CompTIA Network+ N10-009 (V9) Exam Practice Test

1. A network administrator wants a monitoring system to be immediately notified the instant a specific device experiences a critical event, rather than waiting for the next scheduled status check. Which SNMP mechanism supports this?

SNMP polling on a fixed interval

An SNMP trap, sent by the device to the monitoring system immediately when a defined condition occurs

A community string

A management information base (MIB) query

An SNMP trap is sent proactively by the monitored device as soon as a defined condition occurs, providing immediate notification rather than waiting for the next polling interval. Polling checks status only at intervals, a community string is an authentication mechanism, and a MIB query retrieves data on request.

Explanation

An SNMP trap is sent proactively by the monitored device as soon as a defined condition occurs, providing immediate notification rather than waiting for the next polling interval. Polling checks status only at intervals, a community string is an authentication mechanism, and a MIB query retrieves data on request.

2. Match each tool to its correct use case.

Toner

Cable tester

Wi-Fi analyzer

Visual fault locator

A toner traces unlabeled cable runs using an audible tone, a cable tester verifies wiring and continuity in copper cabling, a Wi-Fi analyzer surveys wireless channel and signal conditions, and a visual fault locator uses visible light to help locate a physical break in fiber.

Explanation

A toner traces unlabeled cable runs using an audible tone, a cable tester verifies wiring and continuity in copper cabling, a Wi-Fi analyzer surveys wireless channel and signal conditions, and a visual fault locator uses visible light to help locate a physical break in fiber.

Submit

3. A network engineer wants to see each router hop a packet passes through on its way to a destination, along with the response time at each hop, to help pinpoint where a delay occurs. Which command should be used?

Ping

Traceroute/tracert

Nslookup

Arp

traceroute (tracert on Windows) shows each hop a packet passes through, along with response time per hop, making it well suited to pinpointing where a delay occurs. ping only tests reachability to the final destination, nslookup queries DNS, and arp shows local IP-to-MAC mappings.

Explanation

traceroute (tracert on Windows) shows each hop a packet passes through, along with response time per hop, making it well suited to pinpointing where a delay occurs. ping only tests reachability to the final destination, nslookup queries DNS, and arp shows local IP-to-MAC mappings.

4. Users report that voice calls sound choppy with inconsistent gaps between words, even though the overall call connects and audio eventually arrives without being dropped. Which specific performance issue does this describe?

Packet loss, since some audio data never arrives

Jitter, since the choppy, inconsistent timing indicates variation in packet arrival times rather than data being dropped entirely

Bandwidth exhaustion, since the connection has insufficient throughput capacity

Attenuation, since the signal is weakening over distance

Jitter refers to variation in the timing of packet arrival, causing choppy, inconsistent audio even when all data eventually arrives, distinct from packet loss where data is dropped. Bandwidth exhaustion would more likely cause overall degradation or failure to connect, and attenuation is a signal-strength issue.

Explanation

Jitter refers to variation in the timing of packet arrival, causing choppy, inconsistent audio even when all data eventually arrives, distinct from packet loss where data is dropped. Bandwidth exhaustion would more likely cause overall degradation or failure to connect, and attenuation is a signal-strength issue.

5. A network experiences severe slowdowns and switch port lights blinking rapidly and continuously shortly after a new switch was added without spanning tree properly configured across all connected switches. What is the most likely cause?

Address pool exhaustion on the DHCP server

A network loop, since spanning tree was not properly configured to prevent one across the newly added switch

An incorrect subnet mask on client devices

A duplicate IP address conflict

Adding a switch without properly configured spanning tree across connected switches risks creating a network loop, where broadcast traffic circulates endlessly and severely degrades performance. DHCP exhaustion, subnet mask errors, and IP conflicts would present differently.

Explanation

Adding a switch without properly configured spanning tree across connected switches risks creating a network loop, where broadcast traffic circulates endlessly and severely degrades performance. DHCP exhaustion, subnet mask errors, and IP conflicts would present differently.

