CompTIA Network+ Practice Questions: 25 Exam-Style Examples With Answers and Explanations (N10-009, 2026)

Most people fail CompTIA Network+ because they revised the wrong domain, not because they revised too little. These 25 Network+ practice questions are weighted to match the real N10-009 objectives, so the number you get wrong in each section tells you where the next fortnight of study should go.

Work through them cold, no notes, and write your answers down before you scroll. The explanations underneath each answer say why the distractors are wrong, which is the part that actually moves your score.

What the N10-009 Exam Looks Like

Knowing the shape of the exam changes how you practise. The current version is N10-009, also branded V9, which launched on 20 June 2024 and is expected to run until 2027.

Exam Tip: N10-009 has a maximum of 90 questions in 90 minutes, mixing multiple choice with performance-based questions, and you need 720 on a scale of 100 to 900 to pass. That is roughly 80 percent, which is higher than most candidates assume.

Troubleshooting is the largest domain at 24 percent, and it is the one candidates under-revise most, because it cannot be memorised from a flashcard deck. The exam costs $399 direct from CompTIA as of 1 June 2026, so a retake is an expensive way to learn that lesson.

The performance-based questions usually land in the first few minutes. They take longer than multiple choice, so flag them, clear the multiple choice first, and come back with whatever time is left.

Domain 1: Networking Concepts (Questions 1 to 6)

1. A switch forwards a frame based on the destination MAC address. At which OSI layer is it operating?

A. Layer 1 B. Layer 2 C. Layer 3 D. Layer 4

Answer: B. MAC addresses live in the data link layer header, so any device forwarding on MAC is a Layer 2 device. Layer 1 is signalling only, with no addressing to read. Layer 3 forwarding uses IP addresses, which is a router or a multilayer switch acting as one. Layer 4 decisions use port numbers, which is firewall and load balancer territory.

2. Which port and protocol pair should you open for Remote Desktop Protocol?

A. TCP 22 B. TCP 23 C. TCP 3389 D. UDP 161

Answer: C. RDP uses TCP 3389. TCP 22 is SSH, TCP 23 is Telnet, and UDP 161 is SNMP polling. Port numbers are free marks on this exam and they appear in both the multiple choice and the drag-and-drop performance items, so learn the list properly rather than half of it.

3. How many usable host addresses does the subnet 192.168.10.0/26 provide?

A. 30 B. 62 C. 64 D. 126

Answer: B. A /26 leaves 6 host bits, giving 64 total addresses, minus the network address and the broadcast address, so 62 usable. Answer C is the trap: it counts the total addresses without subtracting the two reserved ones. Answer A is a /27 and answer D is a /25.

4. In which cloud service model does the customer remain responsible for patching the guest operating system?

A. SaaS B. PaaS C. IaaS D. FaaS

Answer: C. With Infrastructure as a Service the provider runs the hardware, storage and hypervisor, and everything from the guest OS upwards is yours, including patching. In PaaS the provider maintains the OS and runtime and you supply the application. In SaaS you manage nothing but your data and user access.

5. Which technology encapsulates Layer 2 frames inside Layer 3 packets to extend a VLAN across a routed data centre?

A. VXLAN B. STP C. NAT D. QoS

Answer: A. VXLAN tunnels Ethernet frames inside UDP so that a Layer 2 segment can span sites that are separated by routed links. Spanning Tree prevents switching loops within a Layer 2 domain rather than extending one. NAT rewrites addresses at the edge and QoS prioritises traffic.

6. A DNS record needs to point mail.certcrush.local at an existing A record for host01.certcrush.local. Which record type is correct?

A. MX B. CNAME C. PTR D. TXT

Answer: B. A CNAME creates an alias from one name to another name. MX identifies which mail server accepts mail for a domain, which is a different job and a common mix-up here. PTR is used for reverse lookups from IP to name, and TXT holds arbitrary text such as SPF and DKIM records.

