Network+ Practice Exam.
Free practice test — 34 verified questions, instant feedback.

Answer: B
Layer 3 (Network) handles logical IP addressing and routing between different networks via routers. Layer 2 handles MAC addressing and switching within a local segment, Layer 4 handles end-to-end segmentation and reliability (TCP/UDP), and Layer 7 handles application-level protocols like HTTP and DNS.

Answer: A
A /25 provides 126 usable host addresses (2^7-2), just enough for 100 hosts with little waste. A /28 only yields 14 usable hosts, a /30 yields 2, and a /22 yields 1022, which is far more address space than needed.

Answer: C
Anycast delivers traffic to the topologically nearest member of a group sharing the same address, commonly used for services like DNS root servers. Unicast is one-to-one, multicast is one-to-many to a defined group, and broadcast (not used in IPv6) sends to all hosts on a segment.

Answer: B
Link-state protocols such as OSPF build a full topology map and use cost metrics (often bandwidth-based) with fast convergence via triggered updates. RIP is a distance-vector protocol limited to hop count and slow convergence; static routing has no dynamic recalculation; ARP resolves IP to MAC addresses and is not a routing protocol.

Answer: B
An AAAA record maps a hostname to a 128-bit IPv6 address. An A record performs this mapping for IPv4, a CNAME record creates an alias to another hostname, and an MX record specifies mail exchange servers for a domain.

Answer: A
Elasticity is the ability to dynamically scale resources up or down based on demand. Multitenancy refers to multiple customers sharing the same underlying infrastructure, fault tolerance describes resilience to component failure, and NFV refers to virtualizing network services such as firewalls and routers on standard hardware.

Answer: A
802.1Q is the IEEE standard that defines VLAN tagging on Ethernet trunk links. 802.1X governs port-based network access control, 802.3af defines Power over Ethernet, and 802.11ac is a wireless LAN standard.

Answer: B
Port mirroring, also called a switched port analyzer (SPAN), duplicates traffic from one or more ports or VLANs to a monitoring port for analysis. Port security restricts which MAC addresses may connect to a port, link aggregation bundles multiple physical links into one logical link, and native VLAN configuration defines untagged traffic handling on a trunk.

Answer: A
MU-MIMO (Multi-User Multiple Input, Multiple Output) allows an access point to communicate with multiple client devices simultaneously using multiple antenna streams, improving aggregate throughput. Channel bonding increases the width of a single channel but doesn't enable concurrent multi-user streams by itself, WPA3 is a security protocol, and BSS isolation prevents client-to-client communication on the same AP.

Answer: A
Cat 6A extends 10GBASE-T support to the full 100-meter horizontal run, whereas Cat 6 typically supports 10 Gbps only up to about 37-55 meters due to alien crosstalk. PoE support is not the differentiator between these categories, Cat 6A is still a copper twisted-pair standard, and both categories work fine for wired workstation connections.

Answer: A
VRRP (Virtual Router Redundancy Protocol) and HSRP (Hot Standby Router Protocol, Cisco proprietary) let two or more routers share a virtual IP so hosts always use the same default gateway, with automatic failover. STP prevents Layer 2 loops among switches, LACP bundles physical links into an aggregated logical link, and DHCP relay forwards DHCP requests across subnets rather than providing gateway redundancy.

Answer: A
T568A and T568B are the two TIA/EIA wiring standards that define the pin-out order of colored wire pairs in RJ45 connectors; mixing them on the two ends of one cable creates a crossover cable. The other options are unrelated standards for wireless/Ethernet framing, network management, or IP addressing.

Answer: A
DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addressing information, including address, mask, gateway, and DNS servers, to clients. NTP synchronizes time, SNMP is used for monitoring and managing network devices, and Syslog centralizes log message collection.

Answer: C
An SNMP trap is an unsolicited message sent from a managed device to the manager as soon as a defined event or threshold occurs, enabling near-real-time alerting. GetRequest and Walk are manager-initiated polling operations, and SetRequest is used by the manager to change a device's configuration value, not to receive alerts.

Answer: A
RPO defines the maximum acceptable amount of data loss measured in time, dictating how frequently backups or replication must occur. RTO defines how quickly a service must be restored after an outage, MTBF measures the average time a system operates before failing, and MTTR measures the average time needed to repair a failed component.

Answer: A
Change management is the formal process of planning, documenting, approving, and reviewing changes to production systems, including rollback plans, to minimize risk. Asset management tracks inventory of hardware/software, incident response addresses active security or operational incidents, and vulnerability scanning identifies weaknesses rather than governing planned changes.

Answer: A
A physical network diagram shows the actual hardware, cabling, and connections between devices, often layered with logical information like IP addressing, to aid design and troubleshooting. An SLA defines expected service performance between provider and customer, an SOP documents step-by-step procedures for routine tasks, and an NDA is a legal confidentiality agreement, none of which depict network topology.

Answer: A
Installing a redundant power supply removes a single point of failure so the device continues operating if one component fails, a core high-availability design principle. Load balancing distributes traffic across multiple servers or links rather than protecting a single device, traffic shaping controls bandwidth usage patterns, and QoS tagging prioritizes certain traffic types, neither of which is about component redundancy.

Answer: A
Establishing a performance baseline and continuously logging metrics over time allows administrators to visualize trends like gradually rising CPU usage and detect anomalies before they cause outages. A single ping test or one-time port scan gives only a snapshot rather than a trend, and static ARP entries have nothing to do with performance monitoring.