6. A switch interface shows a rapidly increasing count of CRC (cyclic redundancy check) errors, while the connected device shows no errors on its end. What should the technician suspect first?

A software application crash on the connected device

A cabling issue, such as a damaged cable, improper termination, or interference, causing frame corruption in transit

A misconfigured VLAN assignment

An exhausted DHCP address pool

CRC errors indicate frames arriving corrupted, most commonly caused by a physical layer issue such as a damaged cable, poor termination, or interference. A software crash, VLAN misconfiguration, or DHCP exhaustion would not produce frame-level corruption errors.

Explanation

CRC errors indicate frames arriving corrupted, most commonly caused by a physical layer issue such as a damaged cable, poor termination, or interference. A software crash, VLAN misconfiguration, or DHCP exhaustion would not produce frame-level corruption errors.

7. A technician has established a theory about the cause of a network outage and tested it, confirming the theory is correct. According to the standard troubleshooting methodology, what should be done next?

Immediately close the ticket without further action

Establish a plan of action to resolve the problem and identify potential effects

Go back and re-identify the problem from scratch

Escalate the issue regardless of the confirmed theory

Once a theory is confirmed, the methodology calls for establishing a plan of action to resolve the problem, including anticipating potential side effects, before implementation. Closing the ticket prematurely, restarting problem identification, or escalating despite a confirmed cause would skip necessary steps.

Explanation

Once a theory is confirmed, the methodology calls for establishing a plan of action to resolve the problem, including anticipating potential side effects, before implementation. Closing the ticket prematurely, restarting problem identification, or escalating despite a confirmed cause would skip necessary steps.

8. A security team is hardening newly deployed network switches before production use. Which two actions should be performed as part of basic device hardening?

Change all default administrative passwords

Disable unused physical ports and unnecessary services

Leave all default SNMP community strings unchanged for compatibility

Enable every available service by default in case it's needed later

Publish the management interface to the public internet for remote convenience

Changing default passwords prevents easy unauthorized access using factory credentials, and disabling unused ports and unnecessary services reduces the attack surface. Leaving default community strings unchanged, enabling all services, or exposing the management interface to the internet would increase risk.

Explanation

Changing default passwords prevents easy unauthorized access using factory credentials, and disabling unused ports and unnecessary services reduces the attack surface. Leaving default community strings unchanged, enabling all services, or exposing the management interface to the internet would increase risk.

Submit

9. Users on a local network segment report that their traffic intended for the default gateway is being silently redirected to an attacker's machine on the same local segment, without any change to DNS resolution. Which attack does this most likely describe?

DNS poisoning, since traffic redirection always involves DNS

ARP poisoning, since the attacker is manipulating local Layer 2 address mappings to redirect traffic on the same segment

A DDoS attack

VLAN hopping

ARP poisoning manipulates local ARP cache mappings between IP and MAC addresses, redirecting local Layer 2 traffic to an attacker's machine without altering DNS at all. DNS poisoning would involve altered name resolution, a DDoS attack floods resources, and VLAN hopping involves crossing VLAN boundaries.

Explanation

ARP poisoning manipulates local ARP cache mappings between IP and MAC addresses, redirecting local Layer 2 traffic to an attacker's machine without altering DNS at all. DNS poisoning would involve altered name resolution, a DDoS attack floods resources, and VLAN hopping involves crossing VLAN boundaries.

10. A user successfully logs into a network system by providing a valid username and password, but is then denied access to a specific file share because their account lacks the necessary role assignment. Which two concepts does this scenario illustrate, respectively?

Authentication (successful login), then authorization (denied based on role/permissions)

Authorization (successful login), then authentication (denied based on role/permissions)

Both steps illustrate authentication only

Both steps illustrate encryption

Authentication verifies who the user is, which succeeded with a valid username and password, while authorization determines what that verified user is allowed to access, which failed due to insufficient role-based permissions. This scenario does not involve encryption.

