COMPTIA NETWORK+ (N10-009) STUDY GUIDE |
LATEST UPDATE 2026/2027 | ACTUAL EXAM |
PRACTICE QUESTIONS AND ANSWERS | EXAM
REVIEW | 100% CORRECT ANSWERS | VERIFIED
SOLUTIONS
This comprehensive practice examination has been meticulously developed for
candidates preparing for the CompTIA Network+ N10-009 certification, the
globally recognized credential validating essential networking knowledge and
hands-on skills required for IT infrastructure roles. This 100-question assessment
mirrors the depth and rigor of the actual certification examination, covering the
latest 2026/2027 exam objectives including network architecture, software-defined
networking, cloud connectivity, IPv4/IPv6 addressing and subnetting, Ethernet
switching, routing protocols, wireless standards, network security hardening, WAN
technologies, and advanced troubleshooting methodologies. Each question has
been crafted by networking subject matter experts to challenge your diagnostic
reasoning, reinforce practical configuration and troubleshooting skills, and test
your ability to design, manage, and optimize resilient enterprise network
infrastructures. This study resource serves as an essential tool for candidates
seeking to validate their networking competency, identify knowledge gaps, and
build confidence before sitting for the official CompTIA Network+ licensing
examination.
Table of Contents:
1.0 Networking Concepts
2.0 Network Implementation
3.0 Network Operations
4.0 Network Security
5.0 Network Troubleshooting
,Question 1: A network architect is designing a new campus network and needs to
implement a solution that allows VLANs to be dynamically assigned to access
ports based on the authenticating user's identity, rather than static switchport
configuration. Which combination of protocols achieves this?
A) 802.1Q trunking with native VLAN
B) 802.1X authentication with RADIUS and dynamic VLAN assignment
C) Link Aggregation Control Protocol (LACP) with port channels
D) Spanning Tree Protocol with PortFast enabled
Correct Answer: B
802.1X provides port-based Network Access Control (PNAC) that authenticates
users via RADIUS. The RADIUS server can return dynamic VLAN attributes
(Tunnel-Private-Group-ID) that the switch applies to the port for that session.
802.1Q (A) simply tags frames with static VLAN IDs.
Question 2: A network engineer notices that two OSPF routers on a broadcast
multi-access network segment are taking over 40 seconds to re-establish adjacency
after a link flap. Both routers are configured with default OSPF timers. What
change would reduce convergence time the most on this segment?
A) Changing the Hello interval to 5 seconds and Dead interval to 20 seconds
B) Enabling BFD (Bidirectional Forwarding Detection) for OSPF
C) Configuring the OSPF network type to point-to-point
D) Increasing the SPF delay timer
Correct Answer: C
On broadcast networks, OSPF performs DR/BDR election, adding overhead and
delay to adjacency formation. Changing the network type to point-to-point
eliminates the election process entirely, allowing immediate adjacency formation
without the 40-second wait for DR/BDR negotiation. BFD (B) speeds failure
detection but not the adjacency formation itself.
Question 3: A technician is implementing IPv6 on a network that currently uses
only IPv4. The organization wants a transition mechanism that allows IPv6 hosts to
communicate with each other across the existing IPv4-only backbone without
manually configuring tunnels between every pair of sites. Which transition
technology automatically builds point-to-multipoint tunnels?
A) ISATAP
B) 6to4
,C) Teredo
D) NAT64
Correct Answer: A
ISATAP (Intra-Site Automatic Tunnel Addressing Protocol) treats the IPv4
network as a virtual NBMA (Non-Broadcast Multi-Access) link layer, allowing
IPv6 hosts behind ISATAP routers to communicate without manual tunnel
configuration. 6to4 (B) requires globally routable IPv4 addresses and uses specific
prefix 2002::/16.
Question 4: A network administrator runs a packet capture on a switch port
configured with port mirroring. The capture shows frames with two 802.1Q tags in
the Ethernet header. What security concern does this represent?
A) A switch spoofing attack using DTP
B) A VLAN hopping attack exploiting double-tagging
C) A MAC flooding attack
D) A DHCP starvation attack
Correct Answer: B
Double-tagging VLAN hopping sends frames with two 802.1Q tags. The first tag
matches the native VLAN of the trunk and is stripped by the first switch; the second
inner tag then forwards the frame onto the target VLAN without the attacker
needing trunk access. This is a specific Layer 2 attack vector.
Question 5: A corporation uses a hub-and-spoke MPLS WAN topology
connecting 50 remote branch offices to the data center. The branches need direct
spoke-to-spoke communication for VoIP calls without hairpinning through the data
center hub router. Which MPLS-layer solution enables this while preserving QoS?
