N10-009 CompTIA Network+ Certification Exam Topics and Questions

At just under a quarter of the exam, this topic rewards breadth over depth. You need working recognition of the OSI model, the common appliances and services that move traffic, and the addressing and media choices that define how data travels. The cost comes from mixing up similar-sounding terms or confusing which protocol runs on which port.

– Models, appliances and cloud infrastructure

The OSI model questions test whether you can match a technology or symptom to its layer. Physical and data link issues look like cable faults or switch behaviour; network layer is IP and routing; transport is TCP and UDP; session, presentation and application collapse into protocol and service recognition. You will not recite the layers in order, but you will need to know where a given problem lives.

Networking appliances appear as recognition tasks. A router forwards between subnets, a switch works within one, a firewall enforces policy, IDS detects without blocking, IPS blocks, a load balancer distributes requests, a proxy intermediates, and NAS and SAN distinguish file-level from block-level storage. Wireless devices include access points and controllers. Cloud concepts centre on NFV separating function from hardware, VPC isolating tenants, network security groups filtering at the instance level, and the difference between public, private and hybrid deployments. SaaS, IaaS and PaaS distinguish what the provider manages from what you do.

– Ports, protocols and traffic patterns

Port and protocol questions pair a service with its default port and transport. FTP uses 20 and 21, SFTP rides SSH on 22, Telnet is 23, SMTP is 25, DNS is 53, DHCP is 67 and 68, HTTP is 80, HTTPS is 443, SNMP is 161 and 162, LDAP is 389, RDP is 3389, SIP is 5060 and 5061. The exam assumes you know which are TCP, which are UDP, and which use both. Mixing up the secure and insecure variants costs marks.

Traffic types test definitions. Unicast is one-to-one, multicast is one-to-many within a group, anycast is one-to-nearest, broadcast is one-to-all on the segment. The distinction between multicast and broadcast matters when interpreting traffic behaviour or choosing an efficient delivery method.

– Media, connectors and topologies

Transmission media questions check whether you can name the right cable or wireless standard for a scenario. Wireless includes 802.11 variants, cellular and satellite. Wired covers fiber, coaxial and direct-attach copper. Transceivers and connectors pair physical form factors with media: SC, LC, ST and MPO are fiber; RJ11 is telephone; RJ45 is Ethernet; F-type is coaxial for cable TV; BNC is coaxial for older networks.

Topologies describe layout and redundancy. Mesh offers multiple paths, hybrid mixes types, star radiates from a central point, spine-and-leaf is a two-tier data centre design, point-to-point links two nodes, three-tier stacks core-distribution-access, and collapsed core merges the top two. The exam tests whether you can identify a topology from a description or choose one to meet a resilience or performance requirement.

– IPv4 addressing and subnetting

IPv4 addressing questions turn on ranges and rules. Public addresses route on the internet, private addresses live behind NAT in RFC1918 space: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. APIPA assigns 169.254.0.0/16 when DHCP fails. Loopback is 127.0.0.0/8. Address classes A, B, C, D and E define historical boundaries, but subnetting with VLSM and CIDR is what the exam cares about.

Subnetting questions give you a network and ask for the range of usable hosts, the broadcast address, the subnet mask in slash or dotted-decimal notation, or which address belongs to which subnet. VLSM lets you split a block into unequal pieces. CIDR aggregates routes. The arithmetic is not hard, but you must work it correctly under time pressure. A single bit error changes the answer.

How Networking Concepts is tested

Twenty-three percent means roughly twenty items, and they span every group. Items present a scenario or a single fact and ask you to identify the layer, appliance, protocol, port, address type or topology that fits. The demand is recognition and elimination: you see four options, three are wrong for reasons you can name.

Candidates lose marks by confusing near-neighbours. SFTP and FTPS both secure file transfer, but SFTP uses SSH on port 22 and FTPS uses TLS on ports 989 and 990. IDS and IPS both watch for threats, but only IPS blocks. Public and private IP ranges look similar until you check the first octet. Subnetting errors come from miscounting bits or forgetting that the network and broadcast addresses are not usable hosts. The exam rewards precision: knowing the term is not enough if you cannot distinguish it from the term next to it. Skim-reading the stem costs you when two options differ by a single word.

Where the first topic tested recognition, this one tests configuration and deployment. You are choosing the right routing protocol, assigning VLANs, setting wireless parameters, or planning a physical installation. The weight is a fifth of the exam, and the questions assume you have already absorbed the concepts from topic one. Errors here come from forgetting how a technology behaves when two of them interact.