Explanation

Authentication verifies who the user is, which succeeded with a valid username and password, while authorization determines what that verified user is allowed to access, which failed due to insufficient role-based permissions. This scenario does not involve encryption.

11. A network engineer wants to be able to access and troubleshoot a router's console even if the router's primary network interface and routing table are completely down. Which management approach supports this?

In-band management, using the same network path as production traffic

Out-of-band management, using a separate dedicated management network or connection independent of production traffic

A GUI-based management tool accessed over the production network

An API integration relying on the production network's routing

Out-of-band management uses a separate, dedicated path, such as a console cable or dedicated management network, that remains accessible even if the primary interface or routing table fails. In-band management, a GUI tool, or an API relying on the production network would all be unreachable if that path is down.

Explanation

Out-of-band management uses a separate, dedicated path, such as a console cable or dedicated management network, that remains accessible even if the primary interface or routing table fails. In-band management, a GUI tool, or an API relying on the production network would all be unreachable if that path is down.

12. A company needs a DNS record that resolves its mail server's hostname to an IPv6 address, and a separate record that lets external servers know which server accepts mail for the domain. Which two record types are needed?

AAAA, for resolving the hostname to an IPv6 address

MX, for identifying the mail server that accepts mail for the domain

CNAME, for the IPv6 resolution

PTR, for identifying the mail server

TXT, for the IPv6 resolution

An AAAA record resolves a hostname to an IPv6 address, and an MX record identifies which mail server accepts mail for a domain. CNAME is used for aliasing, PTR is used for reverse lookups, and TXT records serve various text-based purposes but don't identify a mail server.

Explanation

An AAAA record resolves a hostname to an IPv6 address, and an MX record identifies which mail server accepts mail for a domain. CNAME is used for aliasing, PTR is used for reverse lookups, and TXT records serve various text-based purposes but don't identify a mail server.

Submit

13. A company's disaster recovery plan states that after a major outage, the business can tolerate losing up to 4 hours of data, and must have systems restored and operational within 8 hours. Which two DR metrics does this describe, respectively?

RTO of 4 hours, and RPO of 8 hours

RPO of 4 hours, and RTO of 8 hours

MTBF of 4 hours, and MTTR of 8 hours

Both values describe the same metric, RTO

RPO defines the maximum acceptable data loss, matching the 4-hour tolerance, while RTO defines the maximum acceptable time to restore systems, matching the 8-hour target. MTBF and MTTR describe failure frequency and repair time for ongoing operations, not disaster recovery targets.

Explanation

RPO defines the maximum acceptable data loss, matching the 4-hour tolerance, while RTO defines the maximum acceptable time to restore systems, matching the 8-hour target. MTBF and MTTR describe failure frequency and repair time for ongoing operations, not disaster recovery targets.

14. A network engineer is troubleshooting a problem where packets are being correctly formatted at the physical level but are not being routed to the correct destination network. Which OSI layer is most directly responsible for this function?

Layer 1 (Physical)

Layer 2 (Data Link)

Layer 3 (Network)

Layer 4 (Transport)

Layer 3, the Network layer, is responsible for logical addressing and routing packets between different networks. Layer 1 handles physical transmission, Layer 2 handles local addressing and framing, and Layer 4 handles end-to-end transport and segmentation.

Explanation

Layer 3, the Network layer, is responsible for logical addressing and routing packets between different networks. Layer 1 handles physical transmission, Layer 2 handles local addressing and framing, and Layer 4 handles end-to-end transport and segmentation.

15. A vendor announces that a switch model will no longer receive security patches or technical support, though existing units will continue to function. What does this announcement represent?

