CompTIA Certification
61 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The CompTIA Network+ (N10-008) certification validates professional expertise in CompTIA technologies. This study guide covers all 61 practice questions from our N10-008 practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
A network administrator needs to configure a device that converts between different network protocols at Layer 3. Which device should be used?
Routers operate at Layer 3 (Network layer) and convert between different protocols and networks. Switches operate at Layer 2, hubs are Layer 1 devices, and bridges are Layer 2 devices.
Which of the following subnet masks would provide the most host addresses on a single subnet?
A /22 subnet mask provides 1,022 usable host addresses (2^10 - 2), which is more than /24 (254), /26 (62), or /28 (14) hosts.
An organization is implementing a wireless network and needs to ensure that only authorized devices can connect. Which security feature should be configured?
MAC address filtering restricts access to specific devices, and WPA3 provides strong encryption. WEP is outdated and insecure, open networks lack security, and channel width doesn't address device authorization.
Which protocol is used to dynamically assign IP addresses to devices on a network?
DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses, subnet masks, and other network parameters. DNS resolves hostnames, ARP maps IP to MAC addresses, and SMTP handles email.
A technician is troubleshooting a connection issue where devices on the same physical network segment cannot communicate. Which Layer 2 protocol is most likely the cause if ARP is not functioning correctly?
ARP (Address Resolution Protocol) at Layer 2 maps IP addresses to MAC addresses. If ARP fails, devices cannot find each other's MAC addresses even if on the same segment, preventing communication.
Which of the following is a characteristic of a connection-oriented transport protocol?
Connection-oriented protocols (like TCP) establish a connection via a three-way handshake and guarantee ordered, reliable delivery. Connectionless protocols use datagrams; broadcasting occurs at Layer 2; and Layer operations vary by protocol.
A network administrator wants to implement network segmentation to separate departments. Which of the following technologies would be most appropriate?
VLANs (Virtual Local Area Networks) logically segment a network on managed switches, separating traffic by department. Repeaters extend range, access points extend wireless coverage, and cable upgrades improve speed but don't segment traffic.
Which IPv6 address type is equivalent to an IPv4 private address?
Unique local addresses (fc00::/7) are private, non-routable IPv6 addresses equivalent to IPv4 private ranges. Link-local addresses are automatically assigned; global unicast addresses are routable; multicast addresses are for group communication.
A company is experiencing slow network performance. A packet analyzer shows that many TCP retransmissions are occurring. Which of the following is the most likely cause?
TCP retransmissions occur when packets are lost or not acknowledged within the timeout window. DHCP issues affect IP assignment, DNS affects name resolution, and routing misconfigurations affect path selection, but packet loss directly triggers retransmissions.
Which of the following best describes the function of a proxy server?
Proxy servers act as intermediaries, forwarding client requests while providing caching, filtering, and anonymity benefits. TLS encryption is separate, DHCP assigns addresses, and MAC filtering is a firewall function.
An organization needs to ensure that only traffic on port 443 is allowed inbound to their web servers. Which device should implement this policy?
Firewalls enforce access control policies based on ports, protocols, and IP addresses. Hubs and repeaters don't filter traffic, and passive taps only monitor without controlling traffic flow.
A network technician configures a router interface with the IP address 192.168.1.1/25. How many usable host addresses are available on this subnet?
A /25 subnet provides 2^7 (128) total addresses. Subtracting the network address and broadcast address gives 126 usable host addresses.
Which of the following security protocols provides the highest level of encryption for wireless networks?
WPA3 is the latest and most secure wireless encryption standard, offering individualized data encryption and protection against brute-force attacks. WEP is outdated, WPA is older, and open authentication provides no security.
A company has configured a site-to-site VPN between two offices. Which protocol is most commonly used to establish this secure tunnel?
IPSec is the industry standard for site-to-site VPN tunnels, providing encryption and authentication. PPTP is older and less secure, LDAP handles directory services, and SNMP manages network devices.
A technician is implementing QoS (Quality of Service) on a router to prioritize video conferencing traffic over web browsing. At which layer does this traffic classification occur?
QoS classification typically examines Layer 3 (IP addresses, protocols) and Layer 4 (port numbers) information to identify and prioritize traffic types. Layers 1, 2, and 5 don't provide sufficient application-level granularity.