A) DMVPN over the MPLS underlay
B) BGP route reflectors advertising spoke routes to other spokes via the provider
PE routers
C) GRE tunnels configured between every spoke pair
D) Static routes pointing to the hub for all inter-spoke traffic
Correct Answer: B
In an MPLS L3VPN, the provider edge (PE) routers can exchange routes between
customer edge (CE) routers at different sites. Using BGP with route reflectors
allows spoke prefixes to be advertised directly between PE routers, enabling direct
spoke-to-spoke forwarding across the provider cloud without hairpinning.
, Question 6: A network engineer configures a new 802.11ax (Wi-Fi 6) access point
in a high-density auditorium. The engineer enables OFDMA but notices that
certain legacy 802.11g clients cause the entire OFDMA resource unit allocation to
slow dramatically. Which feature should be enabled to mitigate this performance
degradation caused by legacy devices?
A) MU-MIMO on the downlink
B) Airtime Fairness and band steering to 5 GHz
C) 802.11r Fast BSS Transition
D) Protected Management Frames (PMF)
Correct Answer: B
802.11g clients operate exclusively on 2.4 GHz and consume disproportionate
airtime due to slower data rates. Airtime Fairness prevents slow clients from
monopolizing channel time, and band steering pushes dual-band clients to the less
congested 5 GHz band, leaving 2.4 GHz only for necessary legacy devices.
Question 7: A network administrator needs to implement a first-hop redundancy
protocol that provides active-active load sharing across two default gateways while
allowing each gateway to serve different client groups simultaneously based on
VLAN. Which protocol supports this configuration?
A) HSRP with a single virtual IP
B) VRRP with a master router
C) GLBP (Gateway Load Balancing Protocol)
D) CARP (Common Address Redundancy Protocol)
Correct Answer: C
GLBP is Cisco-proprietary and supports true load balancing by assigning different
virtual MAC addresses to different hosts in the same group using an Active Virtual
Gateway (AVG) and multiple Active Virtual Forwarders (AVFs). HSRP and VRRP
(A, B) only support active-standby by default.
Question 8: A technician configures a site-to-site IPsec VPN tunnel using IKEv2.
The tunnel establishes successfully, but no data passes. The phase 1 and phase 2
security associations appear in the SA table. The technician notices the proxy IDs
(encryption domain) do not match on both sides. What specific IPsec component
fails due to this mismatch?
A) The Diffie-Hellman key exchange
B) The HMAC integrity verification on ESP packets
C) The Security Policy Database (SPD) selectors dropping packets that do not
LATEST UPDATE 2026/2027 | ACTUAL EXAM |
PRACTICE QUESTIONS AND ANSWERS | EXAM
REVIEW | 100% CORRECT ANSWERS | VERIFIED
SOLUTIONS
This comprehensive practice examination has been meticulously developed for
candidates preparing for the CompTIA Network+ N10-009 certification, the
globally recognized credential validating essential networking knowledge and
hands-on skills required for IT infrastructure roles. This 100-question assessment
mirrors the depth and rigor of the actual certification examination, covering the
latest 2026/2027 exam objectives including network architecture, software-defined
networking, cloud connectivity, IPv4/IPv6 addressing and subnetting, Ethernet
switching, routing protocols, wireless standards, network security hardening, WAN
technologies, and advanced troubleshooting methodologies. Each question has
been crafted by networking subject matter experts to challenge your diagnostic
reasoning, reinforce practical configuration and troubleshooting skills, and test
your ability to design, manage, and optimize resilient enterprise network
infrastructures. This study resource serves as an essential tool for candidates
seeking to validate their networking competency, identify knowledge gaps, and
build confidence before sitting for the official CompTIA Network+ licensing
examination.
Table of Contents:
1.0 Networking Concepts
2.0 Network Implementation
3.0 Network Operations
4.0 Network Security
5.0 Network Troubleshooting
,Question 1: A network architect is designing a new campus network and needs to
implement a solution that allows VLANs to be dynamically assigned to access
ports based on the authenticating user's identity, rather than static switchport
configuration. Which combination of protocols achieves this?
A) 802.1Q trunking with native VLAN
B) 802.1X authentication with RADIUS and dynamic VLAN assignment
C) Link Aggregation Control Protocol (LACP) with port channels
D) Spanning Tree Protocol with PortFast enabled
Correct Answer: B
802.1X provides port-based Network Access Control (PNAC) that authenticates
users via RADIUS. The RADIUS server can return dynamic VLAN attributes
(Tunnel-Private-Group-ID) that the switch applies to the port for that session.
802.1Q (A) simply tags frames with static VLAN IDs.
Question 2: A network engineer notices that two OSPF routers on a broadcast
multi-access network segment are taking over 40 seconds to re-establish adjacency
after a link flap. Both routers are configured with default OSPF timers. What
change would reduce convergence time the most on this segment?