End-of-life (EOL), meaning the product is no longer manufactured or sold

End-of-support (EOS), meaning the vendor no longer provides patches or technical support for the product

Decommissioning, meaning the device has been physically removed from service

A baseline configuration change

End-of-support (EOS) specifically refers to a vendor no longer providing patches, updates, or technical support, even though the product may still be sold or in active use. End-of-life (EOL) refers to the product no longer being manufactured or sold, and decommissioning refers to physically removing a device from service.

Explanation

End-of-support (EOS) specifically refers to a vendor no longer providing patches, updates, or technical support, even though the product may still be sold or in active use. End-of-life (EOL) refers to the product no longer being manufactured or sold, and decommissioning refers to physically removing a device from service.

16. A data center is standardizing on a hot aisle/cold aisle layout, and all new equipment must be ordered with airflow that pulls cool air from the front and exhausts hot air out the back. What should be specified when ordering switches for this rack?

Port-side exhaust airflow (front-to-back), matching the hot aisle/cold aisle design

Port-side intake airflow (back-to-front), reversing the standard direction

Any airflow direction, since rack orientation does not affect cooling

A device with no fans at all

In a standard hot aisle/cold aisle layout, equipment should intake cool air from the front and exhaust hot air out the back, so port-side exhaust airflow matching this pattern should be specified. Reversed or inconsistent airflow direction disrupts the cooling design and can cause overheating.

Explanation

In a standard hot aisle/cold aisle layout, equipment should intake cool air from the front and exhaust hot air out the back, so port-side exhaust airflow matching this pattern should be specified. Reversed or inconsistent airflow direction disrupts the cooling design and can cause overheating.

17. A network engineer is deploying access points in the 5GHz band in a region with certain radar-related regulatory restrictions. Which requirement governs how the AP must behave when radar signals are detected on a channel?

WPA3 encryption

802.11h, which requires dynamic frequency selection and transmit power control on affected channels

Band steering

Captive portal authentication

802.11h defines requirements including dynamic frequency selection and transmit power control, allowing access points to avoid interfering with radar systems sharing certain 5GHz channels. WPA3, band steering, and captive portals address encryption, client distribution, and guest authentication, not radar coexistence.

Explanation

802.11h defines requirements including dynamic frequency selection and transmit power control, allowing access points to avoid interfering with radar systems sharing certain 5GHz channels. WPA3, band steering, and captive portals address encryption, client distribution, and guest authentication, not radar coexistence.

18. A network engineer is configuring a trunk link between two switches that must carry traffic for multiple VLANs. Which two configurations are necessary?

Enable 802.1Q tagging on the trunk port

Ensure both switches agree on which VLAN is the native VLAN

Assign the port to a single access VLAN only

Disable spanning tree on the trunk port entirely

Set the port to half duplex

802.1Q tagging allows a single physical link to carry traffic for multiple VLANs, and both switches must agree on the native (untagged) VLAN to avoid mismatch issues. A single access VLAN would defeat the trunk's purpose, disabling spanning tree risks loops, and half duplex would degrade performance.

Explanation

802.1Q tagging allows a single physical link to carry traffic for multiple VLANs, and both switches must agree on the native (untagged) VLAN to avoid mismatch issues. A single access VLAN would defeat the trunk's purpose, disabling spanning tree risks loops, and half duplex would degrade performance.

Submit

19. A small office has only one public IP address but needs to allow dozens of internal devices to access the internet simultaneously, each tracked using a different source port. Which technology enables this?

Static NAT (one-to-one)

PAT (Port Address Translation), also called NAT overload

A First Hop Redundancy Protocol (FHRP)

A Virtual IP (VIP)

PAT, also called NAT overload, allows many internal devices to share a single public IP address by tracking each device's connections using unique source port numbers. Static NAT maps one private address to one public address, and FHRP/VIP address gateway redundancy, not address sharing.

Explanation

PAT, also called NAT overload, allows many internal devices to share a single public IP address by tracking each device's connections using unique source port numbers. Static NAT maps one private address to one public address, and FHRP/VIP address gateway redundancy, not address sharing.

