Network+ Practice Test: 68 Questions With Memory Hooks
What this is
68 questions written from StashGrid’s own hands-on lessons, covering all five Network+ exam domains. The table below shows how much each domain counts on the real exam, so you know where to spend your study time. Click an answer to see right away whether you got it, why, a memory hook to make it stick, and the lesson that teaches it. At the end you get a score per domain and a list of lessons to review.
What the exam tests
| Network+ N10-009 domain | Share of the exam | Questions here |
|---|---|---|
| 1.0 Networking Concepts | 23% | 13 |
| 2.0 Network Implementation | 20% | 9 |
| 3.0 Network Operations | 19% | 10 |
| 4.0 Network Security | 14% | 18 |
| 5.0 Network Troubleshooting | 24% | 18 |
The real exam has up to 90 questions in 90 minutes, including performance-based tasks, and passes at 720 on a 100–900 scale. Our questions are multiple choice and built only from what our labs teach, so treat this as a check on the hands-on side, not a full mock exam. StashGrid isn’t affiliated with CompTIA. Domain names and weights are from the N10-009 exam objectives.
I wrote the wrong answers. Some of them are very convincing. You’re welcome. — Nyx
-
Domain 1Q1. A Windows PC shows the address 169.254.20.7. What does that most likely mean?
The answer is B. 169.254.x.x is an automatic private (APIPA) address: the PC asked for DHCP, got no answer, and assigned itself one. It can only talk to its own segment.
Remember it: 169.254 means “no DHCP, no luck”: the PC is only talking to its own segment.
Learn it: DHCP explained
-
Domain 1Q2. How many usable host addresses are in a /24 network?
The answer is C. A /24 has 256 addresses. The first is the network address and the last is broadcast, leaving 254 for hosts.
Remember it: Two addresses are always taken: the network’s name and its megaphone (broadcast). 256 − 2 = 254.
Learn it: Subnetting and DHCP
-
Domain 1Q3. Which protocol finds the MAC address that belongs to an IPv4 address on the local network?
The answer is B. ARP broadcasts “who has this IP?” and the owner replies with its MAC. It only works inside one network.
Remember it: ARP shouts “Who has this IP? Raise your MAC!”
Learn it: ARP lab
-
Domain 1Q4. Which port does DNS use by default?
The answer is A. DNS uses port 53, over UDP for most lookups and TCP for large answers and zone transfers.
Remember it: DNS is the internet’s phone book, and it lives on line 53.
Learn it: Common ports cheat sheet
-
Domain 1Q5. What is the order of the TCP three-way handshake?
The answer is C. The client sends SYN, the server answers SYN-ACK, and the client confirms with ACK. Only then does data flow.
Remember it: Hi. / Hi, I hear you. / Great, let’s talk. That’s SYN, SYN-ACK, ACK.
Learn it: TCP vs UDP
-
Domain 1Q6. A name resolves to the wrong IP on one PC only, while dig against your DNS server returns the right one. What should you check first?
The answer is B. The hosts file is read before DNS, so one stale or malicious line overrides the DNS answer for that machine only.
Remember it: The hosts file is the sticky note on your monitor: read before the phone book (DNS).
Learn it: The hosts file
-
Domain 1Q7. An IPv6 address starting with fe80:: is what kind of address?
The answer is D. fe80::/10 is link-local: every IPv6 interface has one, and it only works on the local link.
Remember it: fe80 is the “family-only” address: it never leaves the local link.
Learn it: IPv6 explained
-
Domain 2Q8. What does an 802.1Q tag add to an Ethernet frame?
The answer is A. 802.1Q inserts a tag carrying the VLAN ID, so one trunk link can carry several VLANs.
Remember it: 802.1Q puts a name tag (the VLAN ID) on every frame crossing a trunk.
Learn it: VLANs and 802.1Q
-
Domain 2Q9. Two PCs are on the same switch but in different VLANs. What do they need to talk to each other?
The answer is B. VLANs are separate networks. Traffic between them has to be routed, by a router or a layer 3 switch.