Which of the following statements about NAT (Network Address Translation) is correct?
NAT translates Layer 3 IP addresses, converting private addresses to public ones for internet traffic. It doesn't replace firewalls, encrypt data, or operate at Layer 2 with MAC addresses.
A network administrator discovers that a user's computer has an APIPA address (169.254.x.x). What does this indicate?
APIPA (Automatic Private IP Addressing) assigns a link-local address when DHCP is unavailable. DHCP success would show a different range, static configuration is intentional, and proxy use doesn't affect IP assignment.
Which routing protocol uses hop count as its primary metric and has a maximum hop count limit of 15?
RIPv2 uses hop count as its metric with a maximum of 15 hops. OSPF uses cost, BGP uses AS path and other attributes, and IS-IS uses a similar metric to OSPF.
A technician needs to verify that a server is reachable and measure round-trip latency. Which command-line utility should be used?
ping sends ICMP echo requests to test reachability and displays round-trip time. tracert shows the path to a destination, netstat displays connections, and ipconfig shows network configuration.
An organization wants to distribute incoming traffic across multiple servers. Which technology accomplishes this?
Load balancing distributes traffic across multiple servers to optimize performance and availability. Port forwarding redirects traffic to specific devices, packet filtering controls traffic, and bandwidth shaping limits data rates.
Which of the following scenarios would require the use of a default route on a router?
A default route (0.0.0.0/0) provides a fallback for packets destined to networks without a specific routing entry. Directly connected subnets use specific routes, QoS handles prioritization, and encryption is separate from routing.
A network administrator configures spanning tree protocol (STP) on a switched network. What is the primary purpose of this protocol?
STP prevents Layer 2 loops by blocking redundant ports and selecting a root bridge. It doesn't increase bandwidth, assign IPs, or provide encryption.
Which of the following best describes the relationship between SNMPv3 and earlier SNMP versions?
SNMPv3 introduces encryption (DES/AES) and stronger authentication (HMAC) compared to SNMPv2's community strings. It doesn't sacrifice performance, isn't limited to Layer 2, and doesn't require special hardware.
A network administrator needs to configure redundancy for a critical internet connection. Which technology provides automatic failover between primary and backup links?
HSRP and VRRP provide automatic failover between redundant routers at the first-hop gateway level. Static routing requires manual intervention, VLANs segment traffic, and LACP aggregates bandwidth.
Which of the following is a valid concern when implementing a cloud-based disaster recovery solution?
Cloud DR solutions require substantial bandwidth for data transfers and may introduce latency concerns. RTO depends on SLAs, encryption is still necessary in the cloud, and cloud backups can be verified.
Which of the following protocols operates at Layer 4 of the OSI model and provides connectionless communication?
UDP (User Datagram Protocol) operates at the Transport Layer (Layer 4) and provides connectionless, unreliable delivery. TCP also operates at Layer 4 but is connection-oriented.
A network administrator needs to configure a switch port to allow multiple VLANs to pass through a single trunk link. Which IEEE standard defines this trunking protocol?
IEEE 802.1Q is the standard that defines VLAN tagging and allows multiple VLANs to traverse a single physical link through trunk ports.
Which of the following best describes the purpose of a DMZ in network architecture?
A DMZ (Demilitarized Zone) is a network segment that sits between the internal network and the untrusted internet, allowing public-facing services while protecting critical internal infrastructure.
When implementing Quality of Service (QoS) on a network, which of the following would be the MOST appropriate priority level for voice over IP (VoIP) traffic?
VoIP requires real-time interactive priority because voice traffic is sensitive to latency and jitter; delays directly impact call quality and user experience.
A technician is troubleshooting a network where devices can ping the default gateway but cannot reach devices on other subnets. Which of the following is the MOST likely cause?
An incorrect subnet mask would prevent devices from recognizing which addresses are local versus remote, causing traffic destined for other subnets to fail even though the gateway responds to pings.
Which routing protocol uses hop count as its only metric and has a maximum hop count of 15?
RIPv2 (Routing Information Protocol) is a distance-vector routing protocol that uses hop count as its metric with a maximum of 15 hops, limiting it to smaller networks.
A company is deploying a new wireless network and wants to ensure the strongest security for authentication and encryption. Which of the following wireless security standards should be implemented?