20. A router has learned a route to the same destination network via both OSPF and a static route. By default, which route will the router prefer, and why?

The OSPF route, because dynamic routing protocols are always preferred over static routes

The static route, because static routes typically have a lower (more preferred) administrative distance than OSPF by default

Both routes will be used simultaneously with no preference

The route with the higher metric will always be chosen

Administrative distance determines route preference when multiple sources provide a route to the same destination, and static routes typically have a lower, more trusted administrative distance than OSPF by default. A route is chosen based on the lowest administrative distance, not automatically favoring dynamic protocols.

Explanation

Administrative distance determines route preference when multiple sources provide a route to the same destination, and static routes typically have a lower, more trusted administrative distance than OSPF by default. A route is chosen based on the lowest administrative distance, not automatically favoring dynamic protocols.

21. A technician sees a device configured with the IP address 172.16.5.10. Based on RFC 1918, what does this indicate?

This is a public IP address routable on the internet

This is a private IP address, since 172.16.0.0 through 172.31.255.255 is reserved for private use

This is a loopback address

This is an APIPA address

RFC 1918 reserves the range 172.16.0.0 through 172.31.255.255 for private use, so this address falls within a private, non-routable range. It is not a loopback address (127.0.0.0/8) or an APIPA address (169.254.0.0/16).

Explanation

RFC 1918 reserves the range 172.16.0.0 through 172.31.255.255 for private use, so this address falls within a private, non-routable range. It is not a loopback address (127.0.0.0/8) or an APIPA address (169.254.0.0/16).

22. A data center needs to connect two switches 300 meters apart using fiber optic cabling with SFP transceivers. Which fiber type is appropriate for this distance?

Multimode fiber, which is typically limited to shorter distances due to modal dispersion

Single-mode fiber, using a laser light source suited to longer distances

Coaxial cable with a BNC connector

Direct attach copper (DAC) cable

Single-mode fiber uses a laser light source and a narrow core, supporting much longer distances such as 300 meters without significant signal loss, unlike multimode fiber. Coaxial and DAC cables are copper-based and not suited to this distance.

Explanation

Single-mode fiber uses a laser light source and a narrow core, supporting much longer distances such as 300 meters without significant signal loss, unlike multimode fiber. Coaxial and DAC cables are copper-based and not suited to this distance.

23. Match each protocol to its correct port number.

DNS

SMTP

HTTPS

RDP

DNS uses port 53 for name resolution, SMTP uses port 25 for outgoing mail, HTTPS uses port 443 for secure web traffic, and RDP uses port 3389 for remote desktop sessions.

Explanation

DNS uses port 53 for name resolution, SMTP uses port 25 for outgoing mail, HTTPS uses port 443 for secure web traffic, and RDP uses port 3389 for remote desktop sessions.

Submit

24. A company hosts virtual machines in a public cloud provider and wants to logically isolate its own resources from other tenants while maintaining private internal addressing. Which cloud concept provides this?

Content delivery network (CDN)

Virtual private cloud (VPC)

Network functions virtualization (NFV)

Multitenancy

A VPC provides a logically isolated section of a public cloud provider's infrastructure, with its own private addressing space, separate from other tenants. A CDN caches content, NFV virtualizes network functions, and multitenancy describes the shared-infrastructure model a VPC protects against.

Explanation

A VPC provides a logically isolated section of a public cloud provider's infrastructure, with its own private addressing space, separate from other tenants. A CDN caches content, NFV virtualizes network functions, and multitenancy describes the shared-infrastructure model a VPC protects against.

25. A company wants a device that can automatically block malicious traffic in real time as it's detected, rather than simply alerting administrators after the fact. Which device should be deployed?

IDS (Intrusion Detection System)

IPS (Intrusion Prevention System)

A passive network tap

A content delivery network (CDN)

An IPS sits inline and can actively block malicious traffic in real time as it's detected, while an IDS only monitors and alerts without taking direct action. A passive tap only copies traffic for monitoring, and a CDN caches content.