Remember it: Different VLANs are different houses. You need a road between them: a router.
Learn it: VLANs and 802.1Q
-
Domain 2Q10. A host sends a packet to an address that matches no specific route. Where does it go?
The answer is C. The default route (0.0.0.0/0) catches everything without a more specific match, and sends it to the default gateway.
Remember it: If in doubt, ask the gateway. That’s the default route.
Learn it: Routing basics
-
Domain 2Q11. What does NAT masquerading let a home network do?
The answer is B. Masquerading rewrites the source address of outgoing traffic to the router’s public address and tracks each connection so replies find their way back.
Remember it: Masquerade: everyone wears the router’s mask (its public IP) to go out.
Learn it: NAT and firewalls
-
Domain 2Q12. In WireGuard, which setting decides which traffic a peer will send and accept through the tunnel?
The answer is C. AllowedIPs works as both a routing table and an access list: traffic to those addresses goes into the tunnel, and only packets from them are accepted from that peer.
Remember it: AllowedIPs is a guest list that works both ways: who goes into the tunnel, who’s let out.
Learn it: WireGuard VPN
-
Domain 2Q13. Which device forwards traffic between different IP networks?
The answer is C. Routers work at layer 3 and forward packets between networks using their routing table.
Remember it: Routers route between networks; switches switch inside one.
Learn it: Routing basics
-
Domain 3Q14. Which SNMP version sends its community string in plain text?
The answer is B. SNMPv1 and v2c send the community string, effectively a password, unencrypted. SNMPv3 adds authentication and encryption.
Remember it: v2c = “version 2, community in clear.” v3 is the locked one.
Learn it: Syslog and SNMP
-
Domain 3Q15. What is the default port for syslog over UDP?
The answer is B. Classic syslog uses UDP 514. (SNMP uses 161, LDAP 389, SSH 22.)
Remember it: Syslog listens at the door marked 514.
Learn it: Syslog and SNMP
-
Domain 3Q16. What is jitter?
The answer is B. Jitter is how much latency varies between packets. Voice and video suffer from it even when average latency is fine.
Remember it: Jitter is jittery delay: not how long, but how wobbly.
Learn it: Latency, jitter and packet loss
-
Domain 3Q17. Which tool combines traceroute and ping to show loss and latency at every hop, continuously?
The answer is B. mtr keeps probing each hop and shows loss and latency per hop, which makes it good for spotting where a path degrades.
Remember it: mtr is traceroute that never stops pinging.
Learn it: Latency, jitter and packet loss
-
Domain 3Q18. What does iperf3 measure?
The answer is B. iperf3 runs a client and a server and measures how much data actually gets through between them.
Remember it: iperf measures how much data really gets through, like a speed test between two of your own machines.
Learn it: Latency, jitter and packet loss
-
Domain 3Q19. Syslog severity 0 means:
The answer is D. Syslog severities run from 0 (Emergency) to 7 (Debug). Lower numbers are more serious.
Remember it: Lower number, bigger fire. Every Alley Cat Eats Watermelon Nicely In Daylight: Emergency, Alert, Critical, Error, Warning, Notice, Informational, Debug.
Learn it: Syslog and SNMP
-
Domain 3Q20. A monitoring system polls a switch for interface counters such as ifInOctets. Which protocol is it most likely using?
The answer is A. SNMP reads values by OID from a device’s MIB. ifInOctets counts bytes received on an interface.
Remember it: SNMP reads the gauges on a network device’s dashboard, one OID per gauge.
Learn it: Syslog and SNMP
-
Domain 4Q21. Which statement about NAT is true?
The answer is B. NAT changes addresses. Filtering is a firewall’s job: a stateful firewall policy is what actually decides what’s allowed.
Remember it: NAT changes the return address on the envelope. It doesn’t check anyone’s ID.
Learn it: NAT and firewalls
-
Domain 4Q22. What does DNSSEC protect?
The answer is B. DNSSEC signs DNS records so a resolver can verify they are genuine. It does not encrypt or hide what you look up.
