TACACS+Centralized device administration scenarios
MFAStronger identity proofing
RBACPermissions based on roles
Least privilegeMinimum required access
NACAssess/control devices before network access
PKI/certificatesTrust, encryption, device/user identity
Certificate revocationIdentify certificates that should no longer be trusted

Firewalls, ACLs, and segmentation

ControlKey distinction
Stateless ACLFilters mainly on packet attributes without session awareness
Stateful firewallTracks connection state
NGFWAdds application/user/content-aware features
WAFProtects web applications at application layer
DMZPlaces public-facing systems in a controlled segment
MicrosegmentationFine-grained internal segmentation
Zero trust conceptVerify explicitly; do not trust solely based on network location

Common trap: An ACL rule order matters. A broad deny placed above a specific allow can break expected traffic.

VPNs and secure remote access

VPN typeTypical use
Site-to-site VPNConnect networks over an untrusted network
Client-to-site VPNRemote user access
IPsec VPNNetwork-layer tunnel/security
SSL/TLS VPNOften remote-access/browser or client-based
Split tunnelOnly selected traffic uses VPN
Full tunnelAll client traffic uses VPN

Common attacks and mitigations

Attack/problemWhat it targetsUseful mitigation
ARP poisoningLocal traffic redirectionDynamic ARP inspection, segmentation, monitoring
Rogue DHCPClient IP configurationDHCP snooping, port security
VLAN hoppingVLAN separationDisable unused trunks, set native VLAN carefully
MAC floodingSwitch CAM tablePort security
DNS poisoningName resolution trustSecure DNS practices, monitoring
DoS/DDoSAvailabilityRate limiting, upstream filtering, redundancy
Evil twin APWireless clientsWPA-Enterprise, user training, detection
Deauthentication attackWi-Fi availabilityModern protected management features where supported
Man-in-the-middleConfidentiality/integrityTLS, certificate validation, secure protocols
Credential attackIdentity systemsMFA, lockout policies, monitoring

Network operations

Documentation and change control

ItemWhy it matters
Network diagramsFaster troubleshooting and impact analysis
IP address managementPrevents duplicate IPs and undocumented subnets
Rack diagramsSpeeds physical work
Cable labelsReduces outage risk during moves/changes
BaselinesShows what “normal” looks like
Standard operating proceduresMakes operations repeatable
Change requestDocuments proposed work and risk
Backout planDefines how to recover if change fails
Maintenance windowReduces production impact
Post-change validationConfirms the change achieved its goal

Common trap: In scenario questions, the best technical action may not be the best operational action if change approval, risk, or documentation is missing.

Monitoring, logs, and baselines

Data sourceWhat it helps answer
Interface countersErrors, drops, utilization
SyslogEvent history and device messages
SNMP pollingDevice health and metrics
Flow dataWho is talking to whom, and how much
Packet captureExact packet behavior
Wireless controller logsRoaming/auth/RF issues
Authentication logsLogin failures and access events
Environmental sensorsTemperature, humidity, power issues

Power and environment

TopicReview point
UPSShort-term power continuity and graceful shutdown
GeneratorLonger-term backup power
PDUPower distribution in racks
Redundant power suppliesDevice-level resilience
HVACTemperature control
Hot/cold aislesData center airflow management
Grounding/bondingElectrical safety and signal integrity
Fire suppressionProtects facility while limiting equipment damage

Troubleshooting methodology

Use a structured approach instead of guessing.

    flowchart TD
	    A[Identify the problem] --> B[Establish a theory]
	    B --> C[Test the theory]
	    C -->|Theory confirmed| D[Plan the fix]
	    C -->|Theory not confirmed| B
	    D --> E[Implement or escalate]
	    E --> F[Verify full functionality]
	    F --> G[Document findings and changes]

Symptom-to-layer shortcuts

SymptomStart with
No link lightLayer 1: cable, port, power, transceiver
Link up but no DHCP addressVLAN, DHCP server, relay, scope
IP address present but no off-subnet accessDefault gateway, mask, routing
Can ping IP but not hostnameDNS
One application fails, others workPort, service, firewall, application
Intermittent slownessErrors, duplex, congestion, RF, CPU/memory
Only remote users affectedVPN, WAN, DNS split tunnel, authentication
Only one VLAN affectedSVI/router interface, ACL, DHCP scope, trunk
New change caused outageRollback/backout plan, compare change record
High latency but no packet lossCongestion, routing path, QoS, WAN
Packet loss under loadSaturation, errors, drops, policing
VoIP choppyJitter, latency, packet loss, QoS, duplex/RF

