CompTIA Network+ N10-010: Network Troubleshooting

Topic snapshot

Sample questions

These original IT Mastery practice questions are aligned to this topic area. Use them for self-assessment, scope review, and deciding what to drill next.

Question 1

Topic: Network Troubleshooting

A technician can ping a distribution switch management IP from the VPN but cannot open SSH or HTTPS. User traffic through the switch is normal. The organization requires network devices to be managed only from the hardened jump box.

Exhibit: Management ACL log

ALLOW tcp 10.50.10.25 -> 10.20.0.5 eq 22
ALLOW tcp 10.50.10.25 -> 10.20.0.5 eq 443
DENY  tcp 10.60.8.44 -> 10.20.0.5 eq 22
DENY  tcp 10.60.8.44 -> 10.20.0.5 eq 443

What is the best professional decision?

Options:

• A. Troubleshoot user VLAN routing first

• B. Enable Telnet for emergency access

• C. Access the switch through the approved jump box

• D. Remove the management ACL temporarily

Best answer: C

Explanation: The failure is security-related, not a general connectivity outage. ICMP reachability and normal user traffic show the switch is up and forwarding. The ACL log shows management-plane traffic to TCP 22 and 443 is denied from the VPN client but allowed from the jump box address. Because policy requires management only from the hardened jump box, the professional response is to use that approved path rather than weakening controls. If access from another source is needed later, it should go through change management and policy review.

• Removing the ACL would restore access but violates the stated management-access control.
• Telnet is not appropriate because it is an insecure management protocol.
• User VLAN routing is unlikely because production forwarding is normal and only management ports are denied.

Question 2

Topic: Network Troubleshooting

A network technician is troubleshooting a new branch office router. Users can browse the internet, but they cannot reach the data center subnet 10.20.0.0/16. The change must avoid disrupting internet access and should use the existing VPN tunnel.

Exhibit: Routing evidence

Destination        Next hop        Interface
0.0.0.0/0          203.0.113.1     ISP-WAN
192.168.50.0/24    connected       LAN
10.10.0.0/16       172.16.0.2      VPN-TUNNEL

Traceroute to 10.20.5.25:
1  203.0.113.1
2  198.51.100.14
3  * * *

Which action is the BEST professional decision?

Options:

• A. Replace the default route with the VPN tunnel

• B. Flush DNS on the affected branch clients

• C. Disable firewall filtering on the branch router

• D. Add a route for 10.20.0.0/16 through the VPN tunnel

Best answer: D

Explanation: The exhibit shows a routing problem, not a name-resolution or firewall problem. The router has a working default route to the ISP, and traceroute confirms traffic for 10.20.5.25 is being sent toward the internet. It also has a VPN route for 10.10.0.0/16, proving the tunnel path exists for other private networks. What is missing is a more specific route for 10.20.0.0/16 pointing to the VPN next hop. Adding or restoring that route sends only data center traffic through the tunnel while preserving normal internet access through the default route.

• Replacing the default route would likely disrupt internet browsing, which is already working and must remain available.
• Flushing DNS does not address the visible route selection to an IP destination.
• Disabling firewall filtering is too broad and unsupported by the evidence shown.

Question 3

Topic: Network Troubleshooting

A technician is troubleshooting a 5 GHz point-to-point wireless bridge after rooftop maintenance. Users report very low throughput from Building B to Building A, but the reverse direction is mostly stable.

Exhibit: Bridge status

Which issue is best supported by the exhibit?

Options:

• A. Building B has an antenna or pigtail problem

• B. The bridge is failing because of client roaming

• C. The channel is unusable due to interference

• D. Building A needs higher transmit power

Best answer: A

Explanation: The exhibit shows an asymmetric RF problem. Both radios are configured for the same transmit power, and Building A is receiving Building B at only -83 dBm while Building B receives Building A at -51 dBm. The decisive clue is Building B reporting 0 dBi antenna gain when 13 dBi is configured. After rooftop work, that strongly suggests a disconnected, damaged, wrong, or misaligned antenna/pigtail on Building B. The noise floor is normal, so the weak signal is not best explained by general interference. The key takeaway is to compare TX level, RX level, and antenna gain together to identify which side of the RF path is likely impaired.

• Higher A power does not address the weak signal arriving from Building B.
• Interference is not supported because the noise floor is low and the problem is directional.
• Client roaming does not apply to a fixed point-to-point bridge link.

Question 4

Topic: Network Troubleshooting

A warehouse reports intermittent Wi-Fi drops during afternoon shifts. Wired devices remain stable, AP event logs show no authentication failures, and the security policy discourages collecting user payloads unless necessary. The network team needs evidence of possible non-Wi-Fi RF interference around the affected aisles. Which tool is the BEST choice?