A) Changing the Hello interval to 5 seconds and Dead interval to 20 seconds
B) Enabling BFD (Bidirectional Forwarding Detection) for OSPF
C) Configuring the OSPF network type to point-to-point
D) Increasing the SPF delay timer
Correct Answer: C
On broadcast networks, OSPF performs DR/BDR election, adding overhead and
delay to adjacency formation. Changing the network type to point-to-point
eliminates the election process entirely, allowing immediate adjacency formation
without the 40-second wait for DR/BDR negotiation. BFD (B) speeds failure
detection but not the adjacency formation itself.
Question 3: A technician is implementing IPv6 on a network that currently uses
only IPv4. The organization wants a transition mechanism that allows IPv6 hosts to
communicate with each other across the existing IPv4-only backbone without
manually configuring tunnels between every pair of sites. Which transition
technology automatically builds point-to-multipoint tunnels?
A) ISATAP
B) 6to4
,C) Teredo
D) NAT64
Correct Answer: A
ISATAP (Intra-Site Automatic Tunnel Addressing Protocol) treats the IPv4
network as a virtual NBMA (Non-Broadcast Multi-Access) link layer, allowing
IPv6 hosts behind ISATAP routers to communicate without manual tunnel
configuration. 6to4 (B) requires globally routable IPv4 addresses and uses specific
prefix 2002::/16.
Question 4: A network administrator runs a packet capture on a switch port
configured with port mirroring. The capture shows frames with two 802.1Q tags in
the Ethernet header. What security concern does this represent?
A) A switch spoofing attack using DTP
B) A VLAN hopping attack exploiting double-tagging
C) A MAC flooding attack
D) A DHCP starvation attack
Correct Answer: B
Double-tagging VLAN hopping sends frames with two 802.1Q tags. The first tag
matches the native VLAN of the trunk and is stripped by the first switch; the second
inner tag then forwards the frame onto the target VLAN without the attacker
needing trunk access. This is a specific Layer 2 attack vector.
Question 5: A corporation uses a hub-and-spoke MPLS WAN topology
connecting 50 remote branch offices to the data center. The branches need direct
spoke-to-spoke communication for VoIP calls without hairpinning through the data
center hub router. Which MPLS-layer solution enables this while preserving QoS?
A) DMVPN over the MPLS underlay
B) BGP route reflectors advertising spoke routes to other spokes via the provider
PE routers
C) GRE tunnels configured between every spoke pair
D) Static routes pointing to the hub for all inter-spoke traffic
Correct Answer: B
In an MPLS L3VPN, the provider edge (PE) routers can exchange routes between
customer edge (CE) routers at different sites. Using BGP with route reflectors
allows spoke prefixes to be advertised directly between PE routers, enabling direct
spoke-to-spoke forwarding across the provider cloud without hairpinning.
, Question 6: A network engineer configures a new 802.11ax (Wi-Fi 6) access point
in a high-density auditorium. The engineer enables OFDMA but notices that
certain legacy 802.11g clients cause the entire OFDMA resource unit allocation to
slow dramatically. Which feature should be enabled to mitigate this performance
degradation caused by legacy devices?
A) MU-MIMO on the downlink
B) Airtime Fairness and band steering to 5 GHz
C) 802.11r Fast BSS Transition
D) Protected Management Frames (PMF)
Correct Answer: B
802.11g clients operate exclusively on 2.4 GHz and consume disproportionate
airtime due to slower data rates. Airtime Fairness prevents slow clients from
monopolizing channel time, and band steering pushes dual-band clients to the less
congested 5 GHz band, leaving 2.4 GHz only for necessary legacy devices.
Question 7: A network administrator needs to implement a first-hop redundancy
protocol that provides active-active load sharing across two default gateways while
allowing each gateway to serve different client groups simultaneously based on
VLAN. Which protocol supports this configuration?
A) HSRP with a single virtual IP
B) VRRP with a master router
C) GLBP (Gateway Load Balancing Protocol)
D) CARP (Common Address Redundancy Protocol)
Correct Answer: C
GLBP is Cisco-proprietary and supports true load balancing by assigning different
virtual MAC addresses to different hosts in the same group using an Active Virtual
Gateway (AVG) and multiple Active Virtual Forwarders (AVFs). HSRP and VRRP
(A, B) only support active-standby by default.
Question 8: A technician configures a site-to-site IPsec VPN tunnel using IKEv2.
The tunnel establishes successfully, but no data passes. The phase 1 and phase 2
security associations appear in the SA table. The technician notices the proxy IDs
(encryption domain) do not match on both sides. What specific IPsec component
fails due to this mismatch?
A) The Diffie-Hellman key exchange
B) The HMAC integrity verification on ESP packets
C) The Security Policy Database (SPD) selectors dropping packets that do not