Domain 2: Network Implementation (Questions 7 to 11)

7. Which media type suits a 40 km point-to-point link between two buildings?

A. Cat 6a copper B. Multimode fibre C. Single-mode fibre D. Coaxial cable

Answer: C. Single-mode fibre uses a narrow core and a laser source, which keeps modal dispersion low enough for tens of kilometres. Multimode is cheaper but typically tops out in the hundreds of metres. Copper of any category is limited to 100 m, so answers A and D are out before you consider anything else.

8. Which routing protocol builds a full topology map and selects paths using cost derived from interface bandwidth?

A. RIP B. OSPF C. BGP D. EIGRP

Answer: B. OSPF is a link-state protocol, so every router holds an identical map of the area and runs Dijkstra against it, with cost based on bandwidth. RIP is distance vector and counts hops, which is why it picks slow paths. BGP is a path vector protocol used between autonomous systems. EIGRP is Cisco's advanced distance vector protocol and uses a composite metric, not pure cost.

9. Two access switches are connected by a redundant pair of links. What prevents the resulting broadcast storm?

A. VLAN pruning B. Spanning Tree Protocol C. Port mirroring D. Link aggregation only

Answer: B. STP blocks the redundant path until the primary fails, which stops frames looping endlessly. Link aggregation can also solve this by bundling the links into one logical interface, but it has to be configured on both ends first, and the word "only" makes D wrong as a general safeguard. Port mirroring copies traffic for analysis and does nothing about loops.

10. A site needs the 6 GHz band to escape congestion in 2.4 GHz and 5 GHz. Which wireless standard is the minimum requirement?

A. 802.11n B. 802.11ac C. Wi-Fi 6 (802.11ax at 5 GHz) D. Wi-Fi 6E

Answer: D. Wi-Fi 6E is the extension of 802.11ax into the 6 GHz band. Plain Wi-Fi 6 operates in 2.4 and 5 GHz. 802.11ac is 5 GHz only, and 802.11n covers 2.4 and 5 GHz. Client devices also need 6E radios, which is worth remembering for scenario questions about why only some laptops see the new SSID.

11. Which copper cabling category supports 10GBASE-T for the full 100 m channel?

A. Cat 5e B. Cat 6 C. Cat 6a D. Cat 3

Answer: C. Cat 6a is specified for 10 Gbps across 100 m. Cat 6 manages 10 Gbps but only to around 55 m, and less in high-interference environments, which makes it the most tempting wrong answer. Cat 5e is rated for 1 Gbps and Cat 3 for legacy 10 Mbps and telephony.

Domain 3: Network Operations (Questions 12 to 16)

12. What distinguishes an SNMP trap from an SNMP get request?

A. The trap is sent by the manager to the agent B. The trap is initiated by the agent without being polled C. The trap uses TCP rather than UDP D. The trap is encrypted and the get request is not

Answer: B. A trap is agent-initiated, sent the moment a threshold is crossed, whereas a get is manager-initiated polling on a schedule. That is why traps catch a short-lived interface flap that polling every five minutes would miss. Encryption depends on the SNMP version, not on the message type, which rules out D.

13. You need to know which internal hosts consumed the most WAN bandwidth yesterday, broken down by conversation. Which data source answers that?

A. Syslog B. SNMP interface counters C. NetFlow D. A packet capture on the core switch

Answer: C. Flow data records source, destination, ports and byte counts per conversation, which is exactly the top-talkers question. SNMP counters give you total throughput per interface with no breakdown of who caused it. Syslog carries events, not traffic volumes. A packet capture would work but is far heavier than needed, and it has to be running before the event, not after.

14. Which document defines the uptime percentage a provider commits to, and the remedy if it is missed?

A. MOU B. SLA C. NDA D. AUP

Answer: B. The service level agreement is the contractual commitment on availability, response times and penalties. A memorandum of understanding records intent without binding terms. An NDA covers confidentiality and an acceptable use policy governs how staff may use the network.

15. A business can tolerate losing at most one hour of transactions in a disaster. Which metric does that define?

A. RTO B. RPO C. MTTR D. MTBF

Answer: B. The recovery point objective is the maximum acceptable data loss measured in time, which sets your backup or replication frequency. RTO is how long you have to get the service running again. MTTR is the average time taken to repair and MTBF is the average time between failures, both of which describe past performance rather than a target.