Answer: A
An ACL applied to the management interface can permit SSH only from the trusted IT subnet and implicitly deny all other sources, directly enforcing least-privilege management access. Enabling CDP actually broadcasts device information and reduces security, disabling STP creates loop risk without any access-control benefit, and DHCP lease time is unrelated to restricting administrative access.

Answer: A
An evil twin attack involves a rogue access point mimicking a legitimate SSID to trick clients into connecting so the attacker can intercept traffic or harvest credentials. ARP poisoning corrupts a device's ARP cache to redirect Layer 2 traffic, VLAN hopping exploits trunking misconfiguration to access other VLANs, and DNS amplification is a DDoS technique leveraging open DNS resolvers.

Answer: A
Segmenting devices by risk profile (IoT, guest, corporate) into separate VLANs with firewall-enforced boundaries limits lateral movement and contains breaches, a core defense-in-depth practice. Single sign-on addresses authentication convenience, VPN tunneling modes concern remote access routing, and port forwarding exposes an internal service externally, none of which describe internal network segmentation.

Answer: A
An IPS sits inline with traffic flow and can automatically block or drop packets matching malicious signatures in real time. An IDS only monitors and alerts without taking blocking action, a syslog server merely aggregates log messages, and a proxy cache server accelerates and filters web requests but is not designed for real-time attack signature blocking.

Answer: A
A split-tunnel VPN routes only traffic destined for corporate resources through the encrypted tunnel while other internet traffic uses the local connection directly, reducing bandwidth load on the VPN concentrator. A full-tunnel VPN forces all traffic, including general internet browsing, through the tunnel; a site-to-site VPN connects two networks rather than a single remote user; and a clientless portal describes browser-based access rather than tunnel scope.

Answer: A
Following the standard troubleshooting methodology of testing connectivity layer by layer, the next logical step is pinging the gateway and then an external address to narrow down whether the failure is local, at the gateway, or further upstream (e.g., DNS or an external route). Reformatting or replacing hardware without further diagnosis skips isolating the actual fault, and disabling the port would remove the user's access entirely without diagnosing anything.

Answer: A
Jitter is the variation in packet delay over time, which can degrade real-time applications like VoIP even without packet loss. Latency refers to the absolute delay of a single packet's round trip, not its variability; attenuation is the weakening of a signal over distance in a cable; and crosstalk is interference between adjacent wire pairs, neither related to timing variability between pings.

Answer: A
Given signal strength dropped specifically after a firmware update and correlates with distance from the AP, a change to transmit power, antenna settings, or channel width introduced by the update is the most likely cause of reduced coverage. DNS misconfiguration would cause name resolution failures rather than distance-dependent signal drop, DHCP exhaustion would prevent address assignment entirely rather than degrade with distance, and a duplicate IP would cause address conflicts, not a signal strength/distance correlation.

Answer: A
Because the wire map is confirmed correct (no opens, shorts, or transposed pairs) yet performance issues correlate with nearby electrical equipment operation, EMI coupling into the cable is the most likely cause of degraded signal quality and retransmissions. An open circuit or transposed pair would show up on the wire map test which passed, and a duplex mismatch is a switch/NIC configuration issue unrelated to environmental electrical noise.

Answer: A
A new switch introducing a redundant Layer 2 path without STP properly blocking it creates a loop, causing broadcast and unknown-unicast frames to circulate endlessly, spiking CPU and saturating bandwidth network-wide. A DNS outage would cause name resolution failures rather than network-wide flooding, an expired certificate only affects encrypted sessions to one service, and DHCP exhaustion prevents new address assignment but does not cause flooding or high switch CPU from looping frames.

Answer: A
Since the tunnel establishes and some subnets work while others don't, the most likely cause is that the VPN's defined traffic selectors (interesting traffic/proxy IDs) omit the missing subnets, so packets to those networks are never routed into the tunnel. A fully down ISP link or failed power supply would prevent the tunnel from establishing at all, and a DHCP outage affects address assignment locally, not selective reachability of specific remote subnets through an already-established tunnel.

Answer: A
Because DNS resolution is confirmed correct and only connections to specific server addresses fail with unanswered SYN packets, a firewall or ACL silently dropping (rather than rejecting) that traffic is the most likely cause, which produces exactly this retransmission pattern with no response. Incorrect DNS records would misdirect the client to a wrong address rather than causing name-correct connections to specific servers to hang, a half-duplex NIC would typically produce collisions and errors rather than clean unanswered SYNs, and a corrupted gateway ARP cache would affect all destinations, not selectively certain servers.

Answer: A
When latency jumps sharply at one hop and remains elevated for all subsequent hops, it indicates a slow, congested, or otherwise degraded link at that point in the path, since every later hop inherits the added delay. A client-side subnet mask or DHCP lease issue would affect local connectivity broadly rather than produce a hop-specific mid-path latency jump, and a duplicate MAC address typically causes intermittent connectivity or ARP conflicts rather than a consistent added-latency traceroute signature.

Answer: C
The current CompTIA Network+ exam (N10-009) is organized into five official content domains covering networking concepts, network implementation, network operations, network security, and network troubleshooting. The other counts do not match the exam's official published structure.

Answer: D
Network Troubleshooting is the largest domain at 24% of the exam, reflecting the emphasis on applying diagnostic methodology to real-world network problems. Networking Concepts is 23%, Network Implementation is 20%, and Network Security is only 14%, all smaller than Troubleshooting's share.