Remember it: DNSSEC is a wax seal, not an envelope: it proves the answer is genuine but doesn’t hide it.
Learn it: DNSSEC explained
-
Domain 4Q23. Which switch feature defends against ARP spoofing?
The answer is B. Dynamic ARP Inspection checks ARP replies against a trusted table (often built by DHCP snooping) and drops forged ones.
Remember it: Dynamic ARP Inspection is the doorman who checks every “that’s me!” against the guest list.
Learn it: ARP lab
-
Domain 4Q24. How does putting devices into separate VLANs improve security?
The answer is B. Segmentation keeps groups apart at layer 2, so traffic between them must pass a point where rules can be enforced.
Remember it: VLANs are rooms with doors; the firewall is the doorman between them.
Learn it: VLANs and 802.1Q
-
Domain 5Q25. What is the first step of the CompTIA troubleshooting method?
The answer is B. Identify the problem: gather information, question the user, find what changed and reproduce it, before you theorise.
Remember it: Find it before you fix it: Identify first.
Learn it: Troubleshooting capstone
-
Domain 5Q26. You have implemented a fix. What is the next step in the method?
The answer is C. Verify everything works (not just the one symptom) and prevent a repeat. Documenting comes last.
Remember it: Fix it, prove it, prevent it. Paperwork last.
Learn it: Troubleshooting capstone
-
Domain 5Q27. A website loads by IP address but not by its name. What is the most likely cause?
The answer is B. Works by IP, fails by name means name resolution: check the DNS server setting, then query the server directly.
Remember it: Works by number, fails by name: blame the name service (DNS).
Learn it: Troubleshooting capstone
-
Domain 5Q28. Ping to a server works, but a TCP connection to port 80 times out instead of being refused. What does that suggest?
The answer is C. Refused means the host answered “closed.” A timeout means something swallowed the packets: a filtering firewall.
Remember it: Refused means someone said no. A timeout means nobody answered: a firewall ate it.
Learn it: Troubleshooting capstone
-
Domain 5Q29. A user can ping the default gateway but cannot reach anything on other networks. Their configured gateway is .254, but the real router is .1. What should you fix?
The answer is B. Local traffic works, remote traffic doesn’t, and the gateway address is wrong: correct the default gateway.
Remember it: Local yes, remote no: you’re using the wrong door out (the gateway).
Learn it: Troubleshooting capstone
-
Domain 5Q30. One ARP request for a single IP gets two replies with different MAC addresses. What is the problem?
The answer is B. Two devices claim the same IP. Traffic goes to whichever answer the cache keeps, which causes “it works sometimes” problems.
Remember it: Two people answering to one name: a duplicate IP.
Learn it: ARP lab
-
Domain 5Q31. Which tool shows where along the path packets stop getting through?
The answer is B. Traceroute lists each hop until the trail stops, which shows roughly where the break is.
Remember it: Traceroute drops breadcrumbs. Follow them until they stop.
Learn it: Traceroute (tracert)
-
Domain 2Q32. Which 2.4 GHz Wi-Fi channels do not overlap with each other in the US?
The answer is B. 2.4 GHz channels are about 20 MHz wide but only 5 MHz apart, so only 1, 6 and 11 stay clear of each other.
Remember it: 1, 6, 11: the only three 2.4 GHz channels that don’t step on each other’s toes.
Learn it: Wi-Fi standards and channels explained
-
Domain 2Q33. Which Wi-Fi security mode gives each user their own sign-in through a RADIUS server?
The answer is C. Enterprise mode uses 802.1X: each user authenticates through RADIUS, so access can be revoked per person.
Remember it: Enterprise Wi-Fi gives everyone their own key card (802.1X and RADIUS).
Learn it: Wi-Fi standards and channels explained
-
Domain 2Q34. What does Wi-Fi 6E add compared with Wi-Fi 6?
The answer is A. Wi-Fi 6E is 802.11ax extended into the 6 GHz band, which is wide open but only newer devices can use.