Command and tool recognition

Tool/commandUse
pingBasic reachability and latency
traceroute / tracertPath and hop behavior
ipconfig / ifconfig / ipLocal IP configuration
nslookup / digDNS testing
arpLocal IP-to-MAC cache
route / netstat -rRouting table
netstat / ssListening ports and sessions
tcpdump / WiresharkPacket capture/analysis
nmapPort scanning and service discovery
Cable testerPhysical copper validation
OTDRFiber fault location
Spectrum analyzerRF interference analysis

Common trap: ping failure does not always mean the host is down. ICMP may be blocked while TCP/UDP services still work.

Scenario decision rules

If a client cannot reach the Internet

Check in this order:

  1. Link status and Wi-Fi association.
  2. IP address, subnet mask/prefix, gateway, DNS.
  3. APIPA or duplicate IP indicators.
  4. Ping gateway.
  5. Ping known external IP.
  6. Resolve external hostname.
  7. Check firewall/proxy/VPN policy.
  8. Compare with another client in the same VLAN.

If a server is unreachable by name

TestInterpretation
Ping by IP succeedsPath works; investigate DNS/application
Ping by IP failsInvestigate network path, firewall, host status
DNS resolves wrong IPDNS record/cache issue
DNS resolves correctly but app failsPort, service, TLS, firewall, app issue
Works internally but not externallyNAT, public DNS, firewall, DMZ routing

If a VLAN change breaks access

Check:

  • Access port VLAN assignment.
  • Trunk allowed VLANs.
  • Native VLAN mismatch.
  • Inter-VLAN routing interface/SVI.
  • DHCP scope and relay.
  • ACL/firewall rules.
  • Endpoint cached address or lease.

If wireless performance is poor

Check:

  • Band and channel utilization.
  • Co-channel and adjacent-channel interference.
  • AP placement and power levels.
  • Client density and capabilities.
  • Roaming behavior.
  • Authentication delays.
  • QoS for voice/video.
  • Non-Wi-Fi interference sources.

Common candidate mistakes

MistakeBetter approach
Memorizing ports without use casesTie each port to service, security, and troubleshooting clues
Treating every failure as DNSFirst separate link, IP, routing, DNS, and application
Forgetting the default gatewayOff-subnet communication depends on it
Confusing VLANs with subnetsVLANs are Layer 2; subnets are Layer 3
Assuming strong Wi-Fi signal means good performanceConsider interference, channel overlap, and congestion
Ignoring rule orderFirewall/ACL order can change the result
Skipping documentation/change controlOperations questions often reward process discipline
Overlooking time syncBad time breaks logs, certificates, and authentication
Miscounting subnet hostsUse host bits and subtract network/broadcast for traditional IPv4
Picking the most advanced tool firstChoose the simplest tool that proves or disproves the theory

What to drill after this Quick Review

Use IT Mastery practice to convert recognition into exam-speed decision-making. Prioritize:

  1. Subnetting topic drills until you can identify network, broadcast, and usable range quickly.
  2. Ports and protocol drills with scenario wording, not just flashcards.
  3. Troubleshooting questions that force layer isolation.
  4. Wireless scenarios involving interference, authentication, and roaming.
  5. Security controls where multiple answers are plausible.
  6. Mock exams only after targeted topic drills expose fewer gaps.

The best next step is to move into a CompTIA Network+ (N10-009) question bank with original practice questions and detailed explanations, then use missed questions to choose your next focused review topic.

Continue in IT Mastery

Use this Quick Review as a final concept map, then move into IT Mastery for focused topic drills, mixed practice sets, timed mock exams, and detailed explanations. The practice questions are original IT Mastery practice items; they are not official CompTIA questions, copied live-exam content, or exam dumps.

Browse Certification Practice Tests by Exam Family