Free Network+ N10-009 Practice Test

12 free Network+ practice questions

1. Q1Networking Concepts

   Question 1. A cloud provider must stretch tenant Layer 2 segments between two data centers joined only by a routed Layer 3 underlay, and it expects to need more than 4,094 isolated tenant segments. Which of the following technologies BEST meets these requirements?

   1. A802.1Q trunking between the core switches
   2. BA GRE tunnel between the edge routers
   3. CVXLAN with a unique VNI per tenant segment
   4. D802.1ad double tagging on the WAN links

   Show the answer

   Correct answer: C. VXLAN with a unique VNI per tenant segment

   VXLAN wraps Ethernet frames in UDP so they cross a routed underlay, and its 24-bit VNI allows about 16 million segments. 802.1ad double tagging adds tag space but still needs a Layer 2 path end to end, so it cannot ride a routed underlay by itself.

2. Q2Network Implementation

   Question 2. An access switch has two 10 Gbps uplinks to the same distribution switch, but spanning tree keeps one of them in a blocking state. The team wants both uplinks forwarding traffic at once and surviving the loss of either one. What should the technician configure?

   1. ABundle both uplinks into an LACP port channel
   2. BEnable PortFast on both uplink interfaces
   3. CLower the spanning tree bridge priority on the access switch
   4. DConfigure each uplink as an access port in VLAN 1

   Show the answer

   Correct answer: A. Bundle both uplinks into an LACP port channel

   LACP combines the two links into one logical interface, so STP sees a single path, both members carry traffic, and the bundle keeps working if one member fails. Changing bridge priority only changes which switch becomes root; one uplink would still block.

3. Q3Network Operations

   Question 3. An operations team manages 40 branch routers whose configs keep drifting after late-night manual edits. Leadership wants every change peer reviewed, versioned, and pushed the same way to every branch. Which approach BEST addresses this?

   1. AEnable SNMP traps so the NMS alerts on configuration changes
   2. BForward router syslog messages to a central collector
   3. CSave a golden config on a TFTP server for engineers to copy
   4. DKeep templates in a Git repository and deploy them through an IaC pipeline

   Show the answer

   Correct answer: D. Keep templates in a Git repository and deploy them through an IaC pipeline

   Infrastructure as code with source control gives review, version history, repeatable deployment, and drift detection. Syslog or SNMP traps can show that a change happened but do nothing to stop drift or standardize the config.

4. Q4Network Security

   Question 4. Wall jacks in a company's conference rooms should give a laptop network access only after it submits credentials that a RADIUS server validates. In this 802.1X design, which role does the access switch perform?

   1. ASupplicant
   2. BAuthenticator
   3. CAuthentication server
   4. DCertificate authority

   Show the answer

   Correct answer: B. Authenticator

   In 802.1X the switch is the authenticator: it relays EAP messages between the laptop (the supplicant) and the RADIUS server (the authentication server), and it opens the port only after RADIUS approves. The switch never checks credentials itself, so it is not the authentication server.

5. Q5Network Troubleshooting

   Question 5. After a new VLAN 60 and its SVI were added on the core switch, every PC in VLAN 60 gets a 169.254.x.x address. The DHCP server sits in the server VLAN, its VLAN 60 scope is active, and it has 200 free leases. What is the MOST likely cause?

   1. AThe VLAN 60 scope has run out of available leases
   2. BNo DHCP relay (IP helper) is configured on the VLAN 60 SVI
   3. CAnother host on VLAN 60 is using a duplicate IP address
   4. DThe DNS server address in the scope options is unreachable

   Show the answer

   Correct answer: B. No DHCP relay (IP helper) is configured on the VLAN 60 SVI

   DHCP discovers are broadcasts that stop at the router, so without a relay on the VLAN 60 SVI they never reach a server in another subnet and clients fall back to APIPA. Scope exhaustion would cause the same symptom, but the stem says 200 leases are free.

6. Q6Networking Concepts

   Question 6. Headquarters allocates 10.44.96.0/20 to a new campus. Every building VLAN must fit up to 500 wired clients, and all building subnets must be the same size. How many building subnets can the campus carve from this allocation?

   1. A4
   2. B6
   3. C16
   4. D8

   Show the answer

   Correct answer: D. 8

   500 clients need 9 host bits (2^9 - 2 = 510), so each building gets a /23. Moving from /20 to /23 borrows 3 bits, giving 2^3 = 8 subnets; 16 subnets would mean /24s, which hold only 254 hosts each.