Remember it: 6E = 6 GHz, Extended.
Learn it: Wi-Fi standards and channels explained
-
Domain 1Q35. Which copper cable category supports 10 Gbps over the full 100 metres?
The answer is C. Cat6a carries 10 Gbps to 100 m. Cat6 manages 10 Gbps only up to about 55 m.
Remember it: Cat6a: the “a” is for “all the way”, 10 Gbps for the full 100 m.
Learn it: Cabling and connectors explained
-
Domain 1Q36. You need to link two buildings 5 km apart. Which cable fits?
The answer is C. Single-mode fiber with a laser source covers kilometres; multimode is for hundreds of metres.
Remember it: Single-mode is a single-lane highway that runs for kilometres.
Learn it: Cabling and connectors explained
-
Domain 1Q37. How much power can a PoE+ (802.3at) switch port supply?
The answer is C. 802.3af PoE gives 15.4 W, 802.3at PoE+ gives 30 W, and 802.3bt goes up to 60 or 90 W.
Remember it: af 15, at 30, bt 60–90: each new letter roughly doubles the power.
Learn it: Cabling and connectors explained
-
Domain 5Q38. Which tool helps you find which cable in an unlabelled bundle goes to a particular wall jack?
The answer is B. Clip the toner on at one end and run the probe along the bundle until it beeps.
Remember it: The toner sings, the probe listens.
Learn it: Cabling and connectors explained
-
Domain 1Q39. In a cloud network, which filter is stateless and applies to a whole subnet?
The answer is B. Network ACLs are stateless and subnet-wide, so return traffic must be allowed explicitly. Security groups are stateful and per instance.
Remember it: A network ACL never remembers a conversation, so you must allow the replies yourself.
Learn it: Cloud networking and SDN explained
-
Domain 1Q40. In software-defined networking, which plane decides where traffic should go, centrally on a controller?
The answer is B. SDN moves the control plane (the decisions) to a central controller; devices keep the data plane (moving packets).
Remember it: Control plane is the brain; data plane is the muscle.
Learn it: Cloud networking and SDN explained
-
Domain 1Q41. VXLAN carries layer 2 traffic inside which protocol and port by default?
The answer is B. VXLAN wraps Ethernet frames in UDP, port 4789, with a 24-bit ID that allows about 16 million segments.
Remember it: VXLAN is a VLAN eXtended over UDP, port 4789.
Learn it: Cloud networking and SDN explained
-
Domain 3Q42. What does RPO (recovery point objective) measure?
The answer is C. RPO is the data-loss limit (for example one hour of orders), which sets how often you must back up. RTO is how long you can be down.
Remember it: RPO: the Point you roll back to (how much data you lose). RTO: the Time until you’re back Online.
Learn it: High availability, DR and documentation
-
Domain 3Q43. Restoring requires the last full backup plus every backup taken since. Which backup type is in use?
The answer is B. Incrementals hold changes since the last backup of any type, so you need the full plus each incremental in order.
Remember it: Incremental is a chain: lose one link and the restore breaks.
Learn it: High availability, DR and documentation
-
Domain 3Q44. What does VRRP provide?
The answer is B. VRRP (and Cisco HSRP) let routers share a virtual IP and MAC, so the default gateway survives a router failure.
Remember it: VRRP: a Virtual Router that never dies, because a spare steps into its shoes.
Learn it: High availability, DR and documentation
-
Domain 4Q45. In AAA, which A records what a user actually did, such as every command they typed?
The answer is C. Accounting keeps the record of activity. Authentication proves who you are; authorization decides what you may do.
Remember it: “Who are you? What can you do? What did you do?” The last question is Accounting.
Learn it: Network security explained
-
Domain 4Q46. In 802.1X, what role does the switch or Wi-Fi access point play?
The answer is B. The supplicant (laptop) asks, the authenticator (switch or AP) holds the port closed, and the authentication server (usually RADIUS) decides.
Remember it: A nightclub: the guest is the supplicant, the bouncer is the authenticator, the manager with the list is the RADIUS server.