– Routing and address translation

Routing questions distinguish static from dynamic and test when to use each. Static routes are predictable and low-overhead; dynamic routing with BGP, EIGRP or OSPF adapts to topology changes. BGP is for inter-domain, EIGRP is Cisco proprietary and fast, OSPF is open and scalable. Route selection turns on administrative distance and metric. NAT translates private addresses to public, PAT overloads one public address with port numbers, FHRP provides gateway redundancy with VRRP or HSRP, VIP is the shared address the group presents, and subinterfaces let one physical port carry multiple VLANs.

The exam tests whether you can pick the protocol that fits the scale, recognize why a route is not being chosen, or identify the NAT variant from a description of how addresses are rewritten.

– Switching, VLANs and wireless

Switching questions cover VLAN assignment, trunking, spanning tree preventing loops, MTU affecting maximum frame size, and jumbo frames raising throughput on supported links. You need to know that access ports carry one VLAN untagged, trunk ports carry many VLANs tagged with 802.1Q, and spanning tree blocks redundant paths until a failure promotes them.

Wireless questions test channel selection to avoid overlap, frequency choice between 2.4 GHz and 5 GHz, SSID broadcast and hiding, network types like infrastructure and ad hoc, encryption with WPA2 and WPA3, guest network isolation, authentication methods including PSK and 802.1X, antenna types affecting coverage shape, and access point placement. The exam asks which setting solves interference, improves security, or extends range. Candidates lose marks by choosing WEP when WPA3 is available, or by putting too many access points on overlapping channels.

– Physical installation

Physical installation questions address space, power and environment. You consider rack height, weight distribution, cooling, power redundancy with dual supplies, circuit capacity, environmental monitoring for temperature and humidity, and cable management to avoid interference and strain. The exam presents a deployment scenario and asks what you check before installation or what causes a post-install fault. Forgetting that PoE has a distance limit, ignoring heat buildup in a closed rack, or underestimating power draw are common traps.

How Network Implementation is tested

One in five items comes from this topic, and they present configuration or deployment decisions. You see a requirement and choose the protocol, VLAN scheme, wireless setting or installation check that meets it. The options look plausible until you apply the constraint the scenario gives you.

Candidates lose marks by not reading the constraint. An item might say the network has no Cisco devices, which rules out EIGRP. It might specify low administrative overhead, which favours static routing over OSPF. It might mention high throughput on a storage link, which points to jumbo frames if the hardware supports them. Wireless questions trap you by offering encryption that is outdated or authentication that does not match the client environment. Installation questions punish assumptions: if the scenario does not say the rack has ventilation, you cannot assume it does. Marks go to candidates who eliminate options that violate a stated requirement, even when the remaining answer feels less familiar.

This topic shifts from building the network to running it. Documentation, change control, monitoring and disaster recovery all live here, along with the core services that keep devices online and synchronized. The weight is just under a fifth, and the questions test whether you know what to check, what to record, and what to automate when something changes or breaks.

– Documentation and life-cycle management

Documentation questions distinguish physical diagrams showing rack layouts and cable paths from logical diagrams showing IP addressing and VLAN boundaries. Rack diagrams map device positions and power connections. Cable maps track patch-panel assignments. Network diagrams show topology and routing. Asset inventory lists hardware, firmware and warranty status. IPAM tracks address allocation. SLA defines uptime and response commitments. Wireless surveys map signal strength and coverage.

Life-cycle management tests when a device reaches end-of-life, when vendor support stops at end-of-service, how software updates are staged and tested, and how decommissioning is done safely. The exam asks which document you consult to find an IP conflict, or what you update after replacing a switch. Candidates lose marks by choosing a physical diagram when the question needs logical detail, or by forgetting to update IPAM after a change.

– Change and configuration management

Change management questions check that you follow a request process: submit, review, approve, schedule, implement, verify. The exam presents a scenario where a change caused an outage and asks what step was skipped. Tracking is the record that lets you roll back or audit.

Configuration management distinguishes production, backup and baseline configurations. Production is live, backup is the last-known-good copy, baseline is the template for new devices. The exam tests whether you can identify which configuration to restore after a failed change, or what to compare when troubleshooting drift. Forgetting to back up before a change, or applying a baseline to a device that needs custom settings, both cost marks.