16. In syslog, which severity level indicates the system is unusable?

A. 0, Emergency B. 1, Alert C. 4, Warning D. 7, Debug

Answer: A. Syslog severity runs from 0 to 7, and it is inverted compared with most people's instinct: 0 is Emergency and the most severe, while 7 is Debug and the least. Level 1 is Alert, meaning action must be taken immediately, which is serious but not the same as unusable.

Domain 4: Network Security (Questions 17 to 19)

17. Which standard provides port-based network access control, authenticating a device before the switch port passes normal traffic?

A. 802.11i B. 802.1Q C. 802.1X D. 802.3af

Answer: C. 802.1X uses a supplicant, an authenticator (the switch or access point) and an authentication server, usually RADIUS, to gate the port. 802.1Q is VLAN tagging, 802.11i covers wireless security including WPA2, and 802.3af is Power over Ethernet. These four numbers are deliberately similar and CompTIA exploits that.

18. An attacker sends unsolicited ARP replies mapping the default gateway IP to their own MAC address. What is this?

A. ARP spoofing B. DNS poisoning C. MAC flooding D. A rogue DHCP server

Answer: A. Poisoning the ARP cache redirects victim traffic through the attacker, which sets up an on-path attack. DNS poisoning corrupts name resolution instead of address resolution. MAC flooding fills the switch CAM table to force flooding of frames. A rogue DHCP server achieves a similar redirection but does it by handing out its own address as the gateway at lease time.

19. Which configuration change most directly mitigates VLAN hopping via switch spoofing?

A. Enabling DHCP snooping B. Disabling DTP and setting access ports statically C. Increasing the MTU on trunk links D. Enabling port mirroring on the uplink

Answer: B. Switch spoofing works by negotiating a trunk with a port that is willing to auto-negotiate, so turning off Dynamic Trunking Protocol and hard-setting access ports removes the opening. Changing the native VLAN away from VLAN 1 addresses the double-tagging variant of the same attack. DHCP snooping defends against rogue DHCP, and neither MTU nor mirroring has any bearing on trunk negotiation.

Domain 5: Network Troubleshooting (Questions 20 to 25)

20. A 1 Gbps link between a server and a switch throughput-tests at under 10 Mbps, and the switch logs late collisions. What is the likely cause?

A. A failing SFP module B. A duplex mismatch C. An MTU mismatch D. Channel interference

Answer: B. Late collisions on a modern switched link are the signature of one side running full duplex and the other half duplex. The half-duplex side treats the full-duplex side's transmissions as collisions, retransmits, and throughput collapses. An MTU mismatch causes fragmentation or dropped large frames rather than collisions, and channel interference applies to wireless.

21. Which utility shows every hop along the path to a destination along with the latency at each one?

A. ping B. traceroute C. netstat D. nslookup

Answer: B. Traceroute, or tracert on Windows, increments the TTL to elicit a response from each router in turn, which is what gives you the per-hop view. Ping tests end-to-end reachability with no visibility of the middle. Netstat shows local connections and listening ports, and nslookup queries DNS.

22. Several workstations on one VLAN have 169.254.x.x addresses while the rest of the site is fine. What should you check first?

A. The default gateway configuration B. DNS server reachability C. DHCP scope exhaustion or relay on that VLAN D. The workstations' subnet masks

Answer: C. A 169.254 address is APIPA, which means the client asked for a DHCP lease and got no answer. Because the problem is confined to one VLAN, the likely culprits are an exhausted scope or a missing DHCP relay, sometimes called an IP helper, on that interface. Gateway and DNS issues do not stop a client obtaining an address, and a wrong subnet mask would not produce APIPA.

23. A fibre run that worked yesterday now shows high attenuation after a patch panel change. Which tool identifies where the loss occurs along the strand?

A. Tone generator and probe B. Optical time domain reflectometer C. Multimeter D. Wi-Fi analyser

Answer: B. An OTDR sends light down the fibre and reads the reflections, so it reports both the amount of loss and the distance to the fault. An optical power meter tells you the loss is there but not where. A tone generator and probe traces copper, a multimeter measures electrical properties, and a Wi-Fi analyser is wireless only.