Learn it: Network security explained
-
Domain 4Q47. Which AAA protocol uses TCP port 49 and encrypts the entire conversation?
The answer is B. TACACS+ runs over TCP 49 and encrypts the whole payload, which suits admin logins to network devices. RADIUS uses UDP and encrypts only the password.
Remember it: TACACS+ = TCP + Total encryption.
Learn it: Network security explained
-
Domain 4Q48. An attacker floods a switch with thousands of fake source MAC addresses. What is the likely result, and the fix?
The answer is B. A full MAC table makes the switch send frames everywhere, like a hub, so the attacker can capture them. Port security limits how many MACs a port may learn.
Remember it: Overflow the address book and the switch starts shouting to everyone.
Learn it: Network security explained
-
Domain 4Q49. Users suddenly get the wrong default gateway from DHCP. Which switch feature prevents this attack?
The answer is B. DHCP snooping lets only trusted ports (where the real DHCP server lives) send DHCP offers, so a rogue server can’t hand out addresses.
Remember it: Same first word: a DHCP attack is stopped by DHCP snooping.
Learn it: Network security explained
-
Domain 4Q50. Which step helps prevent VLAN hopping by double tagging?
The answer is B. Double tagging relies on the native VLAN. Changing it away from VLAN 1 (and turning off trunk auto-negotiation) closes the gap.
Remember it: Hoppers need a step: the native VLAN is the step, so move it.
Learn it: Network security explained
-
Domain 4Q51. A fake access point broadcasts the same network name as the office Wi-Fi. What is this called?
The answer is A. An evil twin copies a legitimate SSID to lure devices. 802.1X Enterprise Wi-Fi with server certificate checks makes it far harder.
Remember it: Same name, different heart: an evil twin.
Learn it: Network security explained
-
Domain 4Q52. Which protocol should replace Telnet for managing switches and routers?
The answer is C. Telnet (port 23) sends everything, including passwords, in plain text. SSH (port 22) encrypts the session.
Remember it: Telnet tells everyone; SSH keeps a secret.
Learn it: Network security explained
-
Domain 4Q53. What is the core idea of zero trust?
The answer is B. Zero trust removes automatic trust for being “inside”: identity, device and context are checked on every request.
Remember it: The key card is checked at every door, not just the front one.
Learn it: Network security explained
-
Domain 4Q54. Where should a company place its public web server?
The answer is B. A screened subnet sits between the internet and the internal network, so a compromised public server doesn’t sit next to internal systems.
Remember it: The hotel lobby: visitors get in, but not up to the rooms.
Learn it: Network security explained
-
Domain 4Q55. Which IPsec protocol provides encryption?
The answer is B. ESP (Encapsulating Security Payload) encrypts and authenticates. AH only authenticates; it gives no confidentiality.
Remember it: ESP = Encryption. AH = Authentication only.
Learn it: Network security explained
-
Domain 4Q56. A visitor follows an employee through a secure door without badging in. Which control stops this?
The answer is B. An access control vestibule has two doors where only one can open at a time, so tailgating gets stuck in the middle.
Remember it: It’s an airlock: one door shuts before the next opens.
Learn it: Network security explained
-
Domain 4Q57. Hashing a file and comparing the hash later protects which part of the CIA triad?
The answer is B. A matching hash proves the data hasn’t changed. Hashing doesn’t hide anything, so it isn’t confidentiality.
Remember it: Can’t read it (C), Isn’t changed (I), Always there (A). A hash checks the I.
Learn it: Network security explained
-
Domain 4Q58. Which switch feature stops a rogue switch from claiming to be the spanning tree root bridge on a user port?
The answer is A. BPDU guard shuts down an access port that receives spanning tree BPDUs, which a normal PC never sends.
Remember it: Same first word again: a BPDU trick is stopped by BPDU guard.
Learn it: Network security explained
-
Domain 5Q59. File copies to one server are slow, and the switch shows a climbing count of CRC errors on that server’s port. What is the most likely cause?