– Monitoring, services and access

Network monitoring covers SNMP polling for device status, flow data showing traffic patterns, packet capture for deep inspection, baseline metrics defining normal behaviour, log aggregation centralizing event records, API integration for automation, and port mirroring copying traffic to an analyzer. The exam asks which tool reveals a bandwidth hog or detects an anomaly.

Network services include DHCP assigning addresses, SLAAC for IPv6 autoconfiguration, DNS resolving names, NTP synchronizing clocks, PTP for precision time, and NTS securing time data. Access and management methods are VPN for remote connectivity, SSH for secure shell, GUI for point-and-click, API for scripting, and console for out-of-band recovery. The exam tests which service solves an addressing or time-sync issue, and which access method you use when the network is unreachable.

– Disaster recovery

Disaster recovery questions define RPO as the maximum tolerable data loss, RTO as the maximum tolerable downtime, MTTR as mean time to repair, and MTBF as mean time between failures. Cold sites have space and power but no equipment, warm sites have equipment but no data, hot sites are live replicas. Active-active means both sites handle traffic, active-passive means one is standby. Testing validates that the plan works.

The exam presents a business requirement and asks which site type or metric applies. Candidates lose marks by confusing RPO with RTO, or by choosing a cold site when the downtime window is too short.

How Network Operations is tested

Nineteen percent translates to roughly seventeen items, and they span documentation, change control, monitoring, services and DR. Items describe an operational task and ask which document, tool, metric or process you use. The demand is knowing what each artifact or service does in practice.

Candidates lose marks by choosing a tool that captures the wrong layer of detail. SNMP tells you interface status, not which application is consuming bandwidth; for that you need flow data or packet capture. Physical diagrams show cable routes, not VLAN assignments; for that you need a logical diagram. RPO and RTO sound similar but govern different decisions: one is about backup frequency, the other about failover speed. Change management items punish skipping approval or failing to document, even when the change succeeded. The exam rewards candidates who match the question's need to the artifact or process that was designed for it, and who do not assume that any monitoring tool or any diagram will do.

Security is fourteen percent of the exam, and the questions test controls, segmentation and attack recognition. You need to know which technology enforces a policy, which architecture isolates a risk, and which attack a symptom points to. The topic assumes you understand how authentication, encryption and access control work in a network context, not just in theory.

– Logical and physical security

Logical security questions cover encryption in transit with TLS and IPsec, encryption at rest protecting stored data, PKI managing certificates, IAM controlling identity and access, MFA requiring multiple factors, SSO reducing credential sprawl, RADIUS and TACACS+ centralizing authentication, LDAP querying directories, SAML federating identity, time-based authentication adding a clock factor, authorization granting permissions after authentication, least privilege limiting access to what is needed, role-based access control grouping permissions by job function, and geofencing restricting by location.

Physical security is cameras and locks. Deception technologies include honeypots attracting attackers to a fake target and honeynets doing the same at network scale. The exam tests which control mitigates a stated risk. Candidates lose marks by choosing RADIUS when the scenario needs TACACS+ command authorization, or by picking SSO when MFA is the requirement.

– Terminology, compliance and segmentation

Security terminology defines risk as likelihood times impact, vulnerability as a weakness, exploit as the method that uses it, threat as a potential cause of harm, and the CIA triad as confidentiality, integrity and availability. Audits and compliance questions check data locality rules, PCI DSS for payment-card environments, and GDPR for personal data in Europe.

Network segmentation questions test how you isolate IoT devices, industrial IoT, SCADA and ICS in operational technology environments, guest users, and BYOD endpoints. The exam asks which segment a device belongs to, or what control prevents lateral movement. Mixing up IIoT and IoT, or putting guest traffic on the same VLAN as corporate resources, both cost marks.

– Attacks and defenses

Attack questions test recognition. DoS and DDoS flood resources, VLAN hopping jumps between VLANs by exploiting trunking, MAC flooding overflows the switch table to force broadcast mode, ARP poisoning redirects traffic by lying about MAC-to-IP mappings, DNS poisoning corrupts name resolution, rogue devices and services introduce unauthorized infrastructure, evil twin is a fake access point, on-path attack intercepts and relays traffic, and social engineering includes phishing, dumpster diving, shoulder surfing and tailgating.

Defense questions cover device hardening with disabled services and strong credentials, NAC enforcing health checks before network access, key management rotating and protecting cryptographic keys, ACLs filtering by address or port, URL and content filtering blocking by category, trusted versus untrusted zones separating risk levels, and screened subnet placing public-facing services between two firewalls. The exam asks which defense stops a named attack, or which attack a symptom indicates. Confusing MAC flooding with ARP poisoning, or choosing an ACL when NAC is needed, both lose marks.