WPA2 with AES (Advanced Encryption Standard) provides the strongest security for wireless networks, as WEP and WPA are deprecated, and open authentication provides no security regardless of SSID settings.
Which of the following statements accurately describes the difference between TCP and UDP in terms of reliability?
TCP uses sequence numbers and acknowledgments to ensure reliable, ordered delivery, while UDP is connectionless and provides best-effort delivery without guarantees.
A network administrator discovers that a rogue DHCP server is connected to the network and is assigning incorrect IP addresses to clients. Which of the following would be the BEST control to prevent this situation?
DHCP snooping is a security feature that validates DHCP messages and prevents rogue DHCP servers from operating, while allowing the legitimate DHCP server to function normally.
Which of the following IPv6 address types is used for one-to-nearest communication and is typically assigned to routers as a default destination?
Anycast addresses enable one-to-nearest delivery, where a packet is delivered to the nearest node in a group of nodes with the same address; this is commonly used for routing.
A technician needs to document the physical layout of network equipment in a data center. Which of the following tools would be MOST appropriate for this task?
Asset management and facility documentation tools are designed to track and visualize physical equipment locations and configurations in data centers.
Which of the following scenarios would BEST require the use of a site-to-site VPN?
Site-to-site VPNs connect entire networks at different locations, making them ideal for branch office connectivity; remote employee access would use client-to-site VPN.
An organization is implementing a network segmentation strategy and needs to separate IoT devices from critical business systems. Which of the following approaches would be MOST effective?
Implementing separate VLANs for IoT devices and enforcing firewall rules between segments is a best practice in network segmentation that prevents lateral movement and limits attack surface.
When troubleshooting DNS resolution issues, a technician determines that nslookup resolves hostnames successfully, but the ping command still fails. What is the MOST likely cause?
Since DNS resolution (nslookup) works, the name lookup is successful; ping failure despite this indicates that ICMP echo requests are being blocked by a firewall, not a DNS issue.
Which of the following best describes the function of a proxy server in network architecture?
A proxy server intercepts client requests, forwards them to servers on behalf of clients, and returns responses, providing benefits like caching, filtering, and anonymity.
A network engineer is designing a highly available network infrastructure and needs to ensure that if one link fails, traffic automatically routes through an alternate path. Which of the following would BEST accomplish this?
Dynamic routing protocols like OSPF automatically detect link failures and converge to alternate paths, providing true high availability without manual intervention.
Which of the following network devices would be MOST appropriate for a situation where an organization needs to increase bandwidth and support more simultaneous connections in a data center?
A managed switch with higher port density and link aggregation (802.3ad) directly addresses the need for more connections and increased bandwidth in data center environments.
A network administrator is configuring access control lists (ACLs) on a router and needs to deny traffic from a specific subnet while allowing all other traffic. Which of the following statements would be MOST correct regarding ACL design?
ACLs are processed sequentially from top to bottom, and processing stops at the first match; therefore, specific deny rules must precede general permit rules to function correctly.
Which of the following protocols would be used to automatically assign IP addresses to devices on a network segment?
DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses and other network configuration parameters to devices on a network.
A company experiences intermittent connectivity issues where packets are being lost during peak hours. After investigation, the administrator determines that network interfaces are experiencing high CPU utilization. Which of the following would be the BEST solution?
QoS allows prioritization of critical traffic and bandwidth management, which addresses the congestion causing packet loss during peak usage periods.
Which of the following best describes the primary difference between collision domains and broadcast domains?
Switches separate collision domains by creating dedicated paths between ports, while routers separate broadcast domains by preventing broadcast traffic from crossing network boundaries.
An organization implements a network access control (NAC) solution. Which of the following best describes the primary security benefit?
NAC (Network Access Control) enforces security policies by authenticating devices and verifying compliance before allowing network access, preventing unauthorized or compromised devices from connecting.
A network technician is configuring a switch and needs to create multiple logical networks on a single physical switch. Which of the following technologies would be MOST appropriate?
VLANs (Virtual Local Area Networks) allow a single physical switch to create multiple isolated logical networks, improving security and traffic management.
Which of the following scenarios would represent a man-in-the-middle (MITM) attack?