The answer is B. CRC errors mean frames arrived damaged. That is almost always physical: a kinked or badly crimped cable, a bad patch lead, or electrical interference. Swap the cable before touching settings.
Remember it: CRC errors mean the cable is mumbling. Swap it first.
Learn it: Cabling and connectors explained
-
Domain 5Q60. One side of a link reports full duplex, the other half duplex, and the switch logs late collisions. What is the problem?
The answer is A. When one end talks over the other, the half-duplex side sees collisions late in the frame. Set both ends to auto-negotiate (or both to the same fixed speed and duplex).
Remember it: Late collisions: someone is talking over the other side. That’s a duplex mismatch.
Learn it: Cabling and connectors explained
-
Domain 5Q61. Laptops on 2.4 GHz Wi-Fi drop every time the break-room microwave runs. What is the best fix?
The answer is B. Microwave ovens leak noise right in the 2.4 GHz band. 5 GHz avoids it (and has more non-overlapping channels).
Remember it: Microwaves cook 2.4 GHz. Move to 5.
Learn it: Wi-Fi standards and channels explained
-
Domain 5Q62. Existing PCs work fine, but every new device that joins the network gets no address. What is the most likely cause?
The answer is A. Devices that already hold leases keep working; newcomers can’t get one. Check the scope’s free addresses, shorten lease times or widen the scope.
Remember it: Old guests keep their seats; new guests find the room full: scope exhaustion.
Learn it: DHCP explained
-
Domain 5Q63. A PC moved to a different wall jack has a link light but can’t reach anything, while other PCs on that floor are fine. What should you check first?
The answer is B. A link light only proves layer 1. If the new port sits in a different VLAN, the PC lands in the wrong network and can’t reach its gateway.
Remember it: Link light on, nothing works after a move? Check the port’s VLAN.
Learn it: VLANs and 802.1Q
-
Domain 5Q64. Over a VPN, small pings work but large file transfers stall. Which issue does this point to?
The answer is A. Tunnels add headers, so full-size packets no longer fit. Test with a do-not-fragment ping (Windows:
ping -f -l 1400 host) and lower the tunnel MTU until big packets pass.Remember it: Small gets through, big gets stuck: it’s the MTU.
Learn it: WireGuard VPN
-
Domain 5Q65. Which Windows command tests whether a TCP port on a remote server is reachable?
The answer is B. Test-NetConnection tries a real TCP connection and reports TcpTestSucceeded True or False, which separates “port blocked” from “host down”.
Remember it: Ping asks “are you there?” Test-NetConnection asks “is that door open?”
Learn it: Common ports cheat sheet
-
Domain 5Q66. A traceroute shows the same two routers repeating, back and forth, until it gives up. What does this indicate?
The answer is A. Each router thinks the other is the way to the destination, so packets bounce until their TTL runs out. Fix the route tables (often a bad static route).
Remember it: Ping-pong in a traceroute is a routing loop.
Learn it: Routing basics
-
Domain 5Q67. Right after someone plugs both ends of a patch cable into the same switch, the whole network crawls and the port lights flash nonstop. What happened, and what normally prevents it?
The answer is B. A loop lets broadcasts circle forever and multiply. Spanning Tree (STP) blocks redundant paths so a loop can’t form. Unplug the cable, then check STP is enabled.
Remember it: A cable in a circle makes a storm. STP is the umbrella.
Learn it: VLANs and 802.1Q
-
Domain 5Q68. You tested your theory and confirmed the cause. What is the next step in the CompTIA troubleshooting method?
The answer is C. The order is: identify, theory, test the theory, plan of action (and its side effects), implement, verify, document.
Remember it: Confirmed it? Plan before you touch it.
Learn it: Troubleshooting capstone
Keep studying
- Network+ roadmap — every hands-on lesson in order
- Troubleshooting capstone — Domain 5 on real broken networks
- Common ports cheat sheet and networking glossary
Questions written by StashGrid with AI help, from our own tested lessons, and checked against them before publishing. Spotted an error? Tell us and we’ll fix it.