24. A user can reach 10.0.5.20 by IP but not by hostname, while other users reach both. What is the most likely cause?

A. The default gateway is wrong on that workstation B. The DNS server entry on that workstation is wrong or unreachable C. The destination host is offline D. A firewall is blocking ICMP

Answer: B. Reachability by IP proves routing, the gateway and the destination are all fine, so the fault sits in name resolution. Because it affects one user and not the others, the DNS setting on that machine is the first thing to check, followed by a stale entry in its local hosts file or DNS cache. If the host were offline, the IP would fail too.

25. Two access points 15 metres apart are both configured on channel 6 in the 2.4 GHz band. Users report slow throughput near the boundary between them. What is happening?

A. Co-channel interference B. Adjacent-channel interference C. Insufficient transmit power D. A DHCP scope conflict

Answer: A. Two APs on the same channel share the airtime, so clients contend with each other and effective throughput falls even though signal strength looks healthy. Adjacent-channel interference is the overlapping-but-different case, such as channels 6 and 8. The fix is the standard 1, 6, 11 non-overlapping plan in 2.4 GHz, not more transmit power, which usually makes the contention worse.

How to Score Yourself

Mark each domain separately rather than counting a single total. The exam is weighted, so a weak troubleshooting score costs you far more than a weak security score.

• 20 to 25 correct: You are in the range where the real exam is winnable. Move to timed full-length practice exams and work on pace.
• 15 to 19 correct: The knowledge is mostly there. Identify the one or two domains carrying most of your errors and rebuild those from the objectives rather than re-reading everything.
• Under 15 correct: Go back to the official exam objectives and work domain by domain. More practice questions at this stage teaches you the answers rather than the concepts.

One caveat on any free question set, this one included: 25 questions cannot cover a five-domain exam, and none of them are performance-based. Subnetting, cable standards and port numbers are the areas where drilling volume genuinely pays, and they are also the areas where a question bank that adapts to your weak spots beats a static list.

Frequently Asked Questions

How difficult is the Network+ exam?

It is harder than A+ and easier than Security+ for most candidates. The difficulty comes from the pass mark of 720 out of 900 combined with a 24 percent troubleshooting domain that expects you to reason through a scenario rather than recall a definition. Candidates with hands-on network support experience typically find it fair, and those studying purely from books find the performance-based questions the biggest shock.

What questions are on the Network+ exam?

N10-009 uses a maximum of 90 questions across multiple choice and performance-based formats, spread over five domains: networking concepts, implementation, operations, security and troubleshooting. Performance-based questions ask you to configure or diagnose something in a simulated interface, such as placing devices in a topology or matching a fault to its cause.

What are the best practice questions for the Network+ exam?

The useful ones explain why the wrong answers are wrong, map to the current N10-009 objectives, and are weighted to match the real domain percentages. Question sets written for the retired N10-008 objectives still circulate widely and will waste your time on content that has moved. CertCrush's CompTIA Network+ practice exams are built to the N10-009 objectives with an explanation on every option.

How do I study for the Network+ exam?

Work from the official objectives as a checklist, not from a book's chapter order, and spend proportionally more time on troubleshooting and networking concepts because they are the two largest domains. Practise subnetting daily until it is automatic, since it appears throughout the exam and costs time you need elsewhere. Finish with timed practice exams so 90 questions in 90 minutes stops feeling tight.

How much is the Network+ exam?

The N10-009 voucher costs $399 direct from CompTIA as of 1 June 2026, following a price rise across the exam range. Authorised resellers, academic pricing and military discounts often bring it lower, and CompTIA sells bundles that include a retake for more. Check the current price before booking, since the list price has moved twice in recent years.

Ready to Start Practising?

Twenty-five questions tell you where you stand. They will not get you to 720.

CertCrush's CompTIA Network+ course has a full question bank built to the N10-009 objectives, with an explanation on every answer choice and domain-level scoring so you can see exactly which of the five areas is holding your score down. If you are still planning your revision, the 8-week Network+ study plan sets out what to cover each week, and the Network+ versus CCNA comparison is worth a read if you have not committed to Network+ yet.

Create a free CertCrush account and start practising against the real domain weightings today.