A MITM attack specifically involves an attacker positioning themselves between two communicating parties to eavesdrop, intercept, or modify communications transparently.
A network administrator is troubleshooting slow network performance and wants to analyze traffic patterns in real-time. Which of the following tools would be MOST appropriate for this task?
Wireshark is a protocol analyzer that captures and displays packet-level data in real-time, allowing detailed analysis of traffic patterns and identification of performance issues.
Which of the following correctly describes how a switch learns MAC addresses?
Switches build their MAC address tables (CAM tables) dynamically by learning the source MAC address and incoming port from each frame, then flood unknown destination addresses.
A network administrator needs to ensure that traffic from a specific application is prioritized over other traffic during peak hours. Which QoS mechanism should be implemented?
Weighted fair queuing (WFQ) allows administrators to classify traffic and assign different priority levels, ensuring critical applications receive guaranteed bandwidth. Traffic shaping limits but does not prioritize, packet filtering blocks traffic, and MTU reduction affects packet size, not priority.
Which of the following best describes the purpose of a VLAN?
VLANs create logical network segments on a physical infrastructure, allowing better organization, security, and traffic management without requiring separate physical switches. They do not increase speed, encryption, or DHCP functionality.
A technician is troubleshooting a network where some clients cannot obtain IP addresses from the DHCP server, even though the server is operational and other clients are receiving addresses successfully. The server logs show no DHCP requests from the affected clients. What is the most likely cause?
If the DHCP server receives no requests from certain clients, the issue is typically in reaching the server, not the server itself. A misconfigured DHCP relay agent cannot forward broadcast requests across routers to the DHCP server. Since other clients work, it's not a server capacity issue; static configuration would prevent requests but not explain partial failures.
Which port and protocol combination is used by SNMP for sending unsolicited notifications from network devices to a management station?
SNMP traps (unsolicited notifications) are sent via UDP port 162, while standard SNMP queries use UDP port 161. TCP is not typically used for SNMP because UDP provides sufficient reliability for this use case and reduces overhead.
An organization is implementing a new wireless network and wants to ensure that only company-owned devices can connect. Which authentication method should be deployed?
802.1X combined with RADIUS provides enterprise-grade authentication, allowing validation of both devices and users through certificates and credentials, preventing unauthorized access. MAC filtering alone is easily spoofed, WEP is deprecated, and WPA2-PSK doesn't authenticate devices individually.
A network technician observes that a server is experiencing intermittent connectivity issues. Using netstat, they notice that many connections are stuck in the TIME_WAIT state. What does this indicate?
TIME_WAIT is a normal TCP state that occurs after a connection is gracefully closed, during which the connection remains in memory to ensure any delayed packets are discarded. This typically resolves naturally after the timeout period and becomes problematic only if accumulated in excessive numbers.
Which of the following accurately describes the function of the DNS MX record?
MX (Mail Exchange) records identify the mail servers that handle incoming email for a specific domain, allowing email routing to the correct server. MTU is related to packet size, encryption is handled by protocols like TLS, and DNS redundancy uses NS records, not MX records.
A company has implemented a WAN link that uses MPLS for traffic engineering. A network administrator notices that traffic destined for a particular destination is taking an unexpected path that is not the shortest route. What is the most likely explanation?
MPLS allows explicit path selection through LSPs (Label Switched Paths) that can prioritize factors like bandwidth availability, latency, or cost rather than hop count. This is one of MPLS's key advantages for traffic engineering.
Which IPv6 address type is used for communication within a single subnet and cannot be routed across the internet?
Link-local addresses (fe80::/10) are automatically configured on every IPv6 interface and are used for on-link communication only. They cannot be routed beyond the local subnet. Global unicast addresses are routable, multicast is for one-to-many communication, and anycast is for routing to the nearest instance.
An organization is deploying a new application that requires very low latency and consistent bandwidth. The network team is evaluating whether to use MPLS with traffic engineering capabilities or standard IP routing with OSPF. Which advantage does MPLS provide in this scenario?
MPLS enables explicit path control and traffic engineering, allowing administrators to reserve bandwidth and optimize paths based on constraints beyond hop count. The label-switching approach can reduce lookup overhead. While OSPF supports QoS via other mechanisms, MPLS is specifically designed for traffic engineering in demanding environments.
You've reviewed all 61 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free