Explanation

An IPS sits inline and can actively block malicious traffic in real time as it's detected, while an IDS only monitors and alerts without taking direct action. A passive tap only copies traffic for monitoring, and a CDN caches content.

CompTIA Network+ N10-009 (V9) Exam Practice Test 1

1. A network administrator wants a monitoring system to be immediately notified the instant a specific device experiences a critical event, rather than waiting for the next scheduled status check. Which SNMP mechanism supports this?

2.

What first name or nickname would you like us to use?

2. Match each tool to its correct use case.

3. A network engineer wants to see each router hop a packet passes through on its way to a destination, along with the response time at each hop, to help pinpoint where a delay occurs. Which command should be used?

4. Users report that voice calls sound choppy with inconsistent gaps between words, even though the overall call connects and audio eventually arrives without being dropped. Which specific performance issue does this describe?

5. A network experiences severe slowdowns and switch port lights blinking rapidly and continuously shortly after a new switch was added without spanning tree properly configured across all connected switches. What is the most likely cause?

6. A switch interface shows a rapidly increasing count of CRC (cyclic redundancy check) errors, while the connected device shows no errors on its end. What should the technician suspect first?

7. A technician has established a theory about the cause of a network outage and tested it, confirming the theory is correct. According to the standard troubleshooting methodology, what should be done next?

8. A security team is hardening newly deployed network switches before production use. Which two actions should be performed as part of basic device hardening?

9. Users on a local network segment report that their traffic intended for the default gateway is being silently redirected to an attacker's machine on the same local segment, without any change to DNS resolution. Which attack does this most likely describe?

10. A user successfully logs into a network system by providing a valid username and password, but is then denied access to a specific file share because their account lacks the necessary role assignment. Which two concepts does this scenario illustrate, respectively?

11. A network engineer wants to be able to access and troubleshoot a router's console even if the router's primary network interface and routing table are completely down. Which management approach supports this?

12. A company needs a DNS record that resolves its mail server's hostname to an IPv6 address, and a separate record that lets external servers know which server accepts mail for the domain. Which two record types are needed?

13. A company's disaster recovery plan states that after a major outage, the business can tolerate losing up to 4 hours of data, and must have systems restored and operational within 8 hours. Which two DR metrics does this describe, respectively?

14. A network engineer is troubleshooting a problem where packets are being correctly formatted at the physical level but are not being routed to the correct destination network. Which OSI layer is most directly responsible for this function?

15. A vendor announces that a switch model will no longer receive security patches or technical support, though existing units will continue to function. What does this announcement represent?

16. A data center is standardizing on a hot aisle/cold aisle layout, and all new equipment must be ordered with airflow that pulls cool air from the front and exhausts hot air out the back. What should be specified when ordering switches for this rack?

17. A network engineer is deploying access points in the 5GHz band in a region with certain radar-related regulatory restrictions. Which requirement governs how the AP must behave when radar signals are detected on a channel?

18. A network engineer is configuring a trunk link between two switches that must carry traffic for multiple VLANs. Which two configurations are necessary?

19. A small office has only one public IP address but needs to allow dozens of internal devices to access the internet simultaneously, each tracked using a different source port. Which technology enables this?

20. A router has learned a route to the same destination network via both OSPF and a static route. By default, which route will the router prefer, and why?

21. A technician sees a device configured with the IP address 172.16.5.10. Based on RFC 1918, what does this indicate?

22. A data center needs to connect two switches 300 meters apart using fiber optic cabling with SFP transceivers. Which fiber type is appropriate for this distance?

23. Match each protocol to its correct port number.

24. A company hosts virtual machines in a public cloud provider and wants to logically isolate its own resources from other tenants while maintaining private internal addressing. Which cloud concept provides this?

25. A company wants a device that can automatically block malicious traffic in real time as it's detected, rather than simply alerting administrators after the fact. Which device should be deployed?