How Network Security is tested

Fourteen percent means roughly twelve items. They present a threat, a requirement or a symptom, and ask which control, segment or attack applies. The options include technologies that sound related but serve different purposes.

Candidates lose marks by not distinguishing authentication from authorization, or encryption in transit from encryption at rest. An item might describe a scenario where credentials are stolen from a database; the mitigation is encryption at rest, not TLS. Another might show ARP cache entries that do not match the real topology; the attack is ARP poisoning, not DNS poisoning. Segmentation questions punish putting operational technology on the same network as corporate IT, even when both are behind a firewall. Attack questions reward noticing the symptom that is unique to one attack: MAC flooding causes the switch to broadcast all traffic, VLAN hopping requires dynamic trunking to be enabled. The exam tests whether you can name the precise control or attack, not the category it belongs to.

At nearly a quarter of the exam, troubleshooting is the largest single topic. It tests methodology, physical-layer issues, service failures, performance problems, and the tools you use to isolate each one. The questions assume you can work backwards from a symptom to a cause, and that you know which tool or command gives you the evidence you need. Mistakes here cost more than anywhere else because the weight is high and the scenarios layer multiple variables.

– Methodology and cabling issues

Troubleshooting methodology is a fixed sequence: identify the problem by gathering information and questioning users, establish a theory of probable cause, test the theory, plan and implement a solution, verify full functionality, and document findings. The exam tests whether you can name the next step in the process, or identify which step was skipped when a fix fails.

Cabling and physical interface issues include incorrect cable type for the distance or speed, signal degradation from excessive length or interference, improper termination causing reflections, TX and RX transposed so transmit connects to transmit, increasing error counters on an interface indicating collisions or CRC failures, port status showing down when it should be up, PoE issues where power budget is exceeded or the device is not receiving power, transceiver mismatch between speed or fiber type, and signal strength too weak for reliable communication. The exam describes a symptom and asks which physical issue is the cause, or which fix resolves it.

– Service and configuration issues

Network service issues test switching problems like spanning tree blocking the wrong port, VLAN assignment putting a device on the wrong broadcast domain, or ACLs blocking legitimate traffic. Routing issues include missing or incorrect entries in the routing table, or a missing default route so traffic to unknown destinations is dropped. Address pool exhaustion means DHCP has no free leases. Incorrect gateway, IP or subnet mask stops a device reaching other subnets or the internet.

The exam presents connectivity loss or partial reachability and asks which configuration error is responsible. Candidates lose marks by checking the routing table when the problem is VLAN assignment, or by assuming the gateway is wrong when the subnet mask is the real issue. The trap is choosing the first plausible cause instead of the one that fits all the symptoms.

– Performance issues and tools

Performance issues include congestion when traffic exceeds link capacity, latency adding delay to round-trip time, packet loss dropping frames before they arrive, and wireless interference from overlapping channels or non-Wi-Fi sources. The exam gives you a slow or intermittent connection and asks which performance issue explains it, or what you measure to confirm.

Tools and protocols include protocol analyzers capturing and decoding frames, command-line tools like ping, traceroute, ipconfig, nslookup, netstat and arp, cable testers checking continuity and wiring faults, and Wi-Fi analyzers showing signal strength and channel use. The exam asks which tool you use to diagnose a stated symptom. Candidates lose marks by choosing ping when the problem needs a protocol analyzer to see malformed packets, or by picking a cable tester when the issue is wireless interference.

How Network Troubleshooting is tested

Twenty-four percent means roughly twenty-one items, more than any other topic. They describe a failure or performance complaint and ask for the cause, the next diagnostic step, or the tool that reveals it. The stem gives you symptoms, sometimes a partial configuration, and a set of four options that include at least two plausible answers until you check them against every detail.

Candidates lose marks by ignoring a symptom that rules out three options. If the scenario says only one VLAN is affected, the cause is not a routing issue. If ping works but HTTP does not, the problem is not the default gateway. If error counters are climbing on one interface, the fault is physical or data-link, not application-layer. Methodology questions punish skipping straight to a solution without testing the theory, or failing to document after the fix works. Tool questions reward knowing what each command or device shows: traceroute maps the path, netstat lists connections, arp displays the MAC table, a protocol analyzer decodes headers. The exam gives you enough information to eliminate wrong answers, but only if you read every word of the scenario and match it to what each option actually does.