7. Q7Network Implementation

   Question 7. Three sources feed a branch router: EIGRP advertises 10.20.0.0/16 (AD 90), an administrator added a static 10.20.0.0/16 (AD 1), and OSPF advertises 10.20.5.0/24 (AD 110). Where will the router forward a packet destined for host 10.20.5.9?

   1. ATo the OSPF next hop, because the /24 is the longest prefix match
   2. BTo the static next hop, because AD 1 is the most trusted
   3. CTo the EIGRP next hop, because EIGRP outranks OSPF
   4. DAcross all three next hops as equal-cost paths

   Show the answer

   Correct answer: A. To the OSPF next hop, because the /24 is the longest prefix match

   The router first selects the most specific matching prefix, and administrative distance only decides between routes with the same prefix length. The static route beats EIGRP for the /16, but the OSPF /24 is more specific for 10.20.5.9, so it wins.

8. Q8Network Operations

   Question 8. While writing a disaster recovery plan, the finance director states that the order database can lose no more than 15 minutes of committed transactions after any failure. Which metric does this requirement define?

   1. AMTTR
   2. BRTO
   3. CRPO
   4. DMTBF

   Show the answer

   Correct answer: C. RPO

   The recovery point objective (RPO) is the maximum tolerable data loss measured in time, which drives backup or replication frequency. RTO is how quickly service must be restored, not how much data can be lost.

9. Q9Network Security

   Question 9. A company with mostly remote staff wants one cloud-delivered service that combines zero trust network access, a secure web gateway, CASB, and firewall-as-a-service, all managed together with its SD-WAN edges. Which solution BEST fits?

   1. AA full-tunnel site-to-site IPsec VPN to headquarters
   2. BAn on-premises network access control appliance
   3. CA SIEM that correlates logs from branch firewalls
   4. DA secure access service edge (SASE) platform

   Show the answer

   Correct answer: D. A secure access service edge (SASE) platform

   SASE converges SD-WAN with cloud-delivered security services such as ZTNA, SWG, CASB, and FWaaS under a single policy. A VPN to headquarters backhauls traffic through one site and provides none of those inspection services by itself.

10. Q10Network Troubleshooting

    Question 10. After swapping a faulty SFP module that kept dropping the fiber uplink to a remote clinic, a technician watches the link come back up. Following the CompTIA troubleshooting methodology, which step comes immediately after this?

    1. AVerify full system functionality and implement preventive measures
    2. BDocument findings, actions, outcomes, and lessons learned
    3. CEstablish a new theory of probable cause
    4. DEstablish a plan of action and identify potential effects

    Show the answer

    Correct answer: A. Verify full system functionality and implement preventive measures

    Once the fix is in place, the technician must confirm the clinic's services work end to end and add preventive measures, such as monitoring the optic's light levels. Documentation is the final step and comes only after functionality is verified.

11. Q11Networking Concepts

    Question 11. A new monitoring server will poll switch counters with SNMPv3 and must also receive the traps the switches send to it. Which ports must the firewall between them permit?

    1. ATCP 161 and TCP 162
    2. BUDP 514 only
    3. CUDP 161 and UDP 162
    4. DTCP 389 and UDP 123

    Show the answer

    Correct answer: C. UDP 161 and UDP 162

    SNMP runs over UDP, with agents answering polls on port 161 and managers listening for traps on port 162. UDP 514 is syslog, which is a different logging mechanism.

12. Q12Network Troubleshooting

    Question 12. Users in a newly opened wing report frequent 2.4 GHz Wi-Fi drops and slow throughput. A survey shows two neighboring APs with strong overlapping coverage, one set to channel 1 and the other to channel 3. What is the MOST likely cause?

    1. AThe DHCP scope for the wireless VLAN is exhausted
    2. BAdjacent-channel interference between the overlapping APs
    3. CClient drivers do not support WPA3-Personal
    4. DBand steering is forcing clients onto 6 GHz

    Show the answer

    Correct answer: B. Adjacent-channel interference between the overlapping APs

    In 2.4 GHz only channels 1, 6, and 11 do not overlap, so channels 1 and 3 in the same area interfere with each other and cause retransmissions and drops. An exhausted DHCP scope would stop new clients from getting an address, not cause intermittent drops for clients that are already connected.