Try 10 Real Questions From CompTIA Network+ (N10-009) - 500 Questions & Answers with Full Rationales
These are unedited questions from the full 500-question set, pulled from across every exam domain. Click a question to reveal the answer and the full rationale for every option, exactly as it appears in the PDF.
A network technician is reviewing a packet capture and sees that a device is using TCP port 443. Which OSI layer is primarily responsible for end-to-end delivery and reliability for this traffic?
Show answer & full rationale
A: Session (Layer 5) manages session setup/teardown at a higher level, but TCP reliability and ports are Transport-layer functions.
B: Network (Layer 3) handles logical addressing and routing (IP), not TCP reliability or port-based sessions.
C (Correct): The Transport layer (Layer 4) provides end-to-end delivery, including reliability (TCP), sequencing, flow control, and retransmissions. Port numbers (like 443) are also a Transport-layer concept.
D: Data Link (Layer 2) handles framing and MAC addressing on the local link, not end-to-end TCP delivery.
A technician needs to allow secure remote administration to a Linux server using a protocol that supports encryption by default. Which port should be opened?
Show answer & full rationale
A (Correct): SSH uses TCP port 22 and provides encrypted remote administration by default.
B: RDP (3389) is typically used for Windows remote desktop, not standard Linux CLI administration.
C: FTP (21) is for file transfer and is typically unencrypted unless using FTPS/SFTP (SFTP is over SSH on 22).
D: Telnet (23) is remote access but unencrypted, making it insecure.
A network engineer needs to configure a single router interface to route traffic for multiple VLANs using 802.1Q tagging. Which implementation is BEST?
Show answer & full rationale
A (Correct): Router subinterfaces with 802.1Q tagging support router-on-a-stick, enabling inter-VLAN routing over one physical interface.
B: A loopback address isn't used as the VLAN default gateway for end hosts in typical designs.
C: APIPA is a host fallback addressing feature, not a VLAN routing implementation.
D: Disabling trunking would prevent multiple VLANs from reaching the router interface.
A new wireless deployment requires strong encryption and user authentication against a centralized AAA server. Which wireless configuration BEST meets this requirement?
Show answer & full rationale
A: WEP is insecure and MAC filtering is easily bypassed.
B: PSK uses a shared password, not per-user authentication.
C (Correct): Enterprise Wi-Fi with 802.1X integrates with centralized AAA (often RADIUS) for per-user authentication and strong security.
D: Captive portals do not provide the same strong link-layer security as 802.1X.
A technician needs a long-term view of which source/destination pairs are consuming the most bandwidth across a WAN link, without storing full packet payloads. Which is BEST?
Show answer & full rationale
A (Correct): Flow data summarizes traffic patterns (top talkers, protocols, volumes) and is ideal for bandwidth trending and capacity planning without the storage overhead of full packet captures.
B: DNS logs show name lookups, not bandwidth consumption.
C: Continuous packet capture is storage-heavy and excessive for long-term trending.
D: ARP tables show local IP-to-MAC mappings, not bandwidth usage.
A network team wants to establish normal performance levels for latency and throughput so they can quickly detect abnormal changes later. What should they create first?
Show answer & full rationale
A: NAT mapping is an edge configuration, not a measurement standard.
B (Correct): A baseline captures "normal" performance metrics (latency, jitter, utilization, error rates), enabling meaningful comparison when issues arise.
C: DHCP scopes provide address allocation, not performance baselining.
D: Trunking is a network implementation feature, not an operations measurement.
A network engineer wants to enforce authentication before a device is allowed normal access on a wired switchport. Which control BEST meets this requirement?
Show answer & full rationale
A (Correct): 802.1X NAC requires authentication (often via RADIUS) before granting network access, preventing unauthorized endpoints from connecting.
B: DHCP relay forwards DHCP messages across subnets, not authentication.
C: PAT is address translation for internet access, not port authentication.
D: Port mirroring copies traffic for analysis, not access control.
A security analyst reviews firewall logs and finds thousands of TCP SYN packets sent to a web server from many different spoofed source IP addresses, with no corresponding ACK responses. The server becomes unresponsive. Which attack BEST describes this behavior?
Show answer & full rationale
A: VLAN hopping exploits switch trunk misconfiguration to send traffic across VLAN boundaries; it does not involve SYN packets targeting a specific server.
B (Correct): A SYN flood sends large volumes of TCP SYN packets with spoofed source IPs. The server allocates resources and sends SYN-ACK responses for each, but since the sources are fake, no ACK completes the handshake. The server's connection table fills with half-open connections, exhausting resources and causing denial of service.
C: ARP poisoning sends gratuitous ARP replies to associate a malicious MAC with a legitimate IP, enabling on-path attacks -- not a resource-exhaustion attack on a server.
D: MAC flooding targets switch CAM tables by sending frames with many fake source MACs, causing the switch to flood traffic; it does not involve TCP SYN packets.
A user reports, "I can access internal resources, but I cannot reach any websites on the internet." Other users on the same subnet can browse normally. What is the MOST likely issue on this user's workstation?
Show answer & full rationale
A: Switch MTU issues would more likely affect multiple devices and specific traffic patterns, not only one user's internet access.
B: Duplicate SSID is a wireless association issue and wouldn't selectively break only internet access while keeping internal access stable for one wired/wireless host.
C: Rogue DHCP typically impacts multiple hosts and often changes more than just one workstation consistently.
D (Correct): If the issue affects only one workstation and internal access works, a common cause is an incorrect default gateway on that workstation, preventing traffic from leaving the subnet.
A user reports they can reach a server by IP address but not by hostname. Which troubleshooting step is BEST?
Show answer & full rationale
A: MTU changes affect packet size/fragmentation, not DNS name resolution.
B: Disabling VLANs is disruptive and unrelated to DNS resolution.
C: A bad cable typically disrupts all connectivity, not only name resolution.
D (Correct): If IP connectivity works but hostname access fails, DNS is suspect. nslookup confirms whether DNS resolves the hostname correctly.
CompTIA Network+ (N10-009) - 500 Questions & Answers with Full Rationales — $14.99, instant PDF download with full rationale on every answer.
View the practice questions →