Options:

• A. Packet capture

• B. Log collector

• C. Packet analyzer

• D. Spectrum analyzer

Best answer: D

Explanation: The core decision is the type of evidence needed. The symptoms point to a wireless physical-layer problem: intermittent drops in a specific area, stable wired connectivity, and no authentication errors in AP logs. To investigate non-Wi-Fi RF interference, the team needs visibility into radio frequency activity, channel utilization, noise, and possible interferers such as machinery or cordless devices. A spectrum analyzer is designed for that RF view and also avoids unnecessary user payload collection. Packet-focused tools are useful when the evidence needed is frame, packet, protocol, or application behavior, not raw RF energy. A log collector helps centralize device events, but the existing logs are already not showing the cause.

• Packet inspection fails because decoded network traffic does not directly show non-Wi-Fi RF interference.
• Centralized logs fail because the AP logs are inconclusive and logs do not measure RF energy.
• Packet capture fails because capturing traffic is less targeted and may conflict with the stated payload-collection policy.

Question 5

Topic: Network Troubleshooting

A junior technician is sent to restore connectivity for users in a small office IDF. Before touching any equipment, the technician records the following ticket notes.

Exhibit: Ticket notes

Area: IDF-2, second floor
Symptom: Access switch is offline; 18 users disconnected
Observation: Water is dripping from ceiling tile above the rack
Observation: PDU and patch panel are visibly wet
Business impact: Users can work from adjacent office temporarily

What is the best next action?

Options:

• A. Reseat the switch power cable and uplink fiber

• B. Escalate to facilities and electrical safety before troubleshooting

• C. Replace the offline access switch with a spare switch

• D. Open a vendor support case for the access switch

Best answer: B

Explanation: Escalation is required when troubleshooting evidence points to physical safety, security, vendor-only support, or major service-level impact. In this case, the decisive evidence is water dripping onto powered infrastructure, including a wet PDU. A network technician should not continue normal troubleshooting around a possible electrical hazard. The safe action is to stop network work in that area and involve facilities or electrical safety personnel. The disconnected users matter, but the note says they have a temporary workaround, so the immediate driver is safety rather than a critical SLA outage.

• Hardware swap fails because replacing equipment near wet power distribution could expose the technician to electrical danger.
• Cable reseating fails because touching wet powered equipment is unsafe before the hazard is cleared.
• Vendor case fails because the evidence points to an environmental safety issue, not a confirmed switch defect.

Question 6

Topic: Network Troubleshooting

A help desk ticket lists several symptoms after a conference room move: intermittent voice calls, users losing access to a file share, and slow web browsing. Before making changes, a technician checks the closest access switch.

Exhibit:

Switch log: Port 1/0/24 moved to err-disabled
Reason: BPDU guard violation
Port role: access VLAN 30
Recent MAC table: many MAC addresses learned on 1/0/24
Wireless controller: no new interference alerts
DNS monitoring: normal response times

Which next action is best supported by the evidence?

Options:

• A. Convert port 1/0/24 to an 802.1Q trunk.

• B. Change VLAN 30 to use alternate DNS resolvers.

• C. Keep BPDU guard enabled, remove the downstream switch, and re-enable the access port.

• D. Increase wireless transmit power near the conference room.

Best answer: C

Explanation: Evidence-based troubleshooting means acting on confirmed data, not the longest symptom list. The decisive facts are the BPDU guard violation and many MAC addresses on a port configured as an access port. That points to a downstream switch or loop-capable device connected where an end-user device was expected. The safest next action is to keep the protection in place, remove the unauthorized device or loop, then re-enable the port through the normal change process. DNS and wireless checks are normal, so changing those settings would be unsupported. Converting the port to a trunk could make the problem worse and bypass the intended access-port design.

• DNS change fails because monitoring shows normal DNS response times, so DNS is not the supported fault.
• Wireless power fails because the controller has no interference alerts and the switch evidence is more specific.
• Trunk conversion fails because an access port showing BPDU guard violations should not be turned into a trunk without a design requirement.

Question 7

Topic: Network Troubleshooting

A help desk ticket reports that a workstation connected to an access switch has very slow file transfers, but it does not lose link. The switchport and NIC were recently changed during troubleshooting.

Exhibit: Interface evidence

Which configuration change is the best next step?

Options:

• A. Increase the PoE power allocation

• B. Move the workstation to a trunk port

• C. Set both sides to auto-negotiate speed and duplex

• D. Enable jumbo frames on the switchport

Best answer: C

Explanation: Late collisions on a modern switched Ethernet link strongly point to a duplex mismatch, especially when one side is forced and the other side uses auto-negotiation. The auto-negotiating NIC may choose a different duplex mode than the forced switchport, causing poor throughput, retransmissions, FCS errors, and collision-related counters while the link still stays up. The best configuration fix is to make speed and duplex match on both ends, commonly by enabling auto-negotiation on both devices or by explicitly setting the same speed and duplex on both sides. The cable test passing makes a physical wire fault less likely, and the symptoms are not caused by VLAN trunking, MTU size, or PoE power.

• Jumbo frames address MTU consistency, not late collisions or FCS errors from duplex mismatch.
• Trunk port changes VLAN tagging behavior and would not correct access-link collision counters.
• PoE allocation affects power delivery to powered devices, not workstation throughput on an active Ethernet link.

Question 8

Topic: Network Troubleshooting

A workstation on Gi1/0/12 has intermittent connectivity. The technician suspects a Layer 1 issue with the copper patch path and checks the switch interface counters.

Exhibit: Interface counter excerpt

Interface: Gi1/0/12
Status: up/up
Speed/Duplex: 1000/full
Input errors: 18,432
CRC errors: 18,410
Runts: 3
Giants: 0
Collisions: 0
Last cleared: 2 hours ago

Which root cause is best validated by this output?

Options:

• A. Incorrect default gateway

• B. DHCP scope exhaustion

• C. Bad cable or termination

• D. Duplex mismatch

Best answer: C

Explanation: Interface counters are strong evidence for validating suspected physical-layer problems. A large number of CRC errors means frames are arriving corrupted, which commonly points to bad copper cabling, poor termination, damaged patch panels, electrical interference, or a failing NIC/switchport. The link is up at 1000/full, so the counter pattern supports a media/path issue more directly than an IP addressing, routing, or gateway problem.

The key takeaway is to use counters that match the suspected failure domain: CRC and input errors validate Layer 1/2 corruption, not DHCP or gateway configuration.

• DHCP exhaustion would be validated with DHCP server logs, lease scope status, or APIPA addresses, not CRC counters.
• Default gateway issues usually affect off-subnet reachability while local link counters remain normal.
• Duplex mismatch often shows collisions or late collisions on half-duplex links; this interface reports 1000/full and no collisions.

Question 9

Topic: Network Troubleshooting

A network technician is troubleshooting an outage affecting only VMs on Host 3 in VLAN 30. VMs on other hosts in VLAN 30 can reach the gateway. The affected VMs have correct IP settings, the firewall shows no denies, and host CPU/memory are normal.

Exhibit: Relevant findings

Which configuration change is most likely to restore connectivity?

Options:

• A. Configure the Host 3 uplink as an 802.1Q trunk allowing VLAN 30.

• B. Increase CPU and memory reservations on Host 3.

• C. Change the affected VMs to VLAN 10 addressing.

• D. Add a firewall allow rule for VLAN 30.

Best answer: A

Explanation: The evidence points to a switching VLAN configuration problem at the Host 3 uplink. The VM port group is set for VLAN 30, but the connected physical switchport is an access port in VLAN 10, so VLAN 30 traffic from that host cannot reach the VLAN 30 gateway. Other hosts in the same VLAN work, the SVI is up, the VMs have correct addressing, firewall logs show no denies, and host resource usage is normal. Those facts narrow the outage to the local path between the hypervisor and the physical switch.

A trunk that allows VLAN 30 aligns the physical switchport with the hypervisor VLAN tagging.

• Wrong subnet change fails because moving the VMs to VLAN 10 addressing would not restore their intended VLAN 30 connectivity.
• Firewall rule change is not supported because only one host is affected and the firewall shows no deny events.
• Resource tuning does not match the evidence because CPU and memory are normal and the failure is VLAN-specific.

Question 10

Topic: Network Troubleshooting

A help desk ticket reports intermittent connectivity for one office after a copper uplink was moved during a cabling cleanup. The link must stay available until a short maintenance window, and no switch configuration changes are approved yet.

Exhibit: Switch interface Gi1/0/24

Which action is the BEST professional decision?

Options:

• A. Enable jumbo frames on both connected devices

• B. Test and replace the copper cabling or termination

• C. Increase QoS priority for the office subnet

• D. Force the port to 100 Mbps half duplex

Best answer: B

Explanation: CRC errors indicate frames arrived corrupted and failed the frame check sequence, which commonly points to cabling, termination, connector, transceiver, or electrical interference issues. In this case, the problem appeared after a copper uplink was moved, and the CRC counter is increasing while giants, runts, and overruns are zero. That evidence supports a physical-layer investigation rather than an MTU, duplex, or congestion change. The safest professional action is to validate the cable path and terminations, then replace or reterminate the suspect cabling during the maintenance window if needed. A small number of output drops is not the dominant symptom here.

• Jumbo frames would address oversized frame issues, but the giants counter is zero.
• Forced half duplex can create collisions and worse performance; the port already negotiated 1 Gbps full duplex.
• QoS priority targets congestion handling, but the main evidence is corrupted frames, not sustained output drops.

Continue with full practice

Use the CompTIA Network+ N10-010 Practice Test page for the full IT Mastery practice bank, mixed-topic practice, timed mock exams, explanations, and web/mobile app access.

Try CompTIA Network+ N10-010 on Web View CompTIA Network+ N10-010 Practice Test

Related focused pages

• Free CompTIA Network+ N10-010 Full-Length Practice Exam
• Networking Concepts
• Network Implementation
• Network Operations
• Network Security

Free review resource

Use the full IT Mastery practice page above for the latest